From 4bec966bca8c93ef2f4a92984e79ba515721e2a4 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 14:20:02 +0300
Subject: [PATCH 01/15] feat: the synchronous net-http transport and the
 conformance gem (phase 8a)

dexpace-transport-net_http: Dexpace::Transport::NetHTTP with .build over a fresh-per-call Net::HTTP
and .using over a caller's own, the Adapter, the per-response ResponsePump with its head-adaptation
handshake, RequestMapper and ResponseMapper, Deadline, Failures, TLSSettings, ProxyRoute, the
require-time registration under :net_http, and the gemspec's net-http >= 0.4.

dexpace-conformance: the assertion protocol phase 0 postponed (Failure, Vacuous, Assertion, Result,
Report), the twenty-eight-assertion TransportSuite, TransportCase with its SettleOnly guard,
BorrowedPair, the WireServer fixture and its Scripts, MinitestDriver, the opt-in RSpecDriver, and the
RecordingSpan and Allocations doubles.

dexpace-core: Dexpace::TransportError < ::IOError, Configuration::Keys::REQUEST_TIMEOUT and
Instrumentation::Events::TRANSPORT_HEADER_DROPPED, with the pins the two constants moved.

Repository: tempfile on the require allowlist with its fixture, BUNDLE_PATH scoped in the
clean-bundle gate, socket and tempfile on the conformance Steep target, the surface manifests
regenerated once, the net-http Timeout-thread warm-up both adapter gems' test helpers require, and
the bare-require helper core's repaired seam-surface test needs.
---
 Steepfile                                     |   3 +
 .../lib/dexpace/conformance.rb                |  32 ++-
 .../lib/dexpace/conformance/allocations.rb    |  89 +++++++
 .../lib/dexpace/conformance/assertion.rb      |  57 +++++
 .../lib/dexpace/conformance/borrowed_pair.rb  |  47 ++++
 .../lib/dexpace/conformance/failure.rb        |  32 +++
 .../dexpace/conformance/minitest_driver.rb    |  87 +++++++
 .../lib/dexpace/conformance/recording_span.rb |  94 +++++++
 .../lib/dexpace/conformance/report.rb         |  96 +++++++
 .../lib/dexpace/conformance/result.rb         |  47 ++++
 .../lib/dexpace/conformance/rspec_driver.rb   |  62 +++++
 .../lib/dexpace/conformance/scripts.rb        | 234 +++++++++++++++++
 .../lib/dexpace/conformance/transport_case.rb | 178 +++++++++++++
 .../dexpace/conformance/transport_suite.rb    | 104 ++++++++
 .../conformance/transport_suite/checks.rb     | 222 ++++++++++++++++
 .../conformance/transport_suite/inbound.rb    | 109 ++++++++
 .../conformance/transport_suite/lifecycle.rb  | 182 ++++++++++++++
 .../conformance/transport_suite/outbound.rb   | 184 ++++++++++++++
 .../conformance/transport_suite/resilience.rb | 187 ++++++++++++++
 .../conformance/transport_suite/streaming.rb  | 106 ++++++++
 .../lib/dexpace/conformance/vacuous.rb        |  23 ++
 .../lib/dexpace/conformance/wire_server.rb    | 179 +++++++++++++
 .../wire_server/recorded_request.rb           |  60 +++++
 .../conformance/wire_server/request_reader.rb |  76 ++++++
 .../sig/dexpace/conformance/allocations.rbs   |  16 ++
 .../sig/dexpace/conformance/assertion.rbs     |  20 ++
 .../sig/dexpace/conformance/borrowed_pair.rbs |  18 ++
 .../sig/dexpace/conformance/failure.rbs       |  13 +
 .../dexpace/conformance/minitest_driver.rbs   |  15 ++
 .../dexpace/conformance/recording_span.rbs    |  23 ++
 .../sig/dexpace/conformance/report.rbs        |  29 +++
 .../sig/dexpace/conformance/result.rbs        |  19 ++
 .../sig/dexpace/conformance/rspec_driver.rbs  |  13 +
 .../sig/dexpace/conformance/scripts.rbs       |  34 +++
 .../dexpace/conformance/transport_case.rbs    |  61 +++++
 .../dexpace/conformance/transport_suite.rbs   |  21 ++
 .../conformance/transport_suite/checks.rbs    |  33 +++
 .../conformance/transport_suite/inbound.rbs   |  20 ++
 .../conformance/transport_suite/lifecycle.rbs |  28 +++
 .../conformance/transport_suite/outbound.rbs  |  28 +++
 .../transport_suite/resilience.rbs            |  22 ++
 .../conformance/transport_suite/streaming.rbs |  22 ++
 .../sig/dexpace/conformance/vacuous.rbs       |  10 +
 .../sig/dexpace/conformance/wire_server.rbs   |  41 +++
 .../wire_server/recorded_request.rbs          |  22 ++
 .../wire_server/request_reader.rbs            |  19 ++
 .../test/dexpace/conformance_test.rb          |  36 ++-
 gems/dexpace-conformance/test/test_helper.rb  |   3 +
 gems/dexpace-core/lib/dexpace.rb              |   8 +
 .../lib/dexpace/configuration/keys.rb         |  11 +-
 .../lib/dexpace/error/transport_error.rb      |  49 ++++
 .../lib/dexpace/instrumentation/keys.rb       |   8 +-
 .../sig/dexpace/configuration/keys.rbs        |   1 +
 .../sig/dexpace/error/transport_error.rbs     |  12 +
 .../sig/dexpace/instrumentation/keys.rbs      |   3 +-
 .../test/dexpace/configuration/keys_test.rb   |   9 +-
 .../downstream_wirings_test.rb                |   3 +-
 .../test/dexpace/instrumentation/keys_test.rb |   5 +-
 .../test/dexpace/transport_test.rb            |  28 +--
 gems/dexpace-core/test/dexpace_test.rb        |   4 +
 .../dexpace-core/test/support/bare_require.rb |  29 +++
 .../dexpace-transport-net_http.gemspec        |  15 +-
 .../lib/dexpace/transport/net_http.rb         | 145 ++++++++++-
 .../lib/dexpace/transport/net_http/adapter.rb | 236 ++++++++++++++++++
 .../dexpace/transport/net_http/deadline.rb    |  64 +++++
 .../dexpace/transport/net_http/failures.rb    |  59 +++++
 .../dexpace/transport/net_http/proxy_route.rb |  72 ++++++
 .../transport/net_http/request_mapper.rb      | 137 ++++++++++
 .../transport/net_http/response_mapper.rb     | 121 +++++++++
 .../transport/net_http/response_pump.rb       | 223 +++++++++++++++++
 .../transport/net_http/tls_settings.rb        |  58 +++++
 .../sig/dexpace/transport/net_http.rbs        |  15 ++
 .../dexpace/transport/net_http/adapter.rbs    |  52 ++++
 .../dexpace/transport/net_http/deadline.rbs   |  26 ++
 .../dexpace/transport/net_http/failures.rbs   |  17 ++
 .../transport/net_http/proxy_route.rbs        |  25 ++
 .../transport/net_http/request_mapper.rbs     |  26 ++
 .../transport/net_http/response_mapper.rbs    |  25 ++
 .../transport/net_http/response_pump.rbs      |  44 ++++
 .../transport/net_http/tls_settings.rbs       |  15 ++
 .../test/dexpace/transport/net_http_test.rb   |  61 ++++-
 .../test/test_helper.rb                       |   3 +
 tasks/gates.rake                              |   7 +-
 .../gates/require_allowlist/allowed.rb        |   4 +-
 test/fixtures/surface/dexpace-conformance.txt |  98 ++++++++
 test/fixtures/surface/dexpace-core.txt        |   5 +
 .../surface/dexpace-transport-net_http.txt    |  15 ++
 test/support/net_http_warmup.rb               |  32 +++
 tools/require_allowlist.rb                    |   8 +
 89 files changed, 4788 insertions(+), 46 deletions(-)
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/assertion.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/borrowed_pair.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/failure.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/minitest_driver.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/recording_span.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/report.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/result.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/rspec_driver.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/scripts.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_case.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/checks.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/inbound.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/lifecycle.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/outbound.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/resilience.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/streaming.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/vacuous.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/wire_server.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/wire_server/recorded_request.rb
 create mode 100644 gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/allocations.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/assertion.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/borrowed_pair.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/failure.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/minitest_driver.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/recording_span.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/report.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/result.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/rspec_driver.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/scripts.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_case.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/checks.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/inbound.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/lifecycle.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/outbound.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/resilience.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/streaming.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/vacuous.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/wire_server.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/wire_server/recorded_request.rbs
 create mode 100644 gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
 create mode 100644 gems/dexpace-core/lib/dexpace/error/transport_error.rb
 create mode 100644 gems/dexpace-core/sig/dexpace/error/transport_error.rbs
 create mode 100644 gems/dexpace-core/test/support/bare_require.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/adapter.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/deadline.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/failures.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/proxy_route.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/request_mapper.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
 create mode 100644 gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/tls_settings.rb
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/adapter.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/deadline.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/failures.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/proxy_route.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/request_mapper.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_mapper.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
 create mode 100644 gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/tls_settings.rbs
 create mode 100644 test/support/net_http_warmup.rb

diff --git a/Steepfile b/Steepfile
index 7fd878e..219c3b0 100644
--- a/Steepfile
+++ b/Steepfile
@@ -60,5 +60,8 @@ end
 target :conformance do
   check "gems/dexpace-conformance/lib"
   signature "gems/dexpace-conformance/sig", "gems/dexpace-core/sig"
+  # rbs's own stdlib signature sets for the two features this gem's lib/ requires beyond core's
+  # allowlist: `socket` for the wire fixture (P8-14) and `tempfile` for TRANSPORT-28's file body.
+  library "socket", "tempfile"
   configure_code_diagnostics(D::Ruby.default)
 end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance.rb b/gems/dexpace-conformance/lib/dexpace/conformance.rb
index 2ef86f7..e493639 100644
--- a/gems/dexpace-conformance/lib/dexpace/conformance.rb
+++ b/gems/dexpace-conformance/lib/dexpace/conformance.rb
@@ -1,12 +1,38 @@
 # frozen_string_literal: true
 # SPDX-License-Identifier: MIT
 
+# The whole of dexpace-core: this gem declares it and reaches every Dexpace:: constant its
+# assertions name through the one entry point, exactly as a consumer of the suite would.
+require "dexpace"
 require_relative "conformance/version"
+# The assertion protocol's five value types (design §9.3, 8a's R7), in dependency-free order.
+require_relative "conformance/failure"
+require_relative "conformance/vacuous"
+require_relative "conformance/assertion"
+require_relative "conformance/result"
+require_relative "conformance/report"
+# The TCPServer fixture and its named scripts (design §9.3; `socket` is permitted to this gem
+# alone by the require allowlist's scoped denial, P8-14).
+require_relative "conformance/scripts"
+require_relative "conformance/wire_server"
+# The case an assertion receives, the borrowed pair, and the runner (8a's R16 suite contract).
+require_relative "conformance/borrowed_pair"
+require_relative "conformance/transport_case"
+require_relative "conformance/transport_suite"
+# The Minitest driver, and deliberately NOT the RSpec one: an RSpec-only consumer requires
+# "dexpace/conformance/rspec_driver" itself, so a Minitest-only consumer never loads a file naming
+# the other framework (design §9.3). Neither requires its framework.
+require_relative "conformance/minitest_driver"
+# The two observability doubles phases 5c and 5b assigned to this gem (OBS-21, OBS-25).
+require_relative "conformance/recording_span"
+require_relative "conformance/allocations"
 
 module Dexpace
-  # The conformance suite every adapter is proven against. Phase 0 ships the namespace and
-  # VERSION only; the assertion objects and their Minitest and RSpec drivers land in phase 8a,
-  # and phase 9 adds the remaining suites.
+  # The conformance suite every adapter is proven against (design §9.3): the assertion protocol
+  # phase 0 postponed to phase 8a -- Failure, Vacuous, Assertion, Result and Report -- with the
+  # transport suite, its TCPServer fixture and the two thin drivers landing beside them; phase 9
+  # adds the remaining suites. Declares dexpace-core and nothing else, by design: neither driver
+  # requires its framework, so Minitest is never a runtime constraint on a consumer.
   module Conformance
   end
 end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb b/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
new file mode 100644
index 0000000..f59d775
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/error/invalid_argument_error"
+
+module Dexpace
+  module Conformance
+    # OBS-25's "Selecting a no-op path MUST NOT allocate per call", measured the one way that is
+    # insensitive to the caller (5b's R8): the block is driven `iterations` and then
+    # `2 * iterations` times under GC.disable, and the per-call figure is the difference of the two
+    # deltas over `iterations` -- so a fixed cost (a method cache, an inline cache warming) cancels
+    # and only a per-iteration cost survives. What makes it insensitive to the CALLER is the
+    # precondition the block must meet, not the arithmetic: every argument the block passes must be
+    # one that cannot allocate -- a frozen constant, a Symbol, an Integer, nil -- because an inline
+    # String or Hash literal at the call site allocates per iteration whether or not the callee
+    # does. The file's `frozen_string_literal` is a rule of this repository, not this measurement's
+    # precondition.
+    #
+    # The figure returned is the one two consecutive measurements AGREE on -- core's own
+    # `AllocationDelta` shape, which this copies rather than the single loop 8a's plan sketched.
+    # On the 3.2.11 floor a one-time interpreter cost of 7 or 28 objects can land inside a measured
+    # block after the warm-up, once per process, and a single measurement came back NEGATIVE about
+    # one whole-file run in fifteen; an integer division of that is -1 and an exact zero assertion
+    # fails on it. A one-time cost cannot appear in two consecutive measurements, while a real
+    # per-call cost is exactly what every clean measurement returns, so the measurement repeats
+    # until two in a row agree (at most ATTEMPTS, then the last figure is returned and the
+    # assertion reports it) -- which keeps the assertion exact rather than clamping a negative
+    # figure or widening the delta, either of which would also hide a real fractional cost.
+    module Allocations
+      extend self
+
+      # How many measurements may disagree before the helper gives up and reports the last.
+      ATTEMPTS = 5
+
+      # The iterations run before the first measurement, so the first call's one-time costs --
+      # block object creation, method dispatch caches -- do not land in the measured block.
+      # Measured: `GC.stat(:total_allocated_objects)` around an empty block reports 2 and around
+      # `{ nil }` 3 or 4 on the four supported interpreters, so the harness's own overhead is
+      # caller-shaped and the two-loop difference is what removes it.
+      WARMUP_ITERATIONS = 100
+      private_constant :WARMUP_ITERATIONS
+
+      # Objects allocated per call of the block, to one thousandth: the figure two consecutive
+      # two-loop measurements agree on. `iterations:` is REQUIRED (8a's open question 5): OBS-25's
+      # "MUST NOT allocate per call" is a per-iteration claim, and dividing by an unstated count is
+      # not a claim about anything.
+      #
+      # @param iterations [Integer] the first loop's count; the second loop runs twice as many
+      # @yield the call under measurement, over arguments that cannot allocate
+      # @return [Float] objects per call
+      # @raise [Dexpace::InvalidArgumentError] unless iterations is a positive Integer
+      def delta(iterations:, &block)
+        unless iterations.is_a?(::Integer) && iterations.positive?
+          raise ::Dexpace::InvalidArgumentError, "iterations must be a positive Integer"
+        end
+
+        ::GC.disable
+        previous = measure(iterations, &block)
+        ATTEMPTS.times do
+          current = measure(iterations, &block)
+          return current if current == previous
+
+          previous = current
+        end
+        previous
+      ensure
+        ::GC.enable
+      end
+
+      private
+
+      # One two-loop measurement: the warm-up, then `iterations` and `2 * iterations` calls, the
+      # difference of the two deltas over `iterations`.
+      #
+      # `{ yield }` and never `times(&)`: Integer#times hands its index to the block it is given,
+      # and the caller's block -- a lambda, say -- may take no argument.
+      # rubocop:disable-next Style/ExplicitBlockArgument -- see above
+      def measure(iterations)
+        WARMUP_ITERATIONS.times { yield }
+        first = ::GC.stat(:total_allocated_objects)
+        iterations.times { yield }
+        second = ::GC.stat(:total_allocated_objects)
+        (iterations * 2).times { yield }
+        third = ::GC.stat(:total_allocated_objects)
+        ((third - second) - (second - first)) / iterations.to_f
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/assertion.rb b/gems/dexpace-conformance/lib/dexpace/conformance/assertion.rb
new file mode 100644
index 0000000..c7537a9
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/assertion.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/model"
+require "dexpace/error/invalid_argument_error"
+
+module Dexpace
+  module Conformance
+    # One conformance check: the requirement IDs it exercises -- a waiver matches by these, never
+    # by #name -- a human name, and a callable body taking one subject (a TransportCase for the
+    # transport suite; phase 9 adds suites whose subject is not a transport, which is why the body
+    # is typed `^(untyped) -> void` and not against a named interface).
+    #
+    # Public API crossing into a consumer's own suite, so it follows the phase-1 construction
+    # pattern: `.new` private, a validating keyword `.build`, `Model.required!`'s one message form
+    # (SEAM-29), the ids copied through `Model.own` so a caller's later mutation cannot reach them,
+    # and `#with` through `.build` on every interpreter (Model#with).
+    class Assertion < Data.define(:ids, :name, :body)
+      include Model
+
+      private_class_method :new
+
+      # The validating factory every construction path goes through.
+      #
+      # @param ids [Enumerable<String>] the requirement IDs this assertion exercises, non-empty
+      # @param name [String] a human name, used for the generated test method's name
+      # @param body [#call] the check, taking one subject
+      # @return [Assertion] frozen
+      # @raise [Dexpace::InvalidArgumentError] naming the member, on any invalid value
+      def self.build(ids:, name:, body:)
+        new(ids: ids, name: name, body: body)
+      end
+
+      def initialize(ids:, name:, body:)
+        required = Model.required!("ids", ids).to_a
+        unless !required.empty? && required.all?(::String)
+          raise InvalidArgumentError, "ids must be a non-empty collection of requirement-ID Strings"
+        end
+        raise InvalidArgumentError, "body must respond to #call" unless
+          Model.required!("body", body).respond_to?(:call)
+
+        super(ids: Model.own(required), name: Model.frozen_string(Model.required!("name", name)),
+              body: body,)
+      end
+
+      # Runs the check against one subject, returning whatever the body returns; the protocol's
+      # signal is what it RAISES -- nothing, a Failure or a Vacuous -- and TransportSuite.run
+      # maps that onto a Result.
+      #
+      # @param subject [Object] what the suite hands each assertion
+      # @return [Object] the body's return value, of no significance to the protocol
+      def call(subject)
+        body.call(subject)
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/borrowed_pair.rb b/gems/dexpace-conformance/lib/dexpace/conformance/borrowed_pair.rb
new file mode 100644
index 0000000..f270f47
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/borrowed_pair.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/model"
+require "dexpace/error/invalid_argument_error"
+
+module Dexpace
+  module Conformance
+    # What a driver's `borrow:` factory returns (suite contract 4a): the transport wrapping the
+    # caller's own native client, and a probe answering "is that client still usable?". The probe
+    # is the adapter's, because only the adapter knows what using its native client looks like --
+    # a Net::HTTP round trip on one, an Async::HTTP::Client one on the other -- and that is what
+    # keeps TRANSPORT-15's borrowed half portable across adapters that share no client class, and
+    # what keeps a native client class out of this gem's lib/ altogether.
+    class BorrowedPair < Data.define(:transport, :probe)
+      include Model
+
+      private_class_method :new
+
+      # The validating factory every construction path goes through.
+      #
+      # @param transport [Object] the borrowing transport, wrapping the caller's own client
+      # @param probe [#call] answers truthy while the caller's client still works
+      # @return [BorrowedPair] frozen
+      # @raise [Dexpace::InvalidArgumentError] naming the member
+      def self.build(transport:, probe:)
+        new(transport: transport, probe: probe)
+      end
+
+      def initialize(transport:, probe:)
+        Model.required!("transport", transport)
+        raise InvalidArgumentError, "probe must respond to #call" unless
+          Model.required!("probe", probe).respond_to?(:call)
+
+        super
+      end
+
+      # Whether the caller's own client still works, per the adapter's probe -- asked after the
+      # borrowing transport was closed, which is TRANSPORT-15's whole borrowed clause.
+      #
+      # @return [Boolean]
+      def still_usable?
+        probe.call ? true : false
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/failure.rb b/gems/dexpace-conformance/lib/dexpace/conformance/failure.rb
new file mode 100644
index 0000000..5e75dd4
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/failure.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Conformance
+    # The assertion protocol's failure (design §9.3): what an assertion raises instead of returning
+    # cleanly, carrying the expected and actual values it compared and the requirement IDs it was
+    # checking. A TEST RESULT, not an SDK error -- P8-8 records why this is a ::StandardError that
+    # does NOT include Dexpace::Error: phase 1 made that module the root every SDK error includes so
+    # a caller can `rescue Dexpace::Error` broadly, and an adapter author's broad rescue around a
+    # send must not swallow the assertion that the send was wrong.
+    class Failure < ::StandardError
+      # @return [Object] what the assertion expected
+      attr_reader :expected
+      # @return [Object] what it found
+      attr_reader :actual
+      # @return [Array<String>] the requirement IDs the assertion was checking, frozen
+      attr_reader :requirement_ids
+
+      # @param message [String] the failure, in words
+      # @param expected [Object] what the assertion expected
+      # @param actual [Object] what it found
+      # @param requirement_ids [Array<String>] the IDs it was checking
+      def initialize(message, expected:, actual:, requirement_ids:)
+        @expected = expected
+        @actual = actual
+        @requirement_ids = requirement_ids.dup.freeze
+        super(message)
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/minitest_driver.rb b/gems/dexpace-conformance/lib/dexpace/conformance/minitest_driver.rb
new file mode 100644
index 0000000..433fdba
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/minitest_driver.rb
@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "failure"
+require_relative "vacuous"
+require_relative "transport_case"
+
+module Dexpace
+  module Conformance
+    # The thin Minitest driver (design §9.3): `extend` it into a test class and call
+    # `conformance(suite, build:)`, and one test method per assertion is defined. Each generated
+    # test runs its OWN assertion directly, in a fresh TransportCase built from the same settings
+    # every other assertion gets -- so a Minitest `-n` filter exercises exactly the code path a
+    # full run does, never a replay of a cached Result -- and tears the case down in an ensure. A
+    # Vacuous is reported as a skip naming the reason, a Failure as a flunk naming the ids, and a
+    # waived id as a skip naming it, which is design §9.3's "the gap stays visible" in Minitest's
+    # own summary; anything else propagates as an error and is never silently a failure.
+    #
+    # Named MinitestDriver and not Minitest: inside module Dexpace::Conformance a constant named
+    # Minitest would shadow ::Minitest for every bare reference in the namespace, this file's
+    # included (5a's P5-3 reasoning, applied a second time). Nothing here requires or names the
+    # framework: `skip` and `flunk` are sent to the test instance the consumer's class already is,
+    # so this gem stays at `dexpace-core` and nothing else (NFR-2) and a Minitest that is a bundled
+    # gem (verified fact 17) is never a runtime constraint on a consumer.
+    #
+    # The consumer's test class should inherit the repository's own base where it has one -- the
+    # first-party driver inherits DexpaceTestCase, whose teardown counts threads, so a leaked
+    # fixture thread fails the generated test that leaked it.
+    module MinitestDriver
+      # @param suite [#assertions] anything shaped like TransportSuite: an ordered #assertions
+      # @param build [#call] the keyword-taking factory building the SDK-managed transport
+      # @param borrow [#call, nil] the port-taking factory returning a BorrowedPair, or nil
+      # @param waive [Array<String>] requirement IDs recorded as skipped and never run
+      # @param settle [#call, nil] suite contract clause 8's send primitive; nil takes the default
+      # @param around [#call, nil] clause 9's wrapper around each assertion's invocation
+      # @param wire [#call, nil] clause 11's fixture factory; nil takes WireServer
+      # @return [void]
+      def conformance(suite, build:, borrow: nil, waive: [], settle: nil, around: nil, wire: nil)
+        case_options = { build: build, borrow: borrow, settle: settle || TransportCase::DEFAULT_SETTLE,
+                         wire: wire || TransportCase::DEFAULT_WIRE, }.freeze
+        suite.assertions.each do |assertion|
+          define_method(MinitestDriver.method_name_for(assertion)) do
+            MinitestDriver.drive(self, assertion, around, case_options, waive: waive)
+          end
+        end
+      end
+
+      # The generated method's name: `test_` plus the assertion's name with every non-word run
+      # collapsed to one underscore, so `-n` can select it and Minitest's naming rule holds.
+      #
+      # @param assertion [Assertion]
+      # @return [String]
+      def self.method_name_for(assertion)
+        "test_#{assertion.name.gsub(/\W+/, "_").gsub(/\A_|_\z/, "")}"
+      end
+
+      # One assertion in one fresh case on the given test instance, torn down whatever happened
+      # -- or a skip naming the waived id, before any case is built. Clause 9: the driver INVOKES
+      # the assertion, so it may wrap it -- how an async driver opens the reactor the assertion's
+      # body reads a streamed response inside.
+      #
+      # @api private
+      def self.drive(test, assertion, around, case_options, waive:)
+        waived = assertion.ids & waive
+        return test.skip("waived: #{waived.join(", ")}") unless waived.empty?
+
+        kase = build_case(case_options)
+        around ? around.call { assertion.call(kase) } : assertion.call(kase)
+      rescue Vacuous => error
+        test.skip("vacuous: #{error.reason}")
+      rescue Failure => error
+        test.flunk("#{assertion.ids.join(", ")}: #{error.message}")
+      ensure
+        kase&.teardown
+      end
+
+      # The fresh case each generated test builds from the driver's frozen options.
+      #
+      # @api private
+      # @return [TransportCase]
+      def self.build_case(case_options)
+        TransportCase.new(build: case_options.fetch(:build), borrow: case_options[:borrow],
+                          settle: case_options.fetch(:settle), wire: case_options.fetch(:wire),)
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/recording_span.rb b/gems/dexpace-conformance/lib/dexpace/conformance/recording_span.rb
new file mode 100644
index 0000000..7fcaae5
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/recording_span.rb
@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Conformance
+    # OBS-21's RECORDING branch, which core's own NO_SPAN cannot demonstrate because it is always
+    # non-recording: a real in-memory span over phase 5c's `_Span` protocol -- `recording?`, the
+    # three mutators, `status=`, `finish(end_timestamp:)` and `context` -- that records every
+    # mutation while live and goes inert after #finish, which is OBS-21's idempotence clause and
+    # its post-finish-mutation clause in one object. Shipped here rather than in core's test tree
+    # because phase 5c assigned it to the conformance gem and a third-party adapter author
+    # asserting OBS-21 needs it to ship; `recording: false` is the non-recording variant OBS-23's
+    # delegation assertions need.
+    #
+    # `finished_at` is an Array, not a value: "call end() twice and assert no duplicate export" is
+    # assertable only against something that could have exported twice, and a one-element array
+    # after two #finish calls is that assertion.
+    class RecordingSpan
+      # @return [Hash{String => Object}] every attribute set while recording
+      attr_reader :attributes
+      # @return [Array<Hash>] every event added while recording, as `{name:, attributes:}`
+      attr_reader :events
+      # @return [Array<Hash>] every error recorded while recording, as `{error:, attributes:}`
+      attr_reader :errors
+      # @return [Object, nil] the last status set while recording
+      attr_reader :status
+      # @return [Array<Time>] the finish timestamps: at most one, however often #finish was called
+      attr_reader :finished_at
+      # @return [Object, nil] whatever the constructor was given as the span's context
+      attr_reader :context
+
+      # @param recording [Boolean] false for the inert, non-recording variant
+      # @param context [Object, nil] what #context answers (a Bundle, for a real span)
+      def initialize(recording: true, context: nil)
+        @recording = recording ? true : false
+        @context = context
+        @attributes = {}
+        @events = []
+        @errors = []
+        @status = nil
+        @finished_at = []
+      end
+
+      # OBS-21's flag: true until #finish, and never for the non-recording variant.
+      #
+      # @return [Boolean]
+      def recording?
+        @recording && @finished_at.empty?
+      end
+
+      # @param key [String]
+      # @param value [Object]
+      # @return [self]
+      def set_attribute(key, value)
+        @attributes[key] = value if recording?
+        self
+      end
+
+      # @param name [String]
+      # @param attributes [Hash, nil]
+      # @return [self]
+      def add_event(name, attributes: nil)
+        @events << { name: name, attributes: attributes }.freeze if recording?
+        self
+      end
+
+      # @param error [Exception]
+      # @param attributes [Hash, nil]
+      # @return [self]
+      def record_error(error, attributes: nil)
+        @errors << { error: error, attributes: attributes }.freeze if recording?
+        self
+      end
+
+      # @param status [Object]
+      # @return [Object] the status given
+      def status=(status)
+        @status = status if recording?
+        status
+      end
+
+      # Idempotent: the first call records one timestamp and every later call records nothing.
+      #
+      # @param end_timestamp [Time, nil] defaults to now
+      # @return [nil]
+      def finish(end_timestamp: nil)
+        return nil unless recording?
+
+        @finished_at << (end_timestamp || ::Time.now).freeze
+        nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/report.rb b/gems/dexpace-conformance/lib/dexpace/conformance/report.rb
new file mode 100644
index 0000000..20c4137
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/report.rb
@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "result"
+
+module Dexpace
+  module Conformance
+    # A frozen list of Results, partitioned by status, with the one renderer this sub-phase ships.
+    # `#to_s` is the only renderer (8a's open question 6): a structured `#to_h` is NFR-4-locked
+    # surface with no caller until phase 9 aggregates three suites, and phase 9 is the phase with
+    # the caller.
+    #
+    # Two things print on EVERY run and not only on failure, because a green run is the run a
+    # reader is most likely to over-read. Design §9.3: "the gap stays visible rather than
+    # disappearing into a restated item" -- so every waived ID is named. And P8-9: the suite's
+    # fixture speaks plaintext only and exercises no connect timeout, so the suite hands its
+    # preamble in and it prints first, which is what makes a third-party adapter author's green run
+    # honest about TLS and connect-timeout classification.
+    class Report
+      # @return [Array<Result>] every result, frozen, in the suite's order
+      attr_reader :results
+      # @return [String, nil] what the run does not prove, printed first (P8-9)
+      attr_reader :preamble
+
+      # @param results [Enumerable<Result>] the run's results, in order
+      # @param preamble [String, nil] the suite's stated omissions
+      def initialize(results, preamble: nil)
+        @results = results.to_a.freeze
+        @preamble = preamble
+      end
+
+      # True when nothing failed and nothing errored. A vacuous or a waived result does not fail a
+      # run -- the first has no antecedent to fail on and the second is a gap the port has named --
+      # and both are printed so neither reads as a pass.
+      #
+      # @return [Boolean]
+      def passed?
+        failures.empty? && errors.empty?
+      end
+
+      # @return [Array<Result>] the results whose assertion raised a Failure
+      def failures
+        by_status(:failed)
+      end
+
+      # @return [Array<Result>] the results whose assertion raised a Vacuous
+      def vacuous
+        by_status(:vacuous)
+      end
+
+      # @return [Array<Result>] the results a named waiver suppressed before they ran
+      def waived
+        by_status(:waived)
+      end
+
+      # @return [Array<Result>] the results whose assertion raised anything else
+      def errors
+        by_status(:error)
+      end
+
+      # The rendering: the preamble when there is one, a count line, then every waived, vacuous,
+      # failed and errored result named by its IDs -- the waived ones on every run.
+      #
+      # @return [String]
+      def to_s
+        [preamble, counts_line, *waived_lines, *detail_lines].compact.join("\n")
+      end
+
+      private
+
+      def by_status(status)
+        @results.select { |result| result.status == status }
+      end
+
+      def counts_line
+        "#{by_status(:passed).size} passed, #{failures.size} failed, #{vacuous.size} vacuous, " \
+          "#{waived.size} waived, #{errors.size} errored"
+      end
+
+      def waived_lines
+        waived.map { |result| "  waived: #{ids(result)} (#{result.assertion.name})" }
+      end
+
+      def detail_lines
+        { "vacuous" => vacuous, "FAILED" => failures,
+          "ERROR" => errors, }.flat_map do |label, results|
+          results.map { |result| "  #{label}: #{ids(result)}: #{result.detail}" }
+        end
+      end
+
+      def ids(result)
+        result.assertion.ids.join(", ")
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/result.rb b/gems/dexpace-conformance/lib/dexpace/conformance/result.rb
new file mode 100644
index 0000000..1576d38
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/result.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/model"
+require "dexpace/error/invalid_argument_error"
+require_relative "assertion"
+
+module Dexpace
+  module Conformance
+    # One assertion's outcome. `status` is one of the five in STATUSES -- never a boolean, because
+    # collapsing five outcomes into pass/fail is exactly what makes a vacuous requirement
+    # indistinguishable from one nobody ever checked (design §12; 8a's R7). `detail` is the
+    # failure's message, the vacuous reason or the error's class and message, and nil on a pass.
+    class Result < Data.define(:assertion, :status, :detail)
+      include Model
+
+      private_class_method :new
+
+      # The five outcomes: the assertion returned (:passed), raised a Failure (:failed), raised a
+      # Vacuous (:vacuous), was suppressed by a named waiver before it ran (:waived), or raised
+      # anything else (:error -- never silently a failure).
+      STATUSES = %i[passed failed vacuous waived error].freeze
+
+      # The validating factory every construction path goes through.
+      #
+      # @param assertion [Assertion] the assertion this is the outcome of
+      # @param status [Symbol] one of STATUSES
+      # @param detail [String, nil] the failure message, reason or error rendering
+      # @return [Result] frozen
+      # @raise [Dexpace::InvalidArgumentError] on a status outside the five, or a missing assertion
+      def self.build(assertion:, status:, detail: nil)
+        new(assertion: assertion, status: status, detail: detail)
+      end
+
+      def initialize(assertion:, status:, detail: nil)
+        unless Model.required!("assertion", assertion).is_a?(Assertion)
+          raise InvalidArgumentError, "assertion must be a Dexpace::Conformance::Assertion"
+        end
+        unless STATUSES.include?(status)
+          raise InvalidArgumentError, "status must be one of: #{STATUSES.join(", ")}"
+        end
+
+        super
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/rspec_driver.rb b/gems/dexpace-conformance/lib/dexpace/conformance/rspec_driver.rb
new file mode 100644
index 0000000..9ad20f0
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/rspec_driver.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "vacuous"
+require_relative "transport_case"
+
+module Dexpace
+  module Conformance
+    # The thin RSpec driver (design §9.3). Never required by lib/dexpace/conformance.rb: an
+    # RSpec-only consumer opts in with `require "dexpace/conformance/rspec_driver"`, exactly as it
+    # opts into RSpec itself, so a Minitest-only consumer never loads a file naming the other
+    # framework. `::RSpec` is resolved inside the method body, at call time, in the consumer's
+    # process where the framework is already loaded; this file requires nothing of it (NFR-2).
+    #
+    # One example group per assertion with one example each, in the Minitest driver's shape: a
+    # waived id and a Vacuous are skips naming why, a Failure propagates as the example's failure
+    # carrying the expected and actual values, and the case is torn down in an ensure.
+    module RSpecDriver
+      # @param suite [#assertions] anything shaped like TransportSuite: an ordered #assertions
+      # @param build [#call] the keyword-taking factory building the SDK-managed transport
+      # @param borrow [#call, nil] the port-taking factory returning a BorrowedPair, or nil
+      # @param waive [Array<String>] requirement IDs skipped and never run
+      # @param settle [#call, nil] suite contract clause 8's send primitive; nil takes the default
+      # @param around [#call, nil] clause 9's wrapper around each assertion's invocation
+      # @param wire [#call, nil] clause 11's fixture factory; nil takes WireServer
+      # @return [void]
+      def self.conformance(suite, build:, borrow: nil, waive: [], settle: nil, around: nil,
+                           wire: nil)
+        rspec = ::Object.const_get(:RSpec) # resolved at call time, in the consumer's process
+        suite.assertions.each do |assertion|
+          group = rspec.describe(assertion.name)
+          group.it("satisfies #{assertion.ids.join(", ")}") do
+            RSpecDriver.drive(assertion, self, waive: waive, build: build, borrow: borrow,
+                                               settle: settle, around: around, wire: wire,)
+          end
+        end
+      end
+
+      # One assertion in one fresh case, torn down whatever happened -- or a skip naming the
+      # waived id, before any case is built. `example` is the example's own self, whose #skip a
+      # waiver and a Vacuous both reach.
+      #
+      # @api private
+      def self.drive(assertion, example, waive:, build:, borrow:, settle:, around:, wire:)
+        waived = assertion.ids & waive
+        return example.skip("waived: #{waived.join(", ")}") unless waived.empty?
+
+        kase = TransportCase.new(
+          build: build, borrow: borrow,
+          settle: settle || TransportCase::DEFAULT_SETTLE, wire: wire || TransportCase::DEFAULT_WIRE,
+        )
+        begin
+          around ? around.call { assertion.call(kase) } : assertion.call(kase)
+        rescue Vacuous => error
+          example.skip("vacuous: #{error.reason}")
+        ensure
+          kase.teardown
+        end
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/scripts.rb b/gems/dexpace-conformance/lib/dexpace/conformance/scripts.rb
new file mode 100644
index 0000000..1e2224e
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/scripts.rb
@@ -0,0 +1,234 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Conformance
+    # Named response scripts a WireServer runs against every accepted connection. Each function
+    # returns a callable taking the connection socket and the already-read request head (the
+    # request line plus the header lines, an Array of raw String lines); the server has read and
+    # recorded any request body before the script runs, so a script only writes.
+    #
+    # Every status line answers HTTP/1.1: phase 1's Protocol.parse has no alias for "http/1.0"
+    # (8a plan, Task 17), and no TRANSPORT ID asks for 1.0. A script that must WAIT blocks on the
+    # socket -- `wait_readable` for a delay, `readpartial` for "until the peer goes away" -- and
+    # never on `sleep`, so WireServer#close, which closes every accepted socket, wakes it at once
+    # and no handler thread outlives the test that started it.
+    module Scripts
+      extend self
+
+      # A fixed-length body over ordinary framing: the script most assertions reach for. With
+      # `hold: true` the connection is held open after the response until the PEER closes it, so
+      # the fixture's #closed_connections counts the client's close rather than the handler's
+      # finishing -- the only way "closing the response returns the connection" (TRANSPORT-22,
+      # TRANSPORT-25) is observable from the server's side.
+      #
+      # @param body [String] the body bytes
+      # @param status [String] the status line's code and reason
+      # @param headers [Hash{String => String}] response headers beside Content-Length
+      # @param hold [Boolean] whether to wait for the peer's close after answering
+      # @return [Proc] the script
+      def fixed(body, status: "200 OK", headers: { "Content-Type" => "text/plain" }, hold: false)
+        lambda do |conn, _head|
+          write_response(conn, status: status, headers: headers, body: body)
+          drain_until_closed(conn) if hold
+        end
+      end
+
+      # TRANSPORT-25's multi-megabyte body, in one write, over #large_body's bytes; `hold:` as
+      # for #fixed.
+      #
+      # @param byte_count [Integer]
+      # @param hold [Boolean] whether to wait for the peer's close after answering
+      # @return [Proc] the script
+      def large(byte_count, hold: false)
+        fixed(large_body(byte_count), hold: hold)
+      end
+
+      # The bytes #large writes: a repeating alphabet cut to the count, so a byte-exact comparison
+      # detects a dropped or duplicated chunk where a uniform "aaaa" body would not. BINARY, as
+      # every wire byte is.
+      #
+      # @param byte_count [Integer]
+      # @return [String] frozen, BINARY
+      def large_body(byte_count)
+        pattern = ("a".."z").to_a.join
+        (pattern * ((byte_count / pattern.bytesize) + 1)).byteslice(0, byte_count).to_s.b.freeze
+      end
+
+      # TRANSPORT-19/TRANSPORT-25: a chunked body written in two pieces with a gap between them --
+      # the shape that makes pre-buffering observable as a timing defect and not only a content
+      # one. The gap is `wait_readable(delay_seconds)` on the connection, which returns early the
+      # moment the peer closes, so a client that abandons the response is not waited for.
+      #
+      # @param first [String] the first chunk
+      # @param second [String] the second chunk
+      # @param delay_seconds [Numeric] the gap
+      # @return [Proc] the script
+      def dribble(first, second, delay_seconds)
+        lambda do |conn, _head|
+          conn.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n" \
+                     "Transfer-Encoding: chunked\r\n\r\n")
+          conn.write(chunk(first))
+          conn.flush
+          conn.wait_readable(delay_seconds)
+          conn.write("#{chunk(second)}0\r\n\r\n")
+        end
+      end
+
+      # TRANSPORT-1: a raw 302 with a Location, which the transport must return and never follow.
+      #
+      # @param to [String] the Location value
+      # @return [Proc] the script
+      def redirect(to)
+        ->(conn, _head) { write_response(conn, status: "302 Found", headers: { "Location" => to }) }
+      end
+
+      # TRANSPORT-24: a vendor or otherwise unusual status code, with a body.
+      #
+      # @param code [Integer] the status code
+      # @param body [String] the body
+      # @return [Proc] the script
+      def vendor_status(code, body)
+        ->(conn, _head) { write_response(conn, status: "#{code} Vendor", body: body) }
+      end
+
+      # TRANSPORT-14's whole conformance clause in one response: a control byte in a value, a
+      # non-ASCII byte in a name, obs-text in a value, a repeated Set-Cookie, and a body.
+      #
+      # @return [Proc] the script
+      def malformed_headers
+        lambda do |conn, _head|
+          conn.write(
+            "HTTP/1.1 200 OK\r\nX-Ctl: a\x01b\r\nX-B\xE9d: y\r\nX-Obs: caf\xE9\r\n" \
+            "Set-Cookie: a=1\r\nSet-Cookie: b=2\r\nContent-Length: 2\r\n\r\nhi".b,
+          )
+        end
+      end
+
+      # TRANSPORT-27 (8a's R4): a non-numeric Content-Length beside a malformed Content-Type, then a
+      # body closed by connection close -- the shape Net::HTTP itself refuses to read.
+      #
+      # @return [Proc] the script
+      def malformed_content_length
+        lambda do |conn, _head|
+          conn.write("HTTP/1.1 200 OK\r\nContent-Type: not a/;;media type\r\n" \
+                     "Content-Length: abc\r\n\r\nhi")
+        end
+      end
+
+      # TRANSPORT-3/TRANSPORT-4/TRANSPORT-5/TRANSPORT-6: reads the request and never answers,
+      # simulating a dead server on the SEND path -- the head never arrives, so the send itself
+      # times out or is cancelled; it blocks on the socket until the client goes away or
+      # WireServer#close ends it, never on a sleep. `on_request_read:` is called once, on the
+      # SERVER's thread, once the whole request has been read -- the instant the client is
+      # blocked waiting for the head -- which is where a test that must fire a cancellation "while
+      # the call is blocked" pushes into a queue, deterministically, instead of guessing a delay.
+      #
+      # @param on_request_read [#call, nil] the hook
+      # @return [Proc] the script
+      def hang_before_headers(on_request_read: nil)
+        lambda do |conn, _head|
+          on_request_read&.call
+          drain_until_closed(conn)
+        end
+      end
+
+      # The body-read twin: writes a chunked head and never a body, so the head arrives and the
+      # first BODY read is what blocks. `on_headers_written:` fires once the head is flushed, on
+      # the server's thread. The adapter's own suite uses it for a mid-body cancellation and for
+      # the mid-stream deadline refresh (8a's R3).
+      #
+      # @param on_headers_written [#call, nil] the hook
+      # @return [Proc] the script
+      def hang_after_headers(on_headers_written: nil)
+        lambda do |conn, _head|
+          conn.write("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n")
+          conn.flush
+          on_headers_written&.call
+          drain_until_closed(conn)
+        end
+      end
+
+      # TRANSPORT-2/TRANSPORT-3: the first connection on this script's own counter is dropped
+      # without an answer; every later one answers normally -- the shape "assert the native client
+      # does not silently re-send" needs.
+      #
+      # @param body [String] what the later connections answer
+      # @return [Proc] the script
+      def fail_first_connection_then_succeed(body)
+        attempt = 0
+        mutex = ::Thread::Mutex.new
+        lambda do |conn, _head|
+          first = mutex.synchronize { (attempt += 1) == 1 }
+          write_response(conn, body: body) unless first
+        end
+      end
+
+      # A body shorter than its declared Content-Length, then the connection closes: a truncated
+      # transfer, distinct from a clean connection-close-framed body.
+      #
+      # @param declared_length [Integer] the Content-Length written
+      # @param actual_body [String] the bytes actually sent
+      # @return [Proc] the script
+      def truncated(declared_length:, actual_body:)
+        lambda do |conn, _head|
+          conn.write("HTTP/1.1 200 OK\r\nContent-Length: #{declared_length}\r\n\r\n#{actual_body}")
+        end
+      end
+
+      # PAGE-36's per-call-options test: different bodies in call order over one server, the last
+      # repeated, so a test can assert each call reached a distinct page.
+      #
+      # @param bodies [Array<String>]
+      # @return [Proc] the script
+      def sequenced(*bodies)
+        index = 0
+        mutex = ::Thread::Mutex.new
+        lambda do |conn, _head|
+          body = bodies[mutex.synchronize { (index += 1) - 1 }] || bodies.last
+          write_response(conn, body: body)
+        end
+      end
+
+      # TRANSPORT-29: answers with the request's own path, so a response matched to the wrong
+      # request is visible as a body that names another path.
+      #
+      # @return [Proc] the script
+      def echo_path
+        ->(conn, head) { write_response(conn, body: head.first.to_s.split[1].to_s) }
+      end
+
+      # The one write primitive: a status line, the headers plus a computed Content-Length, and
+      # the body. It does not close the connection -- WireServer#handle's ensure does, once, for
+      # every connection whatever its script did.
+      #
+      # @param conn [Object] the accepted socket
+      # @param status [String] the status line's code and reason
+      # @param headers [Hash{String => String}] response headers
+      # @param body [String] the body
+      # @return [nil]
+      def write_response(conn, status: "200 OK", headers: { "Content-Type" => "text/plain" },
+                         body: "")
+        lines = headers.merge("Content-Length" => body.bytesize.to_s)
+          .map { |name, value| "#{name}: #{value}" }.join("\r\n")
+        conn.write("HTTP/1.1 #{status}\r\n#{lines}\r\n\r\n".b, body.b)
+        conn.flush
+        nil
+      end
+
+      private
+
+      def chunk(bytes)
+        "#{bytes.bytesize.to_s(16)}\r\n#{bytes}\r\n"
+      end
+
+      # Blocks until the peer closes or the socket is closed under it: a client that gives up
+      # (its read timeout, its cancellation) ends this at once, and so does WireServer#close.
+      def drain_until_closed(conn)
+        loop { conn.readpartial(4096) }
+      rescue ::IOError, ::SystemCallError
+        nil # EOFError is an IOError: the peer went away, which is the end this wait was for
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_case.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_case.rb
new file mode 100644
index 0000000..e9ab7dc
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_case.rb
@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "vacuous"
+require_relative "borrowed_pair"
+require_relative "scripts"
+require_relative "wire_server"
+
+module Dexpace
+  module Conformance
+    # What an assertion body receives. #transport and #borrowed_transport track every transport
+    # they build so #teardown -- driven by the runner, never by the assertion -- closes all of them;
+    # #wire is lazy and memoized per case, because not every assertion needs a socket. The two
+    # driver-supplied primitives, `settle:` and `wire:`, are the suite contract's clauses 8 and 11
+    # (8a's R16): both default to the synchronous, TCPServer-backed shape, so a sync adapter's
+    # driver passes neither and an async adapter's driver passes both without either forking an
+    # assertion.
+    class TransportCase
+      # Clause 8's default send: `transport.call(request, options, cancellation)`, the sync seam.
+      DEFAULT_SETTLE = lambda do |transport, request, options, cancellation|
+        transport.call(request, options, cancellation)
+      end
+
+      # Clause 11's default fixture: a WireServer on the given script.
+      DEFAULT_WIRE = ->(script) { WireServer.start(script) }
+
+      # @param build [#call] a keyword-taking factory building the SDK-managed transport
+      # @param borrow [#call, nil] a one-argument factory (the fixture's port) returning a
+      #   BorrowedPair, or nil when the adapter has no borrowing construction
+      # @param settle [#call] the send primitive, `(transport, request, options, cancellation)`
+      # @param wire [#call] the fixture factory, taking a script
+      def initialize(build:, borrow: nil, settle: DEFAULT_SETTLE, wire: DEFAULT_WIRE)
+        @build = build
+        @borrow = borrow
+        @settle = settle
+        @wire_factory = wire
+        @transports = []
+        @wire = nil
+      end
+
+      # A fresh SDK-managed transport from the driver's factory, passing only the settings given
+      # -- the two the suite contract allows, `timeout:` and `logger:` (clause 4) -- behind the
+      # clause-8 guard, so what an assertion receives cannot be #call-ed. The default #settle IS
+      # transport.call, so an assertion that called #call directly would pass every run this
+      # phase performs and fail only once an async driver replaces #settle; the guard makes that a
+      # red test here instead.
+      #
+      # @param timeout [Numeric, nil] the transport-level default timeout, when an assertion sets it
+      # @param logger [Object, nil] a Dexpace::Instrumentation::Logger, when the assertion passes it
+      # @return [Object] the guarded transport
+      def transport(timeout: nil, logger: nil)
+        settings = {} #: Hash[Symbol, untyped]
+        settings[:timeout] = timeout unless timeout.nil?
+        settings[:logger] = logger unless logger.nil?
+        SettleOnly.new(track(@build.call(**settings)))
+      end
+
+      # Clause 8: the ONE send primitive. An assertion calls this and never transport.call, so the
+      # same body drives a sync transport and an async one whose future the driver awaits; clause 5
+      # is that a cancellation surfaces from here as Dexpace::CancelledError on both paths.
+      #
+      # @param transport [Object] the guarded transport #transport or #borrowed_transport returned
+      # @param request [Dexpace::Request]
+      # @param options [Dexpace::RequestOptions]
+      # @param cancellation [Dexpace::Cancellation]
+      # @return [Dexpace::Response]
+      def settle(transport, request, options = Dexpace::RequestOptions::EMPTY,
+                 cancellation = Dexpace::Cancellation.none)
+        @settle.call(SettleOnly.unwrap(transport), request, options, cancellation)
+      end
+
+      # Suite contract 4a: the driver's borrow factory takes the fixture's PORT and returns a
+      # BorrowedPair, because the caller's own client is an adapter-specific object and an
+      # assertion that constructed one would have parameterised itself on which adapter it is
+      # looking at -- the one thing this gem may never contain. An adapter with no borrowing
+      # construction supplies no factory, and the assertion is vacuous rather than failed.
+      #
+      # @return [BorrowedPair] the pair, its transport guarded like #transport's
+      # @raise [Vacuous] when the driver supplied no `borrow:`
+      def borrowed_transport
+        if @borrow.nil?
+          raise Vacuous, "this adapter's suite call supplied no borrowing construction " \
+                         "(TRANSPORT-15's borrowed half)"
+        end
+
+        pair = @borrow.call(wire.port)
+        track(pair.transport)
+        BorrowedPair.build(transport: SettleOnly.new(pair.transport), probe: pair.probe)
+      end
+
+      # Clause 11: the fixture, from the driver's factory, started on the first call with the
+      # script given then and returned as it is afterwards. Whatever the factory returns must
+      # answer #port, #requests, #connections, #closed_connections and #await_closed_connection --
+      # WireServer's own surface, which is therefore the contract (sig/'s `_Wire`).
+      #
+      # @param script [#call] the response script, used only on the first call
+      # @return [Object] the fixture
+      def wire(script: Scripts.fixed(""))
+        @wire ||= @wire_factory.call(script)
+      end
+
+      # A request against the live fixture's own port -- which is also why the borrow factory
+      # takes that port: a borrowing transport is bound to one origin (P8-15) and every request
+      # the suite builds names this one.
+      #
+      # @param path [String] the request target
+      # @param method [String] the method token
+      # @param headers [Dexpace::Headers]
+      # @param body [Dexpace::Body, nil]
+      # @return [Dexpace::Request]
+      def request(path: "/", method: "GET", headers: Dexpace::Headers::EMPTY, body: nil)
+        Dexpace::Request.build(method: method, url: "http://127.0.0.1:#{wire.port}#{path}",
+                               headers: headers, body: body,)
+      end
+
+      # Closes every transport this case built and the fixture, quietly, in that order. The
+      # runner calls it in an ensure; an assertion never does.
+      #
+      # @return [nil]
+      def teardown
+        @transports.each { |transport| Dexpace.close_quietly(transport) }
+        Dexpace.close_quietly(@wire)
+        nil
+      end
+
+      private
+
+      def track(built)
+        @transports << built
+        built
+      end
+
+      # Clause 8's guard: delegates every message but #call, on which it raises. Not a Data: it
+      # wraps a foreign object and its identity is the subject's.
+      class SettleOnly
+        # @param object [Object] a guard or anything else
+        # @return [Object] the guarded subject, or the object itself
+        def self.unwrap(object)
+          object.is_a?(SettleOnly) ? object.__subject__ : object
+        end
+
+        def initialize(subject)
+          @subject = subject
+        end
+
+        # The wrapped transport, for #unwrap; double-underscored so no transport's own message
+        # collides with it.
+        def __subject__
+          @subject
+        end
+
+        # Always raises: an assertion sends through TransportCase#settle and never through #call.
+        def call(*)
+          raise ::ArgumentError,
+                "a conformance assertion must send through kase.settle(transport, request, " \
+                "options, cancellation), never transport.call -- an async driver replaces " \
+                "#settle with `transport.call(...).value(cancellation:)`, and a direct #call " \
+                "returns a " \
+                "Dexpace::Async::Future there (suite contract clause 8)"
+        end
+
+        def respond_to_missing?(name, include_private = false)
+          @subject.respond_to?(name, include_private) || super
+        end
+
+        private
+
+        def method_missing(name, ...)
+          return super unless @subject.respond_to?(name)
+
+          @subject.public_send(name, ...)
+        end
+      end
+      private_constant :SettleOnly
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite.rb
new file mode 100644
index 0000000..7420ca9
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite.rb
@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "failure"
+require_relative "vacuous"
+require_relative "assertion"
+require_relative "result"
+require_relative "report"
+require_relative "transport_case"
+require_relative "transport_suite/checks"
+require_relative "transport_suite/outbound"
+require_relative "transport_suite/inbound"
+require_relative "transport_suite/streaming"
+require_relative "transport_suite/resilience"
+require_relative "transport_suite/lifecycle"
+
+module Dexpace
+  module Conformance
+    # The transport suite's runner (8a's R7, R16): every assertion runs in a FRESH TransportCase,
+    # its raise is mapped onto one of Result's five statuses -- Vacuous to :vacuous, Failure to
+    # :failed, anything else to :error and never silently a failure -- the case is torn down in an
+    # ensure whatever happened, and an assertion whose ids meet the waiver list is recorded
+    # :waived without its body ever running. A module with `extend self` (the repository's rule
+    # for a function module), so the two functions are instance rows in the surface manifest.
+    module TransportSuite
+      extend self
+
+      # P8-9, printed at the head of every report: what a green run of this suite does NOT prove,
+      # so a third-party adapter author whose adapter passes is not misled about TLS verification
+      # or connect-timeout classification, which live in the adapter's own suite.
+      PREAMBLE = "dexpace-conformance transport suite: the wire fixture speaks plaintext only " \
+                 "and exercises no connect timeout, so TLS verification and TRANSPORT-4's " \
+                 "open-timeout classification are NOT among the things a green run proves " \
+                 "(P8-9); assert both in the adapter's own suite."
+
+      # The suite's assertions, frozen and ordered: the five groups this phase ships, concatenated.
+      #
+      # @return [Array<Assertion>]
+      def assertions
+        ASSERTIONS
+      end
+
+      # Runs the suite against one adapter.
+      #
+      # @param build [#call] keyword-taking factory building the SDK-managed transport; the suite
+      #   passes at most `timeout:` and `logger:`
+      # @param borrow [#call, nil] a one-argument factory taking the fixture's port and returning
+      #   a BorrowedPair, or nil when the adapter has no borrowing construction
+      # @param waive [Array<String>] requirement IDs whose assertions are recorded :waived and not
+      #   run -- a gap the port has named, printed on every run (design §9.3)
+      # @param around [#call, nil] clause 9: a callable handed each assertion's invocation as a
+      #   block, so an async driver can wrap it in its reactor; nil invokes the assertion directly
+      # @param settle [#call, nil] clause 8's send primitive; nil takes TransportCase's default
+      # @param wire [#call, nil] clause 11's fixture factory; nil takes WireServer
+      # @param assertions [Array<Assertion>] the assertions to run, the suite's own by default --
+      #   a keyword so the suite's own tests hand in three of theirs without stubbing anything
+      # @return [Report]
+      def run(build:, borrow: nil, waive: [], around: nil, settle: nil, wire: nil,
+              assertions: self.assertions)
+        results = assertions.map do |assertion|
+          if assertion.ids.intersect?(waive)
+            Result.build(assertion: assertion, status: :waived)
+          else
+            run_one(assertion, build: build, borrow: borrow, around: around, settle: settle,
+                               wire: wire,)
+          end
+        end
+        Report.new(results, preamble: PREAMBLE)
+      end
+
+      private
+
+      def run_one(assertion, build:, borrow:, around:, settle:, wire:)
+        kase = TransportCase.new(
+          build: build, borrow: borrow,
+          settle: settle || TransportCase::DEFAULT_SETTLE, wire: wire || TransportCase::DEFAULT_WIRE,
+        )
+        begin
+          # Clause 9: the runner INVOKES the assertion, so `around` can put a block around the
+          # whole of it -- the reactor an async driver opens here is the one the body reads a
+          # streamed response inside.
+          around ? around.call { assertion.call(kase) } : assertion.call(kase)
+          Result.build(assertion: assertion, status: :passed)
+        rescue Vacuous => error
+          Result.build(assertion: assertion, status: :vacuous, detail: error.reason)
+        rescue Failure => error
+          Result.build(assertion: assertion, status: :failed, detail: error.message)
+        rescue ::StandardError => error
+          Result.build(assertion: assertion, status: :error,
+                       detail: "#{error.class}: #{error.message}",)
+        ensure
+          kase.teardown
+        end
+      end
+
+      # The five groups, each a private module of its own file (one constant per file, and each
+      # under RuboCop's module-length cap), concatenated in the order a reader meets the chapter:
+      # outbound, inbound, streaming, resilience, lifecycle.
+      ASSERTIONS = (Outbound::ASSERTIONS + Inbound::ASSERTIONS + Streaming::ASSERTIONS +
+                    Resilience::ASSERTIONS + Lifecycle::ASSERTIONS).freeze
+      private_constant :ASSERTIONS
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/checks.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/checks.rb
new file mode 100644
index 0000000..118e160
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/checks.rb
@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "../failure"
+require_relative "../assertion"
+require_relative "../scripts"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # The helpers every assertion group's functions share: the one way a check fails, the
+      # request-building shorthands, the timing and error-capturing wrappers, and the registry
+      # builder each group's ASSERTIONS table goes through. Nothing here names an adapter, a
+      # native client class, a thread or a reactor (8a's R16). A private_constant of
+      # TransportSuite.
+      module Checks
+        extend self
+
+        # How long an assertion waits for the fixture to observe a connection closing, before
+        # calling the connection unreleased. A bound, so a transport that never releases fails
+        # the assertion rather than hanging the run; generous, because the server observes a close
+        # in milliseconds and CI load is the only thing that stretches it.
+        CLOSE_WAIT_SECONDS = 2.0
+
+        # The one way an assertion fails: nothing when the condition holds, a Failure carrying the
+        # ids and the two values otherwise.
+        #
+        # @param condition [Object] truthy when the check holds
+        # @param message [String]
+        # @param ids [Array<String>] the requirement ids the check is for
+        # @param expected [Object]
+        # @param actual [Object]
+        # @return [nil]
+        # @raise [Failure]
+        def check(condition, message, ids:, expected:, actual:)
+          return nil if condition
+
+          raise Failure.new(message, expected: expected, actual: actual, requirement_ids: ids)
+        end
+
+        # #check for the common shape: what was seen must equal what was expected.
+        #
+        # @param seen [Object]
+        # @param expected [Object]
+        # @param message [String]
+        # @param ids [Array<String>]
+        # @return [nil]
+        def expect(seen, expected, message, ids:)
+          check(seen == expected, message, ids: ids, expected: expected, actual: seen)
+        end
+
+        # Suite contract clause 5: a failure carrying no HTTP response answers #retryable? true.
+        #
+        # @param error [Exception, nil]
+        # @return [Boolean]
+        def retryable_failure?(error)
+          !error.nil? && error.respond_to?(:retryable?) && error.retryable? == true
+        end
+
+        # A group's frozen registry, from rows of `[ids, name, function]` where `function` names
+        # a public method of `group` taking the case -- one row per assertion, so a group's table
+        # reads as its index.
+        #
+        # @param group [Module] the group module
+        # @param rows [Array<Array>] `[ids, name, function]` triples
+        # @return [Array<Assertion>] frozen
+        def registry(group, rows)
+          rows.map do |ids, name, function|
+            Assertion.build(ids: Array(ids), name: name,
+                            body: ->(kase) { group.public_send(function, kase) },)
+          end.freeze
+        end
+
+        # @param pairs [Hash{String => String}] header name to value
+        # @return [Dexpace::Headers] an outbound Headers
+        def headers(pairs)
+          builder = Dexpace::Headers.builder
+          pairs.each { |name, value| builder.add(name, value) }
+          builder.build
+        end
+
+        # @return [Dexpace::MediaType] application/json
+        def json
+          Dexpace::MediaType.parse("application/json")
+        end
+
+        # @param string [String] the bytes
+        # @param media_type [Dexpace::MediaType, nil]
+        # @return [Dexpace::BytesBody] a replayable body
+        def bytes_body(string, media_type: nil)
+          Dexpace::Body.bytes(string.b, media_type: media_type)
+        end
+
+        # A SINGLE-USE body (phase 3b's ChunkedBody is never replayable, P3-19) over one chunk,
+        # counting how many times it was pulled -- what TRANSPORT-2, TRANSPORT-17 and TRANSPORT-18
+        # ask about a body that must never be written twice.
+        #
+        # @param payload [String] the one chunk
+        # @return [Array(Dexpace::Body, #call)] the body and a callable answering the pull count
+        def single_use_body(payload)
+          pulls = 0
+          chunked = Object.new
+          chunked.define_singleton_method(:each) do |&block|
+            pulls += 1
+            block.call(payload.b)
+          end
+          [Dexpace::Body.chunked(chunked, content_length: payload.bytesize), -> { pulls }]
+        end
+
+        # @param timeout [Numeric, nil]
+        # @param max_retries [Integer, nil]
+        # @return [Dexpace::RequestOptions]
+        def options(timeout: nil, max_retries: nil)
+          builder = Dexpace::RequestOptions.builder
+          builder.timeout = timeout unless timeout.nil?
+          builder.max_retries = max_retries unless max_retries.nil?
+          builder.build
+        end
+
+        # The last request the fixture recorded, or a Failure naming the ids when it recorded none.
+        #
+        # @param kase [TransportCase]
+        # @param ids [Array<String>]
+        # @return [WireServer::RecordedRequest]
+        def last_request(kase, ids:)
+          recorded = kase.wire.requests.last
+          check(recorded, "no request reached the wire", ids: ids, expected: "one request",
+                                                         actual: kase.wire.requests.size,)
+          recorded
+        end
+
+        # Waits, bounded, for the fixture to see one more connection finish, then checks it did.
+        #
+        # @param kase [TransportCase]
+        # @param ids [Array<String>]
+        # @param message [String]
+        # @return [nil]
+        def check_connection_released(kase, ids:, message:)
+          released = kase.wire.await_closed_connection(timeout: CLOSE_WAIT_SECONDS)
+          check(released, message, ids: ids, expected: "a close within #{CLOSE_WAIT_SECONDS} s",
+                                   actual: "#{kase.wire.closed_connections} closed",)
+        end
+
+        # A thread that cancels `source` the instant the server reports the client blocked waiting
+        # for the head -- through the script's hook and a Queue#pop, never a guessed delay -- for
+        # TRANSPORT-3's send-path cancellation.
+        #
+        # @param kase [TransportCase]
+        # @param source [Dexpace::Cancellation::Source]
+        # @return [Thread] the canceller, for the assertion to join
+        def cancel_when_blocked(kase, source)
+          blocked = ::Thread::Queue.new
+          kase.wire(script: Scripts.hang_before_headers(on_request_read: -> { blocked.push(true) }))
+          ::Thread.new do
+            blocked.pop
+            source.cancel(:conformance_cancel)
+          end
+        end
+
+        # One POST of a single-use body against a server that drops the first connection: whether
+        # the send raised a retryable failure, how many connections the server saw and how many
+        # times the body was pulled -- the measurement TRANSPORT-2 and TRANSPORT-18 both read.
+        #
+        # @param kase [TransportCase]
+        # @return [Hash{Symbol => Object}] `raised:`, `connections:`, `pulls:`
+        def dropped_first_attempt(kase)
+          kase.wire(script: Scripts.fail_first_connection_then_succeed("ok"))
+          body, pulls = single_use_body("payload")
+          error = error_from do
+            kase.settle(kase.transport, kase.request(method: "POST", body: body))
+          end
+          { raised: retryable_failure?(error), connections: kase.wire.connections,
+            pulls: pulls.call, }
+        end
+
+        # Each measured duration inside its own band, in order: TRANSPORT-5's "each bounded by
+        # its own value", asserted over a list of calls.
+        #
+        # @param timings [Array<Float>]
+        # @param bands [Array<Range>]
+        # @return [Boolean]
+        def within_bands?(timings, bands)
+          timings.each_with_index.all? { |took, i| bands.fetch(i).cover?(took) }
+        end
+
+        # The error a send raised (nil when it returned) and how long it took, together.
+        #
+        # @yield the send under test
+        # @return [Array(StandardError?, Float)]
+        def timed_error(&block)
+          error = nil
+          took = elapsed { error = error_from(&block) }
+          [error, took]
+        end
+
+        # @yield the send under test
+        # @return [StandardError, nil] what it raised, or nil when it returned
+        def error_from
+          yield
+          nil
+        rescue ::StandardError => error
+          error
+        end
+
+        # @yield the work to time
+        # @return [Float] seconds, off the monotonic clock
+        def elapsed
+          started = monotonic
+          yield
+          monotonic - started
+        end
+
+        # @return [Float] Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        def monotonic
+          ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+        end
+      end
+      private_constant :Checks
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/inbound.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/inbound.rb
new file mode 100644
index 0000000..a0b13db
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/inbound.rb
@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "../scripts"
+require_relative "checks"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # Group 2, inbound mapping: TRANSPORT-24, TRANSPORT-14 and TRANSPORT-27. Every question is
+      # asked of the Dexpace::Response -- the status, the folded header lookup, the body's own
+      # `content_length` and `media_type` -- and never of a native object (suite contract clauses
+      # 2, 6 and 7). A private_constant of TransportSuite.
+      module Inbound
+        extend self
+
+        # What TRANSPORT-14's script must come back as: the control-byte value and the non-ASCII
+        # name dropped, the obs-text value kept, the body read.
+        LENIENT = { control_byte_dropped: true, non_ascii_name_dropped: true, obs_text_kept: true,
+                    body: "hi", }.freeze
+
+        # TRANSPORT-24's clause: "a 520 with a body" surfaces faithfully.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def vendor_status_surfaces_faithfully(kase)
+          kase.wire(script: Scripts.vendor_status(520, "vendor error"))
+          response = kase.settle(kase.transport, kase.request)
+
+          Checks.expect([response.status.code, response.body_string], [520, "vendor error"],
+                        "a vendor status was not surfaced faithfully", ids: ["TRANSPORT-24"],)
+        end
+
+        # TRANSPORT-14's clause: a control-byte value and a non-ASCII name are dropped, an obs-text
+        # value is preserved, and the body and the remaining headers are still delivered.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def malformed_headers_are_dropped_one_at_a_time(kase)
+          kase.wire(script: Scripts.malformed_headers)
+          response = kase.settle(kase.transport, kase.request)
+
+          Checks.expect(leniency_of(response), LENIENT,
+                        "TRANSPORT-14's per-header leniency did not hold", ids: ["TRANSPORT-14"],)
+        end
+
+        # TRANSPORT-14, the multi-valued half: a repeated Set-Cookie survives as two values, which
+        # is the assertion that fails if an adapter joins with ", " on the way in.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def multi_valued_header_survives(kase)
+          kase.wire(script: Scripts.malformed_headers)
+          response = kase.settle(kase.transport, kase.request)
+          values = response.headers["Set-Cookie"]
+          response.close
+
+          Checks.expect(values, ["a=1", "b=2"], "a multi-valued header collapsed",
+                        ids: ["TRANSPORT-14"],)
+        end
+
+        # TRANSPORT-27's clause: "a malformed Content-Type and non-numeric Content-Length still
+        # let the body read, with null media type and unknown length" -- the -1 sentinel on the
+        # body, never nil and never read off a native object (clause 2).
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def malformed_type_and_length_downgrade(kase)
+          kase.wire(script: Scripts.malformed_content_length)
+          response = kase.settle(kase.transport, kase.request)
+          body = response.body
+
+          Checks.expect([body&.media_type, body&.content_length, response.body_string],
+                        [nil, -1, "hi"], "TRANSPORT-27's downgrade did not hold",
+                        ids: ["TRANSPORT-27"],)
+        end
+
+        # What TRANSPORT-14's script came back as, in LENIENT's shape.
+        #
+        # @param response [Dexpace::Response]
+        # @return [Hash]
+        def leniency_of(response)
+          headers = response.headers
+          { control_byte_dropped: !headers.include?("X-Ctl"),
+            non_ascii_name_dropped: headers.names.none? { |name| name.b.include?("\xE9".b) },
+            obs_text_kept: headers["X-Obs"] == ["caf\xE9".b], body: response.body_string, }
+        end
+
+        # The registry's rows, `[ids, name, function]`, in the group's order.
+        ROWS = [
+          ["TRANSPORT-24", "a vendor status code with a body is surfaced faithfully",
+           :vendor_status_surfaces_faithfully,],
+          ["TRANSPORT-14", "a control-byte value and a non-ASCII name are dropped while obs-text " \
+                           "and the body survive", :malformed_headers_are_dropped_one_at_a_time,],
+          ["TRANSPORT-14", "a multi-valued Set-Cookie survives as two values",
+           :multi_valued_header_survives,],
+          ["TRANSPORT-27", "a malformed Content-Type and a non-numeric Content-Length still let " \
+                           "the body read", :malformed_type_and_length_downgrade,],
+        ].freeze
+        private_constant :ROWS
+
+        # The registry, built from ROWS.
+        ASSERTIONS = Checks.registry(self, ROWS)
+      end
+      private_constant :Inbound
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/lifecycle.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/lifecycle.rb
new file mode 100644
index 0000000..c36e269
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/lifecycle.rb
@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "../scripts"
+require_relative "checks"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # Group 5, lifecycle, concurrency and the cross-phase test: TRANSPORT-5, TRANSPORT-6,
+      # TRANSPORT-15, TRANSPORT-16, TRANSPORT-29 and phase 7c's PAGE-36. TRANSPORT-12 and
+      # TRANSPORT-13 are NOT here: both are phase 8c's rows, whose antecedent -- a native wire
+      # grammar stricter than the SDK model's -- the first-party sync adapter measures absent in
+      # its own suite; a shared assertion declaring them vacuous would be an adapter-specific
+      # claim in a portable suite (8a's R16), so 8c adds their assertions with its driver. A
+      # private_constant of TransportSuite.
+      module Lifecycle
+        extend self
+
+        # TRANSPORT-5's two per-call budgets, and the bounds each call's elapsed time must sit in.
+        BUDGETS = { 0.2 => (0.15..0.7), 1.0 => (0.9..2.0) }.freeze
+
+        # TRANSPORT-5's clause: "two concurrent calls with different per-call timeouts; assert each
+        # is bounded by its own value" -- against a server that never answers, each call raises
+        # after its own budget and neither waits for the other's.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def concurrent_per_call_timeouts_bound_their_own_calls(kase)
+          kase.wire(script: Scripts.hang_before_headers)
+          transport = kase.transport
+          request = kase.request
+          timings = BUDGETS.keys.map do |seconds|
+            ::Thread.new { timed_settle(kase, transport, request, seconds) }
+          end.map(&:value)
+
+          Checks.check(Checks.within_bands?(timings, BUDGETS.values),
+                       "per-call timeouts did not bound their own calls independently",
+                       ids: ["TRANSPORT-5"], expected: BUDGETS.values, actual: timings,)
+        end
+
+        # TRANSPORT-6, asserted by its observable outcome rather than by its antecedent: a per-call
+        # timeout small enough to truncate to zero on a coarser native API must still bound the
+        # call -- it never becomes "no timeout". A hanging server and a bound of two seconds.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def a_near_zero_timeout_never_becomes_unbounded(kase)
+          kase.wire(script: Scripts.hang_before_headers)
+          error, took = Checks.timed_error do
+            kase.settle(kase.transport, kase.request, Checks.options(timeout: 0.000001))
+          end
+
+          bounded = Checks.retryable_failure?(error) && took < 2.0
+          Checks.check(bounded, "a near-zero timeout did not bound the call",
+                       ids: ["TRANSPORT-6"], expected: "a retryable failure in under two seconds",
+                       actual: [error&.class, took],)
+        end
+
+        # TRANSPORT-15's borrowed half (suite contract 4a): a transport over the caller's own
+        # client is closed, and the caller's client is still usable afterwards, by the adapter's
+        # own probe.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def borrowed_client_survives_the_transports_close(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          pair = kase.borrowed_transport
+          kase.settle(pair.transport, kase.request).close
+          pair.transport.close
+
+          Checks.expect([pair.transport.closed?, pair.transport.owned?, pair.still_usable?],
+                        [true, false, true],
+                        "the borrowed client did not survive the transport's close as usable",
+                        ids: ["TRANSPORT-15"],)
+        end
+
+        # TRANSPORT-15's owned half and TRANSPORT-16: an owning transport closed twice is stable,
+        # reports closed, and refuses a later send with Dexpace::ClosedError (SEAM-15).
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def owned_transport_refuses_a_send_after_close(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          transport = kase.transport
+          transport.close
+          transport.close
+          error = Checks.error_from { kase.settle(transport, kase.request) }
+
+          Checks.expect([transport.closed?, transport.owned?, error.class],
+                        [true, true, Dexpace::ClosedError],
+                        "a send after close on an owning transport did not raise ClosedError",
+                        ids: %w[TRANSPORT-15 TRANSPORT-16],)
+        end
+
+        # TRANSPORT-29's clause: "fire many concurrent calls through one transport and assert each
+        # response matches its own request" -- the assertion that fails against a shared native
+        # client (8a's verified fact 9) and passes against a per-call or serialised one.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def concurrent_calls_each_get_their_own_response(kase)
+          kase.wire(script: Scripts.echo_path)
+          transport = kase.transport
+          mismatches = ::Thread::Queue.new
+          Array.new(8) do |thread_index|
+            ::Thread.new { echo_round_trips(kase, transport, thread_index, mismatches) }
+          end.each(&:join)
+          found = [] #: Array[untyped]
+          found << mismatches.pop until mismatches.empty?
+
+          Checks.expect(found, [], "a response was matched to the wrong request",
+                        ids: ["TRANSPORT-29"],)
+        end
+
+        # PAGE-36 (phase 7c's per-call-options conformance test): the same transport driven twice
+        # in sequence with DIFFERENT RequestOptions honours each -- not TRANSPORT-5's concurrent
+        # pair, and not the same options twice, which would pass against a transport that reads
+        # options once and reuses them for every later page.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def sequential_calls_honour_each_calls_options(kase)
+          kase.wire(script: Scripts.sequenced("page one", "page two"))
+          transport = kase.transport
+          first = kase.settle(transport, kase.request, Checks.options(timeout: 5.0)).body_string
+          second = kase.settle(transport, kase.request,
+                               Checks.options(timeout: 0.5, max_retries: 0),).body_string
+
+          Checks.expect([first, second], ["page one", "page two"],
+                        "the second call did not reach a fresh page under its own options",
+                        ids: ["PAGE-36"],)
+        end
+
+        # The registry's rows, `[ids, name, function]`, in the group's order.
+        ROWS = [
+          ["TRANSPORT-5", "two concurrent calls with different per-call timeouts are each " \
+                          "bounded by their own",
+           :concurrent_per_call_timeouts_bound_their_own_calls,],
+          ["TRANSPORT-6", "a near-zero per-call timeout never becomes an unbounded one",
+           :a_near_zero_timeout_never_becomes_unbounded,],
+          ["TRANSPORT-15", "a borrowed client survives the transport's close and stays usable",
+           :borrowed_client_survives_the_transports_close,],
+          [%w[TRANSPORT-15 TRANSPORT-16], "an owned transport raises ClosedError on a send after " \
+                                          "close, and close is idempotent",
+           :owned_transport_refuses_a_send_after_close,],
+          ["TRANSPORT-29", "many concurrent calls through one transport each get their own " \
+                           "response", :concurrent_calls_each_get_their_own_response,],
+          ["PAGE-36", "the same transport driven twice in sequence honours a different " \
+                      "RequestOptions each time", :sequential_calls_honour_each_calls_options,],
+        ].freeze
+        private_constant :ROWS
+
+        # The registry, built from ROWS.
+        ASSERTIONS = Checks.registry(self, ROWS)
+
+        private
+
+        def timed_settle(kase, transport, request, seconds)
+          Checks.timed_error do
+            kase.settle(transport, request, Checks.options(timeout: seconds))
+          end.last
+        end
+
+        # Every failure is recorded as a mismatch and never raised out of the thread, so the
+        # eight threads are always joined and a broken transport fails the assertion rather than
+        # leaking a thread.
+        def echo_round_trips(kase, transport, thread_index, mismatches)
+          20.times do |index|
+            path = "/#{thread_index}-#{index}"
+            body = kase.settle(transport, kase.request(path: path)).body_string
+            mismatches.push([path, body]) unless body == path
+          rescue ::StandardError => error
+            mismatches.push([path, "#{error.class}: #{error.message}"])
+          end
+        end
+      end
+      private_constant :Lifecycle
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/outbound.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/outbound.rb
new file mode 100644
index 0000000..f2b7be5
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/outbound.rb
@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "../scripts"
+require_relative "checks"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # Group 1, outbound mapping: TRANSPORT-10, TRANSPORT-11, TRANSPORT-26, and the wire-boundary
+      # re-validation phase 1 postponed to every adapter (HTTP-17, HTTP-18, XCUT-18). Every send
+      # goes through `kase.settle` (suite contract clause 8), every header is read back from the
+      # fixture by a FOLDED name (clause 6), and what is asserted is the wire -- a real socket is
+      # the only faithful witness of what left the process. A private_constant of TransportSuite.
+      module Outbound
+        extend self
+
+        # A media type every adapter's native client would otherwise be tempted to stamp on a body
+        # nobody described: it is a claim about the bytes that nobody made (8a's P8-4).
+        FORM = "application/x-www-form-urlencoded"
+
+        # TRANSPORT-10 (a): "body media type X with explicit Content-Type Y -> Y on the wire".
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def explicit_content_type_wins(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          headers = Checks.headers("Content-Type" => "text/plain")
+          request = kase.request(method: "POST", headers: headers,
+                                 body: Checks.bytes_body("{}", media_type: Checks.json),)
+          kase.settle(kase.transport, request).close
+
+          Checks.expect(Checks.last_request(kase, ids: ["TRANSPORT-10"]).header("content-type"),
+                        "text/plain", "the caller's explicit Content-Type was overwritten",
+                        ids: ["TRANSPORT-10"],)
+        end
+
+        # TRANSPORT-10 (b): "same body with no explicit header -> X on the wire".
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def body_media_type_when_caller_set_none(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          body = Checks.bytes_body("{}", media_type: Checks.json)
+          kase.settle(kase.transport, kase.request(method: "POST", body: body)).close
+
+          Checks.expect(Checks.last_request(kase, ids: ["TRANSPORT-10"]).header("content-type"),
+                        "application/json", "the body's media type was not used",
+                        ids: ["TRANSPORT-10"],)
+        end
+
+        # TRANSPORT-10, the case the requirement does not spell out: no explicit header and a body
+        # with no media type. What the wire carries then is the adapter's (8a stamps RFC 9110's
+        # application/octet-stream, asserted in its own suite); what it MUST NOT carry is a form
+        # type nobody asked for, which is what a native client left to itself stamps.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def no_type_is_never_invented_as_a_form(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          kase.settle(kase.transport,
+                      kase.request(method: "POST", body: Checks.bytes_body("raw")),).close
+          sent = Checks.last_request(kase, ids: ["TRANSPORT-10"]).header("content-type")
+
+          Checks.check(sent != FORM, "a body with no media type went out as a form",
+                       ids: ["TRANSPORT-10"], expected: "anything but #{FORM}", actual: sent,)
+        end
+
+        # TRANSPORT-26: a body-less request on a body-permitted method is valid and goes out with
+        # a zero-length body, `Content-Length: 0`.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def body_less_post_is_a_zero_length_body(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          response = kase.settle(kase.transport, kase.request(method: "POST"))
+          status = response.status.code
+          response.close
+          sent = Checks.last_request(kase, ids: ["TRANSPORT-26"])
+
+          Checks.expect(status, 200, "a body-less POST did not succeed", ids: ["TRANSPORT-26"])
+          Checks.expect([sent.header("content-length"), sent.body], ["0", ""],
+                        "a body-less POST was not substituted with a zero-length body",
+                        ids: ["TRANSPORT-26"],)
+        end
+
+        # TRANSPORT-11's own clause: "send a bogus Content-Length/Host plus a pass-through header;
+        # assert the framing headers are recomputed and the pass-through survives". Two checks,
+        # because one passing while the other fails is the interesting outcome.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def framing_recomputed_and_pass_through_kept(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          headers = Checks.headers("Content-Length" => "9999", "Host" => "bogus.example",
+                                   "X-Pass" => "kept",)
+          request = kase.request(method: "POST", body: Checks.bytes_body("abc"), headers: headers)
+          kase.settle(kase.transport, request).close
+          sent = Checks.last_request(kase, ids: ["TRANSPORT-11"])
+
+          Checks.expect([sent.header("content-length"), sent.header("host") == "bogus.example"],
+                        ["3", false], "the framing headers were not recomputed",
+                        ids: ["TRANSPORT-11"],)
+          Checks.expect(sent.header("x-pass"), "kept", "the pass-through header vanished",
+                        ids: ["TRANSPORT-11"],)
+        end
+
+        # HTTP-17 / XCUT-18: a forged request -- one that never met a builder, the hole design
+        # §10.10 admits -- carrying a CRLF in a header NAME is refused before any byte reaches the
+        # socket. The name half is the one with no native backstop on Net::HTTP (8a's verified
+        # fact), which is why it is its own assertion.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def forged_header_name_is_rejected_before_dispatch(kase)
+          refuses_forged_header(kase, "X-Evil\r\nInjected", "v", ids: %w[HTTP-17 XCUT-18])
+        end
+
+        # HTTP-18 / XCUT-18: the same, for a CRLF in a header VALUE.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def forged_header_value_is_rejected_before_dispatch(kase)
+          refuses_forged_header(kase, "X-Evil", "a\r\nInjected: 1", ids: %w[HTTP-18 XCUT-18])
+        end
+
+        # The registry's rows, `[ids, name, function]`, in the group's order.
+        ROWS = [
+          ["TRANSPORT-10", "the caller's explicit Content-Type wins over the body's",
+           :explicit_content_type_wins,],
+          ["TRANSPORT-10", "a body-derived Content-Type is used only when the caller set none",
+           :body_media_type_when_caller_set_none,],
+          ["TRANSPORT-10", "no explicit header and no body media type is never a form type",
+           :no_type_is_never_invented_as_a_form,],
+          ["TRANSPORT-26", "a body-less POST goes out as a zero-length body",
+           :body_less_post_is_a_zero_length_body,],
+          ["TRANSPORT-11", "a bogus Content-Length and Host are recomputed and a pass-through " \
+                           "header survives", :framing_recomputed_and_pass_through_kept,],
+          [%w[HTTP-17 XCUT-18], "wire-boundary re-validation: a forged CRLF header name is " \
+                                "rejected before dispatch",
+           :forged_header_name_is_rejected_before_dispatch,],
+          [%w[HTTP-18 XCUT-18], "wire-boundary re-validation: a forged CRLF header value is " \
+                                "rejected before dispatch",
+           :forged_header_value_is_rejected_before_dispatch,],
+        ].freeze
+        private_constant :ROWS
+
+        # The registry, built from ROWS.
+        ASSERTIONS = Checks.registry(self, ROWS)
+
+        private
+
+        # A request-shaped object answering the four readers the seam contract types nothing about
+        # (SEAM-11), carrying one forged header no Dexpace validation has ever seen. The socket
+        # count is the check that discriminates: Dexpace::Response.build refuses a request that is
+        # not a Dexpace::Request, so an adapter that skipped the re-validation and SENT the bytes
+        # still raises InvalidArgumentError -- after the injected header reached the wire.
+        def refuses_forged_header(kase, name, value, ids:)
+          kase.wire(script: Scripts.fixed("ok"))
+          forged = forged_request(kase.request, name, value)
+          error = Checks.error_from { kase.settle(kase.transport, forged) }
+
+          Checks.check(error.is_a?(Dexpace::InvalidArgumentError),
+                       "a forged CRLF header reached the adapter unrejected",
+                       ids: ids, expected: "Dexpace::InvalidArgumentError", actual: error&.class,)
+          Checks.expect(kase.wire.connections, 0, "the forged request reached the socket", ids: ids)
+        end
+
+        def forged_request(template, name, value)
+          headers = Object.new
+          headers.define_singleton_method(:each_entry) { |&block| block.call(name, value) }
+          forged = Object.new
+          forged.define_singleton_method(:method) { template.method }
+          forged.define_singleton_method(:url) { template.url }
+          forged.define_singleton_method(:headers) { headers }
+          forged.define_singleton_method(:body) { nil }
+          forged
+        end
+      end
+      private_constant :Outbound
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/resilience.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/resilience.rb
new file mode 100644
index 0000000..4c3abc1
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/resilience.rb
@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require_relative "../vacuous"
+require_relative "../scripts"
+require_relative "checks"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # Group 4, retry, cancellation and failure classification: TRANSPORT-1, TRANSPORT-2,
+      # TRANSPORT-3, TRANSPORT-4, TRANSPORT-17, TRANSPORT-18, TRANSPORT-20 and TRANSPORT-22. A
+      # cancellation is asserted as Dexpace::CancelledError out of `kase.settle` (suite contract
+      # clause 5), a failure carrying no response as something answering #retryable? true (the
+      # phase-level Dexpace::TransportError), and every cancellation is fired through the
+      # Dexpace::Cancellation token and never a thread interrupt. A private_constant of
+      # TransportSuite.
+      module Resilience
+        extend self
+
+        # TRANSPORT-1: a raw 302 with a Location comes back as it is and is never followed.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def redirect_is_returned_never_followed(kase)
+          kase.wire(script: Scripts.redirect("http://elsewhere.invalid/"))
+          response = kase.settle(kase.transport, kase.request)
+          seen = [response.status.code, response.headers["Location"], kase.wire.requests.size]
+          response.close
+
+          Checks.expect(seen, [302, ["http://elsewhere.invalid/"], 1], "a redirect was followed",
+                        ids: ["TRANSPORT-1"],)
+        end
+
+        # TRANSPORT-2's clause: "with a single-use body and a first-attempt connection failure,
+        # assert the native client does not silently re-send" -- a COUNT of connections and of
+        # body pulls, not an inference from the error.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def first_attempt_failure_is_not_silently_resent(kase)
+          seen = Checks.dropped_first_attempt(kase)
+
+          Checks.expect(seen, { raised: true, connections: 1, pulls: 1 },
+                        "the failed first attempt was silently retried", ids: ["TRANSPORT-2"],)
+        end
+
+        # TRANSPORT-3: a caller-initiated cancellation while the send is blocked surfaces as the
+        # terminal, non-retryable interrupt -- Dexpace::CancelledError -- and never as the
+        # retryable failure, with the token still reporting cancelled afterwards. The cancel fires
+        # when the SERVER says the client is blocked waiting for the head (the script's hook), on
+        # a second thread, through the token: a blocking Queue#pop, never a sleep and never an
+        # interrupt.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def cancellation_surfaces_as_the_interrupt(kase)
+          source = Dexpace::Cancellation.source
+          canceller = Checks.cancel_when_blocked(kase, source)
+          error = Checks.error_from do
+            kase.settle(kase.transport, kase.request, Dexpace::RequestOptions::EMPTY, source.token)
+          end
+          canceller.join
+
+          Checks.expect([error.class, source.cancelled?], [Dexpace::CancelledError, true],
+                        "the cancellation was swallowed or misclassified", ids: ["TRANSPORT-3"],)
+        end
+
+        # TRANSPORT-4's clause: a read timeout classifies as the RETRYABLE transport failure and
+        # leaves the cancellation flag clear.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def read_timeout_is_retryable_and_sets_no_cancellation(kase)
+          kase.wire(script: Scripts.hang_before_headers)
+          source = Dexpace::Cancellation.source
+          error = Checks.error_from do
+            kase.settle(kase.transport(timeout: 0.2), kase.request, Dexpace::RequestOptions::EMPTY,
+                        source.token,)
+          end
+          seen = [Checks.retryable_failure?(error), error.is_a?(Dexpace::CancelledError),
+                  source.cancelled?,]
+
+          Checks.expect(seen, [true, false, false],
+                        "a read timeout did not classify retryable, or set the cancellation flag",
+                        ids: ["TRANSPORT-4"],)
+        end
+
+        # TRANSPORT-17: a single-use body is written exactly once, and the adapter itself triggers
+        # no second write -- one connection, one request, one pull, the bytes intact.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def single_use_body_is_written_once(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          body, pulls = Checks.single_use_body("payload")
+          kase.settle(kase.transport, kase.request(method: "POST", body: body)).close
+          requests = kase.wire.requests
+
+          Checks.expect([requests.size, pulls.call, requests.last&.body], [1, 1, "payload".b],
+                        "the single-use body was written more than once", ids: ["TRANSPORT-17"],)
+        end
+
+        # TRANSPORT-18 conditions on a native body API that "drives writes through a re-subscribable
+        # producer" on its own retry or redirect. The antecedent is not asserted from a list; it is
+        # MEASURED: a single-use body over a dropped first connection is pulled once and the client
+        # opens one connection, so nothing native re-subscribed, and the requirement holds
+        # vacuously on this adapter. An adapter whose native client did re-send fails here instead
+        # of being recorded vacuous.
+        #
+        # @param kase [TransportCase]
+        # @return [void]
+        # @raise [Vacuous] when the measurement shows the antecedent absent
+        def no_native_resubscription_measured(kase)
+          seen = Checks.dropped_first_attempt(kase)
+
+          Checks.expect([seen[:connections], seen[:pulls]], [1, 1],
+                        "the native client re-subscribed the body producer on its own",
+                        ids: ["TRANSPORT-18"],)
+          raise Vacuous, "the native client opened one connection and pulled the single-use body " \
+                         "once across a dropped first attempt, so no re-subscribable producer is " \
+                         "in play on this adapter (TRANSPORT-18's antecedent is absent)"
+        end
+
+        # TRANSPORT-20: a connection refused surfaces as the canonical retryable transport failure.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def connection_refused_is_the_retryable_failure(kase)
+          request = kase.request # against the fixture's port, which stops listening next
+          kase.wire.close
+          error = Checks.error_from { kase.settle(kase.transport, request) }
+
+          Checks.check(Checks.retryable_failure?(error), "a refused connection was not retryable",
+                       ids: ["TRANSPORT-20"], expected: "a retryable transport failure",
+                       actual: error&.class,)
+        end
+
+        # TRANSPORT-22's observable half from outside the adapter: when the CALLER's own code
+        # fails after a live response arrived and closes it, the connection is released -- the
+        # server, holding the connection, sees the close. The adaptation-failure half is asserted
+        # in the adapter's own suite, where a failure can be injected after the head.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def caller_failure_after_head_releases_the_connection(kase)
+          kase.wire(script: Scripts.fixed("ok", hold: true))
+          response = kase.settle(kase.transport, kase.request)
+          begin
+            raise "caller-injected failure after the head arrived"
+          rescue ::RuntimeError
+            response.close
+          end
+
+          Checks.check_connection_released(kase, ids: ["TRANSPORT-22"],
+                                                 message: "the connection was not released",)
+        end
+
+        # The registry's rows, `[ids, name, function]`, in the group's order.
+        ROWS = [
+          ["TRANSPORT-1", "a raw 302 is returned, never followed",
+           :redirect_is_returned_never_followed,],
+          ["TRANSPORT-2", "a single-use body over a first-attempt connection failure is not " \
+                          "silently re-sent", :first_attempt_failure_is_not_silently_resent,],
+          ["TRANSPORT-3", "a mid-send cancellation surfaces as the interrupt, not the retryable " \
+                          "failure", :cancellation_surfaces_as_the_interrupt,],
+          ["TRANSPORT-4", "a read timeout classifies retryable and leaves no cancellation flag set",
+           :read_timeout_is_retryable_and_sets_no_cancellation,],
+          ["TRANSPORT-17", "a single-use body is written exactly once and never re-written by " \
+                           "the adapter", :single_use_body_is_written_once,],
+          ["TRANSPORT-18", "vacuous by measurement: no native re-subscribable body producer is " \
+                           "in play", :no_native_resubscription_measured,],
+          ["TRANSPORT-20", "a connection refused surfaces as the canonical retryable transport " \
+                           "failure", :connection_refused_is_the_retryable_failure,],
+          ["TRANSPORT-22", "a caller failure after a live response arrived still releases the " \
+                           "connection", :caller_failure_after_head_releases_the_connection,],
+        ].freeze
+        private_constant :ROWS
+
+        # The registry, built from ROWS.
+        ASSERTIONS = Checks.registry(self, ROWS)
+      end
+      private_constant :Resilience
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/streaming.rb b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/streaming.rb
new file mode 100644
index 0000000..87d1a54
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/transport_suite/streaming.rb
@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+require "tempfile"
+require_relative "../scripts"
+require_relative "checks"
+
+module Dexpace
+  module Conformance
+    module TransportSuite
+      # Group 3, streaming and body lifecycle: TRANSPORT-25, TRANSPORT-19 and TRANSPORT-28's two
+      # reachable clauses. A private_constant of TransportSuite.
+      module Streaming
+        extend self
+
+        # TRANSPORT-25's "multi-megabyte": ~5 MiB of a non-uniform pattern, compared byte for byte.
+        LARGE_BYTES = (5 * 1024 * 1024) + 26
+
+        # TRANSPORT-25's clause: "stream a multi-megabyte response and assert byte-exact round-trip;
+        # assert closing returns the connection" -- the second half observed from the server, which
+        # holds the connection until the peer closes it.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def multi_megabyte_body_round_trips_and_close_releases(kase)
+          expected = Scripts.large_body(LARGE_BYTES)
+          kase.wire(script: Scripts.large(LARGE_BYTES, hold: true))
+          response = kase.settle(kase.transport, kase.request)
+          drained = response.body_bytes.to_s # reads the whole stream and closes the response
+
+          Checks.check(drained == expected, "the body did not round-trip byte-exactly",
+                       ids: ["TRANSPORT-25"], expected: "#{expected.bytesize} bytes",
+                       actual: "#{drained.bytesize} bytes",)
+          Checks.check_connection_released(kase, ids: ["TRANSPORT-25"],
+                                                 message: "closing the response did not release " \
+                                                          "the connection",)
+        end
+
+        # TRANSPORT-19: closing an undrained response whose producer is blocked mid-body unblocks
+        # it promptly, and the teardown is idempotent. The server's gap is five seconds, so a close
+        # that waited for the producer would take five seconds and the one-second bound catches it.
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def closing_an_undrained_response_is_prompt_and_idempotent(kase)
+          kase.wire(script: Scripts.dribble("aaaaa", "bbbbb", 5.0))
+          response = kase.settle(kase.transport, kase.request)
+          took = Checks.elapsed do
+            response.close
+            response.close
+          end
+
+          Checks.check(took < 1.0, "closing an undrained, dribbling response blocked",
+                       ids: ["TRANSPORT-19"], expected: "< 1.0 s", actual: took,)
+        end
+
+        # TRANSPORT-28's clause: "upload a file body with a non-zero position and partial count;
+        # assert exactly that byte range reaches the wire" -- and its embedded MUST, the body is
+        # replayable. The file is created with the block-less Tempfile.create: the block form
+        # unlinks the path at block exit, before the request would read it (8a, measured).
+        #
+        # @param kase [TransportCase]
+        # @return [nil]
+        def file_body_window_reaches_the_wire(kase)
+          kase.wire(script: Scripts.fixed("ok"))
+          path = window_file("0123456789")
+          body = Dexpace::Body.file(path, offset: 3, count: 4) # "3456"
+          kase.settle(kase.transport, kase.request(method: "POST", body: body)).close
+          sent = Checks.last_request(kase, ids: ["TRANSPORT-28"])
+
+          Checks.expect([body.replayable?, sent.header("content-length"), sent.body],
+                        [true, "4", "3456".b], "the file body's byte range was not honoured",
+                        ids: ["TRANSPORT-28"],)
+        ensure
+          ::File.unlink(path) if path && ::File.exist?(path)
+        end
+
+        # The registry's rows, `[ids, name, function]`, in the group's order.
+        ROWS = [
+          ["TRANSPORT-25", "a multi-megabyte body round-trips byte-exactly and closing returns " \
+                           "the connection", :multi_megabyte_body_round_trips_and_close_releases,],
+          ["TRANSPORT-19", "closing an undrained response unblocks the producer promptly and " \
+                           "idempotently",
+           :closing_an_undrained_response_is_prompt_and_idempotent,],
+          ["TRANSPORT-28", "a file body with a non-zero position and partial count sends exactly " \
+                           "that range", :file_body_window_reaches_the_wire,],
+        ].freeze
+        private_constant :ROWS
+
+        # The registry, built from ROWS.
+        ASSERTIONS = Checks.registry(self, ROWS)
+
+        private
+
+        def window_file(content)
+          file = ::Tempfile.create("dexpace-conformance")
+          file.write(content)
+          file.close
+          file.path
+        end
+      end
+      private_constant :Streaming
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/vacuous.rb b/gems/dexpace-conformance/lib/dexpace/conformance/vacuous.rb
new file mode 100644
index 0000000..b844917
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/vacuous.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Conformance
+    # Raised from INSIDE an assertion body once it has established that the requirement's own
+    # antecedent is absent for the subject under test -- never a skip decided from a list outside
+    # it, so vacuity is a measurement and not a claim. A class of its own rather than a Failure,
+    # because design §12's MUST-level summary counts requirements that "hold vacuously" apart from
+    # ones that passed, and a Report that folded the two together would be the mechanism by which
+    # that count stops being true. Like Failure, a test result and not a Dexpace::Error (P8-8).
+    class Vacuous < ::StandardError
+      # @return [String] why the antecedent is absent on this subject
+      attr_reader :reason
+
+      # @param reason [String] why the antecedent is absent, which is also the message
+      def initialize(reason)
+        @reason = reason
+        super
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/wire_server.rb b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server.rb
new file mode 100644
index 0000000..b451067
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server.rb
@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "socket"
+require "dexpace/closeable"
+require_relative "scripts"
+require_relative "wire_server/recorded_request"
+require_relative "wire_server/request_reader"
+
+module Dexpace
+  module Conformance
+    # Design §9.3's fixture: a plaintext-only TCPServer bound to 127.0.0.1:0, running one accept
+    # loop on its own thread -- never on the fiber under test (suite contract 10) -- and handing
+    # each connection, on a thread of its own, to a script. It records what a transport put on
+    # the wire (#requests, head and body), how many connections it opened (#connections, so
+    # TRANSPORT-2's "does not silently re-send" is a count and not an inference) and how many it
+    # has finished (#closed_connections, so TRANSPORT-25's "closing returns the connection" is
+    # observed from the server's side, under a script that holds the connection until the peer
+    # closes). P8-9: it speaks no TLS and exercises no connect timeout, and the suite's report
+    # preamble says so.
+    #
+    # Teardown is the whole of the fixture's own XCUT-13 and it is where a fixture written the
+    # obvious way leaks: #close closes the listener (waking a blocked #accept), joins the accept
+    # thread, closes EVERY accepted socket (waking a handler blocked in a read or a wait) and
+    # joins every handler, each join bounded by JOIN_DEADLINE_SECONDS -- the same latch-wake-join
+    # shape the adapter's response pump uses, so the fixture teaches the teardown idiom the code
+    # it tests uses (8a's open question 4). A script therefore never sleeps: it waits on the
+    # socket, which #close can wake.
+    #
+    # `#await_closed_connection` is the one wait every "has the server seen the close?" assertion
+    # uses -- a Queue#pop fed from the handler's ensure, bounded when the caller says so, never a
+    # sleep-poll over #closed_connections, which is load-sensitive and order-dependent
+    # (testing/4ef070df).
+    class WireServer
+      # How long #close waits for the accept thread and each handler (XCUT-13: bounded, never an
+      # unbounded join).
+      JOIN_DEADLINE_SECONDS = 5.0
+
+      private_class_method :new
+
+      # Starts a server on an ephemeral port. With a block, closes it on any exit and returns the
+      # block's value; without one the caller owns #close.
+      #
+      # @param script [#call] the response script, taking `(connection, head_lines)`
+      # @return [WireServer, Object]
+      def self.start(script)
+        server = new(script)
+        return server unless block_given?
+
+        begin
+          yield server
+        ensure
+          server.close
+        end
+      end
+
+      def initialize(script)
+        # Through an untyped local: rbs 4.2's `TCPServer#initialize: (?String host, Integer port)`
+        # reads under Steep as a single optional positional, so the direct two-argument call is
+        # refused by the checker and not by Ruby.
+        server_class = ::TCPServer #: untyped
+        @tcp = server_class.new("127.0.0.1", 0)
+        @port = @tcp.addr[1]
+        @script = script
+        @requests = []
+        @connections = 0
+        @closed_connections = 0
+        @sockets = []
+        @handlers = []
+        @closed_queue = ::Thread::Queue.new
+        @mutex = ::Thread::Mutex.new
+        @closed = false
+        @accept_thread = ::Thread.new { accept_loop }
+      end
+
+      # The ephemeral port the listener bound -- read at construction, so it still answers after
+      # #close: TRANSPORT-20's refused-connection assertion closes the fixture and then sends to it.
+      #
+      # @return [Integer]
+      attr_reader :port
+
+      # @return [Array<RecordedRequest>] every request read so far, in arrival order, a fresh list
+      def requests
+        @mutex.synchronize { @requests.dup }
+      end
+
+      # @return [Integer] connections accepted so far
+      def connections
+        @mutex.synchronize { @connections }
+      end
+
+      # @return [Integer] connections whose handler has finished and closed the socket
+      def closed_connections
+        @mutex.synchronize { @closed_connections }
+      end
+
+      # Blocks until `count` more connections have been finished by their handler, or until
+      # `timeout:` seconds pass with one still open. A Queue#pop, timed or not, never a sleep-poll;
+      # #close closes the queue, so a waiter that outlives the server gets nil rather than
+      # hanging. The suite's assertions pass a bound, so a transport that never releases a
+      # connection fails the assertion instead of hanging the run.
+      #
+      # @param count [Integer]
+      # @param timeout [Integer, Float, nil] the bound in seconds, nil to wait indefinitely
+      # @return [Integer, nil] #closed_connections once every awaited connection finished, or nil
+      #   when the bound elapsed or the server closed first
+      def await_closed_connection(count = 1, timeout: nil)
+        count.times do
+          return nil if @closed_queue.pop(timeout: timeout).nil?
+        end
+        closed_connections
+      end
+
+      # Idempotent and bounded. The latch flips under the mutex and nothing else does; everything
+      # after it is a wake and a bounded join.
+      #
+      # @return [nil]
+      def close
+        first = @mutex.synchronize do
+          if @closed
+            false
+          else
+            @closed = true
+          end
+        end
+        return nil unless first
+
+        Dexpace.close_quietly(@tcp)
+        @accept_thread.join(JOIN_DEADLINE_SECONDS)
+        sockets, handlers = @mutex.synchronize { [@sockets.dup, @handlers.dup] }
+        sockets.each { |socket| Dexpace.close_quietly(socket) }
+        handlers.each { |handler| handler.join(JOIN_DEADLINE_SECONDS) }
+        @closed_queue.close
+        nil
+      end
+
+      private
+
+      def accept_loop
+        loop do
+          conn = @tcp.accept
+          handler = ::Thread.new(conn) { |socket| handle(socket) }
+          admitted = @mutex.synchronize do
+            @connections += 1
+            @sockets << conn
+            @handlers << handler
+            !@closed
+          end
+          next if admitted
+
+          # Accepted in the window between the latch and the listener's close: it is tracked and
+          # will be closed and joined by #close's own pass, which took its snapshot after this
+          # thread ended, so nothing is stranded.
+          Dexpace.close_quietly(conn)
+        end
+      rescue ::IOError, ::Errno::EBADF
+        nil # the listener was closed from #close; this thread's job is done
+      end
+
+      def handle(conn)
+        request = RequestReader.read(conn)
+        return if request.nil?
+
+        @mutex.synchronize { @requests << request }
+        @script.call(conn, request.head)
+      rescue ::StandardError
+        nil # a script that raises must not crash the accept loop or strand another connection
+      ensure
+        @mutex.synchronize { @closed_connections += 1 }
+        Dexpace.close_quietly(conn)
+        begin
+          @closed_queue.push(true)
+        rescue ::ClosedQueueError
+          nil # the server closed first; nobody is waiting
+        end
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/recorded_request.rb b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/recorded_request.rb
new file mode 100644
index 0000000..ebbd250
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/recorded_request.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/model"
+
+module Dexpace
+  module Conformance
+    class WireServer
+      # One request as it reached the wire: the head (the request line and the header lines, raw,
+      # BINARY, each still ending in CRLF) and the body the server read under its Content-Length
+      # or chunked framing (BINARY, empty when there was none). A phase-1-shaped value: `.new`
+      # private, a validating `.build`, frozen, its collections owned.
+      class RecordedRequest < Data.define(:head, :body)
+        include Model
+
+        private_class_method :new
+
+        # @param head [Array<String>] the raw head lines
+        # @param body [String] the body bytes
+        # @return [RecordedRequest] frozen
+        def self.build(head:, body:)
+          new(head: head, body: body)
+        end
+
+        def initialize(head:, body:)
+          super(head: Model.own(Model.required!("head", head).map(&:b)),
+                body: Model.required!("body", body).b.freeze,)
+        end
+
+        # The request line without its CRLF, e.g. `GET /pets/7 HTTP/1.1`.
+        #
+        # @return [String]
+        def request_line
+          head.first.to_s.chomp
+        end
+
+        # The request target, the second word of the request line.
+        #
+        # @return [String]
+        def path
+          request_line.split[1].to_s
+        end
+
+        # The first value of a header, looked up by a fold of the name (the bare `downcase`, never
+        # a locale one), or nil. Net::HTTP re-cases every name on the wire (8a's verified fact 11),
+        # which is why no assertion reads a header by its exact spelling.
+        #
+        # @param name [String]
+        # @return [String, nil]
+        def header(name)
+          prefix = "#{name.downcase}:"
+          line = head.drop(1).find { |candidate| candidate.downcase.start_with?(prefix) }
+          return nil if line.nil?
+
+          line.split(":", 2).last.to_s.strip
+        end
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
new file mode 100644
index 0000000..52dcc45
--- /dev/null
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "recorded_request"
+
+module Dexpace
+  module Conformance
+    class WireServer
+      # Reads one HTTP/1.1 request off an accepted socket: the head line by line up to the blank
+      # line, then the body under the framing the head declares -- the exact count under
+      # Content-Length, the de-chunked bytes under Transfer-Encoding: chunked, nothing otherwise --
+      # so an upload is observable byte for byte. A private_constant of WireServer.
+      module RequestReader
+        extend self
+
+        # @param conn [Object] the accepted socket
+        # @return [RecordedRequest, nil] nil when the peer sent nothing
+        def read(conn)
+          head = [] #: Array[String]
+          while (line = conn.gets)
+            head << line
+            break if line == "\r\n"
+          end
+          return nil if head.empty?
+
+          RecordedRequest.build(head: head, body: read_body(conn, head))
+        end
+
+        private
+
+        def read_body(conn, head)
+          length = header_value(head, "content-length")
+          return read_exactly(conn, length.to_i) if length&.match?(/\A[0-9]+\z/)
+
+          encoding = header_value(head, "transfer-encoding")
+          return read_chunked(conn) if encoding&.downcase&.include?("chunked")
+
+          (+"").b
+        end
+
+        def header_value(head, folded)
+          line = head.find { |candidate| candidate.downcase.start_with?("#{folded}:") }
+          return nil if line.nil?
+
+          line.split(":", 2).last.to_s.strip
+        end
+
+        def read_exactly(conn, count)
+          return (+"").b if count.zero?
+
+          (conn.read(count) || "").b
+        end
+
+        def read_chunked(conn)
+          body = (+"").b
+          loop do
+            size_line = conn.gets
+            break if size_line.nil?
+
+            size = size_line.strip.split(";").first.to_i(16)
+            break if size.zero?
+
+            body << (conn.read(size) || "").b
+            conn.read(2) # the chunk's CRLF
+          end
+          # The trailer section, up to and including the blank line.
+          while (line = conn.gets)
+            break if line == "\r\n"
+          end
+          body
+        end
+      end
+      private_constant :RequestReader
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/allocations.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/allocations.rbs
new file mode 100644
index 0000000..87612f8
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/allocations.rbs
@@ -0,0 +1,16 @@
+module Dexpace
+  module Conformance
+    # OBS-25's per-call allocation measurement, two loops agreeing twice (5b's R8).
+    module Allocations
+      ATTEMPTS: Integer
+      # A private_constant with no visibility in RBS.
+      WARMUP_ITERATIONS: Integer
+
+      def self?.delta: (iterations: Integer) { () -> untyped } -> Float
+
+      private
+
+      def measure: (Integer iterations) { () -> untyped } -> Float
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/assertion.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/assertion.rbs
new file mode 100644
index 0000000..85d9799
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/assertion.rbs
@@ -0,0 +1,20 @@
+module Dexpace
+  module Conformance
+    # One conformance check as a value; the body is typed against no named interface because a
+    # subject is whatever suite the assertion belongs to.
+    class Assertion < Data
+      include Dexpace::Model
+
+      attr_reader ids: Array[String]
+      attr_reader name: String
+      attr_reader body: ^(untyped) -> void
+
+      private def self.new: (ids: untyped, name: String, body: untyped) -> instance
+      def initialize: (ids: untyped, name: String, body: untyped) -> void
+
+      def self.build: (ids: untyped, name: String, body: untyped) -> Assertion
+
+      def call: (untyped subject) -> untyped
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/borrowed_pair.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/borrowed_pair.rbs
new file mode 100644
index 0000000..d052432
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/borrowed_pair.rbs
@@ -0,0 +1,18 @@
+module Dexpace
+  module Conformance
+    # Suite contract 4a: the borrowing transport and the adapter's own "still usable?" probe.
+    class BorrowedPair < Data
+      include Dexpace::Model
+
+      attr_reader transport: untyped
+      attr_reader probe: untyped
+
+      private def self.new: (transport: untyped, probe: untyped) -> instance
+      def initialize: (transport: untyped, probe: untyped) -> void
+
+      def self.build: (transport: untyped, probe: untyped) -> BorrowedPair
+
+      def still_usable?: () -> bool
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/failure.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/failure.rbs
new file mode 100644
index 0000000..e45a0c4
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/failure.rbs
@@ -0,0 +1,13 @@
+module Dexpace
+  module Conformance
+    # Design §9.3's assertion failure: a test result, never a Dexpace::Error (P8-8).
+    class Failure < ::StandardError
+      attr_reader expected: untyped
+      attr_reader actual: untyped
+      attr_reader requirement_ids: Array[String]
+
+      def initialize: (String message, expected: untyped, actual: untyped,
+                       requirement_ids: Array[String]) -> void
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/minitest_driver.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/minitest_driver.rbs
new file mode 100644
index 0000000..a36d3b9
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/minitest_driver.rbs
@@ -0,0 +1,15 @@
+module Dexpace
+  module Conformance
+    # The thin Minitest driver: extended into a consumer's test class, whose `define_method`,
+    # `skip` and `flunk` it reaches as an extension -- so the receiver is typed as the Module.
+    module MinitestDriver : Module
+      def conformance: (untyped suite, build: untyped, ?borrow: untyped, ?waive: Array[String],
+                        ?settle: untyped, ?around: untyped, ?wire: untyped) -> void
+
+      def self.method_name_for: (Assertion assertion) -> String
+      def self.drive: (untyped test, Assertion assertion, untyped around,
+                       Hash[Symbol, untyped] case_options, waive: Array[String]) -> void
+      def self.build_case: (Hash[Symbol, untyped] case_options) -> TransportCase
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/recording_span.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/recording_span.rbs
new file mode 100644
index 0000000..12e2f0c
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/recording_span.rbs
@@ -0,0 +1,23 @@
+module Dexpace
+  module Conformance
+    # OBS-21's recording span double, over phase 5c's _Span protocol.
+    class RecordingSpan
+      @recording: bool
+
+      attr_reader attributes: Hash[String, untyped]
+      attr_reader events: Array[Hash[Symbol, untyped]]
+      attr_reader errors: Array[Hash[Symbol, untyped]]
+      attr_reader status: untyped
+      attr_reader finished_at: Array[Time]
+      attr_reader context: untyped
+
+      def initialize: (?recording: bool, ?context: untyped) -> void
+      def recording?: () -> bool
+      def set_attribute: (String key, untyped value) -> self
+      def add_event: (String name, ?attributes: Hash[String, untyped]?) -> self
+      def record_error: (Exception error, ?attributes: Hash[String, untyped]?) -> self
+      def status=: (untyped status) -> untyped
+      def finish: (?end_timestamp: Time?) -> nil
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/report.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/report.rbs
new file mode 100644
index 0000000..72b29b7
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/report.rbs
@@ -0,0 +1,29 @@
+module Dexpace
+  module Conformance
+    # A frozen list of Results with the one renderer this phase ships; the waived IDs and the
+    # suite's preamble print on every run (design §9.3, P8-9).
+    class Report
+      @results: Array[Result]
+      @preamble: String?
+
+      attr_reader results: Array[Result]
+      attr_reader preamble: String?
+
+      def initialize: (untyped results, ?preamble: String?) -> void
+      def passed?: () -> bool
+      def failures: () -> Array[Result]
+      def vacuous: () -> Array[Result]
+      def waived: () -> Array[Result]
+      def errors: () -> Array[Result]
+      def to_s: () -> String
+
+      private
+
+      def by_status: (Symbol status) -> Array[Result]
+      def counts_line: () -> String
+      def waived_lines: () -> Array[String]
+      def detail_lines: () -> Array[String]
+      def ids: (Result result) -> String
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/result.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/result.rbs
new file mode 100644
index 0000000..2616464
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/result.rbs
@@ -0,0 +1,19 @@
+module Dexpace
+  module Conformance
+    # One assertion's outcome, in exactly five statuses (design §12).
+    class Result < Data
+      include Dexpace::Model
+
+      STATUSES: Array[Symbol]
+
+      attr_reader assertion: Assertion
+      attr_reader status: Symbol
+      attr_reader detail: String?
+
+      private def self.new: (assertion: Assertion, status: Symbol, detail: String?) -> instance
+      def initialize: (assertion: Assertion, status: Symbol, ?detail: String?) -> void
+
+      def self.build: (assertion: Assertion, status: Symbol, ?detail: String?) -> Result
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/rspec_driver.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/rspec_driver.rbs
new file mode 100644
index 0000000..36b3480
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/rspec_driver.rbs
@@ -0,0 +1,13 @@
+module Dexpace
+  module Conformance
+    # The thin RSpec driver, opted into by requiring its file; `::RSpec` is resolved at call time
+    # and named in no signature (NFR-11).
+    module RSpecDriver
+      def self.conformance: (untyped suite, build: untyped, ?borrow: untyped,
+                             ?waive: Array[String], ?settle: untyped, ?around: untyped,
+                             ?wire: untyped) -> void
+      def self.drive: (Assertion assertion, untyped example, waive: Array[String], build: untyped,
+                       borrow: untyped, settle: untyped, around: untyped, wire: untyped) -> void
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/scripts.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/scripts.rbs
new file mode 100644
index 0000000..3712a5d
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/scripts.rbs
@@ -0,0 +1,34 @@
+module Dexpace
+  module Conformance
+    # The named response scripts a WireServer runs; each returns a callable taking the accepted
+    # socket (untyped: a TCPSocket, which NFR-11 keeps out of a public signature) and the head.
+    module Scripts
+      def self?.fixed: (String body, ?status: String, ?headers: Hash[String, String], ?hold: bool)
+                     -> ^(untyped, Array[String]) -> void
+      def self?.large: (Integer byte_count, ?hold: bool) -> ^(untyped, Array[String]) -> void
+      def self?.large_body: (Integer byte_count) -> String
+      def self?.dribble: (String first, String second, Numeric delay_seconds)
+                       -> ^(untyped, Array[String]) -> void
+      def self?.redirect: (String to) -> ^(untyped, Array[String]) -> void
+      def self?.vendor_status: (Integer code, String body) -> ^(untyped, Array[String]) -> void
+      def self?.malformed_headers: () -> ^(untyped, Array[String]) -> void
+      def self?.malformed_content_length: () -> ^(untyped, Array[String]) -> void
+      def self?.hang_before_headers: (?on_request_read: (^() -> void)?)
+                                   -> ^(untyped, Array[String]) -> void
+      def self?.hang_after_headers: (?on_headers_written: (^() -> void)?)
+                                  -> ^(untyped, Array[String]) -> void
+      def self?.fail_first_connection_then_succeed: (String body) -> ^(untyped, Array[String]) -> void
+      def self?.truncated: (declared_length: Integer, actual_body: String)
+                         -> ^(untyped, Array[String]) -> void
+      def self?.sequenced: (*String bodies) -> ^(untyped, Array[String]) -> void
+      def self?.echo_path: () -> ^(untyped, Array[String]) -> void
+      def self?.write_response: (untyped conn, ?status: String, ?headers: Hash[String, String],
+                                 ?body: String) -> nil
+
+      private
+
+      def chunk: (String bytes) -> String
+      def drain_until_closed: (untyped conn) -> nil
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_case.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_case.rbs
new file mode 100644
index 0000000..e7c4c5a
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_case.rbs
@@ -0,0 +1,61 @@
+module Dexpace
+  module Conformance
+    # Suite contract 11: a fixture is whatever answers this -- WireServer's own surface -- so 8c's
+    # HTTP/2 server can stand in for it without this gem naming an async constant (NFR-11).
+    interface _Wire
+      def port: () -> Integer
+      def requests: () -> Array[untyped]
+      def connections: () -> Integer
+      def closed_connections: () -> Integer
+      def await_closed_connection: (?Integer count, ?timeout: (Integer | Float)?) -> Integer?
+      def close: () -> nil
+    end
+
+    # What an assertion receives. No `_Transport` is declared here: phase 2's `Dexpace::_Transport`
+    # in core's sig/ is the seam's one named shape. #transport is `untyped` because it returns the
+    # clause-8 guard and because clause 1 admits a transport whose #call returns a Future; the
+    # `-> Dexpace::Response` lives on #settle, where the suite depends on it.
+    class TransportCase
+      DEFAULT_SETTLE: ^(untyped, Dexpace::Request, Dexpace::RequestOptions, Dexpace::Cancellation)
+                      -> Dexpace::Response
+      DEFAULT_WIRE: ^(untyped) -> _Wire
+
+      @build: untyped
+      @borrow: untyped
+      @settle: untyped
+      @wire_factory: untyped
+      @transports: Array[untyped]
+      @wire: untyped
+
+      def initialize: (build: untyped, ?borrow: untyped, ?settle: untyped, ?wire: untyped) -> void
+      def transport: (?timeout: Numeric?, ?logger: untyped) -> untyped
+      def settle: (untyped transport, Dexpace::Request request, ?Dexpace::RequestOptions options,
+                   ?Dexpace::Cancellation cancellation) -> Dexpace::Response
+      def borrowed_transport: () -> BorrowedPair
+      def wire: (?script: untyped) -> untyped
+      def request: (?path: String, ?method: String, ?headers: Dexpace::Headers,
+                    ?body: Dexpace::Body?) -> Dexpace::Request
+      def teardown: () -> nil
+
+      private
+
+      def track: (untyped built) -> untyped
+
+      # A private_constant, declared because the conformance Steep target checks lib/; RBS has no
+      # visibility for a constant, so the privacy lives in transport_case.rb alone.
+      class SettleOnly
+        @subject: untyped
+
+        def self.unwrap: (untyped object) -> untyped
+        def initialize: (untyped subject) -> void
+        def __subject__: () -> untyped
+        def call: (*untyped) -> bot
+        def respond_to_missing?: (Symbol name, ?bool include_private) -> bool
+
+        private
+
+        def method_missing: (Symbol name, *untyped args, **untyped kwargs) { (*untyped) -> untyped } -> untyped
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite.rbs
new file mode 100644
index 0000000..5742da9
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite.rbs
@@ -0,0 +1,21 @@
+module Dexpace
+  module Conformance
+    # The transport suite's runner (8a's R7, R16). `build:` and `borrow:` are untyped callables:
+    # a factory is whatever the driver hands in, and naming a type would be `Proc` or a shape the
+    # runtime check does not have.
+    module TransportSuite
+      PREAMBLE: String
+      # A private_constant with no visibility in RBS; the five groups, concatenated.
+      ASSERTIONS: Array[Assertion]
+
+      def self?.assertions: () -> Array[Assertion]
+      def self?.run: (build: untyped, ?borrow: untyped, ?waive: Array[String], ?around: untyped,
+                      ?settle: untyped, ?wire: untyped, ?assertions: Array[Assertion]) -> Report
+
+      private
+
+      def run_one: (Assertion assertion, build: untyped, borrow: untyped, around: untyped,
+                    settle: untyped, wire: untyped) -> Result
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/checks.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/checks.rbs
new file mode 100644
index 0000000..cad8c7e
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/checks.rbs
@@ -0,0 +1,33 @@
+# Dexpace::Conformance::TransportSuite::Checks is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/ and needs
+# the helpers declared to type the five assertion groups. RBS has no visibility for a constant, so
+# the privacy lives in lib/dexpace/conformance/transport_suite/checks.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Checks
+        CLOSE_WAIT_SECONDS: Float
+
+        def self?.check: (untyped condition, String message, ids: Array[String], expected: untyped,
+                          actual: untyped) -> nil
+        def self?.expect: (untyped seen, untyped expected, String message, ids: Array[String]) -> nil
+        def self?.retryable_failure?: (untyped error) -> bool
+        def self?.registry: (Module group, Array[[untyped, String, Symbol]] rows) -> Array[Assertion]
+        def self?.headers: (Hash[String, String] pairs) -> Dexpace::Headers
+        def self?.json: () -> Dexpace::MediaType
+        def self?.bytes_body: (String string, ?media_type: Dexpace::MediaType?) -> Dexpace::BytesBody
+        def self?.single_use_body: (String payload) -> [Dexpace::Body, ^() -> Integer]
+        def self?.options: (?timeout: Numeric?, ?max_retries: Integer?) -> Dexpace::RequestOptions
+        def self?.last_request: (TransportCase kase, ids: Array[String]) -> untyped
+        def self?.check_connection_released: (TransportCase kase, ids: Array[String], message: String) -> nil
+        def self?.error_from: () { () -> untyped } -> StandardError?
+        def self?.within_bands?: (Array[Float] timings, Array[Range[Float]] bands) -> bool
+        def self?.timed_error: () { () -> untyped } -> [StandardError?, Float]
+        def self?.cancel_when_blocked: (TransportCase kase, Dexpace::Cancellation::Source source) -> Thread
+        def self?.dropped_first_attempt: (TransportCase kase) -> Hash[Symbol, untyped]
+        def self?.elapsed: () { () -> untyped } -> Float
+        def self?.monotonic: () -> Float
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/inbound.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/inbound.rbs
new file mode 100644
index 0000000..4598dc2
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/inbound.rbs
@@ -0,0 +1,20 @@
+# Dexpace::Conformance::TransportSuite::Inbound is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in inbound.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Inbound
+        LENIENT: Hash[Symbol, untyped]
+        ROWS: Array[[untyped, String, Symbol]]
+        ASSERTIONS: Array[Assertion]
+
+        def self?.vendor_status_surfaces_faithfully: (TransportCase kase) -> nil
+        def self?.malformed_headers_are_dropped_one_at_a_time: (TransportCase kase) -> nil
+        def self?.multi_valued_header_survives: (TransportCase kase) -> nil
+        def self?.malformed_type_and_length_downgrade: (TransportCase kase) -> nil
+        def self?.leniency_of: (Dexpace::Response response) -> Hash[Symbol, untyped]
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/lifecycle.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/lifecycle.rbs
new file mode 100644
index 0000000..9350b45
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/lifecycle.rbs
@@ -0,0 +1,28 @@
+# Dexpace::Conformance::TransportSuite::Lifecycle is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in lifecycle.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Lifecycle
+        BUDGETS: Hash[Float, Range[Float]]
+        ROWS: Array[[untyped, String, Symbol]]
+        ASSERTIONS: Array[Assertion]
+
+        def self?.concurrent_per_call_timeouts_bound_their_own_calls: (TransportCase kase) -> nil
+        def self?.a_near_zero_timeout_never_becomes_unbounded: (TransportCase kase) -> nil
+        def self?.borrowed_client_survives_the_transports_close: (TransportCase kase) -> nil
+        def self?.owned_transport_refuses_a_send_after_close: (TransportCase kase) -> nil
+        def self?.concurrent_calls_each_get_their_own_response: (TransportCase kase) -> nil
+        def self?.sequential_calls_honour_each_calls_options: (TransportCase kase) -> nil
+
+        private
+
+        def timed_settle: (TransportCase kase, untyped transport, Dexpace::Request request,
+                           Float seconds) -> Float
+        def echo_round_trips: (TransportCase kase, untyped transport, Integer thread_index,
+                               Thread::Queue mismatches) -> void
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/outbound.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/outbound.rbs
new file mode 100644
index 0000000..6060d68
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/outbound.rbs
@@ -0,0 +1,28 @@
+# Dexpace::Conformance::TransportSuite::Outbound is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in outbound.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Outbound
+        FORM: String
+        ROWS: Array[[untyped, String, Symbol]]
+        ASSERTIONS: Array[Assertion]
+
+        def self?.explicit_content_type_wins: (TransportCase kase) -> nil
+        def self?.body_media_type_when_caller_set_none: (TransportCase kase) -> nil
+        def self?.no_type_is_never_invented_as_a_form: (TransportCase kase) -> nil
+        def self?.body_less_post_is_a_zero_length_body: (TransportCase kase) -> nil
+        def self?.framing_recomputed_and_pass_through_kept: (TransportCase kase) -> nil
+        def self?.forged_header_name_is_rejected_before_dispatch: (TransportCase kase) -> nil
+        def self?.forged_header_value_is_rejected_before_dispatch: (TransportCase kase) -> nil
+
+        private
+
+        def refuses_forged_header: (TransportCase kase, String name, String value,
+                                    ids: Array[String]) -> nil
+        def forged_request: (Dexpace::Request template, String name, String value) -> untyped
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/resilience.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/resilience.rbs
new file mode 100644
index 0000000..ad22dc0
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/resilience.rbs
@@ -0,0 +1,22 @@
+# Dexpace::Conformance::TransportSuite::Resilience is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in resilience.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Resilience
+        ROWS: Array[[untyped, String, Symbol]]
+        ASSERTIONS: Array[Assertion]
+
+        def self?.redirect_is_returned_never_followed: (TransportCase kase) -> nil
+        def self?.first_attempt_failure_is_not_silently_resent: (TransportCase kase) -> nil
+        def self?.cancellation_surfaces_as_the_interrupt: (TransportCase kase) -> nil
+        def self?.read_timeout_is_retryable_and_sets_no_cancellation: (TransportCase kase) -> nil
+        def self?.single_use_body_is_written_once: (TransportCase kase) -> nil
+        def self?.no_native_resubscription_measured: (TransportCase kase) -> bot
+        def self?.connection_refused_is_the_retryable_failure: (TransportCase kase) -> nil
+        def self?.caller_failure_after_head_releases_the_connection: (TransportCase kase) -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/streaming.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/streaming.rbs
new file mode 100644
index 0000000..3490a2d
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/transport_suite/streaming.rbs
@@ -0,0 +1,22 @@
+# Dexpace::Conformance::TransportSuite::Streaming is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in streaming.rb alone.
+module Dexpace
+  module Conformance
+    module TransportSuite
+      module Streaming
+        LARGE_BYTES: Integer
+        ROWS: Array[[untyped, String, Symbol]]
+        ASSERTIONS: Array[Assertion]
+
+        def self?.multi_megabyte_body_round_trips_and_close_releases: (TransportCase kase) -> nil
+        def self?.closing_an_undrained_response_is_prompt_and_idempotent: (TransportCase kase) -> nil
+        def self?.file_body_window_reaches_the_wire: (TransportCase kase) -> nil
+
+        private
+
+        def window_file: (String content) -> String
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/vacuous.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/vacuous.rbs
new file mode 100644
index 0000000..253cfca
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/vacuous.rbs
@@ -0,0 +1,10 @@
+module Dexpace
+  module Conformance
+    # Raised from inside an assertion whose antecedent is absent on the subject (design §12).
+    class Vacuous < ::StandardError
+      attr_reader reason: String
+
+      def initialize: (String reason) -> void
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/wire_server.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server.rbs
new file mode 100644
index 0000000..5a6f7d3
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server.rbs
@@ -0,0 +1,41 @@
+module Dexpace
+  module Conformance
+    # Design §9.3's plaintext TCPServer fixture. The listener, the sockets and the accepted
+    # connections are `untyped`: TCPServer and TCPSocket are constants outside Dexpace:: and the
+    # stdlib allowlist NFR-11's scan admits, and nothing public needs their type.
+    class WireServer
+      JOIN_DEADLINE_SECONDS: Float
+
+      @tcp: untyped
+      @port: Integer
+      @script: ^(untyped, Array[String]) -> void
+      @requests: Array[RecordedRequest]
+      @connections: Integer
+      @closed_connections: Integer
+      @sockets: Array[untyped]
+      @handlers: Array[Thread]
+      @closed_queue: Thread::Queue
+      @mutex: Thread::Mutex
+      @closed: bool
+      @accept_thread: Thread
+
+      private def self.new: (untyped script) -> instance
+      def initialize: (untyped script) -> void
+
+      def self.start: (untyped script) -> WireServer
+                    | [T] (untyped script) { (WireServer) -> T } -> T
+
+      attr_reader port: Integer
+      def requests: () -> Array[RecordedRequest]
+      def connections: () -> Integer
+      def closed_connections: () -> Integer
+      def await_closed_connection: (?Integer count, ?timeout: (Integer | Float)?) -> Integer?
+      def close: () -> nil
+
+      private
+
+      def accept_loop: () -> void
+      def handle: (untyped conn) -> void
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/recorded_request.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/recorded_request.rbs
new file mode 100644
index 0000000..d3aad5a
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/recorded_request.rbs
@@ -0,0 +1,22 @@
+module Dexpace
+  module Conformance
+    class WireServer
+      # One request as it reached the wire: raw head lines and the de-framed body.
+      class RecordedRequest < Data
+        include Dexpace::Model
+
+        attr_reader head: Array[String]
+        attr_reader body: String
+
+        private def self.new: (head: Array[String], body: String) -> instance
+        def initialize: (head: Array[String], body: String) -> void
+
+        def self.build: (head: Array[String], body: String) -> RecordedRequest
+
+        def request_line: () -> String
+        def path: () -> String
+        def header: (String name) -> String?
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
new file mode 100644
index 0000000..7dccded
--- /dev/null
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
@@ -0,0 +1,19 @@
+# Dexpace::Conformance::WireServer::RequestReader is a private_constant and not public API: this
+# declaration exists because the conformance Steep target checks every file under lib/. RBS has no
+# visibility for a constant, so the privacy lives in request_reader.rb alone.
+module Dexpace
+  module Conformance
+    class WireServer
+      module RequestReader
+        def self?.read: (untyped conn) -> RecordedRequest?
+
+        private
+
+        def read_body: (untyped conn, Array[String] head) -> String
+        def header_value: (Array[String] head, String folded) -> String?
+        def read_exactly: (untyped conn, Integer count) -> String
+        def read_chunked: (untyped conn) -> String
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance_test.rb b/gems/dexpace-conformance/test/dexpace/conformance_test.rb
index 0521fa1..1b5a512 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance_test.rb
@@ -8,12 +8,35 @@
 class ConformanceTest < DexpaceTestCase
   # The top-level namespace is snapshotted around the require, so "defines nothing outside
   # Dexpace" holds whether this file loads alone or after the other five gems in one
-  # `rake test:gems` process, where Dexpace already exists.
+  # `rake test:gems` process, where Dexpace already exists. `socket` -- the one stdlib feature this
+  # gem's lib/ requires beyond core's own, for the wire server, and permitted to this gem alone by
+  # the allowlist's scoped denial (P8-14) -- and `tempfile` (TRANSPORT-28) are loaded first, the
+  # way core's smoke suite preloads `digest`: the ten top-level constants `socket` defines
+  # (Addrinfo, BasicSocket, IPSocket, Socket, SocketError, TCPServer, TCPSocket, UDPSocket,
+  # UNIXServer, UNIXSocket -- measured identically on 3.2.11, 3.3.12, 3.4.10 and 4.0.6) and
+  # Tempfile are theirs, not the entry file's; and so is core's whole tree, which the entry file
+  # requires as a consumer would.
+  require "socket"
+  require "tempfile"
+  require "dexpace"
   TOP_LEVEL_BEFORE = Object.constants
   NAMESPACE_BEFORE = defined?(Dexpace) ? Dexpace.constants(false) : []
   require "dexpace/conformance"
   TOP_LEVEL_ADDED = (Object.constants - TOP_LEVEL_BEFORE).freeze
   NAMESPACE_ADDED = (Dexpace.constants(false) - NAMESPACE_BEFORE).freeze
+  # Captured at load, before any test runs: rspec_driver_test.rb requires the RSpec driver inside
+  # its own test bodies, so a read at test time would depend on the random order.
+  ENTRY_FILE_DEFINES = Dexpace::Conformance.constants(false).sort.freeze
+
+  # The public surface phase 8a built into the skeleton (design, "The object model 8a ships"),
+  # exactly: the five protocol types, the fixture and its scripts, the case, the suite, the
+  # Minitest driver, the two observability doubles and the borrowed pair. RSpecDriver is defined
+  # by a file the entry point deliberately does NOT require (an RSpec-only consumer opts in), so
+  # it is absent here and its own test loads it.
+  PUBLIC = %i[
+    VERSION Failure Vacuous Assertion Result Report Scripts WireServer BorrowedPair TransportCase
+    TransportSuite MinitestDriver RecordingSpan Allocations
+  ].freeze
 
   test "defines a semver VERSION string" do
     assert_match(/\A\d+\.\d+\.\d+\z/, Dexpace::Conformance::VERSION)
@@ -26,9 +49,16 @@ class ConformanceTest < DexpaceTestCase
     assert_equal(spec.version.to_s, Dexpace::Conformance::VERSION)
   end
 
-  test "defines nothing outside the Dexpace namespace" do
+  test "defines nothing outside the Dexpace namespace, and exactly its own constants inside it" do
     assert_empty(TOP_LEVEL_ADDED - [:Dexpace], "top-level constants added by the entry file")
     assert_empty(NAMESPACE_ADDED - %i[Conformance], "constants added directly under Dexpace")
-    assert_equal(%i[VERSION], Dexpace::Conformance.constants(false).sort)
+    assert_equal(PUBLIC.sort, ENTRY_FILE_DEFINES)
+  end
+
+  test "declares dexpace-core and nothing else, by design" do
+    gemspec = File.expand_path("../../dexpace-conformance.gemspec", __dir__)
+    spec = Gem::Specification.load(gemspec)
+
+    assert_equal(["dexpace-core"], spec.runtime_dependencies.map(&:name))
   end
 end
diff --git a/gems/dexpace-conformance/test/test_helper.rb b/gems/dexpace-conformance/test/test_helper.rb
index f67df15..40c49a0 100644
--- a/gems/dexpace-conformance/test/test_helper.rb
+++ b/gems/dexpace-conformance/test/test_helper.rb
@@ -7,3 +7,6 @@
 # own test support, which is not the cross-gem require_relative styleguide 12.6 forbids -- that
 # rule is about reaching into another *gem's* internals.
 require_relative "../../../test/support/dexpace_test_case"
+# The one connection that parks net-http's Timeout thread outside every test's thread count on
+# the rows whose net-http still connects through Timeout.timeout (see the file).
+require_relative "../../../test/support/net_http_warmup"
diff --git a/gems/dexpace-core/lib/dexpace.rb b/gems/dexpace-core/lib/dexpace.rb
index 1044305..e74fde9 100644
--- a/gems/dexpace-core/lib/dexpace.rb
+++ b/gems/dexpace-core/lib/dexpace.rb
@@ -328,6 +328,14 @@
 require_relative "dexpace/serde/decoding_handler"
 require_relative "dexpace/serde/status_aware_handler"
 
+# Phase 8a: the one core file phase 8 adds -- the phase-level task the charter owns to no
+# sub-phase. Dexpace::TransportError is the always-retryable failure both transport adapters wrap
+# a bare stdlib I/O or timeout error into (TRANSPORT-20, XCUT-4 branch (b), P6-4), filed under
+# error/ beside its sibling StreamError. Configuration::Keys::REQUEST_TIMEOUT and
+# Instrumentation::Events::TRANSPORT_HEADER_DROPPED land in the files already loaded above; neither
+# is a new file.
+require_relative "dexpace/error/transport_error"
+
 # The dexpace Ruby SDK: an HTTP-client toolkit, not an HTTP client.
 #
 # This file issues explicit `require_relative`s for the whole tree rather than using an
diff --git a/gems/dexpace-core/lib/dexpace/configuration/keys.rb b/gems/dexpace-core/lib/dexpace/configuration/keys.rb
index 69168c4..063a3c8 100644
--- a/gems/dexpace-core/lib/dexpace/configuration/keys.rb
+++ b/gems/dexpace-core/lib/dexpace/configuration/keys.rb
@@ -5,7 +5,8 @@ module Dexpace
   class Configuration
     # The well-known configuration key names (CFG-14): stable constants a caller passes to the
     # chain rather than restating the string. Five are CFG-14's own; two are the names phase
-    # 5a's own wirings read, and one is the name phase 5b's body-logging wiring reads. Nested
+    # 5a's own wirings read, one is the name phase 5b's body-logging wiring reads, and one is the
+    # name phase 8's transport adapters read. Nested
     # under Configuration because a key is a name the chain understands and reads wrongly as a
     # top-level Dexpace:: constant.
     #
@@ -43,6 +44,14 @@ module Keys
       # `preview_bytes:` (`configuration.integer(LOG_PREVIEW_BYTES, default: 8 * 1024)`, OBS-36's
       # reference default being the caller's choice); nothing in core reads it on its own.
       LOG_PREVIEW_BYTES = "LOG_PREVIEW_BYTES"
+
+      # The per-call timeout budget a transport adapter reads for its CONFIGURED tier, added by
+      # phase 8a in the change that reads it (its R3) and shared with phase 8c's adapter, so one
+      # caller setting governs both transports. Read with `#duration`, whose grammar (CFG-7)
+      # treats a bare number as MILLISECONDS: `REQUEST_TIMEOUT=30` is thirty milliseconds, and a
+      # caller who means thirty seconds writes `30s` or `PT30S`. The precedent for a
+      # transport-facing key nothing in core reads is HTTP_PROXY/HTTPS_PROXY/NO_PROXY above.
+      REQUEST_TIMEOUT = "REQUEST_TIMEOUT"
     end
   end
 end
diff --git a/gems/dexpace-core/lib/dexpace/error/transport_error.rb b/gems/dexpace-core/lib/dexpace/error/transport_error.rb
new file mode 100644
index 0000000..b00914e
--- /dev/null
+++ b/gems/dexpace-core/lib/dexpace/error/transport_error.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../error"
+
+module Dexpace
+  # The canonical retryable transport failure (TRANSPORT-20), raised by an adapter for any failure
+  # that produced no HTTP response: connection refused, DNS failure, TLS handshake failure, peer
+  # reset, a connect, read or write timeout.
+  #
+  # An ::IOError and never a subclass of Dexpace::StreamError (P3-3): XCUT-4 splits the failures
+  # near a transport into exactly two branches -- (a) a stream-contract violation, never retryable
+  # by default, and (b) "everything else escaping a transport", always retryable by default -- and
+  # a shared ancestor would let `rescue Dexpace::StreamError` catch a transport failure it was never
+  # written to expect, or the reverse. The one flag below is P6-4's obligation answered in one
+  # place: "wrap, and default to retryable", not ten rescue clauses classifying by hand at the call
+  # site. Phase 8's phase-level task, landed by 8a and cited by 8c; verified fact 7 of 8a's design
+  # is why it cannot be skipped -- none of `Net::OpenTimeout`, `Net::ReadTimeout`, `SocketError`,
+  # `Errno::*`, `OpenSSL::SSL::SSLError`, `Net::HTTPBadResponse` or `Net::HTTPHeaderSyntaxError`
+  # is an ::IOError, so a bare one escaping an adapter classifies NOT retryable through RETRY-2's
+  # capability query.
+  class TransportError < ::IOError
+    include Dexpace::Error
+
+    # Where the failure occurred -- :connect, :write, :read or :close -- for diagnostics only.
+    # RETRY-2's capability query reads #retryable? alone and never branches on this.
+    #
+    # @return [Symbol, nil]
+    attr_reader :phase
+
+    # @param message [String] the failure, defaulting to a generic one so a bare `raise
+    #   Dexpace::TransportError` still reads
+    # @param phase [Symbol, nil] where it occurred, for the record and never for a decision
+    def initialize(message = "a transport failure occurred", phase: nil)
+      @phase = phase
+      super(message)
+    end
+
+    # RETRY-2's capability query. Always true: XCUT-4 branch (b) is "MUST report itself as
+    # always-retryable at the error level", not "retryable when the cause looks retryable", and
+    # there is deliberately no keyword that can answer otherwise. The retry budget and RETRY-7's
+    # idempotency gate are what bound a resend, never this flag.
+    #
+    # @return [true]
+    def retryable?
+      true
+    end
+  end
+end
diff --git a/gems/dexpace-core/lib/dexpace/instrumentation/keys.rb b/gems/dexpace-core/lib/dexpace/instrumentation/keys.rb
index a2527d0..3a0aac6 100644
--- a/gems/dexpace-core/lib/dexpace/instrumentation/keys.rb
+++ b/gems/dexpace-core/lib/dexpace/instrumentation/keys.rb
@@ -57,7 +57,7 @@ module Keys
     # surface manifest for the reason Keys gives. Two are the request cycle's; the five
     # instrumentation diagnostics share OBS-20's `http.instrumentation.` prefix, derived from
     # one constant so a test can assert every one of them starts with it; the ninth is phase
-    # 6c's auth-layer diagnostic.
+    # 6c's auth-layer diagnostic and the tenth phase 8a's transport-layer one.
     module Events
       # The request event (OBS-39).
       HTTP_REQUEST = "http.request"
@@ -86,6 +86,12 @@ module Events
       # request cycle and the instrumentation family: an auth-layer diagnostic, named for the
       # layer that emits it.
       AUTH_REFRESH = "http.auth.refresh"
+      # TRANSPORT-11 and TRANSPORT-13: the header-drop record every transport adapter emits when
+      # it drops a caller-set header, at VERBOSE with a "header" and a "reason" field. ONE name for
+      # both adapters (the phase-8 charter's shared transport contract 2), added by phase 8a and
+      # confirmed by 8c, so one conformance assertion reads a drop from either. The tenth event,
+      # and the second outside the request cycle and the instrumentation family.
+      TRANSPORT_HEADER_DROPPED = "http.transport.header_dropped"
     end
   end
 end
diff --git a/gems/dexpace-core/sig/dexpace/configuration/keys.rbs b/gems/dexpace-core/sig/dexpace/configuration/keys.rbs
index 86a62f5..996efca 100644
--- a/gems/dexpace-core/sig/dexpace/configuration/keys.rbs
+++ b/gems/dexpace-core/sig/dexpace/configuration/keys.rbs
@@ -9,6 +9,7 @@ module Dexpace
       MAX_MATERIALIZED_BYTES: String
       MAX_TRACKED_CONTEXTS: String
       LOG_PREVIEW_BYTES: String
+      REQUEST_TIMEOUT: String
     end
   end
 end
diff --git a/gems/dexpace-core/sig/dexpace/error/transport_error.rbs b/gems/dexpace-core/sig/dexpace/error/transport_error.rbs
new file mode 100644
index 0000000..f7036fa
--- /dev/null
+++ b/gems/dexpace-core/sig/dexpace/error/transport_error.rbs
@@ -0,0 +1,12 @@
+module Dexpace
+  # TRANSPORT-20 and XCUT-4 branch (b): the always-retryable transport failure, a sibling of
+  # StreamError inside ::IOError (P3-3). Phase 8's phase-level task, landed by 8a.
+  class TransportError < ::IOError
+    include Dexpace::Error
+
+    attr_reader phase: Symbol?
+
+    def initialize: (?String message, ?phase: Symbol?) -> void
+    def retryable?: () -> true
+  end
+end
diff --git a/gems/dexpace-core/sig/dexpace/instrumentation/keys.rbs b/gems/dexpace-core/sig/dexpace/instrumentation/keys.rbs
index 19e71b0..e175f59 100644
--- a/gems/dexpace-core/sig/dexpace/instrumentation/keys.rbs
+++ b/gems/dexpace-core/sig/dexpace/instrumentation/keys.rbs
@@ -20,7 +20,7 @@ module Dexpace
       INSTRUMENT_REQUEST_DURATION: String
     end
 
-    # OBS-39 and OBS-20: the emitted event-name vocabulary, eight frozen Strings.
+    # OBS-39 and OBS-20: the emitted event-name vocabulary, ten frozen Strings.
     module Events
       HTTP_REQUEST: String
       HTTP_RESPONSE: String
@@ -31,6 +31,7 @@ module Dexpace
       INSTRUMENTATION_SHUTDOWN: String
       INSTRUMENTATION_CONFIG: String
       AUTH_REFRESH: String
+      TRANSPORT_HEADER_DROPPED: String
     end
   end
 end
diff --git a/gems/dexpace-core/test/dexpace/configuration/keys_test.rb b/gems/dexpace-core/test/dexpace/configuration/keys_test.rb
index 573da4c..09af81d 100644
--- a/gems/dexpace-core/test/dexpace/configuration/keys_test.rb
+++ b/gems/dexpace-core/test/dexpace/configuration/keys_test.rb
@@ -4,11 +4,13 @@
 require_relative "../../test_helper"
 require "dexpace"
 
-# CFG-14: the well-known key constants, plus the two names 5a's own wirings read and the one
+# CFG-14: the well-known key constants, plus the two names 5a's own wirings read, the one
 # name 5b's body-logging wiring reads (LOG_PREVIEW_BYTES, added by phase 5b in the change that
-# reads it -- the eighth constant, and this suite's count grew with it).
+# reads it -- the eighth constant, and this suite's count grew with it) and the one name phase
+# 8's transport adapters read (REQUEST_TIMEOUT, added by phase 8a in the change that reads it,
+# the ninth; the same rule, the same growth).
 class DexpaceConfigurationKeysTest < DexpaceTestCase
-  test "CFG-14: the five well-known keys and the three wiring keys are frozen, non-empty Strings" do
+  test "CFG-14: the five well-known keys and the four wiring keys are frozen, non-empty Strings" do
     expected = {
       MAX_RETRY_ATTEMPTS: "MAX_RETRY_ATTEMPTS",
       LOG_LEVEL: "LOG_LEVEL",
@@ -18,6 +20,7 @@ class DexpaceConfigurationKeysTest < DexpaceTestCase
       MAX_MATERIALIZED_BYTES: "MAX_MATERIALIZED_BYTES",
       MAX_TRACKED_CONTEXTS: "MAX_TRACKED_CONTEXTS",
       LOG_PREVIEW_BYTES: "LOG_PREVIEW_BYTES",
+      REQUEST_TIMEOUT: "REQUEST_TIMEOUT",
     }
 
     assert_equal(expected.keys.sort, Dexpace::Configuration::Keys.constants.sort)
diff --git a/gems/dexpace-core/test/dexpace/instrumentation/downstream_wirings_test.rb b/gems/dexpace-core/test/dexpace/instrumentation/downstream_wirings_test.rb
index b22994b..f995b8a 100644
--- a/gems/dexpace-core/test/dexpace/instrumentation/downstream_wirings_test.rb
+++ b/gems/dexpace-core/test/dexpace/instrumentation/downstream_wirings_test.rb
@@ -221,11 +221,12 @@ def configuration(environment: {}, properties: {})
       assert_empty(sink.entries)
     end
 
+    # Nine keys since phase 8a added REQUEST_TIMEOUT (its R3); this pin was eight until then.
     test "the body-logging caps' key: LOG_PREVIEW_BYTES is the eighth key, LOG_LEVEL is 5a's" do
       assert_equal("LOG_PREVIEW_BYTES", ConfigKeys::LOG_PREVIEW_BYTES)
       assert_equal("LOG_LEVEL", ConfigKeys::LOG_LEVEL)
       assert_predicate(ConfigKeys::LOG_PREVIEW_BYTES, :frozen?)
-      assert_equal(8, ConfigKeys.constants.size)
+      assert_equal(9, ConfigKeys.constants.size)
       # The reference default is the CALLER's, resolved through 5a's typed accessor and never
       # baked into a 5b signature (the plan's open question 5).
       assert_equal(8192, configuration.integer(ConfigKeys::LOG_PREVIEW_BYTES, default: 8 * 1024))
diff --git a/gems/dexpace-core/test/dexpace/instrumentation/keys_test.rb b/gems/dexpace-core/test/dexpace/instrumentation/keys_test.rb
index 21e74f0..77d829e 100644
--- a/gems/dexpace-core/test/dexpace/instrumentation/keys_test.rb
+++ b/gems/dexpace-core/test/dexpace/instrumentation/keys_test.rb
@@ -43,6 +43,9 @@ class DexpaceInstrumentationKeysTest < DexpaceTestCase
     INSTRUMENTATION_CONFIG: "http.instrumentation.config",
     # Phase 6c's, AUTH-37's log-and-continue: an auth-layer diagnostic, outside the prefix.
     AUTH_REFRESH: "http.auth.refresh",
+    # Phase 8a's, TRANSPORT-11/TRANSPORT-13's header-drop record: one name for both transport
+    # adapters (the phase-8 charter's shared transport contract 2), outside the prefix.
+    TRANSPORT_HEADER_DROPPED: "http.transport.header_dropped",
   }.freeze
 
   # Sixteen: OBS-39's named minimum plus the reserved `event` key (OBS-4), the `cause` the
@@ -59,7 +62,7 @@ class DexpaceInstrumentationKeysTest < DexpaceTestCase
     end
   end
 
-  test "OBS-39, OBS-20: Events holds exactly these nine, six under the instrumentation prefix" do
+  test "OBS-39, OBS-20: Events holds exactly these ten, six under the instrumentation prefix" do
     assert_equal(EXPECTED_EVENTS.keys.sort, Events.constants.sort)
     EXPECTED_EVENTS.each do |name, value|
       constant = Events.const_get(name)
diff --git a/gems/dexpace-core/test/dexpace/transport_test.rb b/gems/dexpace-core/test/dexpace/transport_test.rb
index 92edc38..67fdec7 100644
--- a/gems/dexpace-core/test/dexpace/transport_test.rb
+++ b/gems/dexpace-core/test/dexpace/transport_test.rb
@@ -11,6 +11,11 @@
 # #call(request, options, cancellation) and returning a Dexpace::Response. #call is the convergence
 # point of Ruby's own middleware ecosystems (porting-method/bf484e8e, P14), so a bare lambda is a
 # valid transport and phase 4's Dexpace::Pipeline can stand in wherever one is expected (PIPE-26).
+#
+# The properties of a BARE `require "dexpace"` -- an empty registry, the zero-candidate SeamError
+# and nothing resolved after a swap -- live in transport_bare_require_test.rb since phase 8a, whose
+# adapter registers a factory the moment it is required: in one `rake test:gems` process the
+# registry is not empty, and the in-process assertions were the pin that registration invalidated.
 class DexpaceTransportTest < DexpaceTestCase
   CORE = "~> 0.0"
 
@@ -29,24 +34,22 @@ class DexpaceTransportTest < DexpaceTestCase
     refute(Dexpace::Transport.conforms?(nil))
   end
 
-  test "the registry starts empty, so SEAM-1 holds on a bare require" do
-    assert_empty(Dexpace::Transport.registered_keys)
-  end
-
   test "install refuses an object that does not implement the seam" do
     error = assert_raises(Dexpace::InvalidArgumentError) { Dexpace::Transport.install(Object.new) }
 
     assert_match(/must implement the seam/, error.message)
   end
 
+  # The override itself; "and afterwards nothing is resolved" is a property of the bare require
+  # and lives in transport_bare_require_test.rb (see the class comment).
   test "swap scopes an override to its block" do
     transport = ->(_request, _options, _cancellation) { :response }
+    resolved = nil
 
-    Dexpace::Transport.swap(transport) do
-      assert_same(transport, Dexpace::Transport.resolve)
-    end
+    Dexpace::Transport.swap(transport) { resolved = Dexpace::Transport.resolve }
 
-    assert_raises(Dexpace::SeamError) { Dexpace::Transport.resolve }
+    assert_same(transport, resolved)
+    refute_same(transport, Dexpace::Transport.registered_keys, "the swap registered nothing")
   end
 
   # An install inside a swap block is part of the override and is restored with it, which is
@@ -58,15 +61,6 @@ class DexpaceTransportTest < DexpaceTestCase
       assert_same(Dexpace::Transport, Dexpace::Transport.install(installed))
       assert_same(installed, Dexpace::Transport.resolve)
     end
-
-    assert_raises(Dexpace::SeamError) { Dexpace::Transport.resolve }
-  end
-
-  test "register and resolve go through one registry, and the error names no gem" do
-    error = assert_raises(Dexpace::SeamError) { Dexpace::Transport.resolve }
-
-    assert_match(/no transport provider is registered/, error.message)
-    refute_match(%r{net_http|async_http|net/http}i, error.message, "SEAM-2")
   end
 
   # The module-level registry is process-global, so the registration is scoped inside a swap and
diff --git a/gems/dexpace-core/test/dexpace_test.rb b/gems/dexpace-core/test/dexpace_test.rb
index 02630f3..db23a81 100644
--- a/gems/dexpace-core/test/dexpace_test.rb
+++ b/gems/dexpace-core/test/dexpace_test.rb
@@ -83,9 +83,13 @@ class DexpaceTest < DexpaceTestCase
   # Phase 7c: ONE flat constant, the page value that is also the subsystem's namespace (P7-2);
   # everything else the layer ships is under Dexpace::Page, which the PhaseSevenLayers case pins.
   PAGE_LAYER = %i[Page].freeze
+  # Phase 8a: the one core constant phase 8 adds -- the phase-level TransportError (TRANSPORT-20,
+  # XCUT-4 branch (b)), filed beside StreamError; the adapters themselves are other gems.
+  TRANSPORT_LAYER = %i[TransportError].freeze
   LAYERS = [
     DOMAIN_MODEL, SEAM_LAYER, IO_LAYER, BODY_LAYER, CONTEXT_LAYER, RECOVERY_LAYER, PIPELINE_LAYER,
     CONFIGURATION_LAYER, RESILIENCE_LAYER, AUTH_LAYER, REDIRECT_LAYER, SSE_LAYER, PAGE_LAYER,
+    TRANSPORT_LAYER,
   ].flatten.freeze
 
   test "defines nothing outside the Dexpace namespace" do
diff --git a/gems/dexpace-core/test/support/bare_require.rb b/gems/dexpace-core/test/support/bare_require.rb
new file mode 100644
index 0000000..cbc1511
--- /dev/null
+++ b/gems/dexpace-core/test/support/bare_require.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "open3"
+require "rbconfig"
+
+# A fresh interpreter running a program after a bare `require "dexpace"`, with bundler's RUBYOPT
+# cleared so nothing but core's own tree loads (context_store_config_test.rb's idiom). The shape
+# every "property of a bare require" test shares since phase 8a: `rake test:gems` runs every
+# gem's suite in one process, and an adapter's entry file registers its factory under its seam
+# the moment it is required (design §3.6), so in that process a seam's registry is not empty and
+# an in-process assertion of emptiness is the pin the first adapter invalidated. The child
+# requires core alone, which is the property SEAM-1 states.
+module BareRequire
+  CORE_LIB = File.expand_path("../../lib", __dir__)
+
+  # @param program [String] Ruby run after `require "dexpace"`
+  # @return [String] the child's stdout; the child must exit 0 and write nothing to stderr
+  def bare_require(program)
+    out, err, status = Open3.capture3(
+      { "RUBYOPT" => nil }, RbConfig.ruby, "-w", "-W:deprecated", "-I", CORE_LIB, "-e",
+      "require \"dexpace\"; #{program}",
+    )
+
+    assert_predicate(status, :success?, err)
+    assert_empty(err, "a bare require must be silent under -w")
+    out
+  end
+end
diff --git a/gems/dexpace-transport-net_http/dexpace-transport-net_http.gemspec b/gems/dexpace-transport-net_http/dexpace-transport-net_http.gemspec
index 8ddd958..c2b0661 100644
--- a/gems/dexpace-transport-net_http/dexpace-transport-net_http.gemspec
+++ b/gems/dexpace-transport-net_http/dexpace-transport-net_http.gemspec
@@ -12,8 +12,7 @@ Gem::Specification.new do |spec|
   spec.summary = "The synchronous transport adapter for dexpace, over Ruby's net/http."
   spec.description = <<~TEXT
     The reference synchronous transport for the dexpace HTTP-client toolkit, implemented over
-    Ruby's net/http default gem. It depends on dexpace-core and, once the adapter lands, on
-    net-http and nothing else.
+    Ruby's net/http default gem. It depends on dexpace-core and on net-http and nothing else.
   TEXT
   spec.homepage = "https://github.com/dexpace/ruby-sdk"
   spec.license = "MIT"
@@ -32,7 +31,13 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "dexpace-core", DexpaceVersions.core_constraint
 
-  # NFR-2: dexpace-core plus at most one third-party gem. The third-party half of this
-  # adapter's budget is declared by the phase that writes the code needing it (design P0-9);
-  # `rake gates:gemspec_audit` enforces the whole budget either way.
+  # NFR-2: dexpace-core plus at most one third-party gem, and this is the one -- declared by phase
+  # 8a with the code that needs it (design P0-9), the only place the floor is stated. `>= 0.4`
+  # because Net::HTTPGenericRequest, the block form of #request and the `max_retries`,
+  # `proxy_from_env` and `write_timeout` knobs the adapter sets are all present from that release,
+  # which is the default gem on the 3.2 floor. No upper bound: under Bundler the NEWEST published
+  # net-http resolves on every row (0.9.1 at the time of writing), and the adapter is written and
+  # tested to be correct on 0.4.1, 0.6.0 and 0.9.1 alike -- `gates:require_allowlist` is what
+  # makes `require "net/http"` permitted in this gem's lib/ because of this line.
+  spec.add_dependency "net-http", ">= 0.4"
 end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http.rb
index 2fa223f..29ae056 100644
--- a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http.rb
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http.rb
@@ -1,15 +1,156 @@
 # frozen_string_literal: true
 # SPDX-License-Identifier: MIT
 
+require "dexpace"
+require "net/http"
 require_relative "net_http/version"
+require_relative "net_http/deadline"
+require_relative "net_http/failures"
+require_relative "net_http/request_mapper"
+require_relative "net_http/response_mapper"
+require_relative "net_http/response_pump"
+require_relative "net_http/tls_settings"
+require_relative "net_http/proxy_route"
+require_relative "net_http/adapter"
 
 module Dexpace
   # Transport adapters: the synchronous and asynchronous transport seams' shipped
   # implementations. The seam contracts themselves live in dexpace-core.
   module Transport
-    # The reference synchronous transport, over Ruby's `net/http` default gem. Phase 0 ships the
-    # namespace and VERSION only; the adapter itself lands in phase 8.
+    # The reference synchronous transport, over Ruby's `net/http` default gem (phase 8a). One
+    # `Net::HTTP` per call, built from the request's own URL, with `max_retries = 0` and
+    # `proxy_from_env = false` as the two one-line disables the SDK's own retry and proxy layers
+    # need; the response body streams through a per-response producer thread (P8-1) and the
+    # caller owns closing it. Two constructions, and ownership is decided at construction: `.build`
+    # is the SDK-managed one, `.using` wraps a caller's own client verbatim (P8-15).
+    #
+    # What the wire carries (R2): the caller's headers minus MANAGED_HEADERS, plus `Host` and the
+    # framing header the transport derives, plus a `Content-Type` on every body-permitted method
+    # (P8-4). `Accept`, `User-Agent` and `Accept-Encoding` are never invented (P8-2), and a
+    # `Content-Encoding` response is delivered exactly as the server sent it -- compressed, with
+    # its headers intact -- because `decode_content` is off (P8-3); a caller who wants compression
+    # sets `Accept-Encoding` and decodes.
     module NetHTTP
+      extend self
+
+      # The configured tier's fallback for RequestOptions#timeout (R3): the total per-call budget
+      # when neither the call nor the transport nor Configuration::Keys::REQUEST_TIMEOUT says
+      # otherwise. A named setting, not a literal at the call site.
+      DEFAULT_TIMEOUT_SECONDS = 60.0
+
+      # TRANSPORT-6's clamp floor. net-http's three timeout knobs accept floats down to 0.0005 and
+      # treat zero as "poll once", so a strictly positive remaining budget below this is clamped
+      # UP to it rather than handed over as a near-zero that would time out from a confusing place.
+      MIN_TIMEOUT_SECONDS = 0.001
+
+      # The bounded join on a response's producer thread when the response is closed (XCUT-13,
+      # TRANSPORT-16): never `Thread#join` with no argument.
+      JOIN_DEADLINE_SECONDS = 5.0
+
+      # The key the require-time registration below uses, and the key a caller passes to
+      # Dexpace::Transport when they want this adapter by name.
+      REGISTRY_KEY = :net_http
+
+      # R18: the keys `.build`'s `tls:` accepts, and nothing else -- an unknown key raises, because
+      # a silently ignored `verify_mode:` is a security setting the caller believes they set. The
+      # values are plain (a path String, an OpenSSL object the caller built, a Symbol version), so
+      # no OpenSSL constant reaches a public signature (NFR-11).
+      TLS_SETTINGS = %i[ca_file ca_path cert key verify_mode min_version].freeze
+
+      # TRANSPORT-11's drop set (P8-13): the requirement's named minimum -- host, content-length,
+      # transfer-encoding -- plus seven RFC 9110 §7.6.1 hop-by-hop names the requirement's own text
+      # invites. Folded, because HeaderName#folded is what every lookup compares against. Two carry
+      # their own reason: `expect`, because Net::HTTP#continue_timeout is nil by default so
+      # `Expect: 100-continue` would hang against a server that waits; and `connection`, because
+      # this adapter builds and closes a client per call. `proxy-authorization` is deliberately
+      # NOT here: this adapter stamps no proxy credential of its own, so a caller-set value passes
+      # through like any other header. Ten names, a shared transport contract with the async
+      # adapter, which drops the same ten under its own constant (NFR-2 forbids sharing the
+      # constant itself).
+      MANAGED_HEADERS = %w[
+        host content-length transfer-encoding connection keep-alive proxy-connection te trailer
+        upgrade expect
+      ].freeze
+
+      # P8-4: the Content-Type a body-permitted request carries when neither the caller's headers
+      # nor the body's own media type supplies one -- RFC 9110's own default for a payload of
+      # unknown type, and the one value that claims nothing about the bytes. Net::HTTP's own
+      # fallback would be `application/x-www-form-urlencoded`, a claim a server acts on.
+      DEFAULT_CONTENT_TYPE = "application/octet-stream"
+
+      # TRANSPORT-30's SHOULD: the WARNING event emitted once per call when a resolved proxy
+      # carries something Net::HTTP cannot honour -- a custom challenge handler, or a SOCKS type
+      # -- before the adapter proceeds with Basic from the proxy's username and password. Named
+      # here rather than in core's Events because nothing outside this gem reads it.
+      PROXY_LIMITATION_EVENT = "http.transport.proxy_limitation"
+
+      # The SDK-managed construction. Every call builds its own `Net::HTTP` from the request's
+      # URL (TRANSPORT-29: nothing is shared between calls), applies this call's total budget to
+      # the three timeout knobs (R3), and closes the connection when the response is closed.
+      #
+      # The budget's three tiers, highest first: `RequestOptions#timeout` on the call, `timeout:`
+      # here, then `Configuration::Keys::REQUEST_TIMEOUT` -- read through `Configuration#duration`,
+      # whose grammar treats a BARE number as milliseconds (CFG-7): `REQUEST_TIMEOUT=30` is thirty
+      # milliseconds, and thirty seconds is `30s` or `PT30S` -- and finally
+      # DEFAULT_TIMEOUT_SECONDS.
+      #
+      # `tls:` is applied only to an `https` request and only for the keys given (R18): `ca_file`
+      # and `ca_path` are path Strings, `cert` an OpenSSL::X509::Certificate and `key` an
+      # OpenSSL::PKey the caller built, `verify_mode` an Integer such as
+      # OpenSSL::SSL::VERIFY_PEER, `min_version` a Symbol such as `:TLS1_2`. With no `tls:` nothing
+      # is assigned and OpenSSL's own defaults -- VERIFY_PEER with hostname verification -- apply.
+      # Passing `verify_mode: OpenSSL::SSL::VERIFY_NONE` is the caller disabling verification
+      # deliberately; the adapter never weakens a default on its own.
+      #
+      # @param timeout [Numeric, nil] the per-transport default budget in seconds; nil defers to
+      #   the configuration chain
+      # @param logger [Dexpace::Instrumentation::Logger] where header drops and proxy limitations
+      #   are logged; defaults to the null logger so no caller holds a nil
+      # @param tls [Hash, nil] the TLS settings, keyed by TLS_SETTINGS
+      # @return [Adapter] an owning adapter (`#owned?` is true)
+      # @raise [Dexpace::InvalidArgumentError] for a `tls:` that is not a Hash or names an
+      #   unknown key
+      def build(timeout: nil, logger: ::Dexpace::Instrumentation::Logger::NULL, tls: nil)
+        Adapter.owning(timeout: timeout, logger: logger, tls: TLSSettings.validate!(tls))
+      end
+
+      # The borrowing construction (P8-15): the caller's `Net::HTTP` is used verbatim -- no knob,
+      # no endpoint and no `use_ssl` is ever assigned on it, and it is neither started nor
+      # finished by the adapter, so a client the caller already started keeps its connection. The
+      # consequences are the contract: the endpoint is the client's, and a request naming a
+      # different host, port or scheme is refused; a per-call `RequestOptions#timeout` is refused
+      # rather than applied to someone else's client (P8-6); and calls are serialised, one
+      # exchange at a time from `#call` until its response is closed, because one `Net::HTTP`
+      # cannot carry two exchanges at once.
+      #
+      # @param client [Net::HTTP] the caller's own client, which must already have
+      #   `max_retries == 0` -- the adapter asserts it rather than setting it, because
+      #   TRANSPORT-2 scopes the disable to an SDK-managed transport and XCUT-22 forbids mutating
+      #   a caller's object (P8-10)
+      # @param logger [Dexpace::Instrumentation::Logger] as for `.build`
+      # @return [Adapter] a borrowing adapter (`#owned?` is false)
+      # @raise [Dexpace::InvalidArgumentError] when the client's `max_retries` is not zero
+      def using(client, logger: ::Dexpace::Instrumentation::Logger::NULL)
+        Adapter.borrowing(client, logger: logger)
+      end
+
+      # SEAM-5's zero-argument factory the registry calls: a FRESH owning adapter every call,
+      # never a memoized one, because a memoized default would be one adapter shared across
+      # every unconfigured consumer in the process.
+      #
+      # @return [Adapter]
+      def default
+        build
+      end
+
+      # Require-time self-registration, the one load-time side effect this repository permits:
+      # the LAST statement inside the module, so `method(:default)` resolves against it. The
+      # `core:` keyword is phase 2's version-skew guard and raises Dexpace::SeamError on a
+      # Dexpace::VERSION mismatch (design §2.4).
+      ::Dexpace::Transport.register(
+        REGISTRY_KEY, method(:default),
+        core: "~> #{::Dexpace::VERSION.split(".").first(2).join(".")}",
+      )
     end
   end
 end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/adapter.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/adapter.rb
new file mode 100644
index 0000000..9bbf498
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/adapter.rb
@@ -0,0 +1,236 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # The transport (SEAM-11). Two named entry points make ownership a construction-time fact
+      # (design §3.7), which is what SEAM-15's documented post-close mode keys off: an owning
+      # adapter raises Dexpace::ClosedError on a send after `#close`, a borrowing one closes
+      # nothing and stays usable, because the client is the caller's (XCUT-22). Frozen in effect
+      # after construction -- the only state an instance ever writes is Closeable's latch -- which
+      # is what TRANSPORT-29's "effectively immutable after construction" means in Ruby; every
+      # per-call object lives in `#call`'s own frame or in the returned response graph.
+      #
+      # The transport's own `#close` cancels no in-flight response: each response's pump is owned
+      # by the Dexpace::Response that holds it (SEAM-25).
+      class Adapter # rubocop:disable Metrics/ClassLength -- one seam over two constructions: ownership is a fact of one object (design §3.7), so the owning and the borrowing paths are one class and split by nothing but method
+        include ::Dexpace::Closeable
+
+        private_class_method :new
+
+        # The SDK-managed construction behind NetHTTP.build, which is the entry point a caller
+        # uses; public because the module function calls it with an explicit receiver.
+        #
+        # @api private
+        # @return [Adapter]
+        def self.owning(timeout:, logger:, tls:)
+          timeout!(timeout)
+          new(client: nil, timeout: timeout, logger: logger, tls: tls, owned: true)
+        end
+
+        # The borrowing construction behind NetHTTP.using: refuses the client here (P8-10),
+        # before an instance exists.
+        #
+        # @api private
+        # @return [Adapter]
+        def self.borrowing(client, logger:)
+          unless client.respond_to?(:max_retries) && client.max_retries.zero?
+            raise ::Dexpace::InvalidArgumentError,
+                  "a borrowed Net::HTTP must already have max_retries == 0 (TRANSPORT-2): the " \
+                  "adapter may not set it on a client it does not own (XCUT-22)"
+          end
+
+          new(client: client, timeout: nil, logger: logger, tls: nil, owned: false)
+        end
+
+        def self.timeout!(timeout)
+          return if timeout.nil?
+          return if timeout.is_a?(::Numeric) && timeout.finite? && timeout.positive?
+
+          raise ::Dexpace::InvalidArgumentError,
+                "timeout must be a finite, positive number of seconds or nil, got " \
+                "#{timeout.inspect}"
+        end
+        private_class_method :timeout!
+
+        def initialize(client:, timeout:, logger:, tls:, owned:)
+          @client = client
+          @timeout = timeout
+          @logger = logger
+          @tls = tls
+          @clock = ::Dexpace::Clock::SYSTEM
+          # P8-15: one permit, so calls through a BORROWED client are serialised for the whole
+          # life of each exchange. A SizedQueue and not a Mutex: the permit is returned by the
+          # response pump's producer, on its own thread, and Mutex#unlock from a non-owner raises.
+          @permit = owned ? nil : ::Thread::SizedQueue.new(1).tap { |queue| queue.push(:permit) }
+          initialize_closeable(owned: owned)
+        end
+
+        # The seam: validates, maps, dispatches, adapts and returns a Dexpace::Response whose
+        # body streams from the socket until the caller drains or closes it (SEAM-11,
+        # TRANSPORT-25). Every failure that produced no response surfaces classified through
+        # the cancellation token first (TRANSPORT-3) and as a retryable Dexpace::TransportError
+        # otherwise (TRANSPORT-20); a Dexpace::Error of the SDK's own passes through unchanged.
+        #
+        # @param request [Dexpace::Request]
+        # @param options [Dexpace::RequestOptions] `#timeout` is this call's TOTAL budget in
+        #   seconds (R3); nil takes the transport's default
+        # @param cancellation [Dexpace::Cancellation, nil] nil is the never-cancelled token
+        # @return [Dexpace::Response]
+        # @raise [Dexpace::ClosedError] on an owning adapter after `#close` (SEAM-15)
+        # @raise [Dexpace::CancelledError] when the token is cancelled, before or during the call
+        # @raise [Dexpace::TransportError] for any failure that produced no response
+        # @raise [Dexpace::InvalidArgumentError] on a borrowing adapter for a per-call timeout
+        #   (P8-6) or a request naming another origin (P8-15), and for a forged header (HTTP-17)
+        def call(request, options, cancellation)
+          perform(request, options, cancellation || ::Dexpace::Cancellation.none)
+        end
+
+        private
+
+        def perform(request, options, cancellation)
+          raise ::Dexpace::ClosedError, "this transport is closed" if closed? && owned?
+
+          cancellation.check!
+          if owned?
+            owned_call(request, options, cancellation)
+          else
+            borrowed_call(request, options, cancellation)
+          end
+        rescue ::StandardError => error
+          # Raised from inside the rescue, so Ruby's implicit #cause wiring attaches the original
+          # for free; `cause: nil` is the OTHER case, a failure carried across a thread boundary,
+          # and it is the pump's spelling and not this one's.
+          raise Failures.wrap(error, phase: :connect, cancellation: cancellation)
+        end
+
+        # TRANSPORT-5 and TRANSPORT-6: a fresh Net::HTTP per call, built FROM THIS REQUEST'S URL
+        # and with its three timeout knobs assigned from THIS call's own deadline -- never a
+        # shared client, so "leaving the shared native client's configuration untouched" holds
+        # by construction. An expired budget raises before the socket is touched.
+        def owned_call(request, options, cancellation)
+          deadline = Deadline.build(clock: @clock, budget: resolve_timeout(options))
+          if deadline.expired?
+            raise ::Dexpace::TransportError.new("the per-call budget expired before dispatch",
+                                                phase: :connect,)
+          end
+
+          native = RequestMapper.build(request, logger: @logger)
+          dispatch(request, native: native, http: owned_client_for(request.url, deadline),
+                            deadline: deadline, cancellation: cancellation, owns_connection: true,
+                            permit: nil,)
+        end
+
+        # R3's three tiers, highest first: the call, the transport, the configuration chain --
+        # through Configuration#duration, whose bare-number grammar is milliseconds (CFG-7).
+        def resolve_timeout(options)
+          options.timeout || @timeout || configured_timeout
+        end
+
+        def configured_timeout
+          key = ::Dexpace::Configuration::Keys::REQUEST_TIMEOUT
+          ::Dexpace.configuration.duration(key, default: DEFAULT_TIMEOUT_SECONDS) ||
+            DEFAULT_TIMEOUT_SECONDS
+        end
+
+        # The endpoint is a CONSTRUCTOR ARGUMENT and never an assignment: Net::HTTP declares
+        # `address` and `port` as readers only. The four proxy positionals come from phase 5a's
+        # resolver through ProxyRoute (R17), and an explicit nil there is what takes Net::HTTP's
+        # `:ENV` default off the table; `proxy_from_env = false` says the same thing twice on
+        # purpose. TLS settings are applied only when the URL is https (R18).
+        def owned_client_for(url, deadline)
+          http = routed_client(url)
+          http.use_ssl = url.scheme == "https"
+          TLSSettings.apply(http, @tls || {}) if http.use_ssl?
+          apply_budget(http, deadline)
+        end
+
+        def routed_client(url)
+          proxy = ProxyRoute.for(url, logger: @logger)
+          http = ::Net::HTTP.new(url.hostname.to_s, url.port, proxy.address, proxy.port,
+                                 proxy.username, proxy.password,)
+          http.proxy_from_env = false
+          http.max_retries = 0 # TRANSPORT-2: the SDK's retry layer is the only retry
+          http
+        end
+
+        def apply_budget(http, deadline)
+          budget = deadline.clamped
+          http.open_timeout = budget
+          http.write_timeout = budget
+          http.read_timeout = budget
+          http
+        end
+
+        # P8-15: the borrowed client is used VERBATIM, so the endpoint is the CLIENT's and a
+        # request naming a different one is refused rather than sent somewhere the caller's
+        # Request does not name; P8-6: a non-nil per-call timeout is refused, and the OPTIONS
+        # value is checked rather than the resolved one, because a configured default must not
+        # be silently applied to someone else's client either. The native request is mapped
+        # BEFORE the permit is taken, so a refused header holds nothing up; from the moment the
+        # pump exists, its producer returns the permit.
+        def borrowed_call(request, options, cancellation)
+          unless options.timeout.nil?
+            raise ::Dexpace::InvalidArgumentError,
+                  "a per-call timeout cannot apply to a borrowed Net::HTTP without mutating it " \
+                  "(TRANSPORT-5 against XCUT-22); use NetHTTP.build for a call that needs one"
+          end
+          check_endpoint!(request.url)
+
+          native = RequestMapper.build(request, logger: @logger)
+          permit = @permit
+          permit&.pop
+          dispatch(request, native: native, http: @client, deadline: nil,
+                            cancellation: cancellation, owns_connection: false, permit: permit,)
+        end
+
+        def check_endpoint!(url)
+          return if bound_to?(url)
+
+          raise ::Dexpace::InvalidArgumentError,
+                "a borrowed Net::HTTP is bound to #{@client.address}:#{@client.port} " \
+                "(use_ssl=#{@client.use_ssl?}) and this request names " \
+                "#{url.hostname}:#{url.port} (use_ssl=#{url.scheme == "https"}); the adapter " \
+                "may not re-point a client it does not own (TRANSPORT-15, XCUT-22): use " \
+                "NetHTTP.build, or a client bound to this origin"
+        end
+
+        def bound_to?(url)
+          url.hostname.to_s.downcase == @client.address.to_s.downcase &&
+            url.port == @client.port && (url.scheme == "https") == @client.use_ssl?
+        end
+
+        # The head is adapted on THIS thread, so every Dexpace object in the returned graph is
+        # built where the caller can see a failure; if adaptation raises, the pump is closed
+        # before the error propagates (TRANSPORT-22), which is the connection's release. The
+        # permit goes back here only when the pump could not be constructed at all; once its
+        # producer thread exists, that thread's own ensure returns it.
+        def dispatch(request, native:, http:, deadline:, cancellation:, owns_connection:, permit:)
+          pump = begin
+            ResponsePump.new(http: http, native: native, deadline: deadline,
+                             cancellation: cancellation, owns_connection: owns_connection,
+                             permit: permit,)
+          rescue ::StandardError
+            permit&.push(:permit)
+            raise
+          end
+          pump.head_or_raise do |head|
+            ResponseMapper.build(request: request, native: head, pump: pump, logger: @logger,
+                                 head: request.method.token == "HEAD",)
+          end
+        rescue ::StandardError
+          ::Dexpace.close_quietly(pump)
+          raise
+        end
+
+        # The managed construction owns no long-lived native resource, so there is nothing to
+        # release; the borrowing construction never reaches here, because Closeable#close skips
+        # #release when `owned?` is false.
+        def release
+          nil
+        end
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/deadline.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/deadline.rb
new file mode 100644
index 0000000..123cc6e
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/deadline.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # R3: RequestOptions#timeout is a TOTAL per-call budget, not one value assigned to three
+      # per-operation knobs -- a call with `timeout: 5` must be bounded by five seconds in all,
+      # not five seconds per read. The budget is carried as an absolute monotonic instant over
+      # phase 5a's injectable clock (CFG-15: never Time.now), and the adapter reads `#clamped`
+      # into the knobs before the connection exists and again after every chunk the pump
+      # receives. `#clamped` is TRANSPORT-6's one-line clamp, carried here so the ID appears in
+      # exactly one place. A private_constant of NetHTTP.
+      class Deadline
+        private_class_method :new
+
+        # The one construction entry point: the budget is converted to an instant NOW.
+        #
+        # @param clock [#monotonic] phase 5a's Dexpace::Clock or a fake
+        # @param budget [Numeric] seconds from now; a non-positive budget is already expired
+        # @return [Deadline]
+        def self.build(clock:, budget:)
+          new(clock, clock.monotonic + budget)
+        end
+
+        def initialize(clock, instant)
+          @clock = clock
+          @instant = instant
+        end
+
+        # Seconds left, negative once the instant has passed.
+        #
+        # @return [Float]
+        def remaining
+          @instant - @clock.monotonic
+        end
+
+        # Whether the budget is spent: the adapter's own check, taken BEFORE `#clamped` is
+        # consulted, so an expired budget raises rather than dispatching with a near-zero knob
+        # (zero means "poll once" on Net::HTTP, not "no timeout").
+        #
+        # @return [Boolean]
+        def expired?
+          remaining <= 0
+        end
+
+        # TRANSPORT-6: a strictly positive remaining below MIN_TIMEOUT_SECONDS is clamped UP to
+        # it; an already-expired remaining is returned as it is, never clamped up past zero, so
+        # the caller's `#expired?` decision is the one that decides whether to raise.
+        #
+        # @return [Float]
+        def clamped
+          value = remaining
+          return value if value <= 0
+          return MIN_TIMEOUT_SECONDS if value < MIN_TIMEOUT_SECONDS
+
+          value
+        end
+      end
+
+      private_constant :Deadline
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/failures.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/failures.rb
new file mode 100644
index 0000000..994489c
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/failures.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # TRANSPORT-3, TRANSPORT-4 and TRANSPORT-20 in one function, and P6-4's obligation read
+      # literally: "wrap, and default to retryable, not wrap and get the classification right by
+      # hand". The wrap is a CATCH-ALL, never a lookup against an enumerated list -- a list has
+      # exactly one failure mode and it is the bad one: a family nobody thought of escapes
+      # unwrapped and classifies NOT retryable through RETRY-2's capability query, which is the
+      # blind spot P6-4 names. The families this adapter actually meets are documented here rather
+      # than branched on: Net::OpenTimeout, Net::ReadTimeout and Net::WriteTimeout (Timeout::Error
+      # < RuntimeError), SocketError (which covers Socket::ResolutionError where it exists),
+      # Errno::* through SystemCallError, OpenSSL::SSL::SSLError, EOFError, IOError,
+      # Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError and Zlib::Error -- none of which but
+      # EOFError and IOError is an ::IOError, and those two still wrap, because phase 3a's
+      # Dexpace::EndOfStreamError is a Dexpace::Error and takes the pass-through clause instead.
+      # A private_constant of NetHTTP.
+      module Failures
+        extend self
+
+        # The error to actually raise for whatever escaped the native dispatch. It RETURNS the
+        # error and never assigns `#cause`: Ruby populates `#cause` from `$!` at the raise, so a
+        # caller raising the result from inside its own `rescue` gets the original as the cause
+        # for free, and a caller carrying a failure across a thread boundary passes it explicitly.
+        #
+        # @param error [Exception] whatever escaped the native dispatch
+        # @param phase [Symbol] :connect, :write, :read or :close, for TransportError#phase
+        # @param cancellation [Dexpace::Cancellation] the token this call was given
+        # @return [Exception] a Dexpace::CancelledError when the token is cancelled, the error
+        #   itself when it is already a Dexpace::Error, and a retryable Dexpace::TransportError
+        #   otherwise
+        def wrap(error, phase:, cancellation:)
+          # TRANSPORT-3: ask the TOKEN first, never the exception. A cancel delivered by closing
+          # the socket and a peer reset arrive as the SAME IOError with the SAME message, so
+          # discrimination by class or by message cannot work at all.
+          return ::Dexpace::CancelledError.new(cancellation.reason) if cancellation.cancelled?
+          # Never re-wrap what is already ours: double-wrapping a stream-contract violation or a
+          # caller's own InvalidArgumentError into an always-retryable transport failure would
+          # make RETRY-2 re-send on a caller's own bug.
+          return error if own?(error)
+
+          # TRANSPORT-4 and TRANSPORT-20: retryable, and the token is never written here, so a
+          # read timeout leaves the cancellation flag exactly as it found it.
+          ::Dexpace::TransportError.new(error.message, phase: phase)
+        end
+
+        private
+
+        def own?(error)
+          error.is_a?(::Dexpace::Error)
+        end
+      end
+
+      private_constant :Failures
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/proxy_route.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/proxy_route.rb
new file mode 100644
index 0000000..c77b964
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/proxy_route.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # R17 (TRANSPORT-30): the four values for Net::HTTP.new's p_addr, p_port, p_user and
+      # p_pass, all nil when no proxy applies -- and an EXPLICIT nil is the point: Net::HTTP.new's
+      # p_addr defaults to :ENV, which routes through `http_proxy` with a credential this SDK
+      # never resolved and a bypass list it never consulted. The values come from phase 5a's
+      # Dexpace::Proxy.resolve, the resolver's first consumer in the repository. A private_constant
+      # snapshot, so a plain Data without the construction pattern (phase 2's P2-9).
+      ProxyRoute = ::Data.define(:address, :port, :username, :password) do
+        # The direct route.
+        #
+        # @return [ProxyRoute]
+        def self.none
+          new(address: nil, port: nil, username: nil, password: nil)
+        end
+
+        # @param url [URI::Generic] this call's target, for CFG-23's per-host bypass decision
+        # @param configuration [Dexpace::Configuration] the chain the proxy is resolved from
+        # @param logger [Dexpace::Instrumentation::Logger] where an unhonourable proxy feature is
+        #   warned about
+        # @return [ProxyRoute]
+        def self.for(url, configuration: ::Dexpace.configuration,
+                     logger: ::Dexpace::Instrumentation::Logger::NULL)
+          proxy = ::Dexpace::Proxy.resolve(configuration, logger: logger)
+          return none if proxy.nil?
+
+          from(proxy, url, logger: logger)
+        end
+
+        # @param proxy [Dexpace::Proxy] a resolved proxy
+        # @param url [URI::Generic] this call's target
+        # @param logger [Dexpace::Instrumentation::Logger]
+        # @return [ProxyRoute]
+        def self.from(proxy, url, logger: ::Dexpace::Instrumentation::Logger::NULL)
+          return none if proxy.bypass?(url.hostname.to_s)
+
+          warn_unhonoured(proxy, logger)
+          new(address: proxy.host, port: proxy.port, username: proxy.username,
+              password: proxy.password,)
+        end
+
+        # TRANSPORT-30's SHOULD: "a custom (non-Basic) proxy challenge handler SHOULD be surfaced
+        # with a WARN and proxy auth SHOULD fall back to Basic from username/password". Net::HTTP
+        # speaks Basic through p_user/p_pass and nothing else, and no SOCKS at all, so those are
+        # the two unhonourable features and both take the same warning. The event names the
+        # feature and never a credential -- the first embedded MUST.
+        def self.warn_unhonoured(proxy, logger)
+          reasons = [] #: Array[String]
+          reasons << "a custom proxy challenge handler" unless proxy.challenge_handler.nil?
+          unless proxy.type == ::Dexpace::Proxy::Type::HTTP
+            reasons << "proxy type #{proxy.type.name}"
+          end
+          return if reasons.empty?
+
+          ::Dexpace::Instrumentation.contain(logger, event: PROXY_LIMITATION_EVENT) do
+            logger.event(::Dexpace::Instrumentation::Severity::WARNING)
+              .event(PROXY_LIMITATION_EVENT)
+              .field("unhonoured", reasons.join(", "))
+              .field("remedy", "Basic proxy authentication from the proxy's username and password")
+              .emit
+          end
+        end
+      end
+
+      private_constant :ProxyRoute
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/request_mapper.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/request_mapper.rb
new file mode 100644
index 0000000..22cedcb
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/request_mapper.rb
@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # R2's eight steps, in order, as one function returning a Net::HTTPGenericRequest. The only
+      # place in this gem that touches Dexpace::HeaderSyntax, the only place that reads
+      # MANAGED_HEADERS, and the only place that constructs a native request. TRANSPORT-17's
+      # adapter-discipline half ("MUST NOT itself trigger a second write") is a property of this
+      # file's shape: `body_stream=` is assigned exactly once, on the one path through `.build`,
+      # and nothing here loops. A private_constant of NetHTTP.
+      module RequestMapper
+        extend self
+
+        # The three headers Net::HTTPGenericRequest#initialize stamps on every request and this
+        # adapter deletes (P8-2): the wire carries the caller's header set and nothing else.
+        AUTO_STAMPS = %w[Accept Accept-Encoding User-Agent].freeze
+        private_constant :AUTO_STAMPS
+
+        # @param request [Dexpace::Request] the request to send, or anything duck-typed like one
+        # @param logger [Dexpace::Instrumentation::Logger] where each managed-header drop is logged
+        #   at VERBOSE (TRANSPORT-11)
+        # @return [Net::HTTPGenericRequest]
+        # @raise [Dexpace::InvalidArgumentError] when an outbound header name or value fails the
+        #   wire-boundary re-validation (HTTP-17, HTTP-18)
+        def build(request, logger:)
+          revalidate!(request)
+
+          body_permitted = !request.method.body_forbidden?
+          native = native_request(request, body_permitted)
+          copy_headers(request, native, logger)
+          suppress_decode_content(native)
+          set_content_type(request, native, body_permitted)
+          attach_body(request, native, body_permitted)
+          native
+        end
+
+        private
+
+        # An empty header set, the three auto-stamps deleted as soon as they are stamped.
+        def native_request(request, body_permitted)
+          native = ::Net::HTTPGenericRequest.new(request.method.token, body_permitted,
+                                                 request.method.token != "HEAD",
+                                                 request.url.request_uri, {})
+          AUTO_STAMPS.each { |name| native.delete(name) }
+          native
+        end
+
+        # The wire-boundary re-validation phase 1 postponed to the adapters (HTTP-17, HTTP-18,
+        # XCUT-18): every outbound name and value is checked again immediately before dispatch,
+        # BEFORE anything is copied, because HTTP-2's constructor privacy is bypassable and a
+        # duck-typed impostor can reach this code with no Dexpace validation ever having run.
+        # Measured: Net::HTTP#[]= rejects a CR/LF VALUE but writes a CR/LF NAME straight to the
+        # wire, so the name half is the half with no native backstop.
+        def revalidate!(request)
+          request.headers.each_entry do |name, value|
+            ::Dexpace::HeaderSyntax.validate_name!(name)
+            ::Dexpace::HeaderSyntax.validate_outbound_value!(value, name: name)
+          end
+        end
+
+        # TRANSPORT-11: the caller's headers minus MANAGED_HEADERS, each drop logged once. `Host`
+        # is the one that needs saying: Net::HTTP fills it from the URL only when the slot is
+        # empty, so a caller's value that reached the native request would be honoured verbatim.
+        def copy_headers(request, native, logger)
+          request.headers.each_entry do |name, value|
+            if MANAGED_HEADERS.include?(::Dexpace::HeaderName.of(name).folded)
+              log_drop(logger, name)
+            else
+              native.add_field(name, value)
+            end
+          end
+        end
+
+        # P8-3: the switch is `#[]=`, never `#add_field`, because only `#[]=` flips
+        # @decode_content off as a side effect. Re-assigning the caller's own value preserves it
+        # while still tripping the flip; assigning then deleting leaves the flag off and the
+        # header absent when the caller set none.
+        def suppress_decode_content(native)
+          caller_value = native["Accept-Encoding"]
+          if caller_value
+            native["Accept-Encoding"] = caller_value
+          else
+            native["Accept-Encoding"] = "identity"
+            native.delete("Accept-Encoding")
+          end
+        end
+
+        # TRANSPORT-10 and P8-4 together: the caller's explicit header wins (matched
+        # case-insensitively, because Net::HTTPHeader#key? folds); failing that the body's own
+        # media type; failing that DEFAULT_CONTENT_TYPE -- and only ever on a body-permitted
+        # method, body or not, because Net::HTTP gives every body-permitted request a body and its
+        # own fallback would stamp a form type the wire should never carry.
+        def set_content_type(request, native, body_permitted)
+          return if !body_permitted || native.key?("Content-Type")
+
+          media = request.body&.media_type
+          native["Content-Type"] = media ? media.render : DEFAULT_CONTENT_TYPE
+        end
+
+        # Framing is derived from the body and never copied: Content-Length from a known length,
+        # `Transfer-Encoding: chunked` from an unknown one, neither when there is no body -- a
+        # body-less body-permitted request is left to Net::HTTP, which substitutes a zero-length
+        # body with `Content-Length: 0` itself (TRANSPORT-26). The body goes out as a stream
+        # through 3a's `.over`, which owns nothing and pulls from `#each` on demand.
+        def attach_body(request, native, body_permitted)
+          body = request.body
+          return unless body_permitted && body
+
+          length = body.content_length
+          if length >= 0
+            native["Content-Length"] = length.to_s
+          else
+            native["Transfer-Encoding"] = "chunked"
+          end
+          native.body_stream = ::Dexpace::IO::BufferedSource.over(body)
+        end
+
+        # The shared transport contract's one event and field pair, so one conformance assertion
+        # reads a drop record from either adapter.
+        def log_drop(logger, name)
+          event = ::Dexpace::Instrumentation::Events::TRANSPORT_HEADER_DROPPED
+          ::Dexpace::Instrumentation.contain(logger, event: event) do
+            logger.event(::Dexpace::Instrumentation::Severity::VERBOSE)
+              .event(event)
+              .field("header", name)
+              .field("reason", "transport managed header (TRANSPORT-11)")
+              .emit
+          end
+        end
+      end
+
+      private_constant :RequestMapper
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
new file mode 100644
index 0000000..4969c37
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # Takes the native head off the pump and returns a Dexpace::Response (TRANSPORT-14,
+      # TRANSPORT-24, TRANSPORT-27). R4: this file never calls `res.content_length` and never lets
+      # `read_body` call it either -- the length is parsed from the RAW header text, and an
+      # unparseable one is deleted from the native response before the pump reads the body, so
+      # connection-close framing takes over instead of Net::HTTPResponse#content_length raising
+      # Net::HTTPHeaderSyntaxError. Headers come from `#to_hash` and nothing else: `#[]` joins
+      # with ", " and `#each_capitalized` re-cases, both of which would corrupt a multi-valued
+      # Set-Cookie. Dexpace::Protocol admits HTTP/1.1 and HTTP/2 only (HTTP-33), so an HTTP/1.0
+      # response raises Dexpace::InvalidArgumentError here; no TRANSPORT ID asks for 1.0 and the
+      # gap is phase 1's to widen. A private_constant of NetHTTP.
+      module ResponseMapper
+        extend self
+
+        # R4: anchored, character-class-only and linear, so it cannot backtrack and needs no
+        # timeout. `Integer("-4", exception: false)` would answer -4 and collide with the
+        # unknown-length sentinel; this admits one or more digits and nothing else.
+        LENGTH = /\A[0-9]+\z/
+        private_constant :LENGTH
+
+        # @param request [Dexpace::Request] the request the response answers
+        # @param native [Net::HTTPResponse] the head, delivered by the pump before any body read
+        # @param pump [#readpartial, #close] the body source; closed here when there is no body
+        # @param logger [Dexpace::Instrumentation::Logger] where each malformed-header drop is
+        #   logged at VERBOSE (TRANSPORT-14)
+        # @param head [Boolean] whether the request was a HEAD, whose response carries no body
+        #   whatever its status class says
+        # @return [Dexpace::Response]
+        def build(request:, native:, pump:, logger: ::Dexpace::Instrumentation::Logger::NULL,
+                  head: false)
+          # ORDER IS LOAD-BEARING: the headers are copied into Dexpace::Headers FIRST, so the
+          # caller keeps the Content-Length the server actually sent; parse_length! may then
+          # delete it from the NATIVE response, which is an instruction to read_body's framing and
+          # not a rewrite of the response.
+          headers = filter_headers(native, logger)
+          body = body_for(native, pump, head)
+          ::Dexpace::Response.build(
+            request: request, protocol: "HTTP/#{native.http_version}", status: native.code.to_i,
+            reason: native.message, headers: headers, body: body,
+          )
+        end
+
+        private
+
+        # A 204, a 304 or a HEAD response -- anything for which Net::HTTP will read no body --
+        # gets `body: nil` and the pump is closed at once, because a ResponseBody over a stream
+        # that will never yield is a resource with no reader.
+        def body_for(native, pump, head)
+          if head || !native.class.body_permitted?
+            ::Dexpace.close_quietly(pump)
+            return nil
+          end
+
+          content_length = parse_length!(native)
+          ::Dexpace::ResponseBody.new(source: ::Dexpace::IO::BufferedSource.wrapping(pump),
+                                      media_type: parse_media_type(native),
+                                      content_length: content_length,)
+        end
+
+        # R4: the raw header, or -1 for absent, non-numeric, negative or multi-valued -- and in
+        # the -1 case the header is deleted from the NATIVE response so read_body finds no length
+        # and no chunked encoding and falls through to connection-close framing. The wire value
+        # has already been copied into Dexpace::Headers, so only the INTERPRETATION becomes -1.
+        def parse_length!(native)
+          raw = native.to_hash["content-length"]
+          return raw.first.to_i if raw&.size == 1 && LENGTH.match?(raw.first)
+
+          native.delete("content-length")
+          -1
+        end
+
+        # TRANSPORT-27: MediaType.parse RAISES on a malformed value rather than returning nil,
+        # so this rescue is what produces "downgraded to no media type". The malformed value
+        # still reaches the caller verbatim in Dexpace::Headers.
+        def parse_media_type(native)
+          raw = native.to_hash["content-type"]&.first
+          return nil if raw.nil?
+
+          ::Dexpace::MediaType.parse(raw)
+        rescue ::Dexpace::InvalidArgumentError
+          nil
+        end
+
+        # TRANSPORT-14: filtered BEFORE the values reach Headers::Builder, because it re-validates
+        # and would raise on exactly the bytes this filter exists to drop; obs-text is an admitted
+        # inbound byte and is kept. Each drop is logged at VERBOSE by name -- never the value.
+        def filter_headers(native, logger)
+          builder = ::Dexpace::Headers.inbound_builder
+          native.to_hash.each do |name, values|
+            next log_drop(logger, name) unless ::Dexpace::HeaderSyntax.valid_name?(name)
+
+            values.each do |value|
+              next log_drop(logger, name) unless ::Dexpace::HeaderSyntax.valid_inbound_value?(value)
+
+              builder.add(name, value)
+            end
+          end
+          builder.build
+        end
+
+        def log_drop(logger, name)
+          event = ::Dexpace::Instrumentation::Events::TRANSPORT_HEADER_DROPPED
+          ::Dexpace::Instrumentation.contain(logger, event: event) do
+            logger.event(::Dexpace::Instrumentation::Severity::VERBOSE)
+              .event(event)
+              .field("header", name.b)
+              .field("reason", "malformed inbound header (TRANSPORT-14)")
+              .emit
+          end
+        end
+      end
+
+      private_constant :ResponseMapper
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
new file mode 100644
index 0000000..3892760
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
@@ -0,0 +1,223 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # R1 (P8-1): a per-response producer Thread over a Thread::SizedQueue(1), not a Fiber --
+      # Fiber#resume from a second thread raises FiberError, which would break
+      # Transport.async_over's composition and confine TRANSPORT-29's "returned response graph"
+      # to one thread. The producer runs the whole Net::HTTP exchange; the consumer pops the head
+      # on the caller's thread and then chunks through a #readpartial-shaped reader that
+      # BufferedSource.wrapping owns and closes, so `Response#close` cascades down to `#close`
+      # here. One thread per in-flight response, alive until the body is drained or the response
+      # is closed; a response nobody closes and nobody drains strands one thread and one
+      # connection, which is the documented consequence of breaking SEAM-11's "the caller owns
+      # reading and closing it". A private_constant of NetHTTP.
+      class ResponsePump # rubocop:disable Metrics/ClassLength -- one mechanism with two halves, the producer's and the consumer's, which share the queue, the latch and the token and split by nothing but which thread runs them
+        include ::Dexpace::Closeable
+
+        # @param http [Net::HTTP] the client to exchange through
+        # @param native [Net::HTTPGenericRequest] the mapped request
+        # @param deadline [Deadline, nil] this call's budget, refreshed into read_timeout after
+        #   every chunk (R3); nil on the borrowing construction, whose client is never touched
+        # @param cancellation [Dexpace::Cancellation] the token this call was given, asked FIRST
+        #   by every failure classification (TRANSPORT-3)
+        # @param owns_connection [Boolean] false on the borrowing construction (P8-15), where the
+        #   client is neither started nor finished here: Net::HTTP#request opens and closes its
+        #   own session on an unstarted client and reuses an already-started one
+        # @param permit [Thread::SizedQueue, nil] the one-permit queue a borrowed call took,
+        #   returned when the PRODUCER is done with the client -- the exchange, not the #call, is
+        #   what must not overlap
+        def initialize(http:, native:, deadline:, cancellation:, owns_connection: true, permit: nil)
+          @http = http
+          @native = native
+          @deadline = deadline
+          @cancellation = cancellation
+          @owns_connection = owns_connection
+          @permit = permit
+          @queue = ::Thread::SizedQueue.new(1)
+          @proceed = ::Thread::Queue.new
+          @residue = (+"").b
+          initialize_closeable(owned: true)
+          @thread = ::Thread.new { produce }
+          # The caller's cancellation closes this pump for the whole life of the response, not
+          # only for the head: a cancel under a blocked body read is what finishes the owned
+          # connection and wakes the producer (TRANSPORT-3). Registered AFTER the thread exists,
+          # because an already-cancelled token fires the hook at once; detached in #release, so
+          # a client-lifetime token retains this closure only until the response is closed.
+          @subscription = cancellation.on_cancel { close }
+        end
+
+        # Blocks on the first pop and returns the native head -- or, with a block, yields it and
+        # returns what the block returns. The producer does not touch the body until the head has
+        # been adapted: R4 deletes an unparseable Content-Length from the native head so that
+        # read_body never parses it, and that deletion must land BEFORE read_body starts, on the
+        # thread that adapts. The block is that window; the producer is resumed when it ends,
+        # whatever it did. A failure before the head is re-raised on THIS thread with the carried
+        # error as its cause, spelled explicitly: the pump is CARRYING a failure from another
+        # thread, not rescuing one of its own, so `$!` here may be an unrelated exception in
+        # flight on the caller's own stack.
+        #
+        # @yieldparam head [Net::HTTPResponse] the head, before any body byte is read
+        # @return [Net::HTTPResponse, Object] the head, or the block's value
+        # @raise [Dexpace::TransportError, Dexpace::CancelledError] the classified failure
+        def head_or_raise
+          kind, payload = @queue.pop
+          case kind
+          when :head
+            begin
+              block_given? ? yield(payload) : payload
+            ensure
+              resume_producer
+            end
+          when :error then carry(payload, phase: :connect)
+          else
+            # The queue closed with no head and no error: the pump was closed under the
+            # producer, by a cancel or by the caller. The token decides which.
+            ended = ::Dexpace::TransportError.new("the exchange ended before a response",
+                                                  phase: :connect,)
+            raise Failures.wrap(ended, phase: :connect, cancellation: @cancellation)
+          end
+        end
+
+        # The #readpartial-shaped reader BufferedSource.wrapping owns. Pops when the residue is
+        # empty; raises Dexpace::EndOfStreamError -- an ::EOFError subclass, load-bearing:
+        # IO.copy_stream and BufferedSource both terminate cleanly on it -- at end of stream;
+        # re-raises a carried producer failure the way #head_or_raise does; and writes into
+        # `outbuf` with #replace, so the destination carries BINARY whatever the caller's buffer
+        # had before.
+        #
+        # @param maxlen [Integer]
+        # @param outbuf [String, nil]
+        # @return [String] BINARY bytes, at most maxlen of them
+        def readpartial(maxlen, outbuf = nil)
+          raise closed_failure if closed?
+
+          fill if @residue.empty?
+          chunk = @residue.byteslice(0, maxlen).to_s
+          @residue = (@residue.byteslice(maxlen..) || "").b # a fresh, unfrozen, BINARY tail
+          return chunk if outbuf.nil?
+
+          outbuf.replace(chunk)
+        end
+
+        private
+
+        def resume_producer
+          @proceed.push(true)
+          nil
+        rescue ::ClosedQueueError
+          nil
+        end
+
+        def fill
+          kind, payload = @queue.pop
+          case kind
+          when :chunk then @residue << payload.b
+          when :error then carry(payload, phase: :read)
+          else
+            # A closed queue is the end of the body only when the PRODUCER closed it; closed
+            # under a read by #release it is a truncation, never a clean end of stream.
+            raise closed_failure if closed?
+
+            raise ::Dexpace::EndOfStreamError, "the response body is exhausted"
+          end
+        end
+
+        # Use after close (3a's rule), classified through the token first so a response closed
+        # by a cancel reads as the cancellation it was (TRANSPORT-3).
+        def closed_failure
+          closed = ::Dexpace::ClosedError.new("the response was already closed")
+          Failures.wrap(closed, phase: :read, cancellation: @cancellation)
+        end
+
+        # `cause:` is spelled at every carried raise: the original when the error was wrapped,
+        # and `nil` when Failures.wrap handed the payload back unchanged -- raising an error with
+        # itself as its cause is refused by Ruby, and `cause: nil` never clears a cause the
+        # producer's own raise already made.
+        def carry(payload, phase:)
+          error = Failures.wrap(payload, phase: phase, cancellation: @cancellation)
+          raise error, cause: nil if error.equal?(payload)
+
+          raise error, cause: payload
+        end
+
+        # Runs on the PRODUCER's thread. A failure is pushed rather than raised, the queue is
+        # closed in the ensure (never in a rescue) so a consumer blocked on pop ends rather than
+        # hangs, and the permit goes back only here, once the client is free.
+        def produce
+          if @owns_connection
+            @http.start { |connected| exchange(connected) }
+          else
+            exchange(@http)
+          end
+        rescue ::StandardError => error
+          begin
+            @queue.push([:error, error])
+          rescue ::ClosedQueueError
+            nil
+          end
+        ensure
+          @queue.close
+          @permit&.push(:permit)
+        end
+
+        # A push onto a closed queue raises ClosedQueueError, and that raise is the check-after-
+        # resume this producer relies on: it is DELIBERATELY not a `break`. Raising out of the
+        # read_body block makes Net::HTTP close its own socket on the way out, where a break
+        # would leave a half-read connection open and, on a borrowed client, keep it alive for
+        # the caller's next request to read the remainder as a corrupt status line.
+        def exchange(connected)
+          refresh_read_timeout
+          connected.request(@native) do |res|
+            @queue.push([:head, res])
+            @proceed.pop # until the head is adapted, or the pump is closed (nil either way)
+            refresh_read_timeout
+            res.read_body do |chunk|
+              @queue.push([:chunk, chunk])
+              refresh_read_timeout
+            end
+          end
+        end
+
+        # R3: the remaining budget into read_timeout after every chunk this pump receives, when
+        # a deadline was supplied at all. An expired budget raises here rather than being handed
+        # over as zero, which Net::HTTP reads as "poll once".
+        def refresh_read_timeout
+          deadline = @deadline
+          return if deadline.nil?
+
+          if deadline.expired?
+            raise ::Dexpace::TransportError.new("the per-call budget expired mid-exchange",
+                                                phase: :read,)
+          end
+          @http.read_timeout = deadline.clamped
+        end
+
+        # R1's release, in order: the latch is already flipped by Closeable#close; close the
+        # queue, waking a producer blocked on push; finish the connection this pump opened,
+        # waking one blocked in a socket read with IOError -- which works only because
+        # `max_retries = 0` keeps Net::HTTP from retrying through it; join with a BOUNDED
+        # deadline (XCUT-13). On the borrowing construction the socket is the caller's and is
+        # not finished: the producer is left to the caller's own read_timeout, the stated
+        # narrowing of TRANSPORT-19's prompt unblock there. Both wakeups are wrapped so a close
+        # cannot raise over a primary failure.
+        def release
+          begin
+            @queue.close
+            @proceed.close
+            @http.finish if @owns_connection && @http.started?
+          rescue ::StandardError
+            nil
+          end
+          @thread.join(JOIN_DEADLINE_SECONDS)
+          @subscription.detach
+          nil
+        end
+      end
+
+      private_constant :ResponsePump
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/tls_settings.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/tls_settings.rb
new file mode 100644
index 0000000..e1fe49b
--- /dev/null
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/tls_settings.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+module Dexpace
+  module Transport
+    module NetHTTP
+      # R18: `.build`'s `tls:` keyword, validated once at construction and applied to each per-call
+      # client only when the request is `https`. Plain values only -- a path String, an OpenSSL
+      # object the CALLER built, a Symbol version -- so nothing here is named in a public
+      # signature: `tls:` is typed `untyped` in sig/ with a YARD block listing TLS_SETTINGS,
+      # because OpenSSL::X509::Certificate, OpenSSL::PKey::RSA and OpenSSL::SSL::VERIFY_PEER are
+      # all constants NFR-11's scan rejects. A private_constant of NetHTTP.
+      module TLSSettings
+        extend self
+
+        # @param settings [Hash, nil] see NetHTTP::TLS_SETTINGS
+        # @return [Hash] frozen, possibly empty
+        # @raise [Dexpace::InvalidArgumentError] for a non-Hash, or for a key outside
+        #   TLS_SETTINGS -- a silently ignored `verify_mode:` is a security setting the caller
+        #   believes they set
+        def validate!(settings)
+          if settings.nil?
+            none = {} #: Hash[Symbol, untyped]
+            return none.freeze
+          end
+
+          unless settings.is_a?(::Hash)
+            raise ::Dexpace::InvalidArgumentError,
+                  "tls: takes a Hash of #{TLS_SETTINGS.join(", ")} or nil, not a #{settings.class}"
+          end
+
+          unknown = settings.keys - TLS_SETTINGS
+          unless unknown.empty?
+            raise ::Dexpace::InvalidArgumentError,
+                  "tls: does not accept #{unknown.map(&:inspect).join(", ")}; accepted keys are " \
+                  "#{TLS_SETTINGS.join(", ")}"
+          end
+
+          settings.dup.freeze
+        end
+
+        # Assigns only the keys the caller passed, so the default path assigns NOTHING and
+        # OpenSSL's own VERIFY_PEER-with-hostname-verification defaults survive. The adapter never
+        # weakens a default on its own.
+        #
+        # @param http [Net::HTTP] an unstarted, owned client with `use_ssl` on
+        # @param settings [Hash] the validated settings
+        # @return [nil]
+        def apply(http, settings)
+          settings.each { |key, value| http.public_send(:"#{key}=", value) }
+          nil
+        end
+      end
+
+      private_constant :TLSSettings
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http.rbs
index c358a6a..b7e9924 100644
--- a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http.rbs
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http.rbs
@@ -1,6 +1,21 @@
 module Dexpace
   module Transport
+    # The reference synchronous transport over net/http (phase 8a). Nothing from net/http names
+    # a public signature here (NFR-11): `.using`'s client and `.build`'s `tls:` are untyped, with
+    # their YARD blocks saying what each accepts.
     module NetHTTP
+      DEFAULT_TIMEOUT_SECONDS: Float
+      MIN_TIMEOUT_SECONDS: Float
+      JOIN_DEADLINE_SECONDS: Float
+      REGISTRY_KEY: Symbol
+      TLS_SETTINGS: Array[Symbol]
+      MANAGED_HEADERS: Array[String]
+      DEFAULT_CONTENT_TYPE: String
+      PROXY_LIMITATION_EVENT: String
+
+      def self?.build: (?timeout: Numeric?, ?logger: Instrumentation::Logger, ?tls: untyped) -> Adapter
+      def self?.using: (untyped client, ?logger: Instrumentation::Logger) -> Adapter
+      def self?.default: () -> Adapter
     end
   end
 end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/adapter.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/adapter.rbs
new file mode 100644
index 0000000..e29a89d
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/adapter.rbs
@@ -0,0 +1,52 @@
+module Dexpace
+  module Transport
+    module NetHTTP
+      # The transport (SEAM-11): private .new, two construction entry points reached through
+      # NetHTTP.build and NetHTTP.using, and Closeable's latch as the only state written after
+      # construction (TRANSPORT-29). The Net::HTTP ivars are untyped: nothing from net/http may
+      # name a signature (NFR-11).
+      class Adapter
+        include Dexpace::Closeable
+
+        @client: untyped
+        @timeout: Numeric?
+        @logger: Instrumentation::Logger
+        @tls: Hash[Symbol, untyped]?
+        @clock: Dexpace::Clock
+        @permit: Thread::SizedQueue?
+
+        def self.owning: (timeout: Numeric?, logger: Instrumentation::Logger,
+                          tls: Hash[Symbol, untyped]) -> Adapter
+        def self.borrowing: (untyped client, logger: Instrumentation::Logger) -> Adapter
+        private def self.timeout!: (untyped timeout) -> void
+        private def self.new: (client: untyped, timeout: Numeric?, logger: Instrumentation::Logger,
+                               tls: Hash[Symbol, untyped]?, owned: bool) -> instance
+        def initialize: (client: untyped, timeout: Numeric?, logger: Instrumentation::Logger,
+                         tls: Hash[Symbol, untyped]?, owned: bool) -> void
+
+        def call: (Dexpace::Request request, Dexpace::RequestOptions options,
+                   Dexpace::Cancellation? cancellation) -> Dexpace::Response
+
+        private
+
+        def perform: (Dexpace::Request request, Dexpace::RequestOptions options,
+                      Dexpace::Cancellation cancellation) -> Dexpace::Response
+        def owned_call: (Dexpace::Request request, Dexpace::RequestOptions options,
+                         Dexpace::Cancellation cancellation) -> Dexpace::Response
+        def resolve_timeout: (Dexpace::RequestOptions options) -> Numeric
+        def configured_timeout: () -> Float
+        def owned_client_for: (URI::Generic url, Deadline deadline) -> untyped
+        def borrowed_call: (Dexpace::Request request, Dexpace::RequestOptions options,
+                            Dexpace::Cancellation cancellation) -> Dexpace::Response
+        def check_endpoint!: (URI::Generic url) -> void
+        def routed_client: (URI::Generic url) -> untyped
+        def apply_budget: (untyped http, Deadline deadline) -> untyped
+        def bound_to?: (URI::Generic url) -> bool
+        def dispatch: (Dexpace::Request request, native: untyped, http: untyped,
+                       deadline: Deadline?, cancellation: Dexpace::Cancellation,
+                       owns_connection: bool, permit: Thread::SizedQueue?) -> Dexpace::Response
+        def release: () -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/deadline.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/deadline.rbs
new file mode 100644
index 0000000..2fd9713
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/deadline.rbs
@@ -0,0 +1,26 @@
+# Dexpace::Transport::NetHTTP::Deadline is a private_constant and not public API: this declaration
+# exists because the `net_http` Steep target checks every file under lib/ and needs the class
+# declared to type Adapter's and ResponsePump's call sites. RBS has no visibility for a constant,
+# so the privacy lives in lib/dexpace/transport/net_http/deadline.rb alone.
+module Dexpace
+  module Transport
+    module NetHTTP
+      # The one clock method Deadline reads: Dexpace::Clock and any monotonic fake answer it.
+      interface _MonotonicClock
+        def monotonic: () -> Float
+      end
+
+      class Deadline
+        @clock: _MonotonicClock
+        @instant: Float
+
+        private def self.new: (_MonotonicClock clock, Float instant) -> instance
+        def self.build: (clock: _MonotonicClock, budget: Numeric) -> Deadline
+        def initialize: (_MonotonicClock clock, Float instant) -> void
+        def remaining: () -> Float
+        def expired?: () -> bool
+        def clamped: () -> Float
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/failures.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/failures.rbs
new file mode 100644
index 0000000..1b56eeb
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/failures.rbs
@@ -0,0 +1,17 @@
+# Dexpace::Transport::NetHTTP::Failures is a private_constant and not public API: this declaration
+# exists because the `net_http` Steep target checks every file under lib/ and needs the module and
+# its one function declared to type Adapter's and ResponsePump's call sites. RBS has no visibility
+# for a constant, so the privacy lives in lib/dexpace/transport/net_http/failures.rb alone.
+module Dexpace
+  module Transport
+    module NetHTTP
+      module Failures
+        def self?.wrap: (Exception error, phase: Symbol, cancellation: Dexpace::Cancellation) -> Exception
+
+        private
+
+        def own?: (Exception error) -> bool
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/proxy_route.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/proxy_route.rbs
new file mode 100644
index 0000000..17aa987
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/proxy_route.rbs
@@ -0,0 +1,25 @@
+# Dexpace::Transport::NetHTTP::ProxyRoute is a private_constant and not public API: this
+# declaration exists because the `net_http` Steep target checks every file under lib/ and needs
+# the snapshot declared to type Adapter's call site. RBS has no visibility for a constant, so the
+# privacy lives in lib/dexpace/transport/net_http/proxy_route.rb alone.
+module Dexpace
+  module Transport
+    module NetHTTP
+      class ProxyRoute < Data
+        attr_reader address: String?
+        attr_reader port: Integer?
+        attr_reader username: String?
+        attr_reader password: String?
+
+        def self.new: (address: String?, port: Integer?, username: String?,
+                       password: String?) -> instance
+        def self.none: () -> ProxyRoute
+        def self.for: (URI::Generic url, ?configuration: Dexpace::Configuration,
+                       ?logger: Instrumentation::Logger) -> ProxyRoute
+        def self.from: (Dexpace::Proxy proxy, URI::Generic url,
+                        ?logger: Instrumentation::Logger) -> ProxyRoute
+        def self.warn_unhonoured: (Dexpace::Proxy proxy, Instrumentation::Logger logger) -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/request_mapper.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/request_mapper.rbs
new file mode 100644
index 0000000..dab4ed5
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/request_mapper.rbs
@@ -0,0 +1,26 @@
+# Dexpace::Transport::NetHTTP::RequestMapper is a private_constant and not public API: this
+# declaration exists because the `net_http` Steep target checks every file under lib/ and needs
+# the module and its one function declared to type Adapter's call site. RBS has no visibility for
+# a constant, so the privacy lives in lib/dexpace/transport/net_http/request_mapper.rb alone. The
+# native request is untyped: nothing from net/http may name a signature (NFR-11).
+module Dexpace
+  module Transport
+    module NetHTTP
+      module RequestMapper
+        AUTO_STAMPS: Array[String]
+
+        def self?.build: (untyped request, logger: Instrumentation::Logger) -> untyped
+
+        private
+
+        def native_request: (untyped request, bool body_permitted) -> untyped
+        def revalidate!: (untyped request) -> void
+        def copy_headers: (untyped request, untyped native, Instrumentation::Logger logger) -> void
+        def suppress_decode_content: (untyped native) -> void
+        def set_content_type: (untyped request, untyped native, bool body_permitted) -> void
+        def attach_body: (untyped request, untyped native, bool body_permitted) -> void
+        def log_drop: (Instrumentation::Logger logger, String name) -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_mapper.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_mapper.rbs
new file mode 100644
index 0000000..4e3772c
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_mapper.rbs
@@ -0,0 +1,25 @@
+# Dexpace::Transport::NetHTTP::ResponseMapper is a private_constant and not public API: this
+# declaration exists because the `net_http` Steep target checks every file under lib/ and needs
+# the module and its one function declared to type Adapter's call site. RBS has no visibility for
+# a constant, so the privacy lives in lib/dexpace/transport/net_http/response_mapper.rb alone. The
+# native response is untyped: nothing from net/http may name a signature (NFR-11).
+module Dexpace
+  module Transport
+    module NetHTTP
+      module ResponseMapper
+        LENGTH: Regexp
+
+        def self?.build: (request: Dexpace::Request, native: untyped, pump: untyped,
+                          ?logger: Instrumentation::Logger, ?head: bool) -> Dexpace::Response
+
+        private
+
+        def body_for: (untyped native, untyped pump, bool head) -> Dexpace::ResponseBody?
+        def parse_length!: (untyped native) -> Integer
+        def parse_media_type: (untyped native) -> Dexpace::MediaType?
+        def filter_headers: (untyped native, Instrumentation::Logger logger) -> Dexpace::Headers
+        def log_drop: (Instrumentation::Logger logger, String name) -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
new file mode 100644
index 0000000..9714ab0
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
@@ -0,0 +1,44 @@
+# Dexpace::Transport::NetHTTP::ResponsePump is a private_constant and not public API: this
+# declaration exists because the `net_http` Steep target checks every file under lib/ and needs
+# the class declared to type Adapter's and ResponseMapper's call sites. RBS has no visibility for
+# a constant, so the privacy lives in lib/dexpace/transport/net_http/response_pump.rb alone. The
+# Net::HTTP ivars are untyped: nothing from net/http may name a signature (NFR-11).
+module Dexpace
+  module Transport
+    module NetHTTP
+      class ResponsePump
+        include Dexpace::Closeable
+
+        @http: untyped
+        @native: untyped
+        @deadline: Deadline?
+        @cancellation: Dexpace::Cancellation
+        @owns_connection: bool
+        @permit: Thread::SizedQueue?
+        @queue: Thread::SizedQueue
+        @proceed: Thread::Queue
+        @residue: String
+        @thread: Thread
+        @subscription: Dexpace::Cancellation::Subscription
+
+        def initialize: (http: untyped, native: untyped, deadline: Deadline?,
+                         cancellation: Dexpace::Cancellation, ?owns_connection: bool,
+                         ?permit: Thread::SizedQueue?) -> void
+        def head_or_raise: () -> untyped
+                         | [T] () { (untyped) -> T } -> T
+        def readpartial: (Integer maxlen, ?String? outbuf) -> String
+
+        private
+
+        def resume_producer: () -> nil
+        def fill: () -> void
+        def closed_failure: () -> Exception
+        def carry: (Exception payload, phase: Symbol) -> bot
+        def produce: () -> void
+        def exchange: (untyped connected) -> void
+        def refresh_read_timeout: () -> void
+        def release: () -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/tls_settings.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/tls_settings.rbs
new file mode 100644
index 0000000..53e4343
--- /dev/null
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/tls_settings.rbs
@@ -0,0 +1,15 @@
+# Dexpace::Transport::NetHTTP::TLSSettings is a private_constant and not public API: this
+# declaration exists because the `net_http` Steep target checks every file under lib/ and needs
+# the module and its two functions declared to type NetHTTP.build's and Adapter's call sites.
+# RBS has no visibility for a constant, so the privacy lives in
+# lib/dexpace/transport/net_http/tls_settings.rb alone.
+module Dexpace
+  module Transport
+    module NetHTTP
+      module TLSSettings
+        def self?.validate!: (untyped settings) -> Hash[Symbol, untyped]
+        def self?.apply: (untyped http, Hash[Symbol, untyped] settings) -> nil
+      end
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http_test.rb
index 0a6cd4a..1173325 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http_test.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 # SPDX-License-Identifier: MIT
 
+require "open3"
+require "rbconfig"
 require_relative "../../test_helper"
 
 # NFR-15: the version a published artifact reports at runtime is the real one. Styleguide 12.7:
@@ -8,10 +10,14 @@
 class NetHTTPTest < DexpaceTestCase
   # The top-level namespace is snapshotted around the require, so "defines nothing outside
   # Dexpace" holds whether this file loads alone or after the other five gems in one
-  # `rake test:gems` process, where Dexpace already exists. The intermediate namespace is
-  # snapshotted the same way: a sibling this entry file placed beside its own constant --
-  # `Dexpace::Transport::Shared` -- is outside the gem's namespace and inside nothing this suite
-  # would otherwise look at.
+  # `rake test:gems` process, where Dexpace already exists. `net/http` -- the one library this
+  # gem's lib/ requires beyond core's own, declared in the gemspec -- and `dexpace` itself are
+  # loaded first, the way core's smoke suite preloads `digest`: `Net` and core's whole tree are
+  # theirs, not the entry file's. The intermediate namespace is snapshotted the same way: a
+  # sibling this entry file placed beside its own constant -- `Dexpace::Transport::Shared` --
+  # is outside the gem's namespace and inside nothing this suite would otherwise look at.
+  require "net/http"
+  require "dexpace"
   TOP_LEVEL_BEFORE = Object.constants
   NAMESPACE_BEFORE = defined?(Dexpace) ? Dexpace.constants(false) : []
   SIBLINGS_BEFORE = defined?(Dexpace::Transport) ? Dexpace::Transport.constants(false) : []
@@ -20,6 +26,14 @@ class NetHTTPTest < DexpaceTestCase
   NAMESPACE_ADDED = (Dexpace.constants(false) - NAMESPACE_BEFORE).freeze
   SIBLINGS_ADDED = (Dexpace::Transport.constants(false) - SIBLINGS_BEFORE).freeze
 
+  # The public surface phase 8a built into the skeleton (design, "The object model 8a ships"):
+  # the transport, the eight named constants and phase 0's VERSION. The seven private_constants
+  # are absent from constants(false) by definition.
+  PUBLIC = %i[
+    VERSION Adapter DEFAULT_TIMEOUT_SECONDS MIN_TIMEOUT_SECONDS JOIN_DEADLINE_SECONDS REGISTRY_KEY
+    TLS_SETTINGS MANAGED_HEADERS DEFAULT_CONTENT_TYPE PROXY_LIMITATION_EVENT
+  ].freeze
+
   test "defines a semver VERSION string" do
     assert_match(/\A\d+\.\d+\.\d+\z/, Dexpace::Transport::NetHTTP::VERSION)
   end
@@ -31,10 +45,45 @@ class NetHTTPTest < DexpaceTestCase
     assert_equal(spec.version.to_s, Dexpace::Transport::NetHTTP::VERSION)
   end
 
-  test "defines nothing outside the Dexpace namespace" do
+  test "defines nothing outside the Dexpace namespace, and exactly its own constants inside it" do
     assert_empty(TOP_LEVEL_ADDED - [:Dexpace], "top-level constants added by the entry file")
     assert_empty(NAMESPACE_ADDED - %i[Transport], "constants added directly under Dexpace")
     assert_empty(SIBLINGS_ADDED - %i[NetHTTP], "constants added beside this gem's namespace")
-    assert_equal(%i[VERSION], Dexpace::Transport::NetHTTP.constants(false).sort)
+    assert_equal(PUBLIC.sort, Dexpace::Transport::NetHTTP.constants(false).sort)
+  end
+
+  # The registration is proved in a bare subprocess, where nothing else has required the gem:
+  # in one `rake test:gems` process the adapter's own suites load first and the key is already
+  # there, so an in-process before/after snapshot would prove nothing.
+  test "registers itself under REGISTRY_KEY at require time; the registry resolves an adapter" do
+    assert_includes(Dexpace::Transport.registered_keys, Dexpace::Transport::NetHTTP::REGISTRY_KEY)
+    assert_kind_of(Dexpace::Transport::NetHTTP::Adapter, Dexpace::Transport.resolve)
+    assert_equal("[:net_http]", bare_require("p Dexpace::Transport.registered_keys").strip)
+  end
+
+  test "declares dexpace-core and net-http, and nothing else (NFR-2)" do
+    gemspec = File.expand_path("../../../dexpace-transport-net_http.gemspec", __dir__)
+    spec = Gem::Specification.load(gemspec)
+
+    assert_equal(%w[dexpace-core net-http], spec.runtime_dependencies.map(&:name).sort)
+    assert_equal([">= 0.4"], spec.runtime_dependencies.find do |d|
+      d.name == "net-http"
+    end.requirement.as_list,)
+  end
+
+  LIBS = [File.expand_path("../../../lib", __dir__),
+          File.expand_path("../../../../dexpace-core/lib", __dir__),].freeze
+  private_constant :LIBS
+
+  private
+
+  def bare_require(program)
+    command = [RbConfig.ruby, "-w", "-W:deprecated", *LIBS.flat_map { |lib| ["-I", lib] }, "-e",
+               "require \"dexpace/transport/net_http\"; #{program}",]
+    stdout, stderr, status = Open3.capture3({ "RUBYOPT" => nil }, *command)
+
+    assert_predicate(status, :success?, stderr)
+    assert_empty(stderr, "a bare require must be silent under -w")
+    stdout
   end
 end
diff --git a/gems/dexpace-transport-net_http/test/test_helper.rb b/gems/dexpace-transport-net_http/test/test_helper.rb
index f67df15..40c49a0 100644
--- a/gems/dexpace-transport-net_http/test/test_helper.rb
+++ b/gems/dexpace-transport-net_http/test/test_helper.rb
@@ -7,3 +7,6 @@
 # own test support, which is not the cross-gem require_relative styleguide 12.6 forbids -- that
 # rule is about reaching into another *gem's* internals.
 require_relative "../../../test/support/dexpace_test_case"
+# The one connection that parks net-http's Timeout thread outside every test's thread count on
+# the rows whose net-http still connects through Timeout.timeout (see the file).
+require_relative "../../../test/support/net_http_warmup"
diff --git a/tasks/gates.rake b/tasks/gates.rake
index d29c106..8cc5ebc 100644
--- a/tasks/gates.rake
+++ b/tasks/gates.rake
@@ -45,7 +45,12 @@ def clean_bundle_check(name, path, entry, constant, core_path: nil)
       gem #{name.inspect}, path: #{path.inspect}
       #{core_line}
     GEMFILE
-    env = { "BUNDLE_GEMFILE" => File.join(dir, "Gemfile") }
+    # BUNDLE_PATH keeps every install inside the scratch directory: the first gem declaring a
+    # third-party dependency (dexpace-transport-net_http's `net-http >= 0.4`, resolved against
+    # rubygems.org) is where this `bundle install` could otherwise write a newer release into the
+    # running interpreter's own gem directory. Bundler's refusal -- the whole gate -- is unchanged.
+    env = { "BUNDLE_GEMFILE" => File.join(dir, "Gemfile"),
+            "BUNDLE_PATH" => File.join(dir, "vendor"), }
 
     Bundler.with_unbundled_env do
       bundle = Interpreter.executable("bundle")
diff --git a/test/fixtures/gates/require_allowlist/allowed.rb b/test/fixtures/gates/require_allowlist/allowed.rb
index 9084bd7..c528e5a 100644
--- a/test/fixtures/gates/require_allowlist/allowed.rb
+++ b/test/fixtures/gates/require_allowlist/allowed.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 # SPDX-License-Identifier: MIT
 
-# Gate fixture. The positive control for `require`: an allowlisted name and a dexpace/ path.
+# Gate fixture. The positive control for `require`: an allowlisted name, a dexpace/ path, and
+# the name phase 8a allowlisted for dexpace-conformance's file-body assertion (TRANSPORT-28).
 require "uri"
 require "dexpace/version"
+require "tempfile"
diff --git a/test/fixtures/surface/dexpace-conformance.txt b/test/fixtures/surface/dexpace-conformance.txt
index f8b87b4..5b17750 100644
--- a/test/fixtures/surface/dexpace-conformance.txt
+++ b/test/fixtures/surface/dexpace-conformance.txt
@@ -1,2 +1,100 @@
 Dexpace::Conformance
+Dexpace::Conformance::Allocations
+Dexpace::Conformance::Allocations#delta
+Dexpace::Conformance::Allocations::ATTEMPTS : Integer
+Dexpace::Conformance::Assertion
+Dexpace::Conformance::Assertion#body
+Dexpace::Conformance::Assertion#call
+Dexpace::Conformance::Assertion#ids
+Dexpace::Conformance::Assertion#name
+Dexpace::Conformance::Assertion.build
+Dexpace::Conformance::BorrowedPair
+Dexpace::Conformance::BorrowedPair#probe
+Dexpace::Conformance::BorrowedPair#still_usable?
+Dexpace::Conformance::BorrowedPair#transport
+Dexpace::Conformance::BorrowedPair.build
+Dexpace::Conformance::Failure
+Dexpace::Conformance::Failure#actual
+Dexpace::Conformance::Failure#expected
+Dexpace::Conformance::Failure#requirement_ids
+Dexpace::Conformance::MinitestDriver
+Dexpace::Conformance::MinitestDriver#conformance
+Dexpace::Conformance::MinitestDriver.build_case
+Dexpace::Conformance::MinitestDriver.drive
+Dexpace::Conformance::MinitestDriver.method_name_for
+Dexpace::Conformance::RecordingSpan
+Dexpace::Conformance::RecordingSpan#add_event
+Dexpace::Conformance::RecordingSpan#attributes
+Dexpace::Conformance::RecordingSpan#context
+Dexpace::Conformance::RecordingSpan#errors
+Dexpace::Conformance::RecordingSpan#events
+Dexpace::Conformance::RecordingSpan#finish
+Dexpace::Conformance::RecordingSpan#finished_at
+Dexpace::Conformance::RecordingSpan#record_error
+Dexpace::Conformance::RecordingSpan#recording?
+Dexpace::Conformance::RecordingSpan#set_attribute
+Dexpace::Conformance::RecordingSpan#status
+Dexpace::Conformance::RecordingSpan#status=
+Dexpace::Conformance::Report
+Dexpace::Conformance::Report#errors
+Dexpace::Conformance::Report#failures
+Dexpace::Conformance::Report#passed?
+Dexpace::Conformance::Report#preamble
+Dexpace::Conformance::Report#results
+Dexpace::Conformance::Report#to_s
+Dexpace::Conformance::Report#vacuous
+Dexpace::Conformance::Report#waived
+Dexpace::Conformance::Result
+Dexpace::Conformance::Result#assertion
+Dexpace::Conformance::Result#detail
+Dexpace::Conformance::Result#status
+Dexpace::Conformance::Result.build
+Dexpace::Conformance::Result::STATUSES : Array
+Dexpace::Conformance::Scripts
+Dexpace::Conformance::Scripts#dribble
+Dexpace::Conformance::Scripts#echo_path
+Dexpace::Conformance::Scripts#fail_first_connection_then_succeed
+Dexpace::Conformance::Scripts#fixed
+Dexpace::Conformance::Scripts#hang_after_headers
+Dexpace::Conformance::Scripts#hang_before_headers
+Dexpace::Conformance::Scripts#large
+Dexpace::Conformance::Scripts#large_body
+Dexpace::Conformance::Scripts#malformed_content_length
+Dexpace::Conformance::Scripts#malformed_headers
+Dexpace::Conformance::Scripts#redirect
+Dexpace::Conformance::Scripts#sequenced
+Dexpace::Conformance::Scripts#truncated
+Dexpace::Conformance::Scripts#vendor_status
+Dexpace::Conformance::Scripts#write_response
+Dexpace::Conformance::TransportCase
+Dexpace::Conformance::TransportCase#borrowed_transport
+Dexpace::Conformance::TransportCase#request
+Dexpace::Conformance::TransportCase#settle
+Dexpace::Conformance::TransportCase#teardown
+Dexpace::Conformance::TransportCase#transport
+Dexpace::Conformance::TransportCase#wire
+Dexpace::Conformance::TransportCase::DEFAULT_SETTLE : Proc
+Dexpace::Conformance::TransportCase::DEFAULT_WIRE : Proc
+Dexpace::Conformance::TransportSuite
+Dexpace::Conformance::TransportSuite#assertions
+Dexpace::Conformance::TransportSuite#run
+Dexpace::Conformance::TransportSuite::PREAMBLE : String
 Dexpace::Conformance::VERSION : String
+Dexpace::Conformance::Vacuous
+Dexpace::Conformance::Vacuous#reason
+Dexpace::Conformance::WireServer
+Dexpace::Conformance::WireServer#await_closed_connection
+Dexpace::Conformance::WireServer#close
+Dexpace::Conformance::WireServer#closed_connections
+Dexpace::Conformance::WireServer#connections
+Dexpace::Conformance::WireServer#port
+Dexpace::Conformance::WireServer#requests
+Dexpace::Conformance::WireServer.start
+Dexpace::Conformance::WireServer::JOIN_DEADLINE_SECONDS : Float
+Dexpace::Conformance::WireServer::RecordedRequest
+Dexpace::Conformance::WireServer::RecordedRequest#body
+Dexpace::Conformance::WireServer::RecordedRequest#head
+Dexpace::Conformance::WireServer::RecordedRequest#header
+Dexpace::Conformance::WireServer::RecordedRequest#path
+Dexpace::Conformance::WireServer::RecordedRequest#request_line
+Dexpace::Conformance::WireServer::RecordedRequest.build
diff --git a/test/fixtures/surface/dexpace-core.txt b/test/fixtures/surface/dexpace-core.txt
index cb5adb6..5ccc0f0 100644
--- a/test/fixtures/surface/dexpace-core.txt
+++ b/test/fixtures/surface/dexpace-core.txt
@@ -277,6 +277,7 @@ Dexpace::Configuration::Keys::MAX_MATERIALIZED_BYTES : String
 Dexpace::Configuration::Keys::MAX_RETRY_ATTEMPTS : String
 Dexpace::Configuration::Keys::MAX_TRACKED_CONTEXTS : String
 Dexpace::Configuration::Keys::NO_PROXY : String
+Dexpace::Configuration::Keys::REQUEST_TIMEOUT : String
 Dexpace::Configuration::Sources
 Dexpace::Configuration::Sources.from_hash
 Dexpace::Configuration::Sources::ENVIRONMENT : Proc
@@ -483,6 +484,7 @@ Dexpace::Instrumentation::Events::INSTRUMENTATION_HOOK : String
 Dexpace::Instrumentation::Events::INSTRUMENTATION_LOG : String
 Dexpace::Instrumentation::Events::INSTRUMENTATION_PREFIX : String
 Dexpace::Instrumentation::Events::INSTRUMENTATION_SHUTDOWN : String
+Dexpace::Instrumentation::Events::TRANSPORT_HEADER_DROPPED : String
 Dexpace::Instrumentation::HTTPLogging
 Dexpace::Instrumentation::HTTPLogging#at_least?
 Dexpace::Instrumentation::HTTPLogging#name
@@ -1313,6 +1315,9 @@ Dexpace::Transport.register
 Dexpace::Transport.registered_keys
 Dexpace::Transport.resolve
 Dexpace::Transport.swap
+Dexpace::TransportError
+Dexpace::TransportError#phase
+Dexpace::TransportError#retryable?
 Dexpace::TypedResponse
 Dexpace::TypedResponse#headers
 Dexpace::TypedResponse#protocol
diff --git a/test/fixtures/surface/dexpace-transport-net_http.txt b/test/fixtures/surface/dexpace-transport-net_http.txt
index c16aa5e..a8d2b36 100644
--- a/test/fixtures/surface/dexpace-transport-net_http.txt
+++ b/test/fixtures/surface/dexpace-transport-net_http.txt
@@ -1,2 +1,17 @@
 Dexpace::Transport::NetHTTP
+Dexpace::Transport::NetHTTP#build
+Dexpace::Transport::NetHTTP#default
+Dexpace::Transport::NetHTTP#using
+Dexpace::Transport::NetHTTP::Adapter
+Dexpace::Transport::NetHTTP::Adapter#call
+Dexpace::Transport::NetHTTP::Adapter.borrowing
+Dexpace::Transport::NetHTTP::Adapter.owning
+Dexpace::Transport::NetHTTP::DEFAULT_CONTENT_TYPE : String
+Dexpace::Transport::NetHTTP::DEFAULT_TIMEOUT_SECONDS : Float
+Dexpace::Transport::NetHTTP::JOIN_DEADLINE_SECONDS : Float
+Dexpace::Transport::NetHTTP::MANAGED_HEADERS : Array
+Dexpace::Transport::NetHTTP::MIN_TIMEOUT_SECONDS : Float
+Dexpace::Transport::NetHTTP::PROXY_LIMITATION_EVENT : String
+Dexpace::Transport::NetHTTP::REGISTRY_KEY : Symbol
+Dexpace::Transport::NetHTTP::TLS_SETTINGS : Array
 Dexpace::Transport::NetHTTP::VERSION : String
diff --git a/test/support/net_http_warmup.rb b/test/support/net_http_warmup.rb
new file mode 100644
index 0000000..c979770
--- /dev/null
+++ b/test/support/net_http_warmup.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "net/http"
+require "socket"
+
+# net-http below 0.7 opens its connection inside Timeout.timeout (net/http.rb's #connect on
+# 0.4.1 and 0.6.0, the default gems of Ruby 3.2, 3.3 and 3.4), and the FIRST Timeout.timeout in
+# a process starts a process-wide singleton thread that lives for the rest of the process. 0.9.1,
+# Ruby 4.0's, connects through TCPSocket.open(open_timeout:) and starts none. DexpaceTestCase
+# counts threads around every test, so the first test to open a connection on a floor row would
+# be charged with a thread it did not start and cannot join. One connection here, at load and
+# before any count is taken, puts that thread where it belongs: outside every test. This is not
+# the SDK's code -- the SDK never calls Timeout.timeout (design §8.3) -- and the interrupt lands
+# on nothing, because the block returns at once. net-http's own use is on phase 10's inbound
+# list (the phase-8a design's findings).
+module NetHTTPWarmup
+  # @return [nil]
+  def self.run
+    server = ::TCPServer.new("127.0.0.1", 0)
+    accepter = ::Thread.new { server.accept.close }
+    client = ::Net::HTTP.new("127.0.0.1", server.addr[1])
+    client.open_timeout = 5
+    client.start { nil }
+    accepter.join(5)
+    nil
+  ensure
+    server&.close
+  end
+end
+
+NetHTTPWarmup.run
diff --git a/tools/require_allowlist.rb b/tools/require_allowlist.rb
index 89965ef..412b176 100644
--- a/tools/require_allowlist.rb
+++ b/tools/require_allowlist.rb
@@ -23,6 +23,13 @@ module RequireAllowlist
   # Deliberately narrower than "everything stable". The category is not the constraint; what core
   # actually needs is. Growing this list is a reviewed one-line diff naming the requirement that
   # motivated it. Every name was verified to require cleanly on 3.2.11, 3.4.10 and 4.0.6.
+  #
+  # `tempfile` (phase 8a, TRANSPORT-28): dexpace-conformance's file-body assertion needs a file
+  # with known bytes to upload a window of, and creating it inside the assertion is what keeps
+  # the burden off every consumer's harness. A default gem on every supported Ruby and on no row
+  # of Gem::BUNDLED_GEMS::SINCE (the "no allowlisted name is bundled" case in
+  # test/gates/require_allowlist_test.rb re-derives that on every CI row), so it is inside the
+  # rule's letter; nothing in core reads it. Added on 2026-09-20, the day the manager decided it.
   ALLOWED = %w[
     date
     digest
@@ -34,6 +41,7 @@ module RequireAllowlist
     singleton
     stringio
     strscan
+    tempfile
     time
     uri
   ].freeze

From ab034f1b7cd5f09e070a9e39df6cfa5b6ea423fb Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 16:26:38 +0300
Subject: [PATCH 02/15] fix: bounded Content-Length regexps, the swap pin and
 GC state (round 1)

Phase 8a, review round 0's three code-branch nits. R0-6: the adapter's
ResponseMapper::LENGTH and the conformance fixture's RequestReader length
check were regexp literals a wire value reaches; both are now
::Regexp.new('\A[0-9]{1,15}\z', timeout: 1.0).freeze, core's spelling for
every such pattern (PacingParsers, P6-61), so no header hands #to_i an
unbounded digit run -- a sixteen-digit Content-Length is the unknown-length
sentinel like any other value the grammar refuses. R0-7: the rewritten swap
pin in core's transport_test.rb compared a Proc with an Array and could not
fail; it now snapshots Transport.registered_keys before the swap and asserts
the same list afterwards. R0-10: Allocations.delta re-enabled the collector
unconditionally in its ensure; it now records what GC.disable answered and
re-enables only when it found the collector running, so a host that had GC
off around the call finds it off afterwards. The request_reader sig gains
the private LENGTH declaration the Steep target needs.
---
 .../lib/dexpace/conformance/allocations.rb    | 23 +++++++++++--------
 .../conformance/wire_server/request_reader.rb |  8 ++++++-
 .../wire_server/request_reader.rbs            |  2 ++
 .../test/dexpace/transport_test.rb            |  3 ++-
 .../transport/net_http/response_mapper.rb     | 11 +++++----
 5 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb b/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
index f59d775..045840c 100644
--- a/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/allocations.rb
@@ -54,17 +54,22 @@ def delta(iterations:, &block)
           raise ::Dexpace::InvalidArgumentError, "iterations must be a positive Integer"
         end
 
-        ::GC.disable
-        previous = measure(iterations, &block)
-        ATTEMPTS.times do
-          current = measure(iterations, &block)
-          return current if current == previous
+        # `GC.disable` answers whether the collector was ALREADY disabled, and this is published
+        # library code a host may call with the collector off: the state it found is the state it
+        # leaves, so a host that disabled GC around the call does not find it re-enabled.
+        was_disabled = ::GC.disable
+        begin
+          previous = measure(iterations, &block)
+          ATTEMPTS.times do
+            current = measure(iterations, &block)
+            return current if current == previous
 
-          previous = current
+            previous = current
+          end
+          previous
+        ensure
+          ::GC.enable unless was_disabled
         end
-        previous
-      ensure
-        ::GC.enable
       end
 
       private
diff --git a/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
index 52dcc45..2f3046e 100644
--- a/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
+++ b/gems/dexpace-conformance/lib/dexpace/conformance/wire_server/request_reader.rb
@@ -13,6 +13,12 @@ class WireServer
       module RequestReader
         extend self
 
+        # One run of at most fifteen digits, with a per-pattern timeout: the same spelling core
+        # gives every pattern a wire value reaches, and the same bound the adapter's own
+        # Content-Length parser applies.
+        LENGTH = ::Regexp.new('\A[0-9]{1,15}\z', timeout: 1.0).freeze
+        private_constant :LENGTH
+
         # @param conn [Object] the accepted socket
         # @return [RecordedRequest, nil] nil when the peer sent nothing
         def read(conn)
@@ -30,7 +36,7 @@ def read(conn)
 
         def read_body(conn, head)
           length = header_value(head, "content-length")
-          return read_exactly(conn, length.to_i) if length&.match?(/\A[0-9]+\z/)
+          return read_exactly(conn, length.to_i) if length && LENGTH.match?(length)
 
           encoding = header_value(head, "transfer-encoding")
           return read_chunked(conn) if encoding&.downcase&.include?("chunked")
diff --git a/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
index 7dccded..9c65486 100644
--- a/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
+++ b/gems/dexpace-conformance/sig/dexpace/conformance/wire_server/request_reader.rbs
@@ -5,6 +5,8 @@ module Dexpace
   module Conformance
     class WireServer
       module RequestReader
+        LENGTH: Regexp
+
         def self?.read: (untyped conn) -> RecordedRequest?
 
         private
diff --git a/gems/dexpace-core/test/dexpace/transport_test.rb b/gems/dexpace-core/test/dexpace/transport_test.rb
index 67fdec7..0311370 100644
--- a/gems/dexpace-core/test/dexpace/transport_test.rb
+++ b/gems/dexpace-core/test/dexpace/transport_test.rb
@@ -44,12 +44,13 @@ class DexpaceTransportTest < DexpaceTestCase
   # and lives in transport_bare_require_test.rb (see the class comment).
   test "swap scopes an override to its block" do
     transport = ->(_request, _options, _cancellation) { :response }
+    keys_before = Dexpace::Transport.registered_keys
     resolved = nil
 
     Dexpace::Transport.swap(transport) { resolved = Dexpace::Transport.resolve }
 
     assert_same(transport, resolved)
-    refute_same(transport, Dexpace::Transport.registered_keys, "the swap registered nothing")
+    assert_equal(keys_before, Dexpace::Transport.registered_keys, "the swap registered nothing")
   end
 
   # An install inside a swap block is part of the override and is restored with it, which is
diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
index 4969c37..af8a127 100644
--- a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
@@ -17,10 +17,13 @@ module NetHTTP
       module ResponseMapper
         extend self
 
-        # R4: anchored, character-class-only and linear, so it cannot backtrack and needs no
-        # timeout. `Integer("-4", exception: false)` would answer -4 and collide with the
-        # unknown-length sentinel; this admits one or more digits and nothing else.
-        LENGTH = /\A[0-9]+\z/
+        # R4: anchored and character-class-only, so it cannot backtrack; spelled as core spells
+        # every pattern a wire value reaches (`PacingParsers`, `P6-61`) -- `Regexp.new` with a
+        # per-pattern timeout, never a literal, and a bounded run, so no header can hand `to_i` an
+        # unbounded digit string. `Integer("-4", exception: false)` would answer -4 and collide
+        # with the unknown-length sentinel; this admits one to fifteen digits and nothing else,
+        # and a longer run is the unknown-length sentinel like any other value it refuses.
+        LENGTH = ::Regexp.new('\A[0-9]{1,15}\z', timeout: 1.0).freeze
         private_constant :LENGTH
 
         # @param request [Dexpace::Request] the request the response answers

From ff825f01325b81d3593ee1154755f908f4457540 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 18:38:44 +0300
Subject: [PATCH 03/15] fix: a pump built over a cancelled token closes without
 a producer

Cancellation::Source runs an already-cancelled hook inline, so the
pump's own on_cancel { close } could run #release from inside the
constructor before @subscription was assigned, and #release then
raised NoMethodError on nil.detach after joining a producer that had
already put the request on the wire (review round 1, R1-2). On the
borrowing construction that raise reached Adapter#dispatch's rescue,
which pushed the permit a second time onto a full SizedQueue.

ResponsePump#initialize now asks the token first: a cancelled token
gets a closed pump with no thread started, no socket opened and the
borrowed permit handed straight back, exactly once. Otherwise the
thread is started and the subscription registered after it, as before,
with both slots initialised to nil so the inline #release a cancel
racing the registration triggers finds them; #release joins and
detaches nil-safely, and #produce reads the latch before it exchanges,
so a pump closed before its producer was scheduled never touches the
socket. The RBS types both ivars optional and declares the new private
start_producer. Recorded as P8-64.
---
 .../transport/net_http/response_pump.rb       | 44 ++++++++++++++-----
 .../transport/net_http/response_pump.rbs      |  5 ++-
 2 files changed, 37 insertions(+), 12 deletions(-)

diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
index 3892760..0cdcc0e 100644
--- a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_pump.rb
@@ -40,13 +40,9 @@ def initialize(http:, native:, deadline:, cancellation:, owns_connection: true,
           @proceed = ::Thread::Queue.new
           @residue = (+"").b
           initialize_closeable(owned: true)
-          @thread = ::Thread.new { produce }
-          # The caller's cancellation closes this pump for the whole life of the response, not
-          # only for the head: a cancel under a blocked body read is what finishes the owned
-          # connection and wakes the producer (TRANSPORT-3). Registered AFTER the thread exists,
-          # because an already-cancelled token fires the hook at once; detached in #release, so
-          # a client-lifetime token retains this closure only until the response is closed.
-          @subscription = cancellation.on_cancel { close }
+          @thread = nil
+          @subscription = nil
+          start_producer(cancellation)
         end
 
         # Blocks on the first pop and returns the native head -- or, with a block, yields it and
@@ -104,6 +100,28 @@ def readpartial(maxlen, outbuf = nil)
 
         private
 
+        # A token already cancelled when the pump is built gets a closed pump and no exchange:
+        # #close with no producer to join and no subscription to detach, and the permit -- the
+        # producer's to return once it exists -- returned here instead, exactly once (P8-64).
+        # Otherwise the caller's cancellation closes this pump for the whole life of the
+        # response, not only for the head: a cancel under a blocked body read is what finishes
+        # the owned connection and wakes the producer (TRANSPORT-3). Registered AFTER the thread
+        # exists, because Cancellation::Source runs an already-cancelled hook inline -- a cancel
+        # landing between the check and the registration closes the pump from inside this frame,
+        # and that #release joins the thread and finds the still-nil subscription slot. Detached
+        # in #release, so a client-lifetime token retains this closure only until the response
+        # is closed.
+        def start_producer(cancellation)
+          if cancellation.cancelled?
+            close
+            @permit&.push(:permit)
+          else
+            @thread = ::Thread.new { produce }
+            @subscription = cancellation.on_cancel { close }
+          end
+          nil
+        end
+
         def resume_producer
           @proceed.push(true)
           nil
@@ -145,8 +163,14 @@ def carry(payload, phase:)
 
         # Runs on the PRODUCER's thread. A failure is pushed rather than raised, the queue is
         # closed in the ensure (never in a rescue) so a consumer blocked on pop ends rather than
-        # hangs, and the permit goes back only here, once the client is free.
+        # hangs, and the permit goes back only here, once the client is free. The latch is read
+        # first: a pump closed before its producer was scheduled -- a cancel racing the
+        # construction -- exchanges nothing, so the socket is never opened for a response nobody
+        # can receive and the join in #release is not spent waiting out a server that holds
+        # (P8-64).
         def produce
+          return if closed?
+
           if @owns_connection
             @http.start { |connected| exchange(connected) }
           else
@@ -211,8 +235,8 @@ def release
           rescue ::StandardError
             nil
           end
-          @thread.join(JOIN_DEADLINE_SECONDS)
-          @subscription.detach
+          @thread&.join(JOIN_DEADLINE_SECONDS) # nil when the token was cancelled at construction
+          @subscription&.detach # nil there too, and under a cancel racing the registration
           nil
         end
       end
diff --git a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
index 9714ab0..d811195 100644
--- a/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
+++ b/gems/dexpace-transport-net_http/sig/dexpace/transport/net_http/response_pump.rbs
@@ -18,8 +18,8 @@ module Dexpace
         @queue: Thread::SizedQueue
         @proceed: Thread::Queue
         @residue: String
-        @thread: Thread
-        @subscription: Dexpace::Cancellation::Subscription
+        @thread: Thread?
+        @subscription: Dexpace::Cancellation::Subscription?
 
         def initialize: (http: untyped, native: untyped, deadline: Deadline?,
                          cancellation: Dexpace::Cancellation, ?owns_connection: bool,
@@ -30,6 +30,7 @@ module Dexpace
 
         private
 
+        def start_producer: (Dexpace::Cancellation cancellation) -> nil
         def resume_producer: () -> nil
         def fill: () -> void
         def closed_failure: () -> Exception

From 0fc263ebc7eaa2d9b859760681b338e0fb2095da Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 21:05:14 +0300
Subject: [PATCH 04/15] fix: the warm-up client takes an explicit nil proxy,
 never :ENV

Net::HTTP.new's default p_addr is :ENV, which consults URI#find_proxy
on #start, and uri's find_proxy warns "The environment variable
HTTP_PROXY is discouraged" whenever HTTP_PROXY is set and the lower-case
http_proxy is not -- before its loopback exemption and before NO_PROXY
is read (uri 0.12.5 through 1.1.1, every row). DexpaceTestCase makes
every warning fatal, so on such a host test/support/net_http_warmup.rb,
required by both adapter gems' test_helper, aborted every suite of both
gems and rake test:gems at load (review round 2's R2-1, measured on
4.0.6 under HTTP_PROXY=http://127.0.0.1:9 with no http_proxy).

Build the warm-up client the way the adapter builds its own through
ProxyRoute: an explicit nil for the four proxy positionals. The comment
records the mechanism and the rule the tests branch applies to every
raw Net::HTTP a suite starts, so the suites are hermetic under
HTTP_PROXY, http_proxy, HTTPS_PROXY and NO_PROXY alike; the two R17
controls that reach :ENV on purpose set http_proxy themselves.
---
 test/support/net_http_warmup.rb | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/test/support/net_http_warmup.rb b/test/support/net_http_warmup.rb
index c979770..7c98bb6 100644
--- a/test/support/net_http_warmup.rb
+++ b/test/support/net_http_warmup.rb
@@ -14,12 +14,22 @@
 # the SDK's code -- the SDK never calls Timeout.timeout (design §8.3) -- and the interrupt lands
 # on nothing, because the block returns at once. net-http's own use is on phase 10's inbound
 # list (the phase-8a design's findings).
+#
+# The client is built with an EXPLICIT nil proxy, exactly as the adapter builds its own
+# (ProxyRoute, R17), and never with Net::HTTP.new's `:ENV` default. That default consults
+# URI#find_proxy on `#start`, and uri (0.12.5 on the 3.2 floor through 1.1.1 on 4.0.6) warns
+# "The environment variable HTTP_PROXY is discouraged" whenever HTTP_PROXY is set and the
+# lower-case http_proxy is not -- BEFORE its loopback exemption and before NO_PROXY is read --
+# which DexpaceTestCase turns into an error at load, in every suite of both gems (review round
+# 2's R2-1). Every raw Net::HTTP a suite of this repository starts passes the same nil, so the
+# suites are hermetic under HTTP_PROXY, http_proxy, HTTPS_PROXY and NO_PROXY alike; the two
+# R17 controls in the adapter's suites reach `:ENV` on purpose and set http_proxy themselves.
 module NetHTTPWarmup
   # @return [nil]
   def self.run
     server = ::TCPServer.new("127.0.0.1", 0)
     accepter = ::Thread.new { server.accept.close }
-    client = ::Net::HTTP.new("127.0.0.1", server.addr[1])
+    client = ::Net::HTTP.new("127.0.0.1", server.addr[1], nil, nil, nil, nil)
     client.open_timeout = 5
     client.start { nil }
     accepter.join(5)

From 875c9b6155648220f1a044bcbcac06ab1e430f44 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 21:16:08 +0300
Subject: [PATCH 05/15] docs: state the status range the response mapper is
 total over

ResponseMapper's YARD already says what an HTTP/1.0 head does and whose
gap that is. Say the same for the status: phase 1's Status guards
100-599 (HTTP-10's reading), Net::HTTP parses any three digits and
delivers a 999 or a 600 as an HTTPUnknownResponse, and such a head
raises Dexpace::InvalidArgumentError after the head with the connection
released (measured 2026-09-20; review round 2's R2-2). Whether
TRANSPORT-24's "any code" reaches 600-999 is a phase-1 model question,
routed to phase 10's inbound list on the docs branch. A comment only:
no behaviour, gate or surface changes.
---
 .../lib/dexpace/transport/net_http/response_mapper.rb      | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
index af8a127..f4895d6 100644
--- a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
@@ -13,7 +13,12 @@ module NetHTTP
       # with ", " and `#each_capitalized` re-cases, both of which would corrupt a multi-valued
       # Set-Cookie. Dexpace::Protocol admits HTTP/1.1 and HTTP/2 only (HTTP-33), so an HTTP/1.0
       # response raises Dexpace::InvalidArgumentError here; no TRANSPORT ID asks for 1.0 and the
-      # gap is phase 1's to widen. A private_constant of NetHTTP.
+      # gap is phase 1's to widen. The status is total over 100-599, phase 1's Status guard
+      # (HTTP-10's reading): Net::HTTP parses any three digits and delivers a 999 or a 600 as an
+      # HTTPUnknownResponse, and such a head raises Dexpace::InvalidArgumentError here the same
+      # way, after the head and with the connection released (TRANSPORT-22); whether TRANSPORT-24's
+      # "any code" reaches 600-999 is a phase-1 model question on phase 10's inbound list.
+      # A private_constant of NetHTTP.
       module ResponseMapper
         extend self
 

From bb909baf4dcc6e2d33656bb324feb273d4231397 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 22:55:11 +0300
Subject: [PATCH 06/15] fix: a Content-Length beside a chunked encoding is the
 -1 sentinel

Review round 3's R3-1. ResponseMapper#parse_length! took any single,
grammar-matching Content-Length as the body's length, but net-http reads
a response carrying Transfer-Encoding: chunked under the chunked framing
whatever else the head says -- read_body_0 asks #chunked? before
#content_length on 0.4.1, 0.6.0 and 0.9.1 alike -- so the value was RFC
9112 section 6.3's overridden one and never the number of bytes the pump
would deliver. Every reader that copies exactly `content_length` bytes
(ResponseBody#each, #write_to, #to_replayable) therefore truncated a
chunked body silently when the header was short ("0123456789" delivered
as "01234" under Content-Length: 5) or raised StreamError.short_transfer
when it was long, while #body_string, which drains to end of stream,
read all of it. TRANSPORT-27 maps an invalid Content-Length to the
unknown-length sentinel, and a Content-Length the framing overrides is
the invalid case R4's grammar could not see.

The guard gains `!native.chunked?` -- Net::HTTPHeader#chunked?, the
predicate read_body itself consults -- so such a header is the -1
sentinel like any other value the mapper refuses: the pump reads to end
of stream and every reader delivers the whole body. The native delete in
that branch changes nothing read_body consults under a chunked encoding
and is kept for the one-branch shape. The wire value still reaches the
caller's Dexpace::Headers, as before. R4's comment states the case.
Measured through the real adapter against WireServer on 4.0.6: both
directions now answer -1 and deliver ten bytes through #each, #write_to
and #to_replayable.
---
 .../transport/net_http/response_mapper.rb      | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
index f4895d6..eda21cd 100644
--- a/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
+++ b/gems/dexpace-transport-net_http/lib/dexpace/transport/net_http/response_mapper.rb
@@ -70,13 +70,21 @@ def body_for(native, pump, head)
                                       content_length: content_length,)
         end
 
-        # R4: the raw header, or -1 for absent, non-numeric, negative or multi-valued -- and in
-        # the -1 case the header is deleted from the NATIVE response so read_body finds no length
-        # and no chunked encoding and falls through to connection-close framing. The wire value
-        # has already been copied into Dexpace::Headers, so only the INTERPRETATION becomes -1.
+        # R4: the raw header, or -1 for absent, non-numeric, negative, multi-valued -- or beside a
+        # chunked Transfer-Encoding, which is the one case a syntactically valid value is still
+        # not the body's length: read_body_0 asks `#chunked?` BEFORE `#content_length` (0.4.1
+        # through 0.9.1 alike) and reads the chunked framing, so a Content-Length such a message
+        # carries is RFC 9112 section 6.3's overridden, ought-to-be-an-error one; taking it as the
+        # length made ResponseBody#each, #write_to and #to_replayable -- which copy exactly
+        # `content_length` bytes -- truncate the chunked body or raise StreamError.short_transfer
+        # while #body_string read all of it (review round 3's R3-1). In the -1 case the header is
+        # deleted from the NATIVE response so read_body finds no length and no chunked encoding
+        # and falls through to connection-close framing; under a chunked encoding the deletion
+        # changes nothing read_body consults. The wire value has already been copied into
+        # Dexpace::Headers, so only the INTERPRETATION becomes -1.
         def parse_length!(native)
           raw = native.to_hash["content-length"]
-          return raw.first.to_i if raw&.size == 1 && LENGTH.match?(raw.first)
+          return raw.first.to_i if !native.chunked? && raw&.size == 1 && LENGTH.match?(raw.first)
 
           native.delete("content-length")
           -1

From d63a1f6d2287e2db7e5b5f3d72be1913ab8c78ae Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 14:20:17 +0300
Subject: [PATCH 07/15] test: phase 8a suites and doubles for the net-http
 transport and the conformance gem

The adapter's ten suites (adapter, response pump, request and response mappers, deadline, failures,
TLS settings, proxy route, the conformance driver against the real adapter, the generator slice
with its guarded codec half, and the matrix facts printing each row's active net-http version) with
AdapterFixtures and NetHTTPRecordingSink; the conformance gem's nineteen suites with the
RawWireTransport double and its twenty named defects, NonConformingTransport, StubTransport and
AssertionProbe; core's TransportError suite and the bare-require registry tests; and the allowlist
gate test's comment naming tempfile.
---
 .../dexpace/conformance/allocations_test.rb   |  54 ++
 .../dexpace/conformance/assertion_test.rb     |  67 +++
 .../dexpace/conformance/borrowed_pair_test.rb |  40 ++
 .../test/dexpace/conformance/failure_test.rb  |  46 ++
 .../conformance/minitest_driver_test.rb       | 168 +++++++
 .../conformance/recording_span_test.rb        |  79 +++
 .../test/dexpace/conformance/report_test.rb   |  68 +++
 .../test/dexpace/conformance/result_test.rb   |  55 +++
 .../dexpace/conformance/rspec_driver_test.rb  | 121 +++++
 .../test/dexpace/conformance/scripts_test.rb  | 205 ++++++++
 .../conformance/transport_case_test.rb        | 202 ++++++++
 .../transport_suite/inbound_test.rb           |  81 +++
 .../transport_suite/lifecycle_test.rb         |  81 +++
 .../transport_suite/outbound_test.rb          |  77 +++
 .../transport_suite/resilience_test.rb        |  79 +++
 .../transport_suite/streaming_test.rb         |  65 +++
 .../conformance/transport_suite_test.rb       | 184 +++++++
 .../test/dexpace/conformance/vacuous_test.rb  |  21 +
 .../dexpace/conformance/wire_server_test.rb   | 184 +++++++
 .../test/support/assertion_probe.rb           |  52 ++
 .../test/support/non_conforming_transport.rb  |  24 +
 .../test/support/raw_wire_transport.rb        | 282 +++++++++++
 .../test/support/stub_transport.rb            |  34 ++
 .../dexpace/error/transport_error_test.rb     |  74 +++
 .../dexpace/transport_bare_require_test.rb    |  70 +++
 .../transport/net_http/adapter_test.rb        | 467 ++++++++++++++++++
 .../transport/net_http/conformance_test.rb    |  81 +++
 .../transport/net_http/deadline_test.rb       |  90 ++++
 .../transport/net_http/failures_test.rb       | 124 +++++
 .../net_http/generator_slice_test.rb          | 131 +++++
 .../transport/net_http/matrix_facts_test.rb   | 138 ++++++
 .../transport/net_http/proxy_route_test.rb    | 130 +++++
 .../transport/net_http/request_mapper_test.rb | 217 ++++++++
 .../net_http/response_mapper_test.rb          | 191 +++++++
 .../transport/net_http/response_pump_test.rb  | 302 +++++++++++
 .../transport/net_http/tls_settings_test.rb   |  83 ++++
 .../test/support/adapter_fixtures.rb          | 106 ++++
 .../test/support/net_http_recording_sink.rb   |  48 ++
 test/gates/require_allowlist_test.rb          |   5 +
 39 files changed, 4526 insertions(+)
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/assertion_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/borrowed_pair_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/failure_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/minitest_driver_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/recording_span_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/report_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/result_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/rspec_driver_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_case_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite/inbound_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite/lifecycle_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite/outbound_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite/resilience_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite/streaming_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/transport_suite_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/vacuous_test.rb
 create mode 100644 gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
 create mode 100644 gems/dexpace-conformance/test/support/assertion_probe.rb
 create mode 100644 gems/dexpace-conformance/test/support/non_conforming_transport.rb
 create mode 100644 gems/dexpace-conformance/test/support/raw_wire_transport.rb
 create mode 100644 gems/dexpace-conformance/test/support/stub_transport.rb
 create mode 100644 gems/dexpace-core/test/dexpace/error/transport_error_test.rb
 create mode 100644 gems/dexpace-core/test/dexpace/transport_bare_require_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/failures_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/request_mapper_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
 create mode 100644 gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
 create mode 100644 gems/dexpace-transport-net_http/test/support/net_http_recording_sink.rb

diff --git a/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
new file mode 100644
index 0000000..57ff63b
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# OBS-25: "Selecting a no-op path MUST NOT allocate per call." The iteration count is a REQUIRED
+# keyword with no default (8a's open question 5): a caller who forgets it gets an ArgumentError,
+# not a number that means nothing. The shape is core's own two-loop, agree-twice measurement
+# (gems/dexpace-core/test/support/allocation_delta.rb), whose comment anticipates this copy: on
+# the 3.2.11 floor a one-time interpreter cost can land inside a single measured block and come
+# back negative, which a single loop would integer-divide to -1. What makes the measurement
+# caller-insensitive is passing arguments that cannot allocate -- a frozen constant, a Symbol, an
+# Integer, nil -- because an inline literal at the call site allocates per iteration whether or
+# not the callee does (5b's R8).
+class DexpaceConformanceAllocationsTest < DexpaceTestCase
+  Allocations = Dexpace::Conformance::Allocations
+
+  test "delta measures the per-iteration allocation cost, warming up first" do
+    calls = 0
+    delta = Allocations.delta(iterations: 1000) { calls += 1 }
+
+    assert_in_delta(0.0, delta, 0.0)
+    assert_kind_of(Float, delta)
+    assert_operator(calls, :>, 1000, "the warm-up and the second loop must have run too")
+  end
+
+  test "a no-op path over frozen arguments measures exactly zero" do
+    span = Dexpace::Instrumentation::NO_SPAN
+    key = "k"
+    delta = Allocations.delta(iterations: 500) { span.set_attribute(key, 1) }
+
+    assert_in_delta(0.0, delta, 0.0)
+  end
+
+  test "an allocating block reports a positive per-iteration delta, one object for one String" do
+    delta = Allocations.delta(iterations: 200) { +"" }
+
+    assert_in_delta(1.0, delta, 0.0)
+  end
+
+  test "iterations is a required keyword and must be a positive Integer" do
+    assert_raises(::ArgumentError) { Allocations.delta { nil } }
+    assert_raises(Dexpace::InvalidArgumentError) { Allocations.delta(iterations: 0) { nil } }
+    assert_raises(Dexpace::InvalidArgumentError) { Allocations.delta(iterations: 1.5) { nil } }
+  end
+
+  test "the GC is re-enabled afterwards, even when the block raises" do
+    assert_raises(RuntimeError) { Allocations.delta(iterations: 10) { raise "boom" } }
+
+    refute(::GC.disable, "GC.disable returns false when it was enabled, so the helper restored it")
+    ::GC.enable
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/assertion_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/assertion_test.rb
new file mode 100644
index 0000000..8f5191a
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/assertion_test.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# One conformance check as a value: the requirement IDs it exercises (what a waiver matches by --
+# never the name), a human name and a callable body. Follows the phase-1 construction pattern
+# (HTTP-3, HTTP-4, SEAM-29): `.new` private, a validating keyword `.build`, `Model.required!`'s one
+# message form, the ids copied through `Model.own`, `#with` through `.build`.
+class DexpaceConformanceAssertionTest < DexpaceTestCase
+  Assertion = Dexpace::Conformance::Assertion
+
+  test "is a frozen Data carrying its own ids, name and callable body" do
+    ids = ["TRANSPORT-24"]
+    assertion = Assertion.build(ids: ids, name: "maps every status totally", body: lambda { |_case|
+    },)
+
+    assert_equal(["TRANSPORT-24"], assertion.ids)
+    assert_equal("maps every status totally", assertion.name)
+    assert_predicate(assertion, :frozen?)
+    assert_predicate(assertion.ids, :frozen?)
+    refute_same(ids, assertion.ids, "the caller's array is copied, never aliased (Model.own)")
+    assert_nil(assertion.call(:subject))
+  end
+
+  test "#call delegates to #body with the subject" do
+    seen = nil
+    assertion = Assertion.build(ids: ["X"], name: "records its subject",
+                                body: ->(subject) { seen = subject },)
+
+    assertion.call(:the_subject)
+
+    assert_equal(:the_subject, seen)
+  end
+
+  test "HTTP-4 / SEAM-29: every member is required, named in the one message form" do
+    %i[ids name body].each do |member|
+      arguments = { ids: ["X"], name: "n", body: ->(_) {} }
+      arguments[member] = nil
+      error = assert_raises(Dexpace::InvalidArgumentError) { Assertion.build(**arguments) }
+
+      assert_equal("#{member} is required", error.message)
+    end
+  end
+
+  test "ids must be a non-empty collection of Strings and body must be callable" do
+    body = ->(_) {}
+
+    assert_raises(Dexpace::InvalidArgumentError) { Assertion.build(ids: [], name: "n", body: body) }
+    assert_raises(Dexpace::InvalidArgumentError) { Assertion.build(ids: [:X], name: "n", body: body) }
+    assert_raises(Dexpace::InvalidArgumentError) { Assertion.build(ids: ["X"], name: "n", body: :no) }
+  end
+
+  test "HTTP-2: the constructor is private, so .build is the one entry point" do
+    assert_raises(NoMethodError) { Assertion.new(ids: ["X"], name: "n", body: ->(_) {}) }
+  end
+
+  test "#with derives through .build, re-validating on every interpreter" do
+    assertion = Assertion.build(ids: ["X"], name: "n", body: ->(_) {})
+    derived = assertion.with(name: "renamed")
+
+    assert_equal("renamed", derived.name)
+    assert_equal(["X"], derived.ids)
+    assert_raises(Dexpace::InvalidArgumentError) { assertion.with(ids: nil) }
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/borrowed_pair_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/borrowed_pair_test.rb
new file mode 100644
index 0000000..251b0a9
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/borrowed_pair_test.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# Suite contract 4a (8a's R16): what a driver's `borrow:` factory returns -- the transport that
+# wraps the caller's own client, and a probe answering "is that client still usable?" -- so
+# TRANSPORT-15's borrowed half never names a native client class inside this gem.
+class DexpaceConformanceBorrowedPairTest < DexpaceTestCase
+  BorrowedPair = Dexpace::Conformance::BorrowedPair
+
+  test "carries the transport and the probe; #still_usable? is the probe's answer as a boolean" do
+    pair = BorrowedPair.build(transport: :t, probe: -> { "yes" })
+
+    assert_equal(:t, pair.transport)
+    assert_predicate(pair, :still_usable?)
+    refute_predicate(BorrowedPair.build(transport: :t, probe: -> {}), :still_usable?)
+    assert_predicate(pair, :frozen?)
+  end
+
+  test "HTTP-4 / SEAM-29: both members are required, in the one message form; a callable probe" do
+    error = assert_raises(Dexpace::InvalidArgumentError) do
+      BorrowedPair.build(transport: nil, probe: -> {})
+    end
+
+    assert_equal("transport is required", error.message)
+    assert_equal("probe is required",
+                 assert_raises(Dexpace::InvalidArgumentError) do
+                   BorrowedPair.build(transport: :t, probe: nil)
+                 end.message,)
+    assert_raises(Dexpace::InvalidArgumentError) do
+      BorrowedPair.build(transport: :t, probe: :not_callable)
+    end
+  end
+
+  test "HTTP-2: the constructor is private, so .build is the one entry point" do
+    assert_raises(NoMethodError) { BorrowedPair.new(transport: :t, probe: -> {}) }
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/failure_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/failure_test.rb
new file mode 100644
index 0000000..b46b01b
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/failure_test.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# The conformance assertion protocol phase 0 postponed to this phase (design §9.3, 8a's R7): an
+# assertion "either returns cleanly or raises a Dexpace::Conformance::Failure carrying the expected
+# and actual values". P8-8 records why the class is a ::StandardError that does NOT include
+# Dexpace::Error: a conformance failure is a test result, not an SDK error, and an adapter author's
+# broad `rescue Dexpace::Error` around a send must not swallow the assertion that the send was
+# wrong.
+class DexpaceConformanceFailureTest < DexpaceTestCase
+  Failure = Dexpace::Conformance::Failure
+
+  test "P8-8: is a StandardError and does not include Dexpace::Error" do
+    assert_operator(Failure, :<, ::StandardError)
+    refute_operator(Failure, :<, Dexpace::Error)
+    refute_kind_of(Dexpace::Error, Failure.new("x", expected: 1, actual: 2, requirement_ids: ["A"]))
+  end
+
+  test "carries the expected and actual values and the requirement ids it was raised for" do
+    failure = Failure.new("expected X", expected: "X", actual: "Y",
+                                        requirement_ids: ["TRANSPORT-24"],)
+
+    assert_equal("expected X", failure.message)
+    assert_equal("X", failure.expected)
+    assert_equal("Y", failure.actual)
+    assert_equal(["TRANSPORT-24"], failure.requirement_ids)
+    assert_predicate(failure.requirement_ids, :frozen?)
+  end
+
+  test "a broad rescue of the SDK's error root lets it through" do
+    raised = begin
+      begin
+        raise Failure.new("x", expected: 1, actual: 2, requirement_ids: ["A"])
+      rescue Dexpace::Error
+        :swallowed
+      end
+    rescue Failure
+      :propagated
+    end
+
+    assert_equal(:propagated, raised)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/minitest_driver_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/minitest_driver_test.rb
new file mode 100644
index 0000000..4aad7db
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/minitest_driver_test.rb
@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# The thin Minitest driver (design §9.3, 8a's R7): one generated test method per assertion, each
+# running its OWN assertion in a fresh TransportCase, a Vacuous reported as a skip, a Failure as a
+# flunk naming the ids, a waived id as a skip that names it, and the case torn down whatever
+# happened. Named MinitestDriver and not Minitest: inside module Dexpace::Conformance a constant
+# named Minitest would shadow ::Minitest for the whole namespace (5a's P5-3 reasoning).
+#
+# The suite handed in is a plain object answering #assertions -- no `.stub`, so no fence here
+# needs `minitest/mock` -- and every driven class overrides .runnable_methods to return nothing,
+# so it is driven only through Minitest.run_one_method below and never by the outer run. Two
+# nested classes under Metrics/ClassLength (6c's shape).
+module DexpaceConformanceMinitestDriverTest
+  Assertion = Dexpace::Conformance::Assertion
+  Failure = Dexpace::Conformance::Failure
+
+  # Anything shaped like TransportSuite: an ordered #assertions.
+  FakeSuite = Struct.new(:assertions)
+
+  # The driven-class builder and the one-method runner both classes share.
+  module Driving
+    def assertion(id, name, &body)
+      Assertion.build(ids: [id], name: name, body: body)
+    end
+
+    def driven(suite, **options)
+      Class.new(DexpaceTestCase) do
+        extend Dexpace::Conformance::MinitestDriver
+
+        # Kept out of the outer run: this class exists to be driven by run_one_method alone.
+        def self.runnable_methods
+          []
+        end
+
+        conformance(suite, **options)
+      end
+    end
+
+    def generated(klass)
+      klass.public_instance_methods(false).grep(/\Atest_/).map(&:to_s).sort
+    end
+
+    def drive(klass, method_name)
+      ::Minitest.run_one_method(klass, method_name)
+    end
+
+    def drive_one(assertion, **)
+      klass = driven(FakeSuite.new([assertion]), **)
+      drive(klass, generated(klass).first)
+    end
+  end
+
+  # The generated methods and the outcomes each maps to.
+  class OutcomesTest < DexpaceTestCase
+    include Driving
+
+    test "conformance defines one test method per assertion, named from the assertion's name" do
+      suite = FakeSuite.new([assertion("A", "passes cleanly") { |_| nil },
+                             assertion("B", "also passes: with punctuation!") { |_| nil },])
+
+      klass = driven(suite, build: ->(**_) { :t })
+
+      assert_equal(%w[test_also_passes_with_punctuation test_passes_cleanly], generated(klass))
+    end
+
+    test "the generated test runs the assertion in a fresh case built from the driver's factory" do
+      built = []
+      seen = nil
+      transport = Object.new
+      transport.define_singleton_method(:close) { built << :closed }
+      build = lambda do |**_|
+        built << :built
+        transport
+      end
+
+      result = drive_one(assertion("A", "sees the case") do |kase|
+        seen = kase
+        kase.transport
+      end, build: build,)
+
+      assert_predicate(result, :passed?)
+      assert_kind_of(Dexpace::Conformance::TransportCase, seen)
+      assert_equal(%i[built closed], built, "built by the factory, torn down in the ensure")
+    end
+
+    test "a Failure flunks the generated test, naming the ids and the message" do
+      result = drive_one(assertion("TRANSPORT-24", "fails") do |_|
+        raise Failure.new("status was 200", expected: 520, actual: 200,
+                                            requirement_ids: ["TRANSPORT-24"],)
+      end, build: ->(**_) { :t },)
+
+      refute_predicate(result, :passed?)
+      refute_predicate(result, :error?)
+      assert_match(/TRANSPORT-24: status was 200/, result.failure.message)
+    end
+
+    test "a Vacuous skips the generated test, naming the reason" do
+      result = drive_one(assertion("A", "vacuous") do |_|
+        raise Dexpace::Conformance::Vacuous, "no antecedent here"
+      end, build: ->(**_) { :t },)
+
+      assert_predicate(result, :skipped?)
+      assert_match(/vacuous: no antecedent here/, result.failure.message)
+    end
+
+    test "a waived id skips the generated test without running the body, naming the id" do
+      ran = false
+      result = drive_one(assertion("TRANSPORT-28", "waivable") { |_| ran = true },
+                         build: ->(**_) { :t }, waive: ["TRANSPORT-28"],)
+
+      assert_predicate(result, :skipped?)
+      assert_match(/waived: TRANSPORT-28/, result.failure.message)
+      refute(ran)
+    end
+
+    test "any other raise is an error, never silently a failure or a pass" do
+      result = drive_one(assertion("A", "errors") { |_| raise "boom" }, build: ->(**_) { :t })
+
+      assert_predicate(result, :error?)
+    end
+  end
+
+  # The three keywords an async driver passes, and the driver's own independence of the framework.
+  class ContractTest < DexpaceTestCase
+    include Driving
+
+    # Clauses 8, 9 and 11 (8a's R16): the three keywords reach the case the generated test builds,
+    # and a sync driver passing none gets the defaults.
+    test "settle:, around: and wire: reach the case; the guard still refuses a direct #call" do
+      order = []
+      seen = []
+      probe = assertion("A", "probes") do |kase|
+        seen << kase.settle(kase.transport, :req, :opts, :cancel)
+        seen << kase.wire(script: :s)
+        begin
+          kase.transport.call(:r, :o, :c)
+        rescue ArgumentError
+          seen << :guarded
+        end
+        order << :assertion
+      end
+      around = lambda do |&blk|
+        order << :before
+        blk.call
+        order << :after
+      end
+
+      result = drive_one(probe, build: ->(**_) { :t }, settle: ->(_t, _r, _o, _c) { :settled },
+                                wire: ->(script) { [:wired, script] }, around: around,)
+
+      assert_predicate(result, :passed?, result.failure&.message)
+      assert_equal([:settled, %i[wired s], :guarded], seen)
+      assert_equal(%i[before assertion after], order)
+    end
+
+    test "the driver requires no framework itself and names ::Minitest nowhere in its source" do
+      path = File.expand_path("../../../lib/dexpace/conformance/minitest_driver.rb", __dir__)
+      source = File.read(path)
+
+      refute_match(/require ["']minitest/, source)
+      refute_match(/\bMinitest\b(?!Driver)/, source.lines.grep_v(/^\s*#/).join)
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/recording_span_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/recording_span_test.rb
new file mode 100644
index 0000000..32961ef
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/recording_span_test.rb
@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# OBS-21: "A Span MUST expose a recording flag; when non-recording, all mutators ... MUST be inert
+# ... end() MUST be idempotent." Core's own NO_SPAN is non-recording by construction, so the
+# recording branch and the idempotent finish need a RECORDING double to have a subject at all --
+# this one, shipped here because phase 5c assigned it to the conformance gem and a third-party
+# adapter author asserting OBS-21 needs it to ship. The protocol is 5c's `_Span`: `finish
+# (end_timestamp: nil)`, never an `#end`.
+class DexpaceConformanceRecordingSpanTest < DexpaceTestCase
+  RecordingSpan = Dexpace::Conformance::RecordingSpan
+
+  test "satisfies the _Span protocol phase 5c fixed, method for method" do
+    span = RecordingSpan.new
+
+    %i[recording? set_attribute add_event record_error status= finish context].each do |name|
+      assert_respond_to(span, name)
+    end
+
+    assert_equal([%i[key end_timestamp]], span.method(:finish).parameters)
+    refute_respond_to(span, :end, "the protocol is #finish, never #end")
+  end
+
+  test "recording? is true and the mutators actually record" do
+    span = RecordingSpan.new(context: :the_bundle)
+
+    assert_same(span, span.set_attribute("http.status_code", 200))
+    assert_same(span, span.add_event("retry", attributes: { "attempt" => 2 }))
+    assert_same(span, span.record_error(RuntimeError.new("boom")))
+    span.status = :error
+
+    assert_predicate(span, :recording?)
+    assert_equal(200, span.attributes["http.status_code"])
+    assert_equal([{ name: "retry", attributes: { "attempt" => 2 } }], span.events)
+    assert_equal("boom", span.errors.first[:error].message)
+    assert_equal(:error, span.status)
+    assert_equal(:the_bundle, span.context)
+  end
+
+  test "finish is idempotent: a second call does not duplicate the exported record" do
+    span = RecordingSpan.new
+    at = Time.at(0)
+
+    span.finish(end_timestamp: at)
+    span.finish
+
+    assert_equal([at], span.finished_at)
+    refute_predicate(span, :recording?, "a finished span records no more")
+  end
+
+  test "mutators after finish are inert, per OBS-21's own end-then-mutate case" do
+    span = RecordingSpan.new
+    span.finish
+
+    span.set_attribute("late", "value")
+    span.add_event("late")
+    span.record_error(RuntimeError.new("late"))
+    span.status = :late
+
+    refute_includes(span.attributes, "late")
+    assert_empty(span.events)
+    assert_empty(span.errors)
+    assert_nil(span.status)
+  end
+
+  test "recording: false is the non-recording variant, inert from the start and never finished" do
+    span = RecordingSpan.new(recording: false)
+
+    span.set_attribute("k", "v")
+    span.finish
+
+    refute_predicate(span, :recording?)
+    assert_empty(span.attributes)
+    assert_empty(span.finished_at)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/report_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/report_test.rb
new file mode 100644
index 0000000..92f70d3
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/report_test.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# Design §9.3: "the gap stays visible rather than disappearing into a restated item" -- so #to_s
+# names every waived ID on every run, not only on failure; and P8-9's two fixture omissions are
+# printed in the preamble on every run, so a green run is never read as more than it proves.
+class DexpaceConformanceReportTest < DexpaceTestCase
+  Report = Dexpace::Conformance::Report
+
+  def assertion(ids)
+    Dexpace::Conformance::Assertion.build(ids: ids, name: "checks #{ids.join(",")}", body: ->(_) {})
+  end
+
+  def result(ids, status, detail: nil)
+    Dexpace::Conformance::Result.build(assertion: assertion(ids), status: status, detail: detail)
+  end
+
+  test "partitions results by status and #to_s names every waived id and every failure" do
+    report = Report.new([
+                          result(["A"], :passed),
+                          result(["B"], :failed, detail: "boom"),
+                          result(["C"], :vacuous, detail: "no antecedent"),
+                          result(["D"], :waived),
+                          result(["E"], :error, detail: "RuntimeError: oops"),
+                        ])
+
+    refute_predicate(report, :passed?)
+    assert_equal(5, report.results.size)
+    assert_predicate(report.results, :frozen?)
+    assert_equal(["B"], report.failures.map { |r| r.assertion.ids }.flatten)
+    assert_equal(["C"], report.vacuous.map { |r| r.assertion.ids }.flatten)
+    assert_equal(["D"], report.waived.map { |r| r.assertion.ids }.flatten)
+    assert_equal(["E"], report.errors.map { |r| r.assertion.ids }.flatten)
+    text = report.to_s
+
+    assert_includes(text, "1 passed, 1 failed, 1 vacuous, 1 waived, 1 errored")
+    assert_includes(text, "waived: D (checks D)")
+    assert_includes(text, "FAILED: B: boom")
+    assert_includes(text, "ERROR: E: RuntimeError: oops")
+    assert_includes(text, "vacuous: C: no antecedent")
+  end
+
+  test "passed? is true only when nothing failed or errored; vacuous and waived do not fail it" do
+    clean = Report.new([result(["A"], :passed), result(["B"], :vacuous), result(["C"], :waived)])
+
+    assert_predicate(clean, :passed?)
+    refute_predicate(Report.new([result(["E"], :error)]), :passed?)
+    assert_predicate(Report.new([]), :passed?)
+  end
+
+  test "a waived id is named on every run, a passing one included" do
+    report = Report.new([result(["A"], :passed), result(["TRANSPORT-28"], :waived)])
+
+    assert_predicate(report, :passed?)
+    assert_includes(report.to_s, "waived: TRANSPORT-28")
+  end
+
+  test "P8-9: the preamble names what the fixture does not exercise, on every run" do
+    report = Report.new([result(["A"], :passed)], preamble: "plaintext only; no connect timeout")
+
+    assert_equal("plaintext only; no connect timeout", report.preamble)
+    assert_operator(report.to_s, :start_with?, "plaintext only; no connect timeout\n")
+    assert_nil(Report.new([]).preamble)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/result_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/result_test.rb
new file mode 100644
index 0000000..0bf73df
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/result_test.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# One assertion's outcome, in five statuses and never a boolean: collapsing them into pass/fail is
+# exactly what makes a vacuous requirement indistinguishable from one nobody checked (design §12).
+class DexpaceConformanceResultTest < DexpaceTestCase
+  Result = Dexpace::Conformance::Result
+  STATUSES = %i[passed failed vacuous waived error].freeze
+
+  def assertion
+    Dexpace::Conformance::Assertion.build(ids: ["X"], name: "n", body: ->(_) {})
+  end
+
+  test "status is restricted to exactly the five documented values" do
+    assert_equal(STATUSES, Result::STATUSES)
+    STATUSES.each do |status|
+      result = Result.build(assertion: assertion, status: status)
+
+      assert_equal(status, result.status)
+      assert_nil(result.detail)
+      assert_predicate(result, :frozen?)
+    end
+    error = assert_raises(Dexpace::InvalidArgumentError) do
+      Result.build(assertion: assertion, status: :skipped)
+    end
+
+    assert_match(/passed, failed, vacuous, waived, error/, error.message)
+  end
+
+  test "carries the assertion it is the outcome of and an optional detail" do
+    a = assertion
+    result = Result.build(assertion: a, status: :failed, detail: "boom")
+
+    assert_same(a, result.assertion)
+    assert_equal("boom", result.detail)
+  end
+
+  test "HTTP-4 / SEAM-29: the assertion is required, in the one message form" do
+    error = assert_raises(Dexpace::InvalidArgumentError) do
+      Result.build(assertion: nil, status: :passed)
+    end
+
+    assert_equal("assertion is required", error.message)
+    assert_raises(Dexpace::InvalidArgumentError) do
+      Result.build(assertion: :not_one, status: :passed)
+    end
+  end
+
+  test "HTTP-2: the constructor is private, so .build is the one entry point" do
+    assert_raises(NoMethodError) { Result.new(assertion: assertion, status: :passed, detail: nil) }
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/rspec_driver_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/rspec_driver_test.rb
new file mode 100644
index 0000000..629660c
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/rspec_driver_test.rb
@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# The thin RSpec driver: never required by the entry file -- an RSpec-only consumer opts in with
+# `require "dexpace/conformance/rspec_driver"`, exactly as it opts into RSpec -- and `::RSpec` is
+# resolved inside the method body, at call time, so the file loads under a process that has never
+# required the framework. This suite proves both by loading the file with no RSpec present, then
+# standing a recording double in as ::RSpec for the length of one test.
+class DexpaceConformanceRSpecDriverTest < DexpaceTestCase
+  Assertion = Dexpace::Conformance::Assertion
+  FakeSuite = Struct.new(:assertions)
+
+  # A recording stand-in for the two RSpec entry points the driver names: `describe` collects a
+  # group and `it` an example, whose body this test then runs with a context that records
+  # `skip`, so what an example DOES is observable without the framework.
+  module RecordingRSpec
+    Example = Struct.new(:group, :description, :body)
+
+    def self.examples
+      @examples ||= []
+    end
+
+    # With a block, class_exec-shaped as RSpec's own; without one, the group, as RSpec returns.
+    def self.describe(name, &block)
+      group = Group.new(name)
+      group.instance_eval(&block) if block
+      group
+    end
+
+    # What `describe` yields: it records each `it` as an Example.
+    class Group
+      def initialize(name)
+        @name = name
+      end
+
+      def it(description, &body)
+        RecordingRSpec.examples << Example.new(@name, description, body)
+      end
+    end
+
+    # What an example body runs inside: a `skip` that throws, and nothing else RSpec offers.
+    class Context
+      attr_reader :skipped
+
+      def skip(message)
+        @skipped = message
+        throw :skipped
+      end
+
+      def run(example)
+        catch(:skipped) { instance_exec(&example.body) }
+        self
+      end
+    end
+  end
+
+  def with_fake_rspec
+    if defined?(::RSpec)
+      raise "a real RSpec is loaded; this suite stands a double in and must not clobber it"
+    end
+
+    Object.const_set(:RSpec, RecordingRSpec)
+    RecordingRSpec.examples.clear
+    yield
+  ensure
+    Object.send(:remove_const, :RSpec) if defined?(::RSpec) && ::RSpec.equal?(RecordingRSpec)
+  end
+
+  # Captured at load, before either test below requires the driver: the entry file must not.
+  DEFINED_BY_ENTRY_FILE = Dexpace::Conformance.const_defined?(:RSpecDriver, false)
+
+  test "the file loads with no RSpec required and defines the driver alone" do
+    refute(defined?(::RSpec), "the process must not have loaded RSpec")
+    refute(DEFINED_BY_ENTRY_FILE, "dexpace/conformance must not require the RSpec driver")
+
+    require "dexpace/conformance/rspec_driver"
+
+    assert(Dexpace::Conformance.const_defined?(:RSpecDriver, false))
+    source = File.read(File.expand_path("../../../lib/dexpace/conformance/rspec_driver.rb",
+                                        __dir__,))
+
+    refute_match(/require ["']rspec/, source)
+  end
+
+  test "conformance defines one example group per assertion, each run in its own case" do
+    require "dexpace/conformance/rspec_driver"
+    seen = []
+    suite = FakeSuite.new([
+                            Assertion.build(ids: ["A"], name: "passes", body: lambda { |kase|
+                              seen << kase.transport
+                            },),
+                            Assertion.build(ids: ["B"], name: "vacuous", body: lambda { |_|
+                              raise Dexpace::Conformance::Vacuous, "none"
+                            },),
+                            Assertion.build(ids: ["C"], name: "waived", body: lambda { |_|
+                              raise "must not run"
+                            },),
+                          ])
+    closed = []
+    transport = Object.new
+    transport.define_singleton_method(:close) { closed << :closed }
+
+    with_fake_rspec do
+      Dexpace::Conformance::RSpecDriver.conformance(suite, build: lambda { |**_|
+        transport
+      }, waive: ["C"],)
+      examples = RecordingRSpec.examples
+
+      assert_equal(%w[passes vacuous waived], examples.map(&:group))
+      assert_equal(["satisfies A", "satisfies B", "satisfies C"], examples.map(&:description))
+      outcomes = examples.map { |example| RecordingRSpec::Context.new.run(example).skipped }
+
+      assert_equal([nil, "vacuous: none", "waived: C"], outcomes)
+      assert_equal(1, seen.size)
+      assert_equal(%i[closed], closed, "the case is torn down after the example")
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
new file mode 100644
index 0000000..1e74d61
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+require "net/http"
+
+# The named response scripts, each driven through a real socket by a plain Net::HTTP so what a
+# script puts on the wire is what a transport under test will meet. Every wire answers HTTP/1.1 on
+# its status line: phase 1's Protocol.parse has no alias for "http/1.0" (8a plan, Task 17). Two
+# nested classes under Metrics/ClassLength (6c's shape): the scripts that answer, and the ones
+# that wait or fail.
+module DexpaceConformanceScriptsTest
+  WireServer = Dexpace::Conformance::WireServer
+  Scripts = Dexpace::Conformance::Scripts
+
+  # One GET through a plain client, with no transparent decompression.
+  module Fetch
+    def fetch(script, path: "/", &block)
+      WireServer.start(script) do |server|
+        ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+          c.max_retries = 0
+          c.read_timeout = 5
+          req = ::Net::HTTP::Get.new(path)
+          req["Accept-Encoding"] = "identity"
+          block ? c.request(req, &block) : c.request(req)
+        end
+      end
+    end
+
+    def get(server, path = "/")
+      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+        c.max_retries = 0
+        c.request(::Net::HTTP::Get.new(path))
+      end
+    end
+  end
+
+  # The scripts that answer.
+  class AnswersTest < DexpaceTestCase
+    include Fetch
+
+    test "fixed writes a Content-Length body with the given status and headers" do
+      res = fetch(Scripts.fixed("hello", status: "201 Created", headers: { "X-A" => "1" }))
+
+      assert_equal("201", res.code)
+      assert_equal("Created", res.message)
+      assert_equal("hello", res.body)
+      assert_equal("5", res["Content-Length"])
+      assert_equal("1", res["X-A"])
+    end
+
+    test "large writes large_body's deterministic, non-uniform bytes" do
+      body = Scripts.large_body(70_000)
+
+      assert_equal(70_000, body.bytesize)
+      assert_equal("abcdefghijklmnopqrstuvwxyzab", body[0, 28])
+      assert_equal(Encoding::BINARY, body.encoding)
+      assert_equal(body, fetch(Scripts.large(70_000)).body.b)
+    end
+
+    test "redirect writes a raw 302 with a Location and no body" do
+      res = fetch(Scripts.redirect("http://elsewhere.invalid/"))
+
+      assert_equal("302", res.code)
+      assert_equal("http://elsewhere.invalid/", res["Location"])
+    end
+
+    test "vendor_status writes any status code with a body" do
+      res = fetch(Scripts.vendor_status(520, "vendor error"))
+
+      assert_equal("520", res.code)
+      assert_equal("vendor error", res.body)
+    end
+
+    test "malformed_headers writes a control byte, a non-ASCII name, obs-text and two cookies" do
+      res = fetch(Scripts.malformed_headers)
+      hash = res.to_hash
+
+      assert_equal(["a\x01b".b], hash["x-ctl"])
+      assert_equal(["caf\xE9".b], hash["x-obs"])
+      assert_includes(hash.keys.map(&:b), "x-b\xE9d".b)
+      assert_equal(["a=1", "b=2"], hash["set-cookie"])
+      assert_equal("hi", res.body)
+    end
+
+    test "malformed_content_length writes a non-numeric Content-Length Net::HTTP itself rejects" do
+      raw = nil
+      error = assert_raises(::Net::HTTPHeaderSyntaxError) do
+        fetch(Scripts.malformed_content_length) do |res|
+          raw = res.to_hash["content-length"]
+          res.read_body
+        end
+      end
+
+      assert_equal(["abc"], raw)
+      assert_match(/Content-Length/, error.message)
+    end
+
+    test "sequenced answers each connection with the next body and repeats the last" do
+      WireServer.start(Scripts.sequenced("one", "two")) do |server|
+        bodies = Array.new(3) { get(server).body }
+
+        assert_equal(%w[one two two], bodies)
+      end
+    end
+
+    test "echo_path answers with the request's own path, which TRANSPORT-29's matching needs" do
+      assert_equal("/a-7", fetch(Scripts.echo_path, path: "/a-7").body)
+    end
+
+    test "write_response is the one primitive: status line, headers, Content-Length, body" do
+      res = fetch(lambda { |conn, _head|
+        Scripts.write_response(conn, status: "418 Teapot", body: "short")
+      })
+
+      assert_equal("418", res.code)
+      assert_equal("short", res.body)
+      assert_equal("5", res["Content-Length"])
+      assert_equal("1.1", res.http_version)
+    end
+  end
+
+  # The scripts that wait, hold or fail -- every wait on the socket, none on a sleep.
+  class WaitsTest < DexpaceTestCase
+    include Fetch
+
+    def timing_out(script, read_timeout: 0.2)
+      WireServer.start(script) do |server|
+        assert_raises(::Net::ReadTimeout) do
+          ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+            c.max_retries = 0
+            c.read_timeout = read_timeout
+            c.request(::Net::HTTP::Get.new("/before"))
+          end
+        end
+        yield server
+      end
+    end
+
+    test "dribble writes two chunks with a real gap between them" do
+      arrivals = []
+      t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      fetch(Scripts.dribble("aaaaa", "bbbbb", 0.3)) do |res|
+        res.read_body do |chunk|
+          arrivals << [chunk, Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0]
+        end
+      end
+
+      assert_equal(%w[aaaaa bbbbb], arrivals.map(&:first))
+      assert_operator(arrivals[0].last, :<, 0.2)
+      assert_operator(arrivals[1].last, :>=, 0.25)
+    end
+
+    test "fixed with hold: true holds the connection until the peer closes it" do
+      WireServer.start(Scripts.fixed("ok", hold: true)) do |server|
+        socket = ::TCPSocket.new("127.0.0.1", server.port)
+        socket.write("GET / HTTP/1.1\r\nHost: x\r\n\r\n")
+        socket.read(3) # the status line has started: the response is written
+
+        assert_nil(server.await_closed_connection(timeout: 0.2), "held while the peer stays")
+        socket.close
+
+        assert_equal(1, server.await_closed_connection(timeout: 2))
+      end
+    end
+
+    test "hang_before_headers reads the request, calls the hook once, and never answers at all" do
+      hooked = 0
+      seen = nil
+      timing_out(Scripts.hang_before_headers(on_request_read: -> { hooked += 1 })) do |server|
+        seen = server.requests.map(&:path)
+      end
+
+      assert_equal(1, hooked)
+      assert_equal(["/before"], seen, "the request was read in full before the hook fired")
+    end
+
+    test "hang_after_headers writes a chunked head, calls the hook once, and never answers" do
+      hooked = 0
+      timing_out(Scripts.hang_after_headers(on_headers_written: -> { hooked += 1 })) { |_| nil }
+
+      assert_equal(1, hooked)
+    end
+
+    test "fail_first_connection_then_succeed drops the first connection and answers the rest" do
+      WireServer.start(Scripts.fail_first_connection_then_succeed("ok")) do |server|
+        assert_raises(::EOFError, ::Errno::ECONNRESET) { get(server) }
+        assert_equal("ok", get(server).body)
+        assert_equal(2, server.connections)
+      end
+    end
+
+    # Measured on net-http 0.4.1, 0.6.0 and 0.9.1: Net::HTTP#read_body reads a Content-Length
+    # body with `ignore_eof = true`, so a truncated transfer is a SILENTLY short body at the
+    # native level and never an EOFError -- which is why the adapter's short-transfer detection
+    # is phase 3b's ResponseBody#write_to over the declared length, not anything Net::HTTP raises.
+    test "truncated declares more than it sends; Net::HTTP itself returns the short body" do
+      res = fetch(Scripts.truncated(declared_length: 10, actual_body: "abc"))
+
+      assert_equal("10", res["Content-Length"])
+      assert_equal("abc", res.body)
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_case_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_case_test.rb
new file mode 100644
index 0000000..0892f17
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_case_test.rb
@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# What an assertion body receives (8a's R7, R16): a factory-built transport behind the clause-8
+# guard, the borrowed pair (clause 4a), the one send primitive #settle (clause 8), the lazily
+# started fixture from a replaceable factory (clause 11), a request against that fixture's port,
+# and a teardown the runner drives. Two nested classes under Metrics/ClassLength (6c's shape).
+module DexpaceConformanceTransportCaseTest
+  TransportCase = Dexpace::Conformance::TransportCase
+  Scripts = Dexpace::Conformance::Scripts
+
+  # The doubles both classes share.
+  module Doubles
+    def build_case(build: ->(**_settings) { :built }, borrow: nil)
+      TransportCase.new(build: build, borrow: borrow)
+    end
+
+    def guarded_subject(&on_call)
+      subject = Object.new
+      subject.define_singleton_method(:call, &on_call) if on_call
+      subject.define_singleton_method(:close) { @closed = true }
+      subject.define_singleton_method(:closed?) { @closed ? true : false }
+      subject
+    end
+
+    def pair_of(transport, probe_answer)
+      Dexpace::Conformance::BorrowedPair.build(transport: transport, probe: -> { probe_answer })
+    end
+  end
+
+  # The transport, the guard and the send primitive.
+  class TransportTest < DexpaceTestCase
+    include Doubles
+
+    test "#transport calls the build factory with only the settings given, and tracks it" do
+      seen = []
+      kase = build_case(build: lambda { |**settings|
+        seen << settings
+        guarded_subject
+      })
+
+      kase.transport(timeout: 1.5)
+      kase.transport
+      kase.transport(logger: :the_logger)
+
+      assert_equal([{ timeout: 1.5 }, {}, { logger: :the_logger }], seen)
+    end
+
+    # Suite contract 8's guard: what an assertion receives cannot be #call-ed. The default #settle
+    # IS transport.call, so an assertion calling #call directly passes every run 8a performs and
+    # fails only once 8c's async driver replaces #settle -- a defect no test could see otherwise.
+    test "#transport returns a subject that refuses #call and delegates everything else" do
+      subject = guarded_subject { |*| flunk("the guard must not delegate #call") }
+      kase = build_case(build: ->(**_) { subject })
+
+      guarded = kase.transport
+
+      error = assert_raises(ArgumentError) { guarded.call(:r, :o, :c) }
+      assert_match(/kase\.settle/, error.message)
+      assert_match(/clause 8/, error.message)
+      refute_predicate(guarded, :closed?)
+      guarded.close
+
+      assert_predicate(guarded, :closed?, "every other message delegates")
+      assert_respond_to(guarded, :close)
+      refute_respond_to(guarded, :no_such_message)
+      assert_raises(NoMethodError) { guarded.no_such_message }
+    end
+
+    test "#settle unwraps the guard before handing the transport to the driver's primitive" do
+      seen = nil
+      subject = guarded_subject do |*args|
+        seen = args
+        :ok
+      end
+      kase = build_case(build: ->(**_) { subject })
+
+      assert_equal(:ok, kase.settle(kase.transport, :req, :opts, :cancel))
+      assert_equal(%i[req opts cancel], seen)
+    end
+
+    # Clause 8: the ONE send primitive. Its default is transport.call with RequestOptions::EMPTY
+    # and Cancellation.none defaulted; a driver that replaces it is what lets one assertion body
+    # drive a sync adapter and an async one whose future must be awaited.
+    test "#settle defaults to transport.call with EMPTY options and no cancellation, replaceably" do
+      seen = nil
+      transport = guarded_subject do |*args|
+        seen = args
+        :the_response
+      end
+      default = build_case
+
+      assert_equal(:the_response, default.settle(transport, :req))
+      assert_equal([:req, Dexpace::RequestOptions::EMPTY, Dexpace::Cancellation.none], seen)
+      assert_same(TransportCase::DEFAULT_SETTLE, default.instance_variable_get(:@settle))
+
+      awaited = TransportCase.new(build: ->(**_) { :t }, settle: ->(_t, _r, _o, _c) { :awaited })
+
+      assert_equal(:awaited, awaited.settle(transport, :req, :opts, :cancel))
+    end
+
+    test "#borrowed_transport raises Vacuous when the adapter supplies no borrowing entry point" do
+      kase = build_case(borrow: nil)
+
+      error = assert_raises(Dexpace::Conformance::Vacuous) { kase.borrowed_transport }
+      assert_match(/TRANSPORT-15/, error.reason)
+    end
+
+    # Suite contract 4a: the factory takes the fixture's PORT and returns a BorrowedPair, so no
+    # assertion ever names a native client class; the pair's transport comes back guarded too.
+    test "#borrowed_transport calls the borrow factory with the wire's port; the pair is guarded" do
+      seen = nil
+      borrowed = guarded_subject { |*| flunk("guarded") }
+      kase = build_case(borrow: lambda do |port|
+        seen = port
+        pair_of(borrowed, true)
+      end)
+      kase.wire(script: Scripts.fixed("x"))
+
+      pair = kase.borrowed_transport
+
+      assert_equal(kase.wire.port, seen)
+      assert_predicate(pair, :still_usable?)
+      assert_raises(ArgumentError) { pair.transport.call(:r, :o, :c) }
+      pair.transport.close
+
+      assert_predicate(borrowed, :closed?)
+      kase.teardown
+    end
+  end
+
+  # The fixture, the request builder and the teardown.
+  class FixtureTest < DexpaceTestCase
+    include Doubles
+
+    test "#wire starts a WireServer lazily and memoizes it across calls in one case" do
+      kase = build_case
+
+      first = kase.wire(script: Scripts.fixed("x"))
+      second = kase.wire
+
+      assert_same(first, second)
+      assert_kind_of(Dexpace::Conformance::WireServer, first)
+      kase.teardown
+    end
+
+    # Clause 11: the fixture comes from a factory, so 8c can hand in its own HTTP/2 server.
+    test "#wire calls the supplied factory instead of starting a WireServer" do
+      built = []
+      kase = TransportCase.new(build: ->(**_) { :t }, wire: lambda { |script|
+        built << script
+        :foreign
+      },)
+
+      assert_equal(:foreign, kase.wire(script: :the_script))
+      assert_equal(:foreign, kase.wire)
+      assert_equal([:the_script], built)
+    end
+
+    test "#request builds a Dexpace::Request against #wire's own port, defaulting to a GET of /" do
+      kase = build_case
+      kase.wire(script: Scripts.fixed("x"))
+
+      request = kase.request
+      posted = kase.request(path: "/a?b=1", method: "POST",
+                            headers: Dexpace::Headers.builder.tap { |b| b.add("X-A", "1") }.build,
+                            body: Dexpace::Body.bytes("x".b),)
+
+      assert_equal("GET", request.method.token)
+      assert_equal("http://127.0.0.1:#{kase.wire.port}/", Dexpace::URL.external_form(request.url))
+      assert_equal("POST", posted.method.token)
+      assert_equal("/a?b=1", posted.url.request_uri)
+      assert_equal(["1"], posted.headers["X-A"])
+      refute_nil(posted.body)
+      kase.teardown
+    end
+
+    test "#teardown closes every transport it tracked, the borrowed one included, and the wire" do
+      closed = []
+      built = Object.new
+      built.define_singleton_method(:close) { closed << :built }
+      borrowed = Object.new
+      borrowed.define_singleton_method(:close) { closed << :borrowed }
+      kase = build_case(build: ->(**_) { built }, borrow: ->(_port) { pair_of(borrowed, true) })
+      kase.transport
+      kase.borrowed_transport
+      wire = kase.wire
+
+      kase.teardown
+
+      assert_equal(%i[built borrowed], closed)
+      assert_raises(Errno::ECONNREFUSED) { ::TCPSocket.new("127.0.0.1", wire.port).close }
+    end
+
+    test "#teardown is a no-op for a case that built nothing and started no wire" do
+      assert_nil(build_case.teardown)
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/inbound_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/inbound_test.rb
new file mode 100644
index 0000000..00dc9f7
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/inbound_test.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/assertion_probe"
+require_relative "../../../support/stub_transport"
+require "dexpace/conformance"
+
+# Group 2 (8a plan Task 10): TRANSPORT-24, TRANSPORT-14 and TRANSPORT-27, each proven to pass
+# against a hand-built conforming response and to fail against the one hand-built defect it was
+# written for. The stub never touches the fixture: every question these assertions ask is of the
+# Dexpace::Response, which is the point (suite contract clauses 2, 6, 7).
+class DexpaceConformanceInboundAssertionsTest < DexpaceTestCase
+  include AssertionProbe
+
+  def inbound(pairs)
+    builder = Dexpace::Headers.inbound_builder
+    pairs.each { |name, values| Array(values).each { |value| builder.add(name, value) } }
+    builder.build
+  end
+
+  def response_of(status:, body:, headers: Dexpace::Headers::EMPTY_INBOUND, media_type: nil,
+                  content_length: body.bytesize)
+    lambda do |request, _options, _cancellation|
+      Dexpace::Response.build(
+        request: request, protocol: "HTTP/1.1", status: status, headers: headers,
+        body: Dexpace::ResponseBody.new(source: Dexpace::IO::BufferedSource.of_bytes(body.b),
+                                        media_type: media_type, content_length: content_length,),
+      )
+    end
+  end
+
+  def stub(&on_call)
+    ->(**_settings) { StubTransport.new(&on_call) }
+  end
+
+  test "the group registers four assertions after the outbound seven" do
+    assert_equal([["TRANSPORT-24"], ["TRANSPORT-14"], ["TRANSPORT-14"], ["TRANSPORT-27"]],
+                 Suite.assertions[7, 4].map(&:ids),)
+  end
+
+  test "TRANSPORT-24: a 520 with a body passes; a status quietly normalised to 502 fails" do
+    assertion = find("TRANSPORT-24")
+
+    assert_passes(assertion, build: stub(&response_of(status: 520, body: "vendor error")))
+    assert_fails(assertion, build: stub(&response_of(status: 502, body: "vendor error")),
+                            matching: /not surfaced faithfully/,)
+  end
+
+  test "TRANSPORT-14: obs-text kept and malformed headers dropped pass; stripped obs-text fails" do
+    assertion = find_all("TRANSPORT-14")[0]
+    kept = inbound("X-Obs" => "caf\xE9".b, "X-Ok" => "fine", "Set-Cookie" => %w[a=1 b=2])
+    stripped = inbound("X-Obs" => "caf?", "X-Ok" => "fine")
+
+    assert_passes(assertion, build: stub(&response_of(status: 200, body: "hi", headers: kept)))
+    assert_fails(assertion, build: stub(&response_of(status: 200, body: "hi", headers: stripped)),
+                            matching: /leniency did not hold/,)
+  end
+
+  test "TRANSPORT-14: two Set-Cookie values pass; a joined one fails" do
+    assertion = find_all("TRANSPORT-14")[1]
+    two = inbound("Set-Cookie" => %w[a=1 b=2])
+    joined = inbound("Set-Cookie" => "a=1, b=2")
+
+    assert_passes(assertion, build: stub(&response_of(status: 200, body: "hi", headers: two)))
+    assert_fails(assertion, build: stub(&response_of(status: 200, body: "hi", headers: joined)),
+                            matching: /collapsed/,)
+  end
+
+  test "TRANSPORT-27: nil media type, -1 length and a readable body pass; a length or type fails" do
+    assertion = find("TRANSPORT-27")
+
+    assert_passes(assertion, build: stub(&response_of(status: 200, body: "hi", content_length: -1)))
+    assert_fails(assertion, build: stub(&response_of(status: 200, body: "hi", content_length: 2)),
+                            matching: /downgrade did not hold/,)
+    typed = response_of(status: 200, body: "hi", content_length: -1,
+                        media_type: Dexpace::MediaType.parse("text/plain"),)
+
+    assert_fails(assertion, build: stub(&typed), matching: /downgrade did not hold/)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/lifecycle_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/lifecycle_test.rb
new file mode 100644
index 0000000..21aa0b3
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/lifecycle_test.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/assertion_probe"
+require_relative "../../../support/raw_wire_transport"
+require_relative "../../../support/stub_transport"
+require_relative "../../../support/non_conforming_transport"
+require "dexpace/conformance"
+
+# Group 5 (8a plan Task 13): TRANSPORT-5, 6, 15, 16, 29 and phase 7c's PAGE-36, each proven in
+# both directions. This is also the file that closes the registry: the whole suite is 28
+# assertions, one of them vacuous by measurement, none of them TRANSPORT-12's or TRANSPORT-13's
+# (phase 8c's rows, asserted by 8c's driver).
+class DexpaceConformanceLifecycleAssertionsTest < DexpaceTestCase
+  include AssertionProbe
+
+  def borrow_with(probe_answer)
+    lambda do |_port|
+      Dexpace::Conformance::BorrowedPair.build(transport: RawWireTransport.new(owned: false),
+                                               probe: -> { probe_answer },)
+    end
+  end
+
+  test "the suite is exactly 28 assertions in five groups, with no TRANSPORT-12 or TRANSPORT-13" do
+    assert_equal(28, Suite.assertions.size)
+    assert_equal([%w[TRANSPORT-5], %w[TRANSPORT-6], %w[TRANSPORT-15], %w[TRANSPORT-15 TRANSPORT-16],
+                  %w[TRANSPORT-29], %w[PAGE-36],], Suite.assertions[22, 6].map(&:ids),)
+    ids = Suite.assertions.flat_map(&:ids).uniq
+
+    assert_empty(ids & %w[TRANSPORT-12 TRANSPORT-13])
+    assert_equal(22, ids.grep(/\ATRANSPORT-/).size,
+                 "the 23 own IDs minus TRANSPORT-30, whose proxy assertions are the adapter's own",)
+  end
+
+  test "TRANSPORT-5: two concurrent calls each bounded by its own timeout pass; sticky fails" do
+    assertion = find("TRANSPORT-5")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:sticky_timeout), matching: /did not bound their own calls/)
+  end
+
+  test "TRANSPORT-6: a near-zero timeout that still bounds the call passes; non-retryable fails" do
+    assertion = find("TRANSPORT-6")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:non_retryable_timeout), matching: /did not bound the call/)
+  end
+
+  test "TRANSPORT-15 (borrowed): a usable client passes; a broken one fails; no factory: vacuous" do
+    assertion = find_all("TRANSPORT-15")[0]
+
+    assert_passes(assertion, build: raw, borrow: borrow_with(true))
+    assert_fails(assertion, build: raw, borrow: borrow_with(false), matching: /did not survive/)
+    assert_vacuous(assertion, build: raw, matching: /TRANSPORT-15/)
+  end
+
+  test "TRANSPORT-15/16 (owned): ClosedError after two closes passes; a send after close fails" do
+    assertion = find("TRANSPORT-16")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:send_after_close), matching: /did not raise ClosedError/)
+    assert_fails(assertion, build: lambda { |**_|
+      NonConformingTransport.new
+    }, matching: /did not raise ClosedError/,)
+  end
+
+  test "TRANSPORT-29: 160 concurrent echoes each matched to its request pass; a cached one fails" do
+    assertion = find("TRANSPORT-29")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:cached_response), matching: /wrong request/)
+  end
+
+  test "PAGE-36: two pages under two different options pass; reusing the first response fails" do
+    assertion = find("PAGE-36")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:cached_response), matching: /did not reach a fresh page/)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/outbound_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/outbound_test.rb
new file mode 100644
index 0000000..ca20431
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/outbound_test.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/assertion_probe"
+require_relative "../../../support/raw_wire_transport"
+require "dexpace/conformance"
+
+# Group 1 (8a plan Task 9): TRANSPORT-10, TRANSPORT-11, TRANSPORT-26 and the wire-boundary
+# re-validation (HTTP-17, HTTP-18, XCUT-18), each proven to pass against RawWireTransport's correct
+# send and to fail against the one defect it was written to catch. The real adapter's run is the
+# net_http gem's conformance_test.rb.
+class DexpaceConformanceOutboundAssertionsTest < DexpaceTestCase
+  include AssertionProbe
+
+  test "the group registers seven assertions, in the chapter's order" do
+    ids = Suite.assertions.first(7).map(&:ids)
+
+    assert_equal([["TRANSPORT-10"], ["TRANSPORT-10"], ["TRANSPORT-10"], ["TRANSPORT-26"],
+                  ["TRANSPORT-11"], %w[HTTP-17 XCUT-18], %w[HTTP-18 XCUT-18],], ids,)
+  end
+
+  test "TRANSPORT-10 (a): the explicit Content-Type wins: passes when kept, fails overridden" do
+    assertion = find_all("TRANSPORT-10")[0]
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:override_type), matching: /overwritten/)
+  end
+
+  test "TRANSPORT-10 (b): the body's media type is used when the caller set none; ignored fails" do
+    assertion = find_all("TRANSPORT-10")[1]
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:ignore_body_type), matching: /media type was not used/)
+  end
+
+  test "TRANSPORT-10 (c): a body with no media type is never sent as a form; stamped fails" do
+    assertion = find_all("TRANSPORT-10")[2]
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:form_type), matching: /went out as a form/)
+  end
+
+  test "TRANSPORT-26: a body-less POST is a zero-length body; no Content-Length sent fails" do
+    assertion = find("TRANSPORT-26")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:no_zero_length), matching: /zero-length/)
+  end
+
+  test "TRANSPORT-11: framing recomputed and pass-through kept; each clause fails on its defect" do
+    assertion = find("TRANSPORT-11")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:forward_host),
+                            matching: /framing headers were not recomputed/,)
+    assert_fails(assertion, build: raw(:drop_pass_through),
+                            matching: /pass-through header vanished/,)
+  end
+
+  # The socket count is the check that discriminates, and the error class alone would not:
+  # Dexpace::Response.build refuses a request that is not a Dexpace::Request, so an adapter that
+  # skipped the re-validation and SENT the forged bytes still raises InvalidArgumentError -- after
+  # the injected header has reached the wire. Measured here with the double, recorded so nobody
+  # weakens the assertion to the class check.
+  # The failing direction reads the socket count: a non-validating double still raises after the
+  # send, because Response.build refuses a forged Request, so only the connection count tells.
+  test "HTTP-17 / HTTP-18: a forged CRLF name and value are each refused before dispatch" do
+    name = find("HTTP-17")
+    value = find("HTTP-18")
+
+    assert_passes(name, build: raw)
+    assert_passes(value, build: raw)
+    assert_fails(name, build: raw(:skip_validation), matching: /reached the socket/)
+    assert_fails(value, build: raw(:skip_validation), matching: /reached the socket/)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/resilience_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/resilience_test.rb
new file mode 100644
index 0000000..84c5744
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/resilience_test.rb
@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/assertion_probe"
+require_relative "../../../support/raw_wire_transport"
+require "dexpace/conformance"
+
+# Group 4 (8a plan Task 12): TRANSPORT-1, 2, 3, 4, 17, 18, 20 and 22, each proven in both
+# directions against RawWireTransport. TRANSPORT-18 is the one whose correct outcome is Vacuous:
+# vacuity is measured, and the double that re-sends on its own turns it into a Failure.
+class DexpaceConformanceResilienceAssertionsTest < DexpaceTestCase
+  include AssertionProbe
+
+  test "the group registers eight assertions after the first fourteen" do
+    ids = Suite.assertions[14, 8].map(&:ids)
+
+    assert_equal([["TRANSPORT-1"], ["TRANSPORT-2"], ["TRANSPORT-3"], ["TRANSPORT-4"],
+                  ["TRANSPORT-17"], ["TRANSPORT-18"], ["TRANSPORT-20"], ["TRANSPORT-22"],], ids,)
+  end
+
+  test "TRANSPORT-1: a raw 302 returned passes; a transport that follows it fails" do
+    assertion = find("TRANSPORT-1")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:pretend_followed), matching: /redirect was followed/)
+  end
+
+  test "TRANSPORT-2: one connection, one pull over a dropped attempt passes; native retry fails" do
+    assertion = find("TRANSPORT-2")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:retry_once), matching: /silently retried/)
+  end
+
+  test "TRANSPORT-3: a cancel as CancelledError passes; the same as a retryable failure fails" do
+    assertion = find("TRANSPORT-3")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:misclassify_cancel), matching: /swallowed or misclassified/)
+  end
+
+  test "TRANSPORT-4: a retryable timeout with the flag clear passes; raised as a cancel, fails" do
+    assertion = find("TRANSPORT-4")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:cancel_on_timeout), matching: /did not classify retryable/)
+    assert_fails(assertion, build: raw(:non_retryable_timeout),
+                            matching: /did not classify retryable/,)
+  end
+
+  test "TRANSPORT-17: one request, one pull, the bytes intact passes; a second send fails" do
+    assertion = find("TRANSPORT-17")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:send_twice), matching: /more than once/)
+  end
+
+  test "TRANSPORT-18: vacuous by measurement when nothing re-subscribed; a native re-send fails" do
+    assertion = find("TRANSPORT-18")
+
+    assert_vacuous(assertion, build: raw, matching: /antecedent is absent/)
+    assert_fails(assertion, build: raw(:retry_once), matching: /re-subscribed/)
+  end
+
+  test "TRANSPORT-20: a refused connection as the retryable failure passes; a bare Errno fails" do
+    assertion = find("TRANSPORT-20")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:bare_errno), matching: /was not retryable/)
+  end
+
+  test "TRANSPORT-22: a released connection after a caller failure passes; one left open fails" do
+    assertion = find("TRANSPORT-22")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:leave_open), matching: /not released/)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/streaming_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/streaming_test.rb
new file mode 100644
index 0000000..c8e8061
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite/streaming_test.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/assertion_probe"
+require_relative "../../../support/raw_wire_transport"
+require_relative "../../../support/stub_transport"
+require "dexpace/conformance"
+
+# Group 3 (8a plan Task 11): TRANSPORT-25, TRANSPORT-19 and TRANSPORT-28's reachable clauses, each
+# proven in both directions. TRANSPORT-19's subject is the response's own close, so its two
+# directions are hand-built responses whose close is instant or slow.
+class DexpaceConformanceStreamingAssertionsTest < DexpaceTestCase
+  include AssertionProbe
+
+  # A response whose body close takes `close_seconds` -- the slow one SIMULATES a producer that
+  # is waited for, which is the behaviour under test and the only sleep in this file. The body is
+  # a duck answering #source and #close (P3-23), which is all Response#close is written against.
+  def response_closing_in(close_seconds)
+    lambda do |request, _options, _cancellation|
+      inner = Dexpace::ResponseBody.new(source: Dexpace::IO::BufferedSource.of_bytes("aaaaa".b))
+      slow = Object.new
+      slow.define_singleton_method(:source) { inner.source }
+      slow.define_singleton_method(:media_type) { nil }
+      slow.define_singleton_method(:content_length) { -1 }
+      slow.define_singleton_method(:close) do
+        sleep(close_seconds)
+        inner.close
+      end
+      Dexpace::Response.build(request: request, protocol: "HTTP/1.1", status: 200,
+                              headers: Dexpace::Headers::EMPTY_INBOUND, body: slow,)
+    end
+  end
+
+  test "the group registers three assertions after the first eleven" do
+    assert_equal([["TRANSPORT-25"], ["TRANSPORT-19"], ["TRANSPORT-28"]],
+                 Suite.assertions[11, 3].map(&:ids),)
+  end
+
+  test "TRANSPORT-25: a byte-exact multi-megabyte round trip with the connection released passes" do
+    assert_passes(find("TRANSPORT-25"), build: raw)
+  end
+
+  test "TRANSPORT-25: a short read fails on the bytes; a connection left open fails on release" do
+    assertion = find("TRANSPORT-25")
+
+    assert_fails(assertion, build: raw(:short_read), matching: /byte-exactly/)
+    assert_fails(assertion, build: raw(:leave_open), matching: /did not release the connection/)
+  end
+
+  test "TRANSPORT-19: an instant, idempotent close passes; one that waits for the producer fails" do
+    assertion = find("TRANSPORT-19")
+
+    assert_passes(assertion, build: ->(**_) { StubTransport.new(&response_closing_in(0)) })
+    assert_fails(assertion, build: ->(**_) { StubTransport.new(&response_closing_in(1.2)) },
+                            matching: /blocked/,)
+  end
+
+  test "TRANSPORT-28: the file window reaches the wire and the body replays; whole file fails" do
+    assertion = find("TRANSPORT-28")
+
+    assert_passes(assertion, build: raw)
+    assert_fails(assertion, build: raw(:ignore_window), matching: /byte range was not honoured/)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/transport_suite_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite_test.rb
new file mode 100644
index 0000000..d75b46b
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/transport_suite_test.rb
@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require_relative "../../support/non_conforming_transport"
+require "dexpace/conformance"
+
+# The runner (8a's R7): every assertion is run in a fresh TransportCase, its raise mapped onto one
+# of five statuses, its case torn down whatever happened, and a waived id never run at all. The
+# `assertions:` keyword is how these tests hand in three assertions of their own -- no `.stub`, so
+# no fence here needs `minitest/mock` (docs/first-release.md's Minitest 6 entry) -- and how the
+# Minitest driver test hands in a fake suite. Two nested classes under Metrics/ClassLength (6c's
+# shape): the outcomes, and the three driver keywords.
+module DexpaceConformanceTransportSuiteTest
+  TransportSuite = Dexpace::Conformance::TransportSuite
+  Failure = Dexpace::Conformance::Failure
+  Vacuous = Dexpace::Conformance::Vacuous
+
+  # The assertion builder and the one-call runner both classes share.
+  module Running
+    def assertion(id, &body)
+      Dexpace::Conformance::Assertion.build(ids: [id], name: "checks #{id}", body: body)
+    end
+
+    def run_suite(*assertions, **)
+      TransportSuite.run(build: ->(**_) { :t }, assertions: assertions, **)
+    end
+  end
+
+  # The five statuses, the waiver and the per-assertion case.
+  class OutcomesTest < DexpaceTestCase
+    include Running
+
+    test "run executes every assertion in order and returns a passing Report with the preamble" do
+      order = []
+      report = run_suite(assertion("A") { |_| order << :a }, assertion("B") { |_| order << :b })
+
+      assert_predicate(report, :passed?)
+      assert_equal(%i[a b], order)
+      assert_equal(%i[passed passed], report.results.map(&:status))
+      assert_equal(TransportSuite::PREAMBLE, report.preamble)
+      assert_match(/plaintext/, report.preamble)
+      assert_match(/connect timeout/, report.preamble)
+    end
+
+    test "a raised Failure lands as :failed, a Vacuous as :vacuous, anything else as :error" do
+      failing = assertion("A") do |_|
+        raise Failure.new("x", expected: 1, actual: 2, requirement_ids: ["A"])
+      end
+      vacuous = assertion("B") { |_| raise Vacuous, "no antecedent" }
+      erroring = assertion("C") { |_| raise "boom" }
+
+      report = run_suite(failing, vacuous, erroring)
+
+      assert_equal(%i[failed vacuous error], report.results.map(&:status))
+      assert_equal(["x", "no antecedent", "RuntimeError: boom"], report.results.map(&:detail))
+      refute_predicate(report, :passed?)
+    end
+
+    test "waiving an assertion's id suppresses it into :waived without running the body" do
+      ran = false
+      waivable = assertion("A") do |_|
+        ran = true
+        raise "would have failed"
+      end
+      other = assertion("B") { |_| nil }
+
+      report = run_suite(waivable, other, waive: ["A"])
+
+      assert_equal(%i[waived passed], report.results.map(&:status))
+      refute(ran, "a waived assertion's body must not run at all")
+      assert_includes(report.to_s, "waived: A")
+    end
+
+    test "a waiver matches by requirement id, never by name" do
+      two_ids = Dexpace::Conformance::Assertion.build(ids: %w[A B], name: "A", body: lambda { |_|
+        raise "ran"
+      },)
+
+      assert_equal(%i[waived], run_suite(two_ids, waive: ["B"]).results.map(&:status))
+      assert_equal(%i[error], run_suite(two_ids, waive: ["checks A"]).results.map(&:status))
+    end
+
+    test "a deliberately non-conforming fake transport fails the assertion that names its defect" do
+      checks_close = assertion("SEAM-14") do |kase|
+        transport = kase.transport
+        transport.close
+        unless transport.closed?
+          raise Failure.new("closed? did not flip", expected: true, actual: false,
+                                                    requirement_ids: ["SEAM-14"],)
+        end
+      end
+
+      report = TransportSuite.run(build: lambda { |**_|
+        NonConformingTransport.new
+      }, assertions: [checks_close],)
+
+      assert_equal(1, report.failures.size, "the suite must DETECT the defect, not merely run")
+      assert_equal("closed? did not flip", report.failures.first.detail)
+    end
+
+    test "every assertion gets a FRESH case, torn down after it, whatever it raised" do
+      cases = []
+      transports = []
+      build = lambda do |**_|
+        t = Object.new
+        t.define_singleton_method(:close) { transports << :closed }
+        t
+      end
+      first = assertion("A") do |kase|
+        cases << kase
+        kase.transport
+        raise "boom"
+      end
+      second = assertion("B") do |kase|
+        cases << kase
+        kase.transport
+      end
+
+      TransportSuite.run(build: build, assertions: [first, second])
+
+      assert_equal(2, cases.uniq.size)
+      assert_equal(%i[closed closed], transports)
+    end
+
+    test ".assertions is the frozen, ordered registry the default run uses" do
+      assert_predicate(TransportSuite.assertions, :frozen?)
+      assert_kind_of(Array, TransportSuite.assertions)
+      TransportSuite.assertions.each { |a| assert_kind_of(Dexpace::Conformance::Assertion, a) }
+    end
+  end
+
+  # The three keywords a driver passes (suite contract clauses 8, 9 and 11).
+  class DriverKeywordsTest < DexpaceTestCase
+    include Running
+
+    # Suite contract clause 9 (8a's R16): the runner INVOKES the assertion, so a driver can put a
+    # block around it -- how 8c's async driver opens a reactor for the whole assertion, the part
+    # that reads a streamed response body included.
+    test "around: wraps every assertion invocation and the assertion still runs inside it" do
+      order = []
+      wrapped = assertion("A") { |_| order << :assertion }
+
+      report = run_suite(wrapped, around: lambda { |&blk|
+        order << :before
+        blk.call
+        order << :after
+      },)
+
+      assert_predicate(report, :passed?)
+      assert_equal(%i[before assertion after], order)
+    end
+
+    test "a Failure raised inside around: still lands as :failed; the wrapper cannot swallow it" do
+      failing = assertion("A") do |_|
+        raise Failure.new("x", expected: 1, actual: 2, requirement_ids: ["A"])
+      end
+
+      report = run_suite(failing, around: ->(&blk) { blk.call })
+
+      assert_equal(1, report.failures.size)
+    end
+
+    # Clauses 8 and 11: the send primitive and the fixture factory reach every case the runner
+    # builds.
+    test "settle: and wire: reach the case, and the guard still refuses a direct #call" do
+      seen = []
+      kase_seen = nil
+      probe = assertion("A") do |kase|
+        kase_seen = kase
+        seen << kase.settle(kase.transport, :req, :opts, :cancel)
+        seen << kase.wire(script: :s)
+      end
+
+      report = run_suite(probe, settle: ->(_t, _r, _o, _c) { :settled }, wire: lambda { |script|
+        [:wired, script]
+      },)
+
+      assert_predicate(report, :passed?, report.to_s)
+      assert_equal([:settled, %i[wired s]], seen)
+      assert_raises(ArgumentError) { kase_seen.transport.call(:r, :o, :c) }
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/vacuous_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/vacuous_test.rb
new file mode 100644
index 0000000..1636ee3
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/vacuous_test.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+
+# Design §12's MUST-level summary counts requirements that "hold vacuously" as a category of their
+# own -- Vacuous is what keeps that count true rather than something a suite's passing rate erases.
+# Raised from INSIDE an assertion once it has established the antecedent is absent, never decided
+# from a list outside it, so vacuity is a measurement and not a claim (8a's R7).
+class DexpaceConformanceVacuousTest < DexpaceTestCase
+  test "carries a reason and is a StandardError, not a Dexpace::Error and not a Failure" do
+    vacuous = Dexpace::Conformance::Vacuous.new("no proxy is ever configured")
+
+    assert_operator(Dexpace::Conformance::Vacuous, :<, ::StandardError)
+    refute_operator(Dexpace::Conformance::Vacuous, :<, Dexpace::Error)
+    refute_operator(Dexpace::Conformance::Vacuous, :<, Dexpace::Conformance::Failure)
+    assert_equal("no proxy is ever configured", vacuous.reason)
+    assert_equal("no proxy is ever configured", vacuous.message)
+  end
+end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
new file mode 100644
index 0000000..c97cf4c
--- /dev/null
+++ b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace/conformance"
+require "net/http"
+
+# Design §9.3's TCPServer fixture (8a's R7): a fresh server per test, never a shared one, so
+# #connections is never order-dependent across tests (testing/4ef070df). Every wait is a blocking
+# Queue#pop or a bounded join, never a sleep-poll; and #close closes every accepted socket and joins
+# every handler thread, so a test that started a server leaks nothing DexpaceTestCase's teardown
+# counts. Two nested classes under Metrics/ClassLength (6c's shape): what the server records, and
+# how it closes.
+module DexpaceConformanceWireServerTest
+  WireServer = Dexpace::Conformance::WireServer
+  Scripts = Dexpace::Conformance::Scripts
+
+  # One GET through a plain client.
+  module Fetch
+    def get(port, path = "/")
+      ::Net::HTTP.start("127.0.0.1", port) do |c|
+        c.max_retries = 0
+        c.request(::Net::HTTP::Get.new(path))
+      end
+    end
+  end
+
+  # What the server answers and records.
+  class RecordingTest < DexpaceTestCase
+    include Fetch
+
+    test "starts on an ephemeral port and answers a scripted response" do
+      server = WireServer.start(Scripts.fixed("hi"))
+
+      res = get(server.port)
+
+      assert_equal("200", res.code)
+      assert_equal("hi", res.body)
+      server.close
+    end
+
+    test "records requests and connections, independently of the client's own count" do
+      server = WireServer.start(Scripts.fixed("x"))
+
+      2.times { |i| get(server.port, "/p#{i}") }
+
+      assert_equal(2, server.requests.size)
+      assert_equal(2, server.connections)
+      assert_equal(["/p0", "/p1"], server.requests.map(&:path))
+      assert_equal("GET /p0 HTTP/1.1", server.requests.first.request_line)
+      assert_equal("127.0.0.1:#{server.port}", server.requests.first.header("host"))
+      assert_nil(server.requests.first.header("x-absent"))
+      assert_equal("", server.requests.first.body)
+      server.close
+    end
+
+    test "records a Content-Length request body and a chunked one, so an upload is observable" do
+      server = WireServer.start(Scripts.fixed("x"))
+      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+        c.max_retries = 0
+        fixed = ::Net::HTTP::Post.new("/fixed")
+        fixed["Content-Type"] = "application/octet-stream"
+        fixed.body = "caf\xE9".b
+        c.request(fixed)
+      end
+      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+        c.max_retries = 0
+        chunked = ::Net::HTTP::Post.new("/chunked")
+        chunked["Content-Type"] = "application/octet-stream"
+        chunked["Transfer-Encoding"] = "chunked"
+        source = Object.new
+        chunks = ["ab".b, "cde".b]
+        source.define_singleton_method(:readpartial) do |_n, outbuf = nil|
+          raise ::EOFError if chunks.empty?
+
+          chunk = chunks.shift
+          outbuf ? outbuf.replace(chunk) : chunk
+        end
+        chunked.body_stream = source
+        c.request(chunked)
+      end
+
+      assert_equal(["caf\xE9".b, "abcde".b], server.requests.map(&:body))
+      assert_equal(Encoding::BINARY, server.requests.first.body.encoding)
+      server.close
+    end
+
+    test "records closed_connections apart from connections; #await_closed_connection waits" do
+      server = WireServer.start(Scripts.fixed("x"))
+
+      get(server.port)
+
+      assert(server.await_closed_connection) # a blocking Queue#pop, never a sleep-poll
+      assert_equal(1, server.closed_connections)
+      assert_equal(1, server.connections)
+      server.close
+    end
+
+    test "#await_closed_connection with a bound answers nil when nothing finishes in time" do
+      server = WireServer.start(Scripts.fixed("x"))
+
+      took = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      answered = server.await_closed_connection(timeout: 0.1)
+      took = Process.clock_gettime(Process::CLOCK_MONOTONIC) - took
+
+      assert_nil(answered)
+      assert_operator(took, :<, 1.0)
+      server.close
+    end
+
+    test "a script that raises does not crash the accept loop or strand later connections" do
+      calls = 0
+      server = WireServer.start(lambda do |conn, _head|
+        calls += 1
+        raise "first script failure" if calls == 1
+
+        Scripts.write_response(conn, body: "recovered")
+      end)
+
+      assert_raises(::EOFError, ::Errno::ECONNRESET) { get(server.port) }
+      assert_equal("recovered", get(server.port).body)
+      server.close
+    end
+  end
+
+  # How the server closes: bounded, idempotent, and waking everything it owns.
+  class ClosingTest < DexpaceTestCase
+    include Fetch
+
+    test "the block form closes the server on any exit" do
+      port = nil
+      WireServer.start(Scripts.fixed("x")) do |server|
+        port = server.port
+      end
+
+      assert_raises(Errno::ECONNREFUSED) { get(port) }
+    end
+
+    test "#close is idempotent and bounded" do
+      server = WireServer.start(Scripts.fixed("x"))
+
+      t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      server.close
+      server.close
+      elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0
+
+      assert_operator(elapsed, :<, 1.0)
+    end
+
+    # The teardown property every test in every suite relies on: a handler blocked on a socket --
+    # hang_after_headers never answers -- is woken by #close closing the accepted socket, so the
+    # thread ends and the test's own thread count is unchanged (DexpaceTestCase#teardown).
+    test "#close wakes a handler blocked on its socket and joins it, promptly" do
+      entered = ::Thread::Queue.new
+      server = WireServer.start(Scripts.hang_after_headers(on_headers_written: lambda {
+        entered.push(true)
+      }))
+      client = ::TCPSocket.new("127.0.0.1", server.port)
+      client.write("GET / HTTP/1.1\r\nHost: x\r\n\r\n")
+      entered.pop
+      threads_before_close = ::Thread.list.size
+
+      t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      server.close
+      elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0
+      client.close
+
+      assert_operator(elapsed, :<, 1.0)
+      assert_operator(::Thread.list.size, :<, threads_before_close,
+                      "the accept and handler threads ended",)
+      assert_equal(1, server.closed_connections)
+    end
+
+    test "a waiter that outlives the server gets nil from #await_closed_connection, not a hang" do
+      server = WireServer.start(Scripts.fixed("x"))
+      waiter = ::Thread.new { server.await_closed_connection }
+
+      server.close
+
+      refute_nil(waiter.join(2), "the waiter did not wake within two seconds")
+      assert_nil(waiter.value)
+    end
+  end
+end
diff --git a/gems/dexpace-conformance/test/support/assertion_probe.rb b/gems/dexpace-conformance/test/support/assertion_probe.rb
new file mode 100644
index 0000000..c0a7126
--- /dev/null
+++ b/gems/dexpace-conformance/test/support/assertion_probe.rb
@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace/conformance"
+
+# The helpers the five assertion-group suites share: find an assertion by the id it carries, run
+# it alone through the real runner against a given factory (a fresh case, torn down after), and
+# assert the Result's status. An assertion is proven in BOTH directions -- it passes against a
+# correct send and fails against the defect it was written for -- because an assertion that never
+# raises proves nothing, and the real adapter's run cannot tell the difference.
+module AssertionProbe
+  Suite = Dexpace::Conformance::TransportSuite
+
+  def find(id)
+    Suite.assertions.find { |assertion| assertion.ids.include?(id) } ||
+
+      flunk("no assertion carries #{id}")
+  end
+
+  def find_all(id)
+    Suite.assertions.select { |assertion| assertion.ids.include?(id) }
+  end
+
+  def result_for(assertion, build:, borrow: nil)
+    Suite.run(build: build, borrow: borrow, assertions: [assertion]).results.first
+  end
+
+  def assert_passes(assertion, build:, borrow: nil)
+    result = result_for(assertion, build: build, borrow: borrow)
+
+    assert_equal(:passed, result.status, "#{assertion.name}: #{result.detail}")
+  end
+
+  def assert_fails(assertion, build:, borrow: nil, matching: nil)
+    result = result_for(assertion, build: build, borrow: borrow)
+
+    assert_equal(:failed, result.status, "#{assertion.name}: #{result.detail}")
+    assert_match(matching, result.detail.to_s) if matching
+    result
+  end
+
+  def assert_vacuous(assertion, build:, matching: nil)
+    result = result_for(assertion, build: build)
+
+    assert_equal(:vacuous, result.status, "#{assertion.name}: #{result.detail}")
+    assert_match(matching, result.detail.to_s) if matching
+  end
+
+  def raw(*defects)
+    ->(**_settings) { RawWireTransport.new(*defects) }
+  end
+end
diff --git a/gems/dexpace-conformance/test/support/non_conforming_transport.rb b/gems/dexpace-conformance/test/support/non_conforming_transport.rb
new file mode 100644
index 0000000..d25a0d6
--- /dev/null
+++ b/gems/dexpace-conformance/test/support/non_conforming_transport.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+# Core's test fakes stay in core (8a's design, "Work phase 8a postponed, and who owns it now"):
+# dexpace-conformance publishes its OWN doubles rather than lifting dexpace-core's test/support/
+# fakes, so this is the gem's fake and not a move. A transport whose #close never flips #closed?,
+# proving TransportSuite.run DETECTS a defect rather than only running assertions that pass.
+class NonConformingTransport
+  def call(_request, _options, _cancellation)
+    raise "not exercised by the suite's own tests"
+  end
+
+  def close
+    nil # deliberately never flips closed?
+  end
+
+  def closed?
+    false
+  end
+
+  def owned?
+    true
+  end
+end
diff --git a/gems/dexpace-conformance/test/support/raw_wire_transport.rb b/gems/dexpace-conformance/test/support/raw_wire_transport.rb
new file mode 100644
index 0000000..ea1ab44
--- /dev/null
+++ b/gems/dexpace-conformance/test/support/raw_wire_transport.rb
@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "socket"
+require "dexpace"
+
+# A deliberately small HTTP/1.1 client over a raw TCPSocket, written as a conforming transport
+# with NAMED DEFECTS that can be switched on one at a time. It exists so the suite's own tests can
+# prove each assertion in both directions -- it passes against the correct send and FAILS against
+# the defect it was written to catch -- independently of any real adapter (8a's testing strategy,
+# item 6: "a deliberately non-conforming fake transport ... proving the suite detects rather than
+# merely runs"). The gem's own double, never a lift of dexpace-core's (design, "Work phase 8a
+# postponed"). It is not an adapter: no pump, no proxy, no TLS, bodies read eagerly.
+class RawWireTransport # rubocop:disable Metrics/ClassLength -- one client with twenty switchable defects; splitting it would hide which defect lives where
+  DEFECTS = %i[
+    form_type override_type ignore_body_type no_zero_length forward_host drop_pass_through
+    skip_validation retry_once send_twice misclassify_cancel cancel_on_timeout non_retryable_timeout
+    sticky_timeout ignore_window pretend_followed send_after_close cached_response leave_open
+    short_read bare_errno
+  ].freeze
+
+  # The framing headers this client always recomputes and never copies (TRANSPORT-11).
+  FRAMING = %w[content-length transfer-encoding].freeze
+
+  # A non-retryable failure, for the defects that misclassify a timeout.
+  class Bare < StandardError; end
+
+  # One parsed response head and body, straight off the wire.
+  Head = Struct.new(:code, :status_line, :headers, :body)
+
+  attr_reader :calls
+
+  def initialize(*defects, default_timeout: 1.5, owned: true)
+    unknown = defects - DEFECTS
+    raise ArgumentError, "unknown defects: #{unknown.inspect}" unless unknown.empty?
+
+    @defects = defects
+    @default_timeout = default_timeout
+    @owned = owned
+    @timeout_for = nil
+    @cached = nil
+    @closed = false
+    @calls = 0
+    @leaked = []
+  end
+
+  def defect?(name)
+    @defects.include?(name)
+  end
+
+  def owned?
+    @owned
+  end
+
+  def closed?
+    @closed
+  end
+
+  def close
+    @closed = true
+    @leaked.each { |socket| socket.close unless socket.closed? }
+    @leaked.clear
+    nil
+  end
+
+  def call(request, options, cancellation)
+    raise Dexpace::ClosedError, "closed" if @closed && !defect?(:send_after_close)
+
+    @calls += 1
+    return build_response(request, @cached) if defect?(:cached_response) && @cached
+
+    validate!(request) unless defect?(:skip_validation)
+    bytes = wire_bytes(request)
+    response = exchange(request, bytes, timeout_for(options), cancellation)
+    response = exchange(request, bytes, timeout_for(options), cancellation) if defect?(:send_twice)
+    response
+  end
+
+  private
+
+  def timeout_for(options)
+    chosen = options.timeout || @default_timeout
+    return chosen unless defect?(:sticky_timeout)
+
+    @timeout_for ||= chosen
+  end
+
+  def validate!(request)
+    request.headers.each_entry do |name, value|
+      Dexpace::HeaderSyntax.validate_name!(name)
+      Dexpace::HeaderSyntax.validate_outbound_value!(value, name: name)
+    end
+  end
+
+  # The request head and body as bytes, under this double's header policy.
+  def wire_bytes(request)
+    body = body_bytes(request)
+    lines = request_line(request)
+    lines.concat(header_lines(request, body))
+    lines << "Content-Length: #{body.bytesize}" if body && !defect?(:no_zero_length)
+    "#{lines.join("\r\n")}\r\n\r\n".b + (body || "").b
+  end
+
+  def request_line(request)
+    url = request.url
+    lines = ["#{request.method.token} #{url.request_uri} HTTP/1.1"]
+    lines << "Host: #{url.hostname}:#{url.port}" unless defect?(:forward_host)
+    lines
+  end
+
+  def header_lines(request, body)
+    lines = []
+    explicit_type = nil
+    request.headers.each_entry do |name, value|
+      folded = name.downcase
+      next unless copied?(folded)
+
+      explicit_type = value if folded == "content-type"
+      lines << "#{name}: #{value}" unless folded == "content-type" && defect?(:override_type)
+    end
+    type = content_type(request, body, explicit_type)
+    lines << "Content-Type: #{type}" if type
+    lines
+  end
+
+  # Whether a caller's header is copied onto the wire: framing is recomputed, Host is this
+  # client's own unless the defect forwards it, and everything else is pass-through unless the
+  # defect drops it.
+  def copied?(folded)
+    return false if FRAMING.include?(folded)
+    return defect?(:forward_host) if folded == "host"
+
+    folded == "content-type" || !defect?(:drop_pass_through)
+  end
+
+  def content_type(request, body, explicit_type)
+    return nil if body.nil? || (explicit_type && !defect?(:override_type))
+
+    media = request.body&.media_type
+    return media.render if media && !defect?(:ignore_body_type)
+
+    form_type_default
+  end
+
+  def form_type_default
+    defect?(:form_type) ? "application/x-www-form-urlencoded" : nil
+  end
+
+  # The body, pulled exactly once through #each; nil for a body-forbidden method, and a
+  # zero-length one for a body-less permitted method (TRANSPORT-26).
+  def body_bytes(request)
+    body = request.body
+    if body.nil?
+      return nil if request.method.body_forbidden? || defect?(:no_zero_length)
+
+      return (+"").b
+    end
+    return File.binread(body.path) if defect?(:ignore_window) && body.respond_to?(:path)
+
+    bytes = (+"").b
+    body.each { |chunk| bytes << chunk }
+    bytes
+  end
+
+  def exchange(request, bytes, timeout, cancellation)
+    attempt(request, bytes, timeout, cancellation)
+  rescue Dexpace::TransportError
+    raise unless defect?(:retry_once) && (@retried = !@retried)
+
+    attempt(request, bytes, timeout, cancellation)
+  end
+
+  def attempt(request, bytes, timeout, cancellation)
+    socket = connect(request)
+    subscription = cancellation.on_cancel { socket.close }
+    begin
+      socket.write(bytes)
+      read_response(request, socket, timeout, cancellation)
+    rescue IOError, SystemCallError => error
+      raise classify(error, cancellation)
+    ensure
+      subscription.detach
+      # The leave_open defect must keep the socket REFERENCED, not merely unclosed: an unreferenced
+      # TCPSocket is closed by its finalizer at the next GC, and under the whole-repository
+      # `test:gems` process one ran inside the release assertion's bounded wait, so the server saw
+      # the close and the defect passed the assertion it exists to fail. The transport's own
+      # #close releases them, which the case teardown reaches after the assertion has judged.
+      if defect?(:leave_open)
+        @leaked << socket
+      elsif !socket.closed?
+        socket.close
+      end
+    end
+  end
+
+  def connect(request)
+    TCPSocket.new(request.url.hostname, request.url.port)
+  rescue SystemCallError => error
+    raise error if defect?(:bare_errno)
+
+    raise Dexpace::TransportError.new("connect failed: #{error.message}", phase: :connect)
+  end
+
+  def classify(error, cancellation)
+    if cancellation.cancelled?
+      return Dexpace::TransportError.new("cancelled", phase: :read) if defect?(:misclassify_cancel)
+
+      return Dexpace::CancelledError.new(cancellation.reason)
+    end
+    Dexpace::TransportError.new(error.message, phase: :read)
+  end
+
+  def read_response(request, socket, timeout, cancellation)
+    raise timeout_error(cancellation) if socket.wait_readable(timeout).nil?
+
+    head = read_head(socket)
+    return pretend_followed(request) if head.code / 100 == 3 && defect?(:pretend_followed)
+
+    # The cached defect keeps the WIRE bytes and rebuilds a fresh response from them per call, so
+    # every later call answers with the first exchange's status and body.
+    @cached = head if defect?(:cached_response)
+    build_response(request, head)
+  end
+
+  def read_head(socket)
+    status_line = socket.gets
+    if status_line.nil?
+      raise Dexpace::TransportError.new("the connection closed before a status line", phase: :read)
+    end
+
+    headers = read_headers(socket)
+    Head.new(status_line.split[1].to_i, status_line, headers, read_body(socket, headers))
+  end
+
+  def timeout_error(cancellation)
+    if defect?(:cancel_on_timeout)
+      return Dexpace::CancelledError.new(cancellation.reason || :timeout)
+    end
+    return Bare.new("timed out") if defect?(:non_retryable_timeout)
+
+    Dexpace::TransportError.new("timed out", phase: :read)
+  end
+
+  def read_headers(socket)
+    builder = Dexpace::Headers.inbound_builder
+    while (line = socket.gets) && line != "\r\n"
+      name, value = line.chomp.split(":", 2)
+      next unless Dexpace::HeaderSyntax.valid_name?(name.to_s) &&
+                  Dexpace::HeaderSyntax.valid_inbound_value?(value.to_s.strip)
+
+      builder.add(name, value.strip)
+    end
+    builder.build
+  end
+
+  def read_body(socket, headers)
+    length = headers["Content-Length"]&.first&.to_i
+    length /= 2 if length && defect?(:short_read)
+    (length ? socket.read(length) : socket.read).to_s.b
+  end
+
+  def build_response(request, head)
+    body = Dexpace::ResponseBody.new(source: Dexpace::IO::BufferedSource.of_bytes(head.body),
+                                     media_type: media_type(head.headers),
+                                     content_length: head.body.bytesize,)
+    Dexpace::Response.build(request: request, protocol: "HTTP/1.1", status: head.code,
+                            reason: head.status_line.split(" ", 3)[2]&.strip,
+                            headers: head.headers, body: body,)
+  end
+
+  def media_type(headers)
+    raw = headers["Content-Type"]&.first
+    raw && Dexpace::MediaType.parse(raw)
+  rescue Dexpace::InvalidArgumentError
+    nil
+  end
+
+  def pretend_followed(request)
+    Dexpace::Response.build(request: request, protocol: "HTTP/1.1", status: 200, reason: "OK",
+                            headers: Dexpace::Headers::EMPTY_INBOUND, body: nil,)
+  end
+end
diff --git a/gems/dexpace-conformance/test/support/stub_transport.rb b/gems/dexpace-conformance/test/support/stub_transport.rb
new file mode 100644
index 0000000..7eaf3a1
--- /dev/null
+++ b/gems/dexpace-conformance/test/support/stub_transport.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+# A transport double for testing an ASSERTION's own logic against a known-good and a known-bad
+# send, independent of any real adapter. `on_call` receives (request, options, cancellation) and
+# returns whatever the test wants adapted into a Dexpace::Response, or raises. The gem's own
+# double, never a lift of dexpace-core's FakeTransport (8a's design, "Work phase 8a postponed").
+class StubTransport
+  attr_reader :calls
+
+  def initialize(&on_call)
+    @on_call = on_call
+    @calls = []
+    @closed = false
+  end
+
+  def call(request, options, cancellation)
+    @calls << [request, options, cancellation]
+    @on_call.call(request, options, cancellation)
+  end
+
+  def close
+    @closed = true
+    nil
+  end
+
+  def closed?
+    @closed
+  end
+
+  def owned?
+    true
+  end
+end
diff --git a/gems/dexpace-core/test/dexpace/error/transport_error_test.rb b/gems/dexpace-core/test/dexpace/error/transport_error_test.rb
new file mode 100644
index 0000000..db250c2
--- /dev/null
+++ b/gems/dexpace-core/test/dexpace/error/transport_error_test.rb
@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../test_helper"
+require "dexpace"
+
+# XCUT-4 branch (b): "A transport error MUST report itself as always-retryable at the error
+# level." TRANSPORT-20: the canonical retryable transport failure. P3-3: a sibling of
+# Dexpace::StreamError inside ::IOError, never a subclass, because a stream-contract violation
+# must not claim to be always-retryable. P6-4: the class every phase-8 adapter wraps a bare stdlib
+# I/O or timeout error into, so RETRY-2's capability query classifies it retryable.
+#
+# No `net/http` is required here: core embeds no concrete transport (SEAM-1/SEAM-2) and this suite
+# must not either, so the wrapped-cause case uses a plain StandardError.
+class DexpaceTransportErrorTest < DexpaceTestCase
+  test "is an IOError and includes the module error root" do
+    assert_operator(Dexpace::TransportError, :<, ::IOError)
+    assert_operator(Dexpace::TransportError, :<, Dexpace::Error)
+    assert_kind_of(Dexpace::Error, Dexpace::TransportError.new("boom"))
+  end
+
+  test "P3-3: is a sibling of StreamError, never its ancestor or descendant" do
+    refute_operator(Dexpace::TransportError, :<, Dexpace::StreamError)
+    refute_operator(Dexpace::StreamError, :<, Dexpace::TransportError)
+  end
+
+  test "XCUT-4 (b): reports retryable, unconditionally, with no keyword that can override it" do
+    assert_predicate(Dexpace::TransportError.new("boom"), :retryable?)
+    assert_predicate(Dexpace::TransportError.new("boom", phase: :read), :retryable?)
+    refute_includes(
+      Dexpace::TransportError.instance_method(:initialize).parameters.map(&:last), :retryable,
+      "XCUT-4 (b) says always; a retryable: keyword would be a way to say otherwise",
+    )
+  end
+
+  test "RETRY-2's capability query, over the cause chain, classifies it retryable" do
+    assert(Dexpace::Resilience::Policy.throwable_retryable?(Dexpace::TransportError.new("boom")))
+    wrapped = ::RuntimeError.new("outer")
+    wrapped.define_singleton_method(:cause) { Dexpace::TransportError.new("inner") }
+
+    assert(Dexpace::Resilience::Policy.throwable_retryable?(wrapped))
+  end
+
+  test "carries the phase the failure occurred in, for diagnostics only" do
+    error = Dexpace::TransportError.new("boom", phase: :read)
+
+    assert_equal(:read, error.phase)
+    assert_nil(Dexpace::TransportError.new("boom").phase)
+  end
+
+  test "has a default message and carries a wrapped error's #cause the way Ruby always does" do
+    assert_equal("a transport failure occurred", Dexpace::TransportError.new.message)
+    wrapped = begin
+      raise ::StandardError, "slow"
+    rescue ::StandardError
+      begin
+        raise Dexpace::TransportError.new("wrapped", phase: :read)
+      rescue Dexpace::TransportError => error
+        error
+      end
+    end
+
+    assert_instance_of(::StandardError, wrapped.cause)
+    assert_equal("slow", wrapped.cause.message)
+    assert_equal(:read, wrapped.phase)
+  end
+
+  test "P4-12: carries the suppressed trail like every other core error" do
+    error = Dexpace::TransportError.new("primary")
+    Dexpace.attach_suppressed(error, ::IOError.new("close failed"))
+
+    assert_equal(["close failed"], Dexpace.suppressed(error).map(&:message))
+  end
+end
diff --git a/gems/dexpace-core/test/dexpace/transport_bare_require_test.rb b/gems/dexpace-core/test/dexpace/transport_bare_require_test.rb
new file mode 100644
index 0000000..dadabb6
--- /dev/null
+++ b/gems/dexpace-core/test/dexpace/transport_bare_require_test.rb
@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../test_helper"
+require_relative "../support/bare_require"
+require "dexpace"
+
+# SEAM-1, SEAM-2, SEAM-6: the properties of the Transport seam that hold on a BARE
+# `require "dexpace"` and on nothing else -- an empty registry, the zero-candidate SeamError that
+# follows from one, and a swap or an install that leaves nothing resolved behind it. Each runs in
+# a fresh process: `rake test:gems` runs every gem's suite in one process, and since phase 8a
+# `dexpace-transport-net_http`'s entry file registers its factory under :net_http the moment it
+# is required (design §3.6's require-time registration), so in that process the registry is NOT
+# empty and #resolve builds an adapter instead of raising. The in-process form was the pin phase
+# 8a's registration invalidated; transport_test.rb keeps the in-process halves. Phases 8b and 8c
+# meet the same on AsyncTransport and can reuse this shape. No lib/ mirror: it asserts the
+# process, not a file.
+class DexpaceTransportBareRequireTest < DexpaceTestCase
+  include BareRequire
+
+  test "the registry starts empty, so SEAM-1 holds on a bare require" do
+    assert_equal("[]", bare_require("print Dexpace::Transport.registered_keys.inspect"))
+  end
+
+  test "the zero-candidate error names no transport provider gem (SEAM-2)" do
+    message = bare_require(<<~RUBY)
+      begin
+        Dexpace::Transport.resolve
+        print "resolved"
+      rescue Dexpace::SeamError => error
+        print error.message
+      end
+    RUBY
+
+    assert_match(/no transport provider is registered/, message)
+    refute_match(%r{net_http|async_http|net/http}i, message, "SEAM-2")
+  end
+
+  test "after a swap block nothing is resolved again (SEAM-6)" do
+    out = bare_require(<<~RUBY)
+      t = ->(_request, _options, _cancellation) { :response }
+      Dexpace::Transport.swap(t) do
+        abort("the override was not resolved") unless Dexpace::Transport.resolve.equal?(t)
+      end
+      begin
+        Dexpace::Transport.resolve
+        print "resolved after the block"
+      rescue Dexpace::SeamError
+        print "SeamError"
+      end
+    RUBY
+
+    assert_equal("SeamError", out)
+  end
+
+  test "an install inside a swap block is restored with it, leaving nothing resolved" do
+    out = bare_require(<<~RUBY)
+      i = ->(_request, _options, _cancellation) { :installed }
+      Dexpace::Transport.swap(:override) { Dexpace::Transport.install(i) }
+      begin
+        Dexpace::Transport.resolve
+        print "resolved after the block"
+      rescue Dexpace::SeamError
+        print "SeamError"
+      end
+    RUBY
+
+    assert_equal("SeamError", out)
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
new file mode 100644
index 0000000..0c35459
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -0,0 +1,467 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/adapter_fixtures"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-1 to 6, 15, 16, 20, 22, 29, 30 and the constructions (P8-6, P8-10, P8-15). The
+# lifecycle and concurrency proofs over a real socket; the per-mapping unit tests live beside
+# the mappers. Six nested classes under Metrics/ClassLength (6c's shape): the constructions,
+# the lifecycle, the budget and failure classification, the wire, cancellation, and the proxy.
+module DexpaceTransportNetHttpAdapterTest
+  NetHTTP = Dexpace::Transport::NetHTTP
+  Scripts = Dexpace::Conformance::Scripts
+
+  # .build, .using, .default and what each refuses.
+  class ConstructionTest < DexpaceTestCase
+    include AdapterFixtures
+
+    test ".build produces an owned adapter; .using produces a borrowing one; both are transports" do
+      owned = NetHTTP.build
+      borrowed = NetHTTP.using(client_for(1))
+
+      assert_predicate(owned, :owned?)
+      refute_predicate(borrowed, :owned?)
+      assert(Dexpace::Transport.conforms?(owned))
+      assert(Dexpace::Transport.conforms?(borrowed))
+    end
+
+    test "P8-10: .using refuses a client whose max_retries is not zero, without mutating it" do
+      client = ::Net::HTTP.new("127.0.0.1", 1)
+
+      error = assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.using(client) }
+
+      assert_match(/max_retries/, error.message)
+      assert_equal(1, client.max_retries, "the client is the caller's (XCUT-22)")
+    end
+
+    test ".build validates its timeout and refuses a non-positive or non-finite one" do
+      assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(timeout: 0) }
+      assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(timeout: -1.0) }
+      assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(timeout: Float::INFINITY) }
+      assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(timeout: "5") }
+      assert_predicate(NetHTTP.build(timeout: 2.5), :owned?)
+    end
+
+    test ".default builds a fresh owned instance every call, and the registry knows the key" do
+      refute_same(NetHTTP.default, NetHTTP.default)
+      assert_predicate(NetHTTP.default, :owned?)
+      assert_includes(Dexpace::Transport.registered_keys, NetHTTP::REGISTRY_KEY)
+    end
+
+    test "Adapter.new is private: the two named entry points are the whole construction surface" do
+      assert_raises(NoMethodError) { NetHTTP::Adapter.new }
+    end
+
+    test "a nil cancellation is the never-cancelled token" do
+      server = wire(Scripts.fixed("ok"))
+
+      response = NetHTTP.build.call(request_for(server), Dexpace::RequestOptions::EMPTY, nil)
+
+      assert_equal("ok", response.body_string)
+    end
+  end
+
+  # Close on both constructions, and the borrowing construction's three refusals (P8-15).
+  class LifecycleTest < DexpaceTestCase
+    include AdapterFixtures
+
+    test "TRANSPORT-15/16: an owned adapter raises ClosedError after close; reclose is a no-op" do
+      server = wire(Scripts.fixed("ok"))
+      adapter = NetHTTP.build
+      adapter.close
+      adapter.close
+
+      assert_predicate(adapter, :closed?)
+      assert_raises(Dexpace::ClosedError) { settle(adapter, request_for(server)) }
+      assert_equal(0, server.connections)
+    end
+
+    test "TRANSPORT-15: a borrowed adapter's close disables neither the caller's client nor it" do
+      server = wire(Scripts.fixed("ok"))
+      client = client_for(server.port)
+      adapter = NetHTTP.using(client)
+      settle(adapter, request_for(server)).close
+      adapter.close
+
+      assert_predicate(adapter, :closed?)
+      assert_equal("200", client.start { |c| c.request(::Net::HTTP::Get.new("/")) }.code)
+      assert_equal(200, settle(adapter, request_for(server)).tap(&:close).status.code,
+                   "SEAM-15's borrowing mode: closes nothing and stays usable",)
+    end
+
+    test "TRANSPORT-16: a pre-existing cancellation flag is untouched by close" do
+      source = Dexpace::Cancellation.source
+      source.cancel(:before)
+      adapter = NetHTTP.build
+
+      adapter.close
+
+      assert_predicate(source, :cancelled?)
+      assert_equal(:before, source.reason)
+    end
+
+    test "P8-6: a non-nil per-call timeout against a borrowed client raises before any send" do
+      server = wire(Scripts.fixed("ok"))
+      adapter = NetHTTP.using(client_for(server.port))
+      options = Dexpace::RequestOptions.build(timeout: 1.0, max_retries: nil, tags: {})
+
+      error = assert_raises(Dexpace::InvalidArgumentError) do
+        adapter.call(request_for(server), options, Dexpace::Cancellation.none)
+      end
+
+      assert_match(/TRANSPORT-5/, error.message)
+      assert_equal(0, server.connections)
+    end
+
+    test "P8-15: a borrowed adapter refuses a request naming a different origin, unsent" do
+      server = wire(Scripts.fixed("ok"))
+      adapter = NetHTTP.using(client_for(server.port))
+      elsewhere = Dexpace::Request.build(method: "GET", url: "http://127.0.0.1:1/",
+                                         headers: Dexpace::Headers::EMPTY, body: nil,)
+      https = Dexpace::Request.build(method: "GET", url: "https://127.0.0.1:#{server.port}/",
+                                     headers: Dexpace::Headers::EMPTY, body: nil,)
+
+      assert_raises(Dexpace::InvalidArgumentError) { settle(adapter, elsewhere) }
+      assert_raises(Dexpace::InvalidArgumentError) { settle(adapter, https) }
+      assert_equal(0, server.connections)
+    end
+
+    test "P8-15: a borrowed adapter reuses a client the caller started, and never finishes it" do
+      server = wire(keep_alive_twice("one", "two"))
+      client = client_for(server.port)
+      client.start
+      adapter = NetHTTP.using(client)
+
+      first = settle(adapter, request_for(server)).body_string
+      second = settle(adapter, request_for(server)).body_string
+
+      assert_equal(%w[one two], [first, second])
+      assert_predicate(client, :started?, "the adapter must not finish a client it does not own")
+      assert_equal(1, server.connections, "one keep-alive connection served both exchanges")
+      client.finish
+    end
+
+    test "P8-15: a borrowed response closed mid-stream leaves the caller's started client usable" do
+      server = wire(Scripts.large(200_000))
+      client = client_for(server.port)
+      client.start
+      adapter = NetHTTP.using(client)
+      partial = settle(adapter, request_for(server))
+      partial.body.source.read_into((+"").b, count: 10)
+      partial.close
+
+      whole = settle(adapter, request_for(server))
+
+      assert_equal(200_000, whole.body_bytes.bytesize)
+      assert_predicate(client, :started?)
+      client.finish
+    end
+  end
+
+  # The per-call budget (R3) and how a failure that produced no response is classified.
+  class BudgetAndFailureTest < DexpaceTestCase
+    include AdapterFixtures
+
+    test "TRANSPORT-2: a dropped first connection is one connection and one failure, no retry" do
+      server = wire(Scripts.fail_first_connection_then_succeed("ok"))
+
+      error = assert_raises(Dexpace::TransportError) { settle(NetHTTP.build, request_for(server)) }
+
+      assert_predicate(error, :retryable?)
+      assert_equal(1, server.connections)
+    end
+
+    test "TRANSPORT-20: a refused connection is the canonical retryable failure, with its cause" do
+      server = wire(Scripts.fixed("x"))
+      request = request_for(server)
+      server.close
+
+      error = assert_raises(Dexpace::TransportError) { settle(NetHTTP.build, request) }
+
+      assert_predicate(error, :retryable?)
+      assert_equal(:connect, error.phase)
+      assert_kind_of(::SystemCallError, error.cause)
+    end
+
+    test "TRANSPORT-4: a read timeout is a retryable failure; the cancellation flag stays clear" do
+      server = wire(Scripts.hang_before_headers)
+      source = Dexpace::Cancellation.source
+      adapter = NetHTTP.build(timeout: 0.2)
+
+      error = assert_raises(Dexpace::TransportError) do
+        adapter.call(request_for(server), Dexpace::RequestOptions::EMPTY, source.token)
+      end
+
+      assert_predicate(error, :retryable?)
+      refute_predicate(source, :cancelled?)
+      assert_kind_of(::Net::ReadTimeout, error.cause)
+    end
+
+    test "TRANSPORT-5: the per-call timeout overrides the transport's, for that call only" do
+      server = wire(Scripts.hang_before_headers)
+      adapter = NetHTTP.build(timeout: 30.0)
+      options = Dexpace::RequestOptions.build(timeout: 0.2, max_retries: nil, tags: {})
+
+      took = elapsed do
+        assert_raises(Dexpace::TransportError) do
+          adapter.call(request_for(server), options, Dexpace::Cancellation.none)
+        end
+      end
+
+      assert_operator(took, :<, 2.0)
+    end
+
+    # R3 (P8-5): the budget is TOTAL. Four chunks 0.15 s apart pass a per-read window of 0.4 s
+    # one at a time and blow the same 0.4 s as a whole; only the total reading fails here.
+    test "TRANSPORT-5 / P8-5: the budget bounds the whole call, not each read" do
+      server = wire(trickle(4, 0.15))
+      adapter = NetHTTP.build(timeout: 0.4)
+      response = settle(adapter, request_for(server))
+      error = nil
+
+      took = elapsed { error = assert_raises(Dexpace::TransportError) { response.body_bytes } }
+
+      assert_predicate(error, :retryable?)
+      assert_operator(took, :<, 0.55, "a per-read budget would have taken 0.6 s or more")
+    end
+
+    # R3: a budget that is spent by the time the call is checked raises from the ADAPTER, before
+    # any socket -- never handed to Net::HTTP as a zero or negative knob. A nanosecond is spent
+    # between the deadline's construction and its check on every interpreter.
+    test "TRANSPORT-6 / R3: an expired budget is refused before dispatch, as a retryable failure" do
+      server = wire(Scripts.fixed("ok"))
+      options = Dexpace::RequestOptions.build(timeout: 1e-9, max_retries: nil, tags: {})
+
+      error = assert_raises(Dexpace::TransportError) do
+        NetHTTP.build.call(request_for(server), options, Dexpace::Cancellation.none)
+      end
+
+      assert_predicate(error, :retryable?)
+      assert_equal(:connect, error.phase)
+      assert_match(/expired before dispatch/, error.message)
+      assert_nil(error.cause, "the adapter's own raise, not a library timeout")
+      assert_equal(0, server.connections)
+    end
+
+    test "the configured tier is read through Keys::REQUEST_TIMEOUT, as a duration" do
+      server = wire(Scripts.hang_before_headers)
+      key = Dexpace::Configuration::Keys::REQUEST_TIMEOUT
+      Dexpace.configure { |builder| builder.override(key, "200ms") }
+
+      took = elapsed do
+        assert_raises(Dexpace::TransportError) { settle(NetHTTP.build, request_for(server)) }
+      end
+
+      assert_operator(took, :<, 2.0)
+    ensure
+      Dexpace.reset_config!
+    end
+  end
+
+  # What one exchange puts on the wire and hands back, and the proxy the SDK resolved.
+  class WireTest < DexpaceTestCase
+    include AdapterFixtures
+
+    test "TRANSPORT-1: a raw 302 with a Location comes back as it is and is never followed" do
+      server = wire(Scripts.redirect("http://127.0.0.1:1/elsewhere"))
+
+      response = settle(NetHTTP.build, request_for(server))
+
+      assert_equal(302, response.status.code)
+      assert_equal(["http://127.0.0.1:1/elsewhere"], response.headers["Location"])
+      assert_equal(1, server.connections)
+      response.close
+    end
+
+    test "TRANSPORT-29: many concurrent calls through one owned adapter each get their own reply" do
+      server = wire(Scripts.echo_path)
+      adapter = NetHTTP.build
+
+      assert_empty(echo_mismatches(adapter, server, threads: 4, rounds: 10))
+      adapter.close
+    end
+
+    # TRANSPORT-29 on the OTHER construction: satisfied by serialisation rather than by per-call
+    # construction (P8-15), and a proof of one is not a proof of the other.
+    test "TRANSPORT-29: concurrent calls through a borrowed adapter are serialised and matched" do
+      server = wire(Scripts.echo_path)
+      adapter = NetHTTP.using(client_for(server.port))
+
+      assert_empty(echo_mismatches(adapter, server, threads: 4, rounds: 5))
+    end
+
+    test "P8-4: a ruby -w POST with and without a body raises no warning" do
+      server = wire(Scripts.fixed("ok"))
+      adapter = NetHTTP.build
+      with_body = Dexpace::Request.build(method: "POST", url: "http://127.0.0.1:#{server.port}/",
+                                         headers: Dexpace::Headers::EMPTY,
+                                         body: Dexpace::Body.bytes("x".b),)
+      without = with_body.new_builder.tap { |b| b.body = nil }.build
+
+      settle(adapter, with_body).close # Warning.warn raises under DexpaceTestCase
+      settle(adapter, without).close
+
+      heads = server.requests.map(&:head)
+
+      assert_equal(["Content-Length: 1\r\n", "Content-Length: 0\r\n"],
+                   heads.map { |head| head.find { |line| line.start_with?("Content-Length") } },)
+      assert_equal(["Content-Type: application/octet-stream\r\n"] * 2,
+                   heads.map { |head| head.find { |line| line.start_with?("Content-Type") } },)
+    end
+
+    test "P8-3: a gzip response is delivered compressed, with Content-Encoding and length intact" do
+      compressed = gzip("hello, faithfully")
+      server = wire(Scripts.fixed(compressed, headers: { "Content-Encoding" => "gzip" }))
+      request = request_for(server).new_builder.tap do |b|
+        b.headers = Dexpace::Headers.builder.tap { |h| h.add("Accept-Encoding", "gzip") }.build
+      end.build
+
+      response = settle(NetHTTP.build, request)
+
+      assert_equal(["gzip"], response.headers["Content-Encoding"])
+      assert_equal(compressed.bytesize, response.body.content_length)
+      assert_equal(compressed, response.body_bytes)
+    end
+
+    test "TRANSPORT-25: a chunked response streams and the body bytes are BINARY" do
+      server = wire(Scripts.dribble("caf\xE9".b, "x", 0))
+
+      response = settle(NetHTTP.build, request_for(server))
+      bytes = response.body_bytes
+
+      assert_equal(-1, response.body.content_length)
+      assert_equal("caf\xE9x".b, bytes)
+      assert_equal(Encoding::BINARY, bytes.encoding)
+    end
+
+    test "TRANSPORT-25: closing the response releases the connection, seen from the server" do
+      server = wire(Scripts.large(5 * 1024 * 1024, hold: true))
+
+      response = settle(NetHTTP.build, request_for(server))
+      response.body.source.read_into((+"").b, count: 1024)
+      response.close
+
+      assert_equal(1, server.await_closed_connection(timeout: 2))
+    end
+
+    test "TRANSPORT-22: an adaptation failure after the head releases the connection and raises" do
+      server = wire(lambda do |conn, _head|
+        conn.write("HTTP/1.0 200 OK\r\nContent-Length: 2\r\n\r\nok")
+        conn.read # holds the connection until the peer closes it
+      end)
+
+      assert_raises(Dexpace::InvalidArgumentError) { settle(NetHTTP.build, request_for(server)) }
+      assert_equal(1, server.await_closed_connection(timeout: 2))
+    end
+
+    test "a HEAD response carries no body and no producer thread stays behind" do
+      server = wire(Scripts.fixed("ignored"))
+      request = request_for(server).new_builder.tap { |b| b.method = "HEAD" }.build
+
+      response = settle(NetHTTP.build, request)
+
+      assert_nil(response.body)
+      assert_equal(["7"], response.headers["Content-Length"])
+    end
+  end
+
+  # TRANSPORT-3: the token is asked first, at every point a cancel can land.
+  class CancellationTest < DexpaceTestCase
+    include AdapterFixtures
+
+    # Verified fact 3: with max_retries at its default the call RETURNS 200 after a cancel, so
+    # the assertion is on the outcome -- the exchange as a whole raises the cancellation. The
+    # cancel fires once the server has flushed the head, which the caller may or may not have
+    # popped yet, so either the call or the body read is where it surfaces; the pump's own suite
+    # pins each side deterministically.
+    test "TRANSPORT-3: a cancellation delivered under a blocked read raises CancelledError" do
+      blocked = ::Thread::Queue.new
+      server = wire(Scripts.hang_after_headers(on_headers_written: -> { blocked.push(true) }))
+      source = Dexpace::Cancellation.source
+      canceller = ::Thread.new do
+        blocked.pop
+        source.cancel(:test)
+      end
+
+      error = assert_raises(Dexpace::CancelledError) do
+        NetHTTP.build.call(request_for(server), Dexpace::RequestOptions::EMPTY, source.token)
+          .body_bytes
+      end
+      canceller.join
+
+      assert_equal(:test, error.reason)
+    end
+
+    test "TRANSPORT-3: a cancellation before the head raises CancelledError from the call itself" do
+      blocked = ::Thread::Queue.new
+      server = wire(Scripts.hang_before_headers(on_request_read: -> { blocked.push(true) }))
+      source = Dexpace::Cancellation.source
+      canceller = ::Thread.new do
+        blocked.pop
+        source.cancel(:early)
+      end
+
+      error = assert_raises(Dexpace::CancelledError) do
+        NetHTTP.build.call(request_for(server), Dexpace::RequestOptions::EMPTY, source.token)
+      end
+      canceller.join
+
+      assert_equal(:early, error.reason)
+    end
+
+    test "an already-cancelled token is refused before anything reaches the wire" do
+      server = wire(Scripts.fixed("ok"))
+      source = Dexpace::Cancellation.source
+      source.cancel(:gone)
+
+      assert_raises(Dexpace::CancelledError) do
+        NetHTTP.build.call(request_for(server), Dexpace::RequestOptions::EMPTY, source.token)
+      end
+      assert_equal(0, server.connections)
+    end
+  end
+
+  # R17 and TRANSPORT-30: the proxy the SDK resolved is the only proxy the adapter uses.
+  class ProxyTest < DexpaceTestCase
+    include AdapterFixtures
+
+    # R17: Net::HTTP.new's p_addr defaults to :ENV, and the resolver reads only the upper-case
+    # keys, so a lower-case `http_proxy` naming the fixture is exactly what the old shape would
+    # have honoured behind the SDK's back. The target is TEST-NET-1: unroutable, never loopback
+    # (which find_proxy exempts), so the call times out against it instead of reaching the fixture.
+    test "R17: with http_proxy in the environment the per-call client still does not proxy" do
+      server = wire(Scripts.fixed("via proxy"))
+      target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/",
+                                      headers: Dexpace::Headers::EMPTY, body: nil,)
+      would_have = nil
+      error = with_env("http_proxy" => "http://user:pw@127.0.0.1:#{server.port}") do
+        would_have = ::Net::HTTP.new("192.0.2.1", 80).proxy?
+        assert_raises(Dexpace::TransportError) { settle(NetHTTP.build(timeout: 0.3), target) }
+      end
+
+      assert(would_have, "Net::HTTP.new's own default WOULD have proxied")
+      assert_predicate(error, :retryable?)
+      assert_equal(0, server.connections, "nothing reached the environment's proxy")
+    end
+
+    # TRANSPORT-30: the proxy the SDK resolved IS used -- the fixture plays the proxy and sees
+    # the absolute-form request line a proxy is sent.
+    test "TRANSPORT-30: a proxy resolved through the configuration chain carries the call" do
+      server = wire(Scripts.fixed("via proxy"))
+      target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/x?y=1",
+                                      headers: Dexpace::Headers::EMPTY, body: nil,)
+      Dexpace.configure do |builder|
+        builder.override(Dexpace::Configuration::Keys::HTTP_PROXY, "http://127.0.0.1:#{server.port}")
+      end
+
+      response = settle(NetHTTP.build, target)
+
+      assert_equal("via proxy", response.body_string)
+      assert_equal("GET http://192.0.2.1/x?y=1 HTTP/1.1", server.requests.first.request_line)
+    ensure
+      Dexpace.reset_config!
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
new file mode 100644
index 0000000..064ca4a
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require "dexpace/transport/net_http"
+require "dexpace/conformance"
+
+# The shared conformance suite run against the real adapter (8a's R16, the suite contract):
+# one generated test per assertion, driven through MinitestDriver with no `settle:`, `around:`
+# or `wire:` -- the defaults ARE this adapter's shape -- and `waive: []`, because TRANSPORT-28's
+# zero-copy clause has no assertion to suppress. TRANSPORT-18 reports vacuous (a skip in
+# Minitest's vocabulary): with max_retries = 0 no native re-subscription exists to measure.
+# The class inherits DexpaceTestCase so a fixture thread an assertion leaked fails the test that
+# leaked it.
+class DexpaceTransportNetHttpConformanceTest < DexpaceTestCase
+  extend Dexpace::Conformance::MinitestDriver
+
+  NetHTTP = Dexpace::Transport::NetHTTP
+
+  conformance(
+    Dexpace::Conformance::TransportSuite,
+    build: ->(**settings) { NetHTTP.build(**settings) },
+    # Suite contract 4a: the factory takes the fixture's PORT and returns a BorrowedPair, so no
+    # assertion inside dexpace-conformance ever names ::Net::HTTP. The client is bound to that
+    # port because a borrowing transport refuses any other origin (P8-15), and max_retries is set
+    # by the CALLER, never by `.using`, which refuses a client that lacks it (P8-10). The probe is
+    # a real round trip through the client itself: the only thing that proves the transport's
+    # close did not touch it.
+    borrow: lambda do |port|
+      client = ::Net::HTTP.new("127.0.0.1", port)
+      client.max_retries = 0
+      Dexpace::Conformance::BorrowedPair.build(
+        transport: NetHTTP.using(client),
+        probe: lambda do
+          client.start { |c| c.request(::Net::HTTP::Get.new("/")) }.code == "200"
+        rescue ::StandardError
+          false
+        end,
+      )
+    end,
+    waive: [],
+  )
+
+  # The driver's own contract, checked rather than assumed: every assertion in the suite became
+  # a test method here, and the suite still carries no TRANSPORT-12 or TRANSPORT-13 row.
+  test "one generated test per assertion, and none for the two IDs the suite does not carry" do
+    generated = public_methods(false).grep(/\Atest_/).reject do |name|
+      name.to_s.start_with?("test_: ")
+    end
+    ids = Dexpace::Conformance::TransportSuite.assertions.flat_map(&:ids).uniq
+
+    assert_equal(Dexpace::Conformance::TransportSuite.assertions.size, generated.size)
+    refute_includes(ids, "TRANSPORT-12")
+    refute_includes(ids, "TRANSPORT-13")
+  end
+
+  # What a real third-party adapter author would write: the borrow lambda sets max_retries = 0
+  # first, and writing it wrong fails loudly rather than silently.
+  test "TRANSPORT-15's borrowed half genuinely refuses a client with a non-zero max_retries" do
+    assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.using(::Net::HTTP.new("127.0.0.1", 1)) }
+  end
+
+  # TRANSPORT-12 and TRANSPORT-13 are 8c's rows; here they are cross-references whose antecedent
+  # is MEASURED absent: a header valid at the SDK model layer is never rejected by net-http's own
+  # wire grammar, so there is no per-header drop to make and no drop-logging policy to expose.
+  # The measurement walks every byte the outbound value grammar admits and every token byte a
+  # name admits, through the same native call the mapper makes.
+  test "TRANSPORT-12/13 cross-reference: net-http rejects no model-valid header (no antecedent)" do
+    admitted_values = (0x20..0x7E).map(&:chr) << "\t"
+    admitted_values.select! { |byte| Dexpace::HeaderSyntax.valid_outbound_value?("a#{byte}b") }
+    admitted_names = (0x21..0x7E).map(&:chr).select { |byte| Dexpace::HeaderSyntax.valid_name?("x#{byte}") }
+    native = ::Net::HTTPGenericRequest.new("GET", false, true, "/", {})
+
+    admitted_values.each { |byte| native.add_field("X-Value", "a#{byte}b") }
+    admitted_names.each { |byte| native.add_field("x#{byte}", "v") }
+
+    refute_empty(admitted_values)
+    refute_empty(admitted_names)
+    assert_equal(admitted_values.size, native.get_fields("X-Value").size)
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
new file mode 100644
index 0000000..e651837
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-5, TRANSPORT-6 (8a's R3): RequestOptions#timeout is a TOTAL per-call budget, carried
+# as a monotonic instant over an injectable clock. TRANSPORT-5's own conformance clause is a
+# statement about the CALL's budget, not one syscall, and the total reading is what makes it
+# implementable at all. Deadline is a private_constant, reached through const_get.
+class DexpaceTransportNetHttpDeadlineTest < DexpaceTestCase
+  NetHTTP = Dexpace::Transport::NetHTTP
+  Deadline = NetHTTP.const_get(:Deadline)
+
+  # A clock that advances only when told to: no real time enters these tests.
+  class FakeClock
+    def initialize(start)
+      @now = start
+    end
+
+    def monotonic
+      @now
+    end
+
+    def advance(seconds)
+      @now += seconds
+    end
+  end
+
+  test "is a private_constant of NetHTTP, and .new is private" do
+    assert_raises(NameError) { NetHTTP::Deadline }
+    assert_raises(NoMethodError) { Deadline.new(FakeClock.new(0.0), 1.0) }
+  end
+
+  test "#remaining counts down as the clock advances" do
+    clock = FakeClock.new(0.0)
+    deadline = Deadline.build(clock: clock, budget: 5.0)
+
+    clock.advance(2.0)
+
+    assert_in_delta(3.0, deadline.remaining)
+  end
+
+  test "#expired? is true once remaining reaches zero or below" do
+    clock = FakeClock.new(0.0)
+    deadline = Deadline.build(clock: clock, budget: 1.0)
+
+    refute_predicate(deadline, :expired?)
+    clock.advance(1.0)
+
+    assert_predicate(deadline, :expired?)
+    clock.advance(0.5)
+
+    assert_predicate(deadline, :expired?)
+  end
+
+  # TRANSPORT-6: the antecedent is inverted on this adapter (zero means poll-once, not
+  # unbounded), and the clamp ships anyway, for adapters over coarser APIs.
+  test "#clamped raises a tiny positive remaining up to MIN_TIMEOUT_SECONDS" do
+    clock = FakeClock.new(0.0)
+    deadline = Deadline.build(clock: clock, budget: NetHTTP::MIN_TIMEOUT_SECONDS / 2)
+
+    assert_in_delta(NetHTTP::MIN_TIMEOUT_SECONDS, deadline.clamped)
+  end
+
+  test "#clamped does not raise an already-expired remaining" do
+    clock = FakeClock.new(0.0)
+    deadline = Deadline.build(clock: clock, budget: -1.0)
+
+    assert_operator(deadline.clamped, :<=, 0)
+    assert_predicate(deadline, :expired?)
+  end
+
+  test "#clamped leaves a comfortably positive remaining untouched" do
+    clock = FakeClock.new(0.0)
+    deadline = Deadline.build(clock: clock, budget: 10.0)
+
+    assert_in_delta(10.0, deadline.clamped)
+  end
+
+  test "the budget is measured against the clock's monotonic reading, never Time.now" do
+    clock = FakeClock.new(1_000.0)
+    deadline = Deadline.build(clock: clock, budget: 0.5)
+
+    assert_in_delta(0.5, deadline.remaining)
+    clock.advance(0.25)
+
+    assert_in_delta(0.25, deadline.remaining)
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/failures_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/failures_test.rb
new file mode 100644
index 0000000..cd83797
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/failures_test.rb
@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require "dexpace/transport/net_http"
+require "openssl"
+require "zlib"
+require "socket"
+
+# TRANSPORT-3: "Discrimination MUST be out-of-band ... not by matching exception messages."
+# TRANSPORT-4: a read timeout classifies retryable and MUST NOT set the cancellation flag.
+# TRANSPORT-20: the canonical retryable transport failure, for anything that produced no
+# response. P6-4's obligation: wrap, and default to retryable -- a CATCH-ALL, never a lookup
+# against a list, because a family nobody thought of escaping unwrapped classifies not-retryable.
+class DexpaceTransportNetHttpFailuresTest < DexpaceTestCase
+  Failures = Dexpace::Transport::NetHTTP.const_get(:Failures)
+
+  # The families the adapter actually meets (design, verified fact 7): none but EOFError and
+  # IOError is an ::IOError, which is why an unwrapped one would be P6-4's blind spot.
+  FAMILIES = [
+    ::Net::OpenTimeout, ::Net::ReadTimeout, ::Net::WriteTimeout, ::SocketError,
+    ::Errno::ECONNRESET, ::Errno::ECONNREFUSED, ::OpenSSL::SSL::SSLError, ::EOFError, ::IOError,
+    ::Net::HTTPBadResponse, ::Net::HTTPHeaderSyntaxError, ::Zlib::DataError,
+  ].freeze
+
+  def uncancelled
+    Dexpace::Cancellation.none
+  end
+
+  # Failures.wrap RETURNS the error and never assigns #cause: Ruby populates #cause from `$!`
+  # at the raise, so the production call site raises from inside its own rescue. This helper
+  # reproduces that context so the cause assertion below is the real one.
+  def wrap_and_capture(original, phase: :read, cancellation: uncancelled)
+    raise original
+  rescue original.class => error
+    begin
+      raise Failures.wrap(error, phase: phase, cancellation: cancellation)
+    rescue Dexpace::TransportError => wrapped
+      wrapped
+    end
+  end
+
+  test "is a private_constant of NetHTTP" do
+    assert_raises(NameError) { Dexpace::Transport::NetHTTP::Failures }
+  end
+
+  FAMILIES.each do |klass|
+    test "wraps #{klass} into a retryable Dexpace::TransportError carrying it as #cause" do
+      original = klass.new("boom")
+
+      wrapped = wrap_and_capture(original)
+
+      assert_instance_of(Dexpace::TransportError, wrapped)
+      assert_predicate(wrapped, :retryable?)
+      assert_same(original, wrapped.cause)
+      assert_equal(:read, wrapped.phase)
+      assert_equal(original.message, wrapped.message)
+    end
+  end
+
+  test "only EOFError and IOError of the documented families are ::IOErrors (P6-4's blind spot)" do
+    io_errors = FAMILIES.select { |klass| klass <= ::IOError }
+
+    assert_equal([::EOFError, ::IOError], io_errors)
+  end
+
+  test "TRANSPORT-3: asks the cancellation token first, regardless of the exception's class" do
+    source = Dexpace::Cancellation.source
+    source.cancel(:caller_requested)
+
+    closed = ::IOError.new("stream closed in another thread")
+
+    wrapped = Failures.wrap(closed, phase: :read, cancellation: source.token)
+
+    assert_instance_of(Dexpace::CancelledError, wrapped)
+    assert_equal(:caller_requested, wrapped.reason)
+  end
+
+  test "TRANSPORT-3: a cancelled token wins even over a Dexpace::Error of the adapter's own" do
+    source = Dexpace::Cancellation.source
+    source.cancel(:gave_up)
+
+    wrapped = Failures.wrap(Dexpace::ClosedError.new("closed"), phase: :read,
+                                                                cancellation: source.token,)
+
+    assert_instance_of(Dexpace::CancelledError, wrapped)
+  end
+
+  test "TRANSPORT-4: a read timeout does not itself set the cancellation flag" do
+    source = Dexpace::Cancellation.source
+
+    wrapped = Failures.wrap(::Net::ReadTimeout.new("slow"), phase: :read,
+                                                            cancellation: source.token,)
+
+    refute_predicate(source, :cancelled?)
+    assert_predicate(wrapped, :retryable?)
+  end
+
+  test "never re-wraps a Dexpace::Error the adapter's own code raised" do
+    own_errors = [Dexpace::StreamError.new("x"), Dexpace::ClosedError.new("x"),
+                  Dexpace::EndOfStreamError.new("x"), Dexpace::InvalidArgumentError.new("x"),
+                  Dexpace::TransportError.new("x", phase: :read),]
+    own_errors.each do |own|
+      wrapped = Failures.wrap(own, phase: :read, cancellation: uncancelled)
+
+      assert_same(own, wrapped)
+    end
+  end
+
+  test "an unrecognised StandardError still wraps retryable, per the design's own default" do
+    wrapped = Failures.wrap(::RuntimeError.new("unexpected"), phase: :connect,
+                                                              cancellation: uncancelled,)
+
+    assert_instance_of(Dexpace::TransportError, wrapped)
+    assert_predicate(wrapped, :retryable?)
+    assert_equal(:connect, wrapped.phase)
+  end
+
+  test "the wrapped error answers RETRY-2's capability query through the policy" do
+    wrapped = wrap_and_capture(::Net::OpenTimeout.new("connect"))
+
+    assert(Dexpace::Resilience::Policy.throwable_retryable?(wrapped))
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
new file mode 100644
index 0000000..3df16ed
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/adapter_fixtures"
+require "dexpace/transport/net_http"
+require "dexpace/conformance"
+
+# The generator slice, end to end over the first real socket in the repository: SEAM-26 (the
+# operation descriptor), SEAM-27 (the typed response), SERDE-28 (the status-aware handler),
+# RECOV-15 (the error carrying a buffered body), PIPE-39 (the standard pipeline over a builder),
+# HTTP-52/BODY-30 (Tristate omission; the snapshot error body). None is 8a's row: this is the
+# composition test, and it adds no implementation. The codec half names phase 7a's
+# Dexpace::Serde::JSON::Codec, which this base does not carry, so that one test is GUARDED and
+# 7a un-guards it; the two socket-only halves run here.
+class DexpaceTransportNetHttpGeneratorSliceTest < DexpaceTestCase
+  include AdapterFixtures
+
+  NetHTTP = Dexpace::Transport::NetHTTP
+  Scripts = Dexpace::Conformance::Scripts
+
+  # A witness is a named object answering .dexpace_load (7a's Serde.witness! contract).
+  class Pet
+    attr_reader :name
+
+    def self.dexpace_load(parsed, _context)
+      new(parsed["name"])
+    end
+
+    def initialize(name)
+      @name = name
+    end
+  end
+
+  # The smallest object answering the step protocol at Stages::AUTH that stamps a bearer: 6c's
+  # Auth::Step refuses a plaintext URL (AUTH-28) and the fixture speaks plaintext only (P8-9), so
+  # the assertion here is about the pipeline seeding a step at that stage and the stamped request
+  # reaching the wire, not about 6c's constructor.
+  class BearerStep
+    def stage
+      Dexpace::Pipeline::Stages::AUTH
+    end
+
+    def call(request, cursor)
+      headers = request.headers.new_builder.set("Authorization", "Bearer t0ken").build
+      cursor.fork.call(request.with(headers: headers))
+    end
+  end
+
+  def operation
+    Dexpace::Operation.build(method: "GET", template: "/pets/{id}",
+                             projections: { id: [:path, "id"] },)
+  end
+
+  def base_url(server)
+    "http://127.0.0.1:#{server.port}"
+  end
+
+  # SEAM-26's path expansion: a projected path value containing "/" is ONE segment on the wire.
+  test "SEAM-26: a path parameter containing a slash reaches the server as one escaped segment" do
+    server = wire(Scripts.fixed("{}"))
+    request = operation.build_request(base_url: base_url(server), inputs: { id: "a/b" })
+
+    settle(NetHTTP.build, request).close
+
+    line = server.requests.first.request_line
+
+    assert_includes(line, "/pets/a%2Fb")
+    refute_includes(line, "/pets/a/b")
+  end
+
+  # PIPE-39 with an AUTH-stage step, seeded the documented way: a Pipeline::Builder handed to
+  # Pipeline.standard as its one positional (6b's Task 13a; PIPE-24's validate-then-commit).
+  test "PIPE-39: an AUTH-stage step seeded through a builder stamps the wire request" do
+    server = wire(Scripts.fixed("{}"))
+    adapter = NetHTTP.build
+    builder = Dexpace::Pipeline.builder(transport: adapter)
+    builder.append(BearerStep.new)
+    pipeline = Dexpace::Pipeline.standard(builder)
+    request = operation.build_request(base_url: base_url(server), inputs: { id: "7" })
+
+    pipeline.call(request, Dexpace::RequestOptions::EMPTY, Dexpace::Cancellation.none).close
+
+    assert_equal("Bearer t0ken", server.requests.first.header("authorization"))
+    assert_equal("GET /pets/7 HTTP/1.1", server.requests.first.request_line)
+  end
+
+  # SEAM-27, SERDE-28, RECOV-15, BODY-30 and HTTP-52 in one guarded test: a 200 decodes to the
+  # witness's type; a 404 raises an error whose buffered body is still readable after the socket
+  # is gone; an ABSENT field is omitted from a PATCH body and a NULL one is not.
+  test "SEAM-27/SERDE-28/RECOV-15/BODY-30/HTTP-52: the codec half of the slice" do
+    skip "phase 7a's Dexpace::Serde::JSON::Codec is not on this base; 7a un-guards" \
+      unless defined?(Dexpace::Serde::JSON::Codec)
+
+    serde = Dexpace::Serde
+    codec = serde::JSON::Codec.default
+    handler = serde::StatusAwareHandler.build(serde: codec, witness: Pet)
+
+    ok = wire(Scripts.fixed('{"name":"Rex"}'))
+    request = operation.build_request(base_url: base_url(ok), inputs: { id: "7" })
+    response = Dexpace::Pipeline.standard(NetHTTP.build)
+      .call(request, Dexpace::RequestOptions::EMPTY, Dexpace::Cancellation.none)
+
+    assert_equal("Rex", Dexpace::TypedResponse.new(response: response, handler: handler).value.name)
+
+    missing = wire(Scripts.vendor_status(404, '{"error":"no such pet"}'))
+    request = operation.build_request(base_url: base_url(missing), inputs: { id: "7" })
+    response = Dexpace::Pipeline.standard(NetHTTP.build)
+      .call(request, Dexpace::RequestOptions::EMPTY, Dexpace::Cancellation.none)
+    error = assert_raises(Dexpace::ProtocolError) do
+      Dexpace::TypedResponse.new(response: response, handler: handler).value
+    end
+
+    assert_equal(404, error.status.code)
+    refute_nil(error.headers)
+    assert_match(/no such pet/, error.body.source.read_fully)
+    assert_match(/no such pet/, error.body.source.read_fully) # twice, after the socket is gone
+
+    patch = Dexpace::Operation.build(method: "PATCH", template: "/pets/{id}",
+                                     projections: { id: [:path, "id"], body: [:body, "body"] },)
+    echo = wire(Scripts.fixed("{}"))
+    encoded = codec.dump_bytes("name" => serde::Tristate::ABSENT, "tag" => serde::Tristate::NULL)
+    body = Dexpace::Body.bytes(encoded, media_type: Dexpace::MediaType.parse("application/json"))
+    request = patch.build_request(base_url: base_url(echo), inputs: { id: "7", body: body })
+
+    settle(NetHTTP.build, request).close
+
+    refute_includes(echo.requests.first.body, "name")
+    assert_includes(echo.requests.first.body, "tag")
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
new file mode 100644
index 0000000..407b80a
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require "dexpace/transport/net_http"
+require "socket"
+require "openssl"
+
+# Exercises: TRANSPORT-2, TRANSPORT-3, TRANSPORT-6, TRANSPORT-10, TRANSPORT-11, TRANSPORT-26 (the
+# net-http facts they rest on) -- the phase-8a design's verified facts the adapter's shape depends
+# on, re-run as a standing test on every CI row rather than once in a scratch script (5a's to
+# 6c's precedent). The gemspec pins `net-http >= 0.4` with no upper bound, so the ACTIVE net-http
+# version is what varies across the matrix and not only the interpreter: 3.2.11 carries 0.4.1
+# as its default gem, 3.4.10 carries 0.6.0, 4.0.6 carries 0.9.1, and a networked resolution on
+# any row can activate a newer one. The first test prints the active version so a CI log records
+# which one each row proved, and the two version-bound facts below are asserted as the
+# disjunction the adapter is correct under. No lib/ mirror: it asserts the library, not a file.
+class DexpaceTransportNetHttpMatrixFactsTest < DexpaceTestCase
+  def net_http_version
+    Gem::Version.new(::Net::HTTP::VERSION)
+  end
+
+  test "the active net-http is 0.4 or newer, and the row's version is printed for the record" do
+    spec = Gem.loaded_specs["net-http"]
+    puts "\n[phase 8a matrix] ruby #{RUBY_VERSION}: net-http #{::Net::HTTP::VERSION} " \
+         "(#{spec&.default_gem? ? "default gem" : "installed gem"}), openssl #{OpenSSL::VERSION}"
+
+    assert_operator(net_http_version, :>=, Gem::Version.new("0.4"))
+  end
+
+  test "TRANSPORT-2 fact 2: max_retries defaults to 1 and the retried set covers PUT and DELETE" do
+    idempotent = ::Net::HTTP.const_get(:IDEMPOTENT_METHODS_)
+
+    assert_equal(1, ::Net::HTTP.new("example.com", 80).max_retries)
+    assert_includes(idempotent, "PUT")
+    assert_includes(idempotent, "DELETE")
+  end
+
+  test "TRANSPORT-3 fact 3: an IOError is on the library's own retry rescue list, so only " \
+       "max_retries = 0 lets a socket close under a read surface" do
+    source = File.read(::Net::HTTP.instance_method(:transport_request).source_location.first)
+
+    assert_match(/rescue Net::ReadTimeout, IOError, EOFError/, source)
+  end
+
+  test "TRANSPORT-6 fact 8: the three timeout knobs accept a float below a millisecond, and 0 is " \
+       "poll-once rather than unbounded" do
+    http = ::Net::HTTP.new("example.com", 80)
+    http.open_timeout = 0.0005
+    http.read_timeout = 0.0005
+    http.write_timeout = 0.0005
+
+    assert_in_delta(0.0005, http.read_timeout)
+    assert_operator(Dexpace::Transport::NetHTTP::MIN_TIMEOUT_SECONDS, :>, 0.0005)
+  end
+
+  test "TRANSPORT-10/26 version-bound fact 5: supply_default_content_type warns under -w on " \
+       "net-http < 0.9 and is absent from 0.9; the adapter's own Content-Type holds on both" do
+    request = ::Net::HTTPGenericRequest.new("POST", true, true, "/", {})
+
+    if request.respond_to?(:supply_default_content_type, true)
+      assert_operator(net_http_version, :<, Gem::Version.new("0.9"))
+    else
+      assert_operator(net_http_version, :>=, Gem::Version.new("0.9"))
+    end
+  end
+
+  test "TRANSPORT-11 fact 4: a caller-set Host is honoured verbatim by the native request" do
+    request = ::Net::HTTPGenericRequest.new("GET", false, true, "/", { "Host" => "bogus.example" })
+
+    assert_equal("bogus.example", request["Host"])
+  end
+
+  test "P8-2 fact 13: the empty-initheader construction stamps exactly Accept-Encoding, Accept " \
+       "and User-Agent, and #[]= on Accept-Encoding flips decode_content off" do
+    request = ::Net::HTTPGenericRequest.new("GET", false, true, "/", {})
+
+    assert_equal(%w[accept accept-encoding user-agent], request.to_hash.keys.sort)
+    assert(request.decode_content)
+    request["Accept-Encoding"] = "identity"
+
+    refute(request.decode_content)
+  end
+
+  test "R1 fact 10: Fiber#resume from another thread raises FiberError, which is why the pump " \
+       "is a thread" do
+    fiber = Fiber.new { Fiber.yield(:first) }
+    fiber.resume
+    error = nil
+
+    ::Thread.new do
+      fiber.resume
+    rescue FiberError => error # the block closes over the outer local
+      error
+    end.join
+
+    assert_kind_of(FiberError, error)
+  end
+
+  test "R17 fact: Net::HTTP.new's p_addr defaults to :ENV and reads a lower-case http_proxy for " \
+       "a non-loopback target" do
+    saved = ENV.fetch("http_proxy", nil)
+    ENV["http_proxy"] = "http://user:pw@127.0.0.1:3128"
+
+    default = ::Net::HTTP.new("192.0.2.1", 80)
+    explicit = ::Net::HTTP.new("192.0.2.1", 80, nil, nil, nil, nil)
+
+    assert_predicate(default, :proxy?)
+    assert_equal("127.0.0.1", default.proxy_address)
+    refute_predicate(explicit, :proxy?)
+  ensure
+    ENV["http_proxy"] = saved
+  end
+
+  test "version-bound fact: Socket::ResolutionError exists from 3.3, and SocketError covers it " \
+       "everywhere, which is why Failures wraps the family and not the name" do
+    if defined?(::Socket::ResolutionError)
+      assert_operator(::Socket::ResolutionError, :<, ::SocketError)
+    else
+      assert_operator(Gem::Version.new(RUBY_VERSION), :<, Gem::Version.new("3.3"))
+    end
+  end
+
+  test "P8-15 fact 9: Net::HTTP exposes address and port as readers only" do
+    http = ::Net::HTTP.new("example.com", 80)
+
+    refute_respond_to(http, :address=)
+    refute_respond_to(http, :port=)
+    assert_respond_to(http, :use_ssl=)
+  end
+
+  test "R18 fact 16: an SSLContext with no assignments defaults to VERIFY_PEER" do
+    context = OpenSSL::SSL::SSLContext.new
+    context.set_params({})
+
+    assert_equal(OpenSSL::SSL::VERIFY_PEER, context.verify_mode)
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
new file mode 100644
index 0000000..c4f51f9
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/adapter_fixtures"
+require_relative "../../../support/net_http_recording_sink"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-30, including both of its embedded MUSTs, consuming CFG-22 to CFG-28 (8a's R17):
+# phase 5a's resolver meets its first consumer here. Every configuration is a hermetic
+# from_hash source, never the process environment, because Configuration::EMPTY reads the real
+# ENV. ProxyRoute is a private_constant, reached through const_get.
+class DexpaceTransportNetHttpProxyRouteTest < DexpaceTestCase
+  include AdapterFixtures
+
+  NetHTTP = Dexpace::Transport::NetHTTP
+  ProxyRoute = NetHTTP.const_get(:ProxyRoute)
+  Keys = Dexpace::Configuration::Keys
+
+  def url(host = "api.example.com")
+    Dexpace::URL.parse!("https://#{host}/v1/pets")
+  end
+
+  def configuration_with(pairs)
+    Dexpace::Configuration.build(env_source: Dexpace::Configuration::Sources.from_hash(pairs))
+  end
+
+  def logger_over(sink)
+    Dexpace::Instrumentation::Logger.build(sink: sink)
+  end
+
+  test "is a private_constant of NetHTTP" do
+    assert_raises(NameError) { NetHTTP::ProxyRoute }
+  end
+
+  test "no configured proxy yields four nils, so Net::HTTP gets an explicit nil p_addr" do
+    route = ProxyRoute.for(url, configuration: configuration_with({}))
+
+    assert_nil(route.address)
+    assert_nil(route.port)
+    assert_nil(route.username)
+    assert_nil(route.password)
+    assert_equal(ProxyRoute.none, route)
+  end
+
+  test "a resolved proxy's four values reach the route" do
+    configuration = configuration_with(Keys::HTTPS_PROXY => "http://u:pw@proxy.example:3128")
+
+    route = ProxyRoute.for(url, configuration: configuration)
+
+    assert_equal("proxy.example", route.address)
+    assert_equal(3128, route.port)
+    assert_equal("u", route.username)
+    assert_equal("pw", route.password)
+  end
+
+  # CFG-23: the bypass decision is the resolved Proxy's, asked per target host.
+  test "a host matching the non-proxy list is routed directly; another host is not" do
+    configuration = configuration_with(Keys::HTTPS_PROXY => "http://proxy.example:3128",
+                                       Keys::NO_PROXY => "*.example.com",)
+
+    assert_nil(ProxyRoute.for(url("api.example.com"), configuration: configuration).address)
+    assert_equal("proxy.example",
+                 ProxyRoute.for(url("other.test"), configuration: configuration).address,)
+  end
+
+  # TRANSPORT-30's SHOULD, in the one shape Net::HTTP makes reachable.
+  test "a proxy carrying a challenge handler warns once and still routes through Basic" do
+    sink = NetHTTPRecordingSink.new
+    configuration = configuration_with(Keys::HTTPS_PROXY => "http://u:pw@proxy.example:3128")
+    proxy = Dexpace::Proxy.resolve(configuration).with(challenge_handler: ->(_challenge) {})
+
+    route = ProxyRoute.from(proxy, url, logger: logger_over(sink))
+
+    assert_equal("proxy.example", route.address)
+    assert_equal("u", route.username)
+    warnings = sink.events(NetHTTP::PROXY_LIMITATION_EVENT)
+
+    assert_equal(1, warnings.size)
+    assert_equal(:warn, warnings.first.severity)
+    assert_match(/challenge handler/, warnings.first.payload["unhonoured"])
+    assert_match(/Basic/, warnings.first.payload["remedy"])
+  end
+
+  test "a SOCKS proxy takes the same warning, naming the type, and still routes" do
+    sink = NetHTTPRecordingSink.new
+    proxy = Dexpace::Proxy.build(type: :socks5, host: "socks.example", port: 1080)
+
+    route = ProxyRoute.from(proxy, url, logger: logger_over(sink))
+
+    assert_equal("socks.example", route.address)
+    assert_match(/proxy type/, sink.events(NetHTTP::PROXY_LIMITATION_EVENT).first.payload["unhonoured"])
+  end
+
+  test "a plain HTTP proxy with no handler warns about nothing" do
+    sink = NetHTTPRecordingSink.new
+    configuration = configuration_with(Keys::HTTPS_PROXY => "http://proxy.example:3128")
+
+    ProxyRoute.for(url, configuration: configuration, logger: logger_over(sink))
+
+    assert_empty(sink.entries)
+  end
+
+  # TRANSPORT-30's first embedded MUST: "Proxy credentials MUST NOT be logged."
+  test "no log event anywhere in a proxied exchange carries the credential" do
+    sink = NetHTTPRecordingSink.new
+    configuration = configuration_with(Keys::HTTPS_PROXY => "http://u:s3cret@proxy.example:3128")
+    proxy = Dexpace::Proxy.resolve(configuration, logger: logger_over(sink))
+      .with(challenge_handler: ->(_challenge) {})
+
+    ProxyRoute.from(proxy, url, logger: logger_over(sink))
+
+    refute_empty(sink.entries, "the limitation warning was emitted")
+    refute_match(/s3cret/, sink.entries.inspect)
+  end
+
+  # TRANSPORT-30's second embedded MUST: "MUST NOT be answered to an origin-server (401)
+  # challenge." Structural: this adapter stamps no header in response to any status, because it
+  # never reads one.
+  test "an origin 401 draws no Proxy-Authorization out of the adapter" do
+    server = wire(Dexpace::Conformance::Scripts.vendor_status(401, "denied"))
+
+    response = settle(NetHTTP.build, request_for(server))
+
+    assert_equal(401, response.status.code)
+    assert_equal(1, server.requests.size, "no second, credential-carrying request")
+    assert_nil(server.requests.first.header("proxy-authorization"))
+    response.close
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/request_mapper_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/request_mapper_test.rb
new file mode 100644
index 0000000..25ddc0a
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/request_mapper_test.rb
@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/net_http_recording_sink"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-10, TRANSPORT-11, TRANSPORT-17, TRANSPORT-26, and the wire-boundary re-validation
+# call site phase 1 postponed to the adapters (HTTP-17, HTTP-18, XCUT-18). 8a's R2, P8-2, P8-3,
+# P8-4 and P8-13, at the unit level: what the native request carries after mapping, before any
+# socket. RequestMapper is a private_constant, reached through const_get. Two nested classes
+# under Metrics/ClassLength (6c's shape): the header policy, and the body with its framing.
+module DexpaceTransportNetHttpRequestMapperTest
+  NetHTTP = Dexpace::Transport::NetHTTP
+  RequestMapper = NetHTTP.const_get(:RequestMapper)
+  Events = Dexpace::Instrumentation::Events
+
+  # The request and header builders both classes share.
+  module Mapping
+    def request(method: "GET", headers: Dexpace::Headers::EMPTY, body: nil,
+                url: "http://127.0.0.1:1/a?b=1")
+      Dexpace::Request.build(method: method, url: url, headers: headers, body: body)
+    end
+
+    def native(logger: Dexpace::Instrumentation::Logger::NULL, **)
+      RequestMapper.build(request(**), logger: logger)
+    end
+
+    def headers(pairs)
+      Dexpace::Headers.builder.tap { |b| pairs.each { |name, value| b.add(name, value) } }.build
+    end
+
+    def json_body(bytes)
+      Dexpace::Body.bytes(bytes.b, media_type: Dexpace::MediaType.parse("application/json"))
+    end
+  end
+
+  # R2 steps 1 to 4: re-validation, the managed drop set, the auto-stamps and decode_content.
+  class HeadersTest < DexpaceTestCase
+    include Mapping
+
+    test "is a private_constant of NetHTTP" do
+      assert_raises(NameError) { NetHTTP::RequestMapper }
+    end
+
+    test "P8-2: the three construction-time auto-stamps are deleted" do
+      req = native
+
+      refute(req.key?("Accept"))
+      refute(req.key?("Accept-Encoding"))
+      refute(req.key?("User-Agent"))
+      assert_equal("GET", req.method)
+      assert_equal("/a?b=1", req.path)
+    end
+
+    test "TRANSPORT-11 / P8-13: MANAGED_HEADERS is exactly the ten folded names" do
+      assert_equal(%w[host content-length transfer-encoding connection keep-alive
+                      proxy-connection te trailer upgrade expect], NetHTTP::MANAGED_HEADERS,)
+      assert_predicate(NetHTTP::MANAGED_HEADERS, :frozen?)
+      refute_includes(NetHTTP::MANAGED_HEADERS, "proxy-authorization")
+    end
+
+    test "TRANSPORT-11: managed headers are dropped even when the caller set them; the rest pass" do
+      req = native(headers: headers("Host" => "bogus.example", "Content-Length" => "9999",
+                                    "Connection" => "keep-alive", "X-Pass" => "kept",))
+
+      refute(req.key?("Host"), "Net::HTTP fills Host from the URL only when the slot is empty")
+      refute(req.key?("Content-Length"))
+      refute(req.key?("Connection"))
+      assert_equal("kept", req["X-Pass"])
+    end
+
+    test "TRANSPORT-11: each drop is logged once at VERBOSE under the shared event and fields" do
+      sink = NetHTTPRecordingSink.new
+      logger = Dexpace::Instrumentation::Logger.build(sink: sink)
+
+      native(logger: logger, headers: headers("Host" => "bogus", "Expect" => "100-continue",
+                                              "X-Pass" => "kept",),)
+
+      drops = sink.events(Events::TRANSPORT_HEADER_DROPPED)
+
+      assert_equal(2, drops.size)
+      assert_equal(%i[debug debug], drops.map(&:severity))
+      assert_equal(%w[Host Expect], drops.map { |entry| entry.payload["header"] })
+      assert_equal(["transport managed header (TRANSPORT-11)"],
+                   drops.map { |entry| entry.payload["reason"] }.uniq,)
+    end
+
+    test "proxy-authorization is NOT managed: a caller-set value passes through" do
+      req = native(headers: headers("Proxy-Authorization" => "Basic x"))
+
+      assert_equal("Basic x", req["Proxy-Authorization"])
+    end
+
+    test "a multi-valued caller header keeps both values" do
+      two = headers("X-Multi" => "a").new_builder.tap { |b| b.add("X-Multi", "b") }.build
+
+      assert_equal(%w[a b], native(headers: two).get_fields("X-Multi"))
+    end
+
+    # HTTP-17/HTTP-18: a duck-typed impostor that never met a builder -- the residual gap design
+    # §10.10 admits -- is refused at the wire boundary before anything is copied.
+    test "HTTP-17: a forged CRLF header NAME is refused before anything is copied" do
+      forged = forged_request("X-Evil\r\nInjected", "v")
+
+      error = assert_raises(Dexpace::InvalidArgumentError) do
+        RequestMapper.build(forged, logger: Dexpace::Instrumentation::Logger::NULL)
+      end
+      assert_match(/X-Evil/, error.message)
+    end
+
+    test "HTTP-18: a forged CRLF header VALUE is refused before anything is copied" do
+      forged = forged_request("X-Evil", "a\r\nInjected: b")
+
+      assert_raises(Dexpace::InvalidArgumentError) do
+        RequestMapper.build(forged, logger: Dexpace::Instrumentation::Logger::NULL)
+      end
+    end
+
+    test "P8-3: decode_content is off unconditionally, whatever the caller's Accept-Encoding" do
+      plain = native
+      with_header = native(headers: headers("Accept-Encoding" => "gzip"))
+
+      refute(plain.decode_content)
+      refute(plain.key?("Accept-Encoding"))
+      refute(with_header.decode_content)
+      assert_equal("gzip", with_header["Accept-Encoding"])
+    end
+
+    private
+
+    # Anything answering #method/#url/#headers/#body duck-types past the builder entirely
+    # (design §10.10, P8); this one carries a header no Dexpace::Headers would ever have admitted.
+    def forged_request(name, value)
+      forged_headers = Object.new
+      forged_headers.define_singleton_method(:each_entry) { |&blk| blk.call(name, value) }
+      forged = Object.new
+      forged.define_singleton_method(:method) { Dexpace::Method::GET }
+      forged.define_singleton_method(:url) { Dexpace::URL.parse!("http://127.0.0.1:1/") }
+      forged.define_singleton_method(:headers) { forged_headers }
+      forged.define_singleton_method(:body) { nil }
+      forged
+    end
+  end
+
+  # R2 steps 5 to 8: Content-Type, framing and the body stream.
+  class BodyTest < DexpaceTestCase
+    include Mapping
+
+    test "TRANSPORT-10 (a): an explicit Content-Type wins over the body's own media type" do
+      req = native(method: "POST", headers: headers("content-type" => "text/plain"),
+                   body: json_body("{}"),)
+
+      assert_equal("text/plain", req["Content-Type"])
+      assert_equal(1, req.get_fields("Content-Type").size)
+    end
+
+    test "TRANSPORT-10 (b): the body's media type is used when the caller set none" do
+      req = native(method: "POST", body: json_body("{}"))
+
+      assert_equal("application/json", req["Content-Type"])
+    end
+
+    test "P8-4: no header and no body media type falls back to octet-stream, body or not" do
+      with_body = native(method: "POST", body: Dexpace::Body.bytes("x".b))
+      without = native(method: "POST")
+
+      assert_equal(NetHTTP::DEFAULT_CONTENT_TYPE, with_body["Content-Type"])
+      assert_equal(NetHTTP::DEFAULT_CONTENT_TYPE, without["Content-Type"])
+      assert_equal("application/octet-stream", NetHTTP::DEFAULT_CONTENT_TYPE)
+    end
+
+    test "a body-forbidden method gets no Content-Type and no body stream at all" do
+      req = native(method: "GET")
+
+      refute(req.key?("Content-Type"))
+      assert_nil(req.body_stream)
+      refute_predicate(req, :request_body_permitted?)
+    end
+
+    test "framing: Content-Length from a known-length body, never Transfer-Encoding" do
+      req = native(method: "POST", body: Dexpace::Body.bytes("abc".b))
+
+      assert_equal("3", req["Content-Length"])
+      refute(req.key?("Transfer-Encoding"))
+    end
+
+    test "framing: Transfer-Encoding: chunked from an unknown-length body" do
+      req = native(method: "POST", body: Dexpace::Body.chunked(["a".b, "b".b]))
+
+      assert_equal("chunked", req["Transfer-Encoding"])
+      refute(req.key?("Content-Length"))
+    end
+
+    test "TRANSPORT-17: the body is attached once, as a BufferedSource over the body's #each" do
+      req = native(method: "POST", body: Dexpace::Body.bytes("abc".b))
+
+      assert_kind_of(Dexpace::IO::BufferedSource, req.body_stream)
+      assert_nil(req.body)
+      assert_equal("abc".b, req.body_stream.readpartial(16))
+    end
+
+    test "TRANSPORT-26: a body-less POST attaches no stream; Net::HTTP sends Content-Length: 0" do
+      req = native(method: "POST")
+
+      assert_nil(req.body_stream)
+      refute(req.key?("Content-Length"))
+      assert_predicate(req, :request_body_permitted?)
+    end
+
+    test "response_body_permitted is false only for HEAD" do
+      refute_predicate(native(method: "HEAD"), :response_body_permitted?)
+      assert_predicate(native(method: "GET"), :response_body_permitted?)
+      assert_predicate(native(method: "DELETE"), :response_body_permitted?)
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
new file mode 100644
index 0000000..ea69e0a
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/net_http_recording_sink"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-14, TRANSPORT-24, TRANSPORT-27 (8a's R4) at the unit level: native heads built
+# directly, no socket, a two-method duck as the pump. ResponseMapper is a private_constant,
+# reached through const_get. Two nested classes under Metrics/ClassLength (6c's shape): the head
+# and its headers, then the body's length, type and absence.
+module DexpaceTransportNetHttpResponseMapperTest
+  NetHTTP = Dexpace::Transport::NetHTTP
+  ResponseMapper = NetHTTP.const_get(:ResponseMapper)
+  Events = Dexpace::Instrumentation::Events
+
+  # The request, the scripted pump and the native head both classes build.
+  module Heads
+    def dexpace_request(method: "GET")
+      Dexpace::Request.build(method: method, url: "http://127.0.0.1:1/",
+                             headers: Dexpace::Headers::EMPTY, body: nil,)
+    end
+
+    # A pump over scripted chunks: #readpartial hands them out, then raises EOF.
+    def pump_of(*chunks)
+      pump = Object.new
+      queue = chunks.map(&:b)
+      pump.define_singleton_method(:readpartial) do |*_|
+        raise ::EOFError if queue.empty?
+
+        queue.shift
+      end
+      pump.define_singleton_method(:close) { @closed = true }
+      pump.define_singleton_method(:closed?) { @closed ? true : false }
+      pump
+    end
+
+    def ok(pairs = {})
+      native = ::Net::HTTPOK.new("1.1", "200", "OK")
+      pairs.each { |name, value| Array(value).each { |v| native.add_field(name, v) } }
+      native
+    end
+
+    def build(native, pump: pump_of, request: dexpace_request, **)
+      ResponseMapper.build(request: request, native: native, pump: pump, **)
+    end
+  end
+
+  # The status line, the protocol and TRANSPORT-14's header filter.
+  class HeadTest < DexpaceTestCase
+    include Heads
+
+    test "is a private_constant of NetHTTP" do
+      assert_raises(NameError) { NetHTTP::ResponseMapper }
+    end
+
+    test "maps the status line and the protocol, and reads the body through the pump" do
+      response = build(ok("Content-Length" => "2"), pump: pump_of("hi"))
+
+      assert_equal(200, response.status.code)
+      assert_equal("OK", response.reason)
+      assert_equal(Dexpace::Protocol::HTTP_1_1, response.protocol)
+      assert_equal(2, response.body.content_length)
+      assert_equal("hi", response.body_string)
+    end
+
+    test "TRANSPORT-24: a vendor status maps totally, and a 499 too" do
+      vendor = ::Net::HTTPResponse.send(:response_class, "520").new("1.1", "520", "Vendor")
+      vendor["Content-Length"] = "0"
+      client = ::Net::HTTPResponse.send(:response_class, "499").new("1.1", "499", "")
+      client["Content-Length"] = "0"
+
+      assert_equal(520, build(vendor).status.code)
+      assert_equal(499, build(client).status.code)
+    end
+
+    test "TRANSPORT-14: a control-byte value is dropped; the body and remaining headers survive" do
+      response = build(ok("X-Ctl" => "a\x01b", "X-Ok" => "fine", "Content-Length" => "2"),
+                       pump: pump_of("hi"),)
+
+      refute_includes(response.headers, "X-Ctl")
+      assert_equal(["fine"], response.headers["X-Ok"])
+      assert_equal("hi", response.body_string)
+    end
+
+    test "TRANSPORT-14: a non-ASCII NAME is dropped; the body still reads" do
+      native = ok("Content-Length" => "2")
+      native.instance_variable_get(:@header)["x-b\xE9d".b] = ["v"]
+
+      response = build(native, pump: pump_of("hi"))
+
+      assert_equal(%w[content-length], response.headers.names)
+      assert_equal("hi", response.body_string)
+    end
+
+    test "TRANSPORT-14: obs-text in a value is preserved, never stripped" do
+      response = build(ok("X-Obs" => "caf\xE9".b, "Content-Length" => "0"))
+
+      assert_equal(["caf\xE9".b], response.headers["X-Obs"])
+    end
+
+    test "TRANSPORT-14: each drop is logged once at VERBOSE by NAME, under the shared event" do
+      sink = NetHTTPRecordingSink.new
+      logger = Dexpace::Instrumentation::Logger.build(sink: sink)
+
+      build(ok("X-Ctl" => "a\x01b", "Content-Length" => "0"), logger: logger)
+
+      drops = sink.events(Events::TRANSPORT_HEADER_DROPPED)
+
+      assert_equal(1, drops.size)
+      assert_equal(:debug, drops.first.severity)
+      assert_equal("x-ctl", drops.first.payload["header"])
+      assert_equal("malformed inbound header (TRANSPORT-14)", drops.first.payload["reason"])
+      refute_match(/\x01/, drops.first.payload.inspect, "the value is never logged")
+    end
+
+    test "a multi-valued Set-Cookie survives as two values (verified fact 6: #to_hash, not #[])" do
+      response = build(ok("Set-Cookie" => %w[a=1 b=2], "Content-Length" => "0"))
+
+      assert_equal(%w[a=1 b=2], response.headers["Set-Cookie"])
+    end
+
+    test "an HTTP/1.0 head raises InvalidArgumentError: Protocol admits 1.1 and 2 only (HTTP-33)" do
+      native = ::Net::HTTPOK.new("1.0", "200", "OK")
+      native["Content-Length"] = "0"
+
+      assert_raises(Dexpace::InvalidArgumentError) { build(native) }
+    end
+  end
+
+  # R4's length parse, TRANSPORT-27's downgrades, and the responses that carry no body.
+  class BodyTest < DexpaceTestCase
+    include Heads
+
+    test "TRANSPORT-27: a non-numeric Content-Length maps to the -1 sentinel and the body reads" do
+      native = ok("Content-Length" => "abc")
+
+      response = build(native, pump: pump_of("hi"))
+
+      assert_equal(-1, response.body.content_length)
+      assert_equal(["abc"], response.headers["Content-Length"], "the raw header reaches the caller")
+      assert_nil(native["Content-Length"], "deleted from the NATIVE response before read_body")
+      assert_equal("hi", response.body_string)
+    end
+
+    test "R4: negative, multi-valued and absent Content-Lengths map to -1; a good one is exact" do
+      lengths = [ok("Content-Length" => "-4"), ok("Content-Length" => %w[3 3]), ok,
+                 ok("Content-Length" => "7"),].map do |native|
+        build(native, pump: pump_of("x")).body.content_length
+      end
+
+      assert_equal([-1, -1, -1, 7], lengths)
+    end
+
+    test "TRANSPORT-27: a malformed Content-Type downgrades to nil rather than raising" do
+      response = build(ok("Content-Type" => "not a/;;media type", "Content-Length" => "0"))
+
+      assert_nil(response.body.media_type)
+      assert_equal(["not a/;;media type"], response.headers["Content-Type"])
+    end
+
+    test "a well-formed Content-Type is parsed, with its charset" do
+      response = build(ok("Content-Type" => "text/plain; charset=utf-8", "Content-Length" => "0"))
+      media = response.body.media_type
+
+      assert_equal(%w[text plain], [media.type, media.subtype])
+      assert_equal("utf-8", media.charset)
+    end
+
+    test "a 204 gets no body, and the pump is closed immediately" do
+      pump = pump_of
+      native = ::Net::HTTPNoContent.new("1.1", "204", "No Content")
+
+      response = build(native, pump: pump)
+
+      assert_nil(response.body)
+      assert_predicate(pump, :closed?)
+    end
+
+    test "a HEAD response gets no body whatever its status class says, and the pump is closed" do
+      pump = pump_of
+
+      response = build(ok("Content-Length" => "99"), pump: pump, head: true,
+                                                     request: dexpace_request(method: "HEAD"),)
+
+      assert_nil(response.body)
+      assert_equal(["99"], response.headers["Content-Length"])
+      assert_predicate(pump, :closed?)
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
new file mode 100644
index 0000000..b635ee3
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
@@ -0,0 +1,302 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/adapter_fixtures"
+require "dexpace/transport/net_http"
+
+# TRANSPORT-19, TRANSPORT-25, and the mechanism TRANSPORT-22 rests on: 8a's R1 (P8-1), the
+# group R1 is answerable to. The fixture is dexpace-conformance's own WireServer (design boundary
+# 13: never a second fixture hand-rolled beside it), reached through the root Gemfile's path
+# loading and never through this gem's gemspec. No test sleeps to synchronise: every wait is a
+# queue pop, a bounded join or the dribble script's own deliberate delay, which is the thing
+# under test. ResponsePump is a private_constant, reached through const_get. Three nested
+# classes under Metrics/ClassLength (6c's shape): delivery, teardown, and the carried failures.
+module DexpaceTransportNetHttpResponsePumpTest
+  NetHTTP = Dexpace::Transport::NetHTTP
+  ResponsePump = NetHTTP.const_get(:ResponsePump)
+  Scripts = Dexpace::Conformance::Scripts
+
+  # The pump construction and the drain the three classes share.
+  module Pumping
+    include AdapterFixtures
+
+    def get
+      ::Net::HTTPGenericRequest.new("GET", false, true, "/", {})
+    end
+
+    def pump_for(server, cancellation: Dexpace::Cancellation.none, **)
+      ResponsePump.new(http: client_for(server.port), native: get, deadline: nil,
+                       cancellation: cancellation, **,)
+    end
+
+    def drain(pump, size = 64 * 1024)
+      drained = (+"").b
+      loop { drained << pump.readpartial(size) }
+    rescue Dexpace::EndOfStreamError
+      drained
+    end
+  end
+
+  # The head, the chunks and the end of stream.
+  class DeliveryTest < DexpaceTestCase
+    include Pumping
+
+    test "is a private_constant of NetHTTP" do
+      assert_raises(NameError) { NetHTTP::ResponsePump }
+    end
+
+    test "delivers the head before the second chunk, with a real time gap (never buffered whole)" do
+      pump = pump_for(wire(Scripts.dribble("aaaaa", "bbbbb", 0.3)))
+      head = nil
+
+      head_at = elapsed { head = pump.head_or_raise }
+
+      assert_equal("200", head.code)
+      assert_operator(head_at, :<, 0.15, "the head must not wait for the second chunk")
+      assert_equal("aaaaabbbbb", drain(pump, 16))
+      pump.close
+    end
+
+    test "with a block, #head_or_raise yields the head and returns the block's value" do
+      pump = pump_for(wire(Scripts.fixed("ok")))
+
+      code = pump.head_or_raise { |head| head.code.to_i }
+
+      assert_equal(200, code)
+      assert_equal("ok", drain(pump))
+      pump.close
+    end
+
+    test "TRANSPORT-25: a multi-megabyte body round-trips byte-exactly; close is idempotent" do
+      body = Scripts.large_body(4 * 1024 * 1024)
+      pump = pump_for(wire(Scripts.fixed(body)))
+      pump.head_or_raise
+
+      drained = drain(pump)
+
+      assert_equal(body.bytesize, drained.bytesize)
+      assert_equal(body, drained)
+      pump.close
+      pump.close
+    end
+
+    test "a drained pump reports end of stream, not a closed response" do
+      pump = pump_for(wire(Scripts.fixed("ok")))
+      pump.head_or_raise
+      drain(pump)
+
+      assert_raises(Dexpace::EndOfStreamError) { pump.readpartial(1) }
+      pump.close
+    end
+
+    test "writing into an explicit outbuf retags it to BINARY via #replace" do
+      pump = pump_for(wire(Scripts.fixed("caf\xE9".b)))
+      pump.head_or_raise
+      outbuf = (+"prior").force_encoding(Encoding::UTF_8)
+
+      returned = pump.readpartial(16, outbuf)
+
+      assert_same(outbuf, returned)
+      assert_equal(Encoding::BINARY, outbuf.encoding)
+      assert_equal("caf\xE9".b, outbuf)
+      pump.close
+    end
+
+    test "#readpartial honours maxlen, keeping the remainder for the next read" do
+      pump = pump_for(wire(Scripts.fixed("abcdef")))
+      pump.head_or_raise
+
+      assert_equal("ab", pump.readpartial(2))
+      assert_equal("cd", pump.readpartial(2))
+      assert_equal("ef", pump.readpartial(16))
+      pump.close
+    end
+  end
+
+  # R1's release: bounded, idempotent, from any state, and on both constructions.
+  class TeardownTest < DexpaceTestCase
+    include Pumping
+
+    test "TRANSPORT-19: closing mid-stream with the producer blocked on a socket read is prompt" do
+      pump = pump_for(wire(Scripts.dribble("a", "b", 10))) # never waits 10 s: close wins
+      pump.head_or_raise
+      pump.readpartial(16) # consumes "a", leaves the producer blocked waiting for "b"
+
+      took = elapsed { pump.close }
+
+      assert_operator(took, :<, 1.0)
+      assert_operator(elapsed { pump.close }, :<, 0.1, "idempotent")
+      assert_raises(Dexpace::ClosedError) { pump.readpartial(1) }
+    end
+
+    test "closing before any read, and with the producer blocked on the queue, both return" do
+      early = pump_for(wire(Scripts.fixed("x" * 100_000)))
+
+      assert_operator(elapsed { early.close }, :<, 1.0)
+
+      blocked = pump_for(wire(Scripts.fixed("x" * (1024 * 1024))))
+      blocked.head_or_raise
+      blocked.readpartial(1) # the producer is now blocked pushing into the full queue
+
+      assert_operator(elapsed { blocked.close }, :<, 1.0)
+    end
+
+    test "the cancellation subscription is detached when the pump is closed" do
+      source = Dexpace::Cancellation.source
+      pump = pump_for(wire(Scripts.fixed("ok")), cancellation: source.token)
+      pump.head_or_raise
+      drain(pump)
+      pump.close
+
+      source.cancel(:late) # nothing left to close; a retained hook would close a closed pump twice
+
+      assert_predicate(pump, :closed?)
+    end
+
+    # XCUT-13: the join in #release is BOUNDED by JOIN_DEADLINE_SECONDS, asserted over the source
+    # because the one producer that can outlive it -- a borrowed client's, left to the caller's
+    # own read_timeout -- would cost the suite the whole deadline to observe.
+    test "the producer join in #release is bounded by JOIN_DEADLINE_SECONDS, never unbounded" do
+      path = File.expand_path("../../../../lib/dexpace/transport/net_http/response_pump.rb",
+                              __dir__,)
+      source = File.read(path)
+
+      assert_match(/@thread\.join\(JOIN_DEADLINE_SECONDS\)/, source)
+      refute_match(/@thread\.join\b(?!\(JOIN_DEADLINE_SECONDS\))/, source)
+    end
+
+    # P8-15: the borrowing construction. The pump must neither start nor finish a client it does
+    # not own, so an ALREADY-STARTED client is reused and survives the response's close; the
+    # permit is returned by the producer once the client is free.
+    test "owns_connection: false neither starts nor finishes the client; the permit comes back" do
+      server = wire(Scripts.fixed("ok"))
+      http = client_for(server.port)
+      http.start
+      permit = ::Thread::SizedQueue.new(1)
+
+      pump = ResponsePump.new(http: http, native: get, deadline: nil,
+                              cancellation: Dexpace::Cancellation.none, owns_connection: false,
+                              permit: permit,)
+      pump.head_or_raise
+      drain(pump)
+      pump.close
+
+      assert_predicate(http, :started?, "the adapter must not finish a client it does not own")
+      assert_equal(1, permit.size, "the permit is returned once the producer is done (P8-15)")
+      http.finish
+    end
+  end
+
+  # What a failure looks like from the consumer's thread: its class, its cause and its timing.
+  class FailuresTest < DexpaceTestCase
+    include Pumping
+
+    # A chunked head, one chunk, then the connection drops with no terminating 0-chunk: the
+    # next read inside Net::HTTP raises, after the head was delivered.
+    def truncated_chunked
+      lambda do |conn, _head|
+        conn.write("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n1\r\na\r\n")
+        conn.close
+      end
+    end
+
+    # pipeline/7ce4431d: a carried failure is raised with its cause spelled explicitly. An
+    # unrelated exception is deliberately in flight here, so a bare `raise` -- which would take
+    # `$!` -- is the only way the cause assertion below can fail.
+    test "a producer failure after the head surfaces on the consumer's thread with its cause" do
+      pump = pump_for(wire(truncated_chunked))
+      pump.head_or_raise
+      pump.readpartial(16) # "a"
+
+      error = begin
+        raise "unrelated, deliberately in flight"
+      rescue RuntimeError
+        begin
+          pump.readpartial(16)
+          nil
+        rescue StandardError => caught
+          caught
+        end
+      end
+
+      assert_instance_of(Dexpace::TransportError, error)
+      assert_equal(:read, error.phase)
+      assert_predicate(error, :retryable?)
+      refute_nil(error.cause)
+      refute_equal("unrelated, deliberately in flight", error.cause.message)
+      pump.close
+    end
+
+    test "a failure before the head is raised from #head_or_raise, classified and with its cause" do
+      server = wire(Scripts.fixed("x"))
+      http = client_for(server.port)
+      server.close
+      pump = ResponsePump.new(http: http, native: get, deadline: nil,
+                              cancellation: Dexpace::Cancellation.none,)
+
+      error = assert_raises(Dexpace::TransportError) { pump.head_or_raise }
+
+      assert_equal(:connect, error.phase)
+      assert_kind_of(::SystemCallError, error.cause)
+      pump.close
+    end
+
+    # TRANSPORT-3: the token is asked first. The cancel lands while the producer is blocked in
+    # a socket read, and the failure it produces classifies as the cancellation, not as a reset.
+    test "a cancel under a blocked body read closes the pump and the read raises CancelledError" do
+      entered = ::Thread::Queue.new
+      server = wire(Scripts.hang_after_headers(on_headers_written: -> { entered.push(true) }))
+      source = Dexpace::Cancellation.source
+      pump = pump_for(server, cancellation: source.token)
+      pump.head_or_raise
+      canceller = ::Thread.new do
+        entered.pop
+        source.cancel(:gave_up)
+      end
+
+      error = assert_raises(Dexpace::CancelledError) { pump.readpartial(16) }
+      canceller.join
+
+      assert_equal(:gave_up, error.reason)
+      assert_predicate(pump, :closed?)
+      pump.close
+    end
+
+    test "a cancel before the head classifies #head_or_raise's failure as the cancellation" do
+      entered = ::Thread::Queue.new
+      server = wire(Scripts.hang_before_headers(on_request_read: -> { entered.push(true) }))
+      source = Dexpace::Cancellation.source
+      pump = pump_for(server, cancellation: source.token)
+      canceller = ::Thread.new do
+        entered.pop
+        source.cancel(:early)
+      end
+
+      error = assert_raises(Dexpace::CancelledError) { pump.head_or_raise }
+      canceller.join
+
+      assert_equal(:early, error.reason)
+      pump.close
+    end
+
+    # R3: the budget is refreshed into read_timeout after every chunk, so a trickling body
+    # cannot multiply it by the chunk count; an expired budget mid-exchange surfaces as a
+    # retryable transport failure rather than a hang.
+    test "a deadline that expires between chunks fails the read with a retryable TransportError" do
+      deadline = NetHTTP.const_get(:Deadline).build(clock: Dexpace::Clock::SYSTEM, budget: 0.25)
+      http = client_for(wire(Scripts.dribble("a", "b", 10)).port)
+      pump = ResponsePump.new(http: http, native: get, deadline: deadline,
+                              cancellation: Dexpace::Cancellation.none,)
+      pump.head_or_raise
+      pump.readpartial(16)
+      error = nil
+
+      took = elapsed { error = assert_raises(Dexpace::TransportError) { pump.readpartial(16) } }
+
+      assert_predicate(error, :retryable?)
+      assert_operator(took, :<, 2.0)
+      pump.close
+    end
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
new file mode 100644
index 0000000..ecbaa6a
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require_relative "../../../test_helper"
+require_relative "../../../support/adapter_fixtures"
+require "dexpace/transport/net_http"
+require "openssl"
+
+# 8a's R18: `.build`'s `tls:` keyword. No TRANSPORT ID -- this is public surface NFR-4 locks, and
+# the values are plain so no OpenSSL constant reaches a public signature (NFR-11). The plaintext
+# fixture (P8-9) is why the last test is structural rather than a handshake. TLSSettings is a
+# private_constant, reached through const_get.
+class DexpaceTransportNetHttpTLSSettingsTest < DexpaceTestCase
+  include AdapterFixtures
+
+  NetHTTP = Dexpace::Transport::NetHTTP
+  TLSSettings = NetHTTP.const_get(:TLSSettings)
+
+  test "is a private_constant of NetHTTP, and TLS_SETTINGS is the frozen six-key set" do
+    assert_raises(NameError) { NetHTTP::TLSSettings }
+    assert_equal(%i[ca_file ca_path cert key verify_mode min_version], NetHTTP::TLS_SETTINGS)
+    assert_predicate(NetHTTP::TLS_SETTINGS, :frozen?)
+  end
+
+  test "the default assigns nothing, so SSLContext#set_params supplies VERIFY_PEER" do
+    http = ::Net::HTTP.new("example.com", 443)
+    TLSSettings.apply(http, TLSSettings.validate!(nil))
+
+    assert_nil(http.verify_mode, "an unassigned verify_mode is what lets set_params default it")
+    assert_nil(http.ca_file)
+    assert_nil(http.min_version)
+    assert_equal(OpenSSL::SSL::VERIFY_PEER, OpenSSL::SSL::SSLContext.new.tap do |c|
+      c.set_params({})
+    end.verify_mode,)
+  end
+
+  test "each accepted key reaches the client, and the validated hash is frozen" do
+    http = ::Net::HTTP.new("example.com", 443)
+    settings = TLSSettings.validate!(ca_file: "/tmp/ca.pem", ca_path: "/tmp/certs",
+                                     verify_mode: OpenSSL::SSL::VERIFY_PEER, min_version: :TLS1_2,)
+    TLSSettings.apply(http, settings)
+
+    assert_predicate(settings, :frozen?)
+    assert_equal("/tmp/ca.pem", http.ca_file)
+    assert_equal("/tmp/certs", http.ca_path)
+    assert_equal(OpenSSL::SSL::VERIFY_PEER, http.verify_mode)
+    assert_equal(:TLS1_2, http.min_version)
+  end
+
+  test "an unknown key raises and names itself and the accepted set" do
+    error = assert_raises(Dexpace::InvalidArgumentError) do
+      TLSSettings.validate!(verify_hostname: false)
+    end
+
+    assert_match(/verify_hostname/, error.message)
+    assert_match(/ca_file/, error.message)
+  end
+
+  test "a non-Hash tls: raises rather than being coerced" do
+    error = assert_raises(Dexpace::InvalidArgumentError) { TLSSettings.validate!("/tmp/ca.pem") }
+
+    assert_match(/String/, error.message)
+    assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(tls: [:ca_file]) }
+  end
+
+  test ".build validates tls: at construction, before any call" do
+    error = assert_raises(Dexpace::InvalidArgumentError) { NetHTTP.build(tls: { bogus: 1 }) }
+
+    assert_match(/bogus/, error.message)
+  end
+
+  # The assertion is that a plain-http URL never reaches #apply at all: a bogus ca_file would
+  # have failed a handshake, and the plaintext call succeeds.
+  test "tls: is not applied to a plain-http request" do
+    server = wire(Dexpace::Conformance::Scripts.fixed("ok"))
+    adapter = NetHTTP.build(tls: { ca_file: "/nonexistent/ca.pem",
+                                   verify_mode: OpenSSL::SSL::VERIFY_PEER, })
+
+    response = settle(adapter, request_for(server))
+
+    assert_equal("ok", response.body_string)
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
new file mode 100644
index 0000000..02a6ec2
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "zlib"
+require "stringio"
+require "dexpace/conformance"
+
+# The helpers the adapter's own suites share: a tracked WireServer per test, closed in teardown
+# so nothing leaks past DexpaceTestCase's thread count; a request against that server; the one
+# send primitive; and the scripts, clients and environment swaps the exchange tests need. The
+# fixture is dexpace-conformance's own WireServer (design boundary 13), never a second one.
+module AdapterFixtures
+  def teardown
+    @servers&.each(&:close)
+    super
+  end
+
+  def wire(script)
+    server = Dexpace::Conformance::WireServer.start(script)
+    (@servers ||= []) << server
+    server
+  end
+
+  def client_for(port)
+    client = ::Net::HTTP.new("127.0.0.1", port)
+    client.max_retries = 0
+    client
+  end
+
+  def request_for(server, path: "/")
+    Dexpace::Request.build(method: "GET", url: "http://127.0.0.1:#{server.port}#{path}",
+                           headers: Dexpace::Headers::EMPTY, body: nil,)
+  end
+
+  def settle(adapter, request, options = Dexpace::RequestOptions::EMPTY)
+    adapter.call(request, options, Dexpace::Cancellation.none)
+  end
+
+  def elapsed
+    t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    yield
+    Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0
+  end
+
+  # A chunked body of `count` one-byte chunks, each `delay` seconds apart; the wait is on the
+  # socket, never a sleep the client could not interrupt.
+  def trickle(count, delay)
+    lambda do |conn, _head|
+      conn.write("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n")
+      count.times do |i|
+        conn.wait_readable(delay) if i.positive?
+        conn.write("1\r\n#{i}\r\n")
+      end
+      conn.write("0\r\n\r\n")
+    end
+  end
+
+  # Two responses on ONE connection: the first request was read by the fixture, the second is
+  # read here, so a client that keeps its connection alive is told apart from one that does not.
+  def keep_alive_twice(first, second)
+    lambda do |conn, _head|
+      Dexpace::Conformance::Scripts.write_response(conn, body: first)
+      head = (+"").b
+      head << conn.readpartial(4096) until head.include?("\r\n\r\n")
+      Dexpace::Conformance::Scripts.write_response(conn, body: second)
+    end
+  end
+
+  # TRANSPORT-29's proof: `threads` threads each sending `rounds` echo requests through one
+  # adapter, every response matched to its own request; the mismatches, which must be none. A
+  # raise inside a thread is recorded as a mismatch rather than aborting the join.
+  def echo_mismatches(adapter, server, threads:, rounds:)
+    mismatches = ::Thread::Queue.new
+    workers = Array.new(threads) do |t|
+      ::Thread.new do
+        rounds.times do |i|
+          path = "/#{t}-#{i}"
+          body = settle(adapter, request_for(server, path: path)).body_string
+          mismatches.push([path, body]) unless body == path
+        rescue StandardError => error
+          mismatches.push([path, error])
+        end
+      end
+    end
+    workers.each(&:join)
+    found = []
+    found << mismatches.pop until mismatches.empty?
+    found
+  end
+
+  def gzip(string)
+    io = StringIO.new((+"").b)
+    writer = Zlib::GzipWriter.new(io)
+    writer.write(string)
+    writer.finish
+    io.string
+  end
+
+  def with_env(pairs)
+    saved = pairs.to_h { |name, _| [name, ENV.fetch(name, nil)] }
+    pairs.each { |name, value| ENV[name] = value }
+    yield
+  ensure
+    saved.each { |name, value| ENV[name] = value }
+  end
+end
diff --git a/gems/dexpace-transport-net_http/test/support/net_http_recording_sink.rb b/gems/dexpace-transport-net_http/test/support/net_http_recording_sink.rb
new file mode 100644
index 0000000..56dd781
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/support/net_http_recording_sink.rb
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+# A logging sink that records every write, for the tests that assert what the adapter logs and
+# -- TRANSPORT-30's first embedded MUST -- what it never logs. The gem's own double: core's test
+# support is not reachable from an adapter gem's suite, and a double this small is not worth a
+# shared home. Every method the facade's duck-typed `_Sink` names, and nothing else.
+#
+# Named for its gem, never a bare `RecordingSink`: `test:gems` loads every gem's suite into ONE
+# process (tools/suite_runner.rb, so SimpleCov reports one aggregate figure), and core's
+# test/support/recording_sink.rb already defines a top-level `RecordingSink` with an `Entry` of its
+# own -- a second definition re-assigns the constant, and that "already initialized constant"
+# warning is fatal under NFR-6 at load time, before a single test runs.
+class NetHTTPRecordingSink
+  Entry = ::Data.define(:severity, :payload)
+
+  attr_reader :entries
+
+  def initialize
+    @entries = []
+    @mutex = ::Thread::Mutex.new
+  end
+
+  def debug(message = nil, &) = record(:debug, message, &)
+  def info(message = nil, &) = record(:info, message, &)
+  def warn(message = nil, &) = record(:warn, message, &)
+  def error(message = nil, &) = record(:error, message, &)
+
+  def debug? = true
+  def info? = true
+  def warn? = true
+  def error? = true
+
+  # The records whose event field is the given name.
+  def events(name)
+    @mutex.synchronize do
+      @entries.select { |entry| entry.payload.is_a?(::Hash) && entry.payload["event"] == name }
+    end
+  end
+
+  private
+
+  def record(severity, message)
+    payload = block_given? ? yield : message
+    @mutex.synchronize { @entries << Entry.new(severity: severity, payload: payload) }
+    nil
+  end
+end
diff --git a/test/gates/require_allowlist_test.rb b/test/gates/require_allowlist_test.rb
index 6952e4b..b63d468 100644
--- a/test/gates/require_allowlist_test.rb
+++ b/test/gates/require_allowlist_test.rb
@@ -109,6 +109,11 @@ def skip_without_bundled_table
     assert_empty(scan("internal_relative.rb"))
   end
 
+  # The fixture's third require is `tempfile`, phase 8a's one-line growth of the allowlist
+  # (TRANSPORT-28): a default gem on every supported Ruby that no row of Gem::BUNDLED_GEMS::SINCE
+  # names -- the bundled-table case below is what keeps that true on every CI row -- so
+  # dexpace-conformance may create the file its file-body assertion uploads a window of, and
+  # core is no wider for it (nothing in core requires it).
   test "accepts an allowlisted name and a dexpace/ path" do
     assert_empty(scan("allowed.rb"))
   end

From e0c1a4bd1a4a8412327fe48201e9c1e16c883b7d Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 16:34:22 +0300
Subject: [PATCH 08/15] test: make three surviving mutations red and guard the
 round-1 fixes

Phase 8a, review round 0. R0-1: the TRANSPORT-22 adaptation-failure fixture
declares Content-Length: 100, sends two bytes and holds the connection, so
only Adapter#dispatch's close can release it -- mutation H (the guard
removed) now fails the bounded await and strands the producer the test
base's thread count catches. R0-2: the two clamp assertions in
deadline_test.rb carry an explicit 0.0 delta, since Minitest's default
0.001 is MIN_TIMEOUT_SECONDS exactly and swallowed mutation N. R0-3: the
subscription test reads the Cancellation::Source's hook list, one longer
while the pump is open and back to its size after the close, the way
core's own cancellation suite observes a bounded registration; mutation E
(the detach removed) now fails. R0-8: the plain-http TLS test's comment
and name say what it proves -- a tls: hash is inert on a plaintext call --
and record mutation X as unobservable. R0-9: the origin-401 test configures
a credentialled proxy through the chain and lets the fixture play it: one
request carrying the preemptive Basic, a 401, and no second request.

Three guards for the code branch's round-1 lines: the sixteen-digit
Content-Length that ResponseMapper's bounded grammar maps to the sentinel
and RequestReader's frames as no body, each grammar's per-pattern timeout,
and a collector the host had disabled staying disabled after
Allocations.delta. Each was run red against its reverse mutation.
---
 .../dexpace/conformance/allocations_test.rb   | 13 +++++++++
 .../dexpace/conformance/wire_server_test.rb   | 22 ++++++++++++++
 .../transport/net_http/adapter_test.rb        | 12 ++++++--
 .../transport/net_http/deadline_test.rb       |  9 ++++--
 .../transport/net_http/proxy_route_test.rb    | 29 ++++++++++++++-----
 .../net_http/response_mapper_test.rb          | 23 +++++++++++++++
 .../transport/net_http/response_pump_test.rb  | 10 +++++++
 .../transport/net_http/tls_settings_test.rb   | 10 +++++--
 8 files changed, 111 insertions(+), 17 deletions(-)

diff --git a/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
index 57ff63b..2f4e7dd 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance/allocations_test.rb
@@ -51,4 +51,17 @@ class DexpaceConformanceAllocationsTest < DexpaceTestCase
     refute(::GC.disable, "GC.disable returns false when it was enabled, so the helper restored it")
     ::GC.enable
   end
+
+  # Published library code: a host that had the collector OFF around the call finds it off
+  # afterwards -- the helper restores the state it found, not the state it prefers (review round
+  # 0's R0-10; core's test-only copy re-enables unconditionally and may).
+  test "a collector the host had disabled stays disabled afterwards" do
+    ::GC.disable
+
+    Allocations.delta(iterations: 10) { nil }
+
+    assert(::GC.disable, "GC.disable answers true when it was already disabled")
+  ensure
+    ::GC.enable
+  end
 end
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
index c97cf4c..9501caf 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
@@ -85,6 +85,28 @@ class RecordingTest < DexpaceTestCase
       server.close
     end
 
+    # The reader's Content-Length grammar is core's spelling for a pattern a wire value reaches
+    # (PacingParsers, P6-61): a Regexp.new with its own timeout and a bounded run, the same bound
+    # the adapter's own ResponseMapper applies. A raw socket is the one way to send the sixteen
+    # digits Net::HTTP would refuse to frame.
+    test "the request reader's length grammar has a timeout and admits at most fifteen digits" do
+      grammar = WireServer.const_get(:RequestReader).const_get(:LENGTH)
+
+      refute_nil(grammar.timeout, "a literal carries no per-pattern timeout")
+      assert_in_delta(1.0, grammar.timeout, 0.0)
+      assert_match(grammar, "9" * 15)
+      refute_match(grammar, "9" * 16)
+      server = WireServer.start(Scripts.fixed("x"))
+      socket = ::TCPSocket.new("127.0.0.1", server.port)
+      socket.write("POST /long HTTP/1.1\r\nHost: h\r\nContent-Length: #{"9" * 16}\r\n\r\nab")
+      socket.close_write
+      socket.read
+      socket.close
+
+      assert_equal([""], server.requests.map(&:body), "an over-long length frames no body")
+      server.close
+    end
+
     test "records closed_connections apart from connections; #await_closed_connection waits" do
       server = WireServer.start(Scripts.fixed("x"))
 
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
index 0c35459..4fb7cb5 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -346,14 +346,20 @@ class WireTest < DexpaceTestCase
       assert_equal(1, server.await_closed_connection(timeout: 2))
     end
 
+    # The body is UNDRAINABLE -- a hundred bytes declared, two sent, the connection held -- so
+    # only the adapter's own close in Adapter#dispatch's rescue can release it: with that guard
+    # removed the producer stays blocked in read_body on the 98 bytes that never come, the server
+    # never sees the peer close, and the bound below elapses. A two-byte body drained itself and
+    # released the connection whether or not the guard existed (review round 0's mutation H).
     test "TRANSPORT-22: an adaptation failure after the head releases the connection and raises" do
       server = wire(lambda do |conn, _head|
-        conn.write("HTTP/1.0 200 OK\r\nContent-Length: 2\r\n\r\nok")
-        conn.read # holds the connection until the peer closes it
+        conn.write("HTTP/1.0 200 OK\r\nContent-Length: 100\r\n\r\nok")
+        conn.read # holds the connection, and the 98 undelivered bytes, until the peer closes it
       end)
 
       assert_raises(Dexpace::InvalidArgumentError) { settle(NetHTTP.build, request_for(server)) }
-      assert_equal(1, server.await_closed_connection(timeout: 2))
+      assert_equal(1, server.await_closed_connection(timeout: 2),
+                   "the guard's close is the only thing that can release this connection",)
     end
 
     test "a HEAD response carries no body and no producer thread stays behind" do
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
index e651837..ce9051b 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/deadline_test.rb
@@ -55,12 +55,15 @@ def advance(seconds)
   end
 
   # TRANSPORT-6: the antecedent is inverted on this adapter (zero means poll-once, not
-  # unbounded), and the clamp ships anyway, for adapters over coarser APIs.
+  # unbounded), and the clamp ships anyway, for adapters over coarser APIs. The deltas below are
+  # an explicit 0.0: Minitest's default delta is 0.001, which is MIN_TIMEOUT_SECONDS exactly, so
+  # the unclamped half-millisecond passed the assertion with the clamp deleted (review round 0's
+  # mutation N -- the same autocorrect hazard 6a's checklist records for its jitter assertions).
   test "#clamped raises a tiny positive remaining up to MIN_TIMEOUT_SECONDS" do
     clock = FakeClock.new(0.0)
     deadline = Deadline.build(clock: clock, budget: NetHTTP::MIN_TIMEOUT_SECONDS / 2)
 
-    assert_in_delta(NetHTTP::MIN_TIMEOUT_SECONDS, deadline.clamped)
+    assert_in_delta(NetHTTP::MIN_TIMEOUT_SECONDS, deadline.clamped, 0.0)
   end
 
   test "#clamped does not raise an already-expired remaining" do
@@ -75,7 +78,7 @@ def advance(seconds)
     clock = FakeClock.new(0.0)
     deadline = Deadline.build(clock: clock, budget: 10.0)
 
-    assert_in_delta(10.0, deadline.clamped)
+    assert_in_delta(10.0, deadline.clamped, 0.0)
   end
 
   test "the budget is measured against the clock's monotonic reading, never Time.now" do
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
index c4f51f9..f14898d 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
@@ -115,16 +115,29 @@ def logger_over(sink)
   end
 
   # TRANSPORT-30's second embedded MUST: "MUST NOT be answered to an origin-server (401)
-  # challenge." Structural: this adapter stamps no header in response to any status, because it
-  # never reads one.
-  test "an origin 401 draws no Proxy-Authorization out of the adapter" do
-    server = wire(Dexpace::Conformance::Scripts.vendor_status(401, "denied"))
-
-    response = settle(NetHTTP.build, request_for(server))
+  # challenge." With a credentialled proxy CONFIGURED through the chain -- the fixture plays the
+  # proxy, on the adapter suite's ProxyTest precedent -- the one request that reaches it carries
+  # the preemptive Basic the SHOULD's fallback stamps, and the 401 it answers draws no second
+  # request: this adapter stamps no header in response to any status, because it never reads one.
+  # With no proxy configured there was no credential to leak and the assertion held against any
+  # adapter (review round 0's R0-9); the target is TEST-NET-1 because find_proxy exempts loopback.
+  test "an origin 401 draws no second, Proxy-Authorization-bearing request out of the adapter" do
+    proxy = wire(Dexpace::Conformance::Scripts.vendor_status(401, "denied"))
+    target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/private",
+                                    headers: Dexpace::Headers::EMPTY, body: nil,)
+    Dexpace.configure do |builder|
+      builder.override(Keys::HTTP_PROXY, "http://u:pw@127.0.0.1:#{proxy.port}")
+    end
+
+    response = settle(NetHTTP.build, target)
 
     assert_equal(401, response.status.code)
-    assert_equal(1, server.requests.size, "no second, credential-carrying request")
-    assert_nil(server.requests.first.header("proxy-authorization"))
+    assert_equal(1, proxy.requests.size, "no second, credential-carrying request")
+    assert_equal("Basic #{["u:pw"].pack("m0")}", proxy.requests.first.header("proxy-authorization"),
+                 "the Basic fallback goes out preemptively, once, with the first request",)
+    assert_equal("GET http://192.0.2.1/private HTTP/1.1", proxy.requests.first.request_line)
     response.close
+  ensure
+    Dexpace.reset_config!
   end
 end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
index ea69e0a..72c9a4f 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
@@ -152,6 +152,29 @@ class BodyTest < DexpaceTestCase
       assert_equal([-1, -1, -1, 7], lengths)
     end
 
+    # The length grammar is core's spelling for a pattern a wire value reaches (PacingParsers,
+    # P6-61): a Regexp.new with its own timeout, never a literal, and a bounded digit run, so no
+    # header hands #to_i an unbounded string. Fifteen digits is exact; a sixteenth is the sentinel.
+    test "R4: the length grammar carries a per-pattern timeout and admits at most fifteen digits" do
+      grammar = ResponseMapper.const_get(:LENGTH)
+      fifteen = "9" * 15
+      sixteen = "9" * 16
+
+      refute_nil(grammar.timeout, "a literal carries no per-pattern timeout")
+      assert_in_delta(1.0, grammar.timeout, 0.0)
+      assert_predicate(grammar, :frozen?)
+      assert_equal(fifteen.to_i,
+                   build(ok("Content-Length" => fifteen), pump: pump_of("x")).body.content_length,)
+      native = ok("Content-Length" => sixteen)
+      response = build(native, pump: pump_of("x"))
+
+      assert_equal(-1, response.body.content_length)
+      assert_equal([sixteen], response.headers["Content-Length"],
+                   "the raw header still reaches the caller",)
+      assert_nil(native["Content-Length"],
+                 "deleted from the NATIVE response before read_body, as any refused value is",)
+    end
+
     test "TRANSPORT-27: a malformed Content-Type downgrades to nil rather than raising" do
       response = build(ok("Content-Type" => "not a/;;media type", "Content-Length" => "0"))
 
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
index b635ee3..641cb56 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
@@ -142,13 +142,23 @@ class TeardownTest < DexpaceTestCase
       assert_operator(elapsed { blocked.close }, :<, 1.0)
     end
 
+    # P8-52: the hook is registered on the SOURCE for the response's life and withdrawn by
+    # #release, observed the way core's own cancellation suite observes a bounded registration --
+    # the source's hook list, one longer while the pump is open and back to its size after the
+    # close. A retained hook was unobservable through the closed pump alone: it would only have
+    # closed an already-closed pump again (review round 0's mutation E).
     test "the cancellation subscription is detached when the pump is closed" do
       source = Dexpace::Cancellation.source
+      hooks = -> { source.instance_variable_get(:@hooks).size }
+      before = hooks.call
       pump = pump_for(wire(Scripts.fixed("ok")), cancellation: source.token)
+
+      assert_equal(before + 1, hooks.call, "the pump subscribed for the response's life")
       pump.head_or_raise
       drain(pump)
       pump.close
 
+      assert_equal(before, hooks.call, "#release withdrew the pump's one registration")
       source.cancel(:late) # nothing left to close; a retained hook would close a closed pump twice
 
       assert_predicate(pump, :closed?)
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
index ecbaa6a..36e99f0 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/tls_settings_test.rb
@@ -69,9 +69,13 @@ class DexpaceTransportNetHttpTLSSettingsTest < DexpaceTestCase
     assert_match(/bogus/, error.message)
   end
 
-  # The assertion is that a plain-http URL never reaches #apply at all: a bogus ca_file would
-  # have failed a handshake, and the plaintext call succeeds.
-  test "tls: is not applied to a plain-http request" do
+  # What this proves is only that a tls: hash is INERT on a plaintext call: a bogus ca_file and
+  # VERIFY_PEER are configured and the plain-http call still answers "ok". Whether #apply was
+  # reached is not observable from here -- assigning ca_file or verify_mode on a plain-http
+  # Net::HTTP changes nothing on the wire, because there is no handshake either way -- so the
+  # "applied only when the URL is https" branch in Adapter#owned_client_for rests on its source
+  # and on no behavioural assertion (review round 0's mutation X, recorded as unobservable).
+  test "a tls: hash is inert on a plain-http request" do
     server = wire(Dexpace::Conformance::Scripts.fixed("ok"))
     adapter = NetHTTP.build(tls: { ca_file: "/nonexistent/ca.pem",
                                    verify_mode: OpenSSL::SSL::VERIFY_PEER, })

From a31e1db45f1ed70f20f3a2c95d56c7677809b7b3 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 17:11:52 +0300
Subject: [PATCH 09/15] test: say which proxy-route test sets the process-wide
 configuration

Phase 8a, review round 1. The suite's header said every configuration is a
hermetic from_hash source; since round 1 the origin-401 test drives the
whole adapter through Dexpace.configure's override tier -- above the
environment -- and resets it in an ensure, and the header now says so.
---
 .../test/dexpace/transport/net_http/proxy_route_test.rb   | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
index f14898d..78524c9 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
@@ -7,9 +7,11 @@
 require "dexpace/transport/net_http"
 
 # TRANSPORT-30, including both of its embedded MUSTs, consuming CFG-22 to CFG-28 (8a's R17):
-# phase 5a's resolver meets its first consumer here. Every configuration is a hermetic
-# from_hash source, never the process environment, because Configuration::EMPTY reads the real
-# ENV. ProxyRoute is a private_constant, reached through const_get.
+# phase 5a's resolver meets its first consumer here. Every configuration handed to the route is a
+# hermetic from_hash source, never the process environment, because Configuration::EMPTY reads the
+# real ENV; the one test that drives the whole adapter sets the process-wide slot through
+# Dexpace.configure's override tier, which sits above the environment, and resets it in an ensure.
+# ProxyRoute is a private_constant, reached through const_get.
 class DexpaceTransportNetHttpProxyRouteTest < DexpaceTestCase
   include AdapterFixtures
 

From a723d5542b8b88e2c06f97e3d4939ec9e7fa7fdb Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 18:39:21 +0300
Subject: [PATCH 10/15] test: hermetic proxy keys and the pump built over a
 cancelled token

Review round 1's R1-1: the two tests that drive the whole adapter
through Dexpace.configure overrode HTTP_PROXY alone over
Configuration::EMPTY, whose environment tier is the real ENV, so a
host HTTPS_PROXY won the resolver's preference and a host NO_PROXY
covering the target bypassed the fixture. Both now override all three
keys the resolver reads, and the origin-401 test's comment gives the
real reason for its TEST-NET-1 target. Measured while fixing it: with
HTTPS_PROXY=http://127.0.0.1:9 exported, fifteen of the adapter
suite's thirty-four tests routed their loopback fixture through that
proxy, because every owning adapter resolves its proxy through the
process-wide configuration. NetHTTPHermeticProxy blanks the three
keys through the override tier around every test that includes
AdapterFixtures and around the conformance driver, never touching
ENV, and the two Net::HTTP :ENV controls clear no_proxy for the
library's own find_proxy. The gem's suite is green under
HTTPS_PROXY=http://127.0.0.1:9 NO_PROXY=192.0.2.1 and under a clean
environment alike.

R1-2: two tests in a fourth nested class of the pump suite build a
pump over an already-cancelled source, against a fixture that holds
before headers: the pump comes back closed, its first read is the
cancellation, no connection reached the fixture and, on the borrowing
construction, the permit is back exactly once. Both are red against
the unfixed pump (NoMethodError on nil.detach plus a leaked producer)
and against the nil-safe release alone (one connection, a producer
outliving the join, the permit held). The bounded-join source scan
admits the nil-safe spelling and still refuses an unbounded join.
---
 .../transport/net_http/adapter_test.rb        | 12 ++++-
 .../transport/net_http/conformance_test.rb    |  5 +-
 .../transport/net_http/matrix_facts_test.rb   | 10 +++-
 .../transport/net_http/proxy_route_test.rb    | 15 ++++--
 .../transport/net_http/response_pump_test.rb  | 53 +++++++++++++++++--
 .../test/support/adapter_fixtures.rb          |  5 ++
 .../test/support/net_http_hermetic_proxy.rb   | 35 ++++++++++++
 7 files changed, 123 insertions(+), 12 deletions(-)
 create mode 100644 gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb

diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
index 4fb7cb5..f24c55a 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -437,12 +437,15 @@ class ProxyTest < DexpaceTestCase
     # keys, so a lower-case `http_proxy` naming the fixture is exactly what the old shape would
     # have honoured behind the SDK's back. The target is TEST-NET-1: unroutable, never loopback
     # (which find_proxy exempts), so the call times out against it instead of reaching the fixture.
+    # A host's own no_proxy is cleared for the control, which find_proxy honours in either case.
     test "R17: with http_proxy in the environment the per-call client still does not proxy" do
       server = wire(Scripts.fixed("via proxy"))
       target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/",
                                       headers: Dexpace::Headers::EMPTY, body: nil,)
       would_have = nil
-      error = with_env("http_proxy" => "http://user:pw@127.0.0.1:#{server.port}") do
+      swapped = { "http_proxy" => "http://user:pw@127.0.0.1:#{server.port}",
+                  "no_proxy" => nil, "NO_PROXY" => nil, }
+      error = with_env(swapped) do
         would_have = ::Net::HTTP.new("192.0.2.1", 80).proxy?
         assert_raises(Dexpace::TransportError) { settle(NetHTTP.build(timeout: 0.3), target) }
       end
@@ -453,13 +456,18 @@ class ProxyTest < DexpaceTestCase
     end
 
     # TRANSPORT-30: the proxy the SDK resolved IS used -- the fixture plays the proxy and sees
-    # the absolute-form request line a proxy is sent.
+    # the absolute-form request line a proxy is sent. The chain is Configuration::EMPTY, whose
+    # environment tier is the real ENV, so every key the resolver reads is overridden: the
+    # resolver prefers HTTPS_PROXY over HTTP_PROXY and a host's NO_PROXY could cover the target,
+    # and a blank override is an answer that masks the environment (review round 1's R1-1).
     test "TRANSPORT-30: a proxy resolved through the configuration chain carries the call" do
       server = wire(Scripts.fixed("via proxy"))
       target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/x?y=1",
                                       headers: Dexpace::Headers::EMPTY, body: nil,)
       Dexpace.configure do |builder|
         builder.override(Dexpace::Configuration::Keys::HTTP_PROXY, "http://127.0.0.1:#{server.port}")
+        builder.override(Dexpace::Configuration::Keys::HTTPS_PROXY, "")
+        builder.override(Dexpace::Configuration::Keys::NO_PROXY, "")
       end
 
       response = settle(NetHTTP.build, target)
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
index 064ca4a..716cfff 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MIT
 
 require_relative "../../../test_helper"
+require_relative "../../../support/net_http_hermetic_proxy"
 require "dexpace/transport/net_http"
 require "dexpace/conformance"
 
@@ -11,8 +12,10 @@
 # zero-copy clause has no assertion to suppress. TRANSPORT-18 reports vacuous (a skip in
 # Minitest's vocabulary): with max_retries = 0 no native re-subscription exists to measure.
 # The class inherits DexpaceTestCase so a fixture thread an assertion leaked fails the test that
-# leaked it.
+# leaked it, and includes NetHTTPHermeticProxy so the adapter every assertion builds resolves no
+# proxy from the host's environment.
 class DexpaceTransportNetHttpConformanceTest < DexpaceTestCase
+  include NetHTTPHermeticProxy
   extend Dexpace::Conformance::MinitestDriver
 
   NetHTTP = Dexpace::Transport::NetHTTP
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
index 407b80a..2d78678 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/matrix_facts_test.rb
@@ -97,10 +97,16 @@ def net_http_version
     assert_kind_of(FiberError, error)
   end
 
+  # URI#find_proxy, which :ENV consults, also honours a no_proxy in either case, so a host's
+  # own no_proxy covering TEST-NET-1 is cleared for the control, or it would read as "does not
+  # proxy" for the library's reason rather than the adapter's (review round 1's R1-1).
   test "R17 fact: Net::HTTP.new's p_addr defaults to :ENV and reads a lower-case http_proxy for " \
        "a non-loopback target" do
-    saved = ENV.fetch("http_proxy", nil)
+    names = %w[http_proxy no_proxy NO_PROXY]
+    saved = names.to_h { |name| [name, ENV.fetch(name, nil)] }
     ENV["http_proxy"] = "http://user:pw@127.0.0.1:3128"
+    ENV.delete("no_proxy")
+    ENV.delete("NO_PROXY")
 
     default = ::Net::HTTP.new("192.0.2.1", 80)
     explicit = ::Net::HTTP.new("192.0.2.1", 80, nil, nil, nil, nil)
@@ -109,7 +115,7 @@ def net_http_version
     assert_equal("127.0.0.1", default.proxy_address)
     refute_predicate(explicit, :proxy?)
   ensure
-    ENV["http_proxy"] = saved
+    saved.each { |name, value| ENV[name] = value }
   end
 
   test "version-bound fact: Socket::ResolutionError exists from 3.3, and SocketError covers it " \
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
index 78524c9..86d481a 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/proxy_route_test.rb
@@ -10,8 +10,12 @@
 # phase 5a's resolver meets its first consumer here. Every configuration handed to the route is a
 # hermetic from_hash source, never the process environment, because Configuration::EMPTY reads the
 # real ENV; the one test that drives the whole adapter sets the process-wide slot through
-# Dexpace.configure's override tier, which sits above the environment, and resets it in an ensure.
-# ProxyRoute is a private_constant, reached through const_get.
+# Dexpace.configure's override tier, which sits above the environment, overriding EVERY key the
+# resolver reads -- HTTP_PROXY with the fixture, HTTPS_PROXY and NO_PROXY blank, because the
+# resolver prefers HTTPS_PROXY and a host's NO_PROXY could cover the target (review round 1's
+# R1-1: a blank override is an answer to Configuration#string and absent for the preference, so
+# nothing falls through to ENV) -- and resets it in an ensure. ProxyRoute is a private_constant,
+# reached through const_get.
 class DexpaceTransportNetHttpProxyRouteTest < DexpaceTestCase
   include AdapterFixtures
 
@@ -122,13 +126,18 @@ def logger_over(sink)
   # the preemptive Basic the SHOULD's fallback stamps, and the 401 it answers draws no second
   # request: this adapter stamps no header in response to any status, because it never reads one.
   # With no proxy configured there was no credential to leak and the assertion held against any
-  # adapter (review round 0's R0-9); the target is TEST-NET-1 because find_proxy exempts loopback.
+  # adapter (review round 0's R0-9). The target is TEST-NET-1 so that the absolute-form request
+  # line names a host that is plainly not the fixture; with the proxy explicit, loopback would
+  # be proxied too (`Net::HTTP.new(h, p, "127.0.0.1", 3128).proxy?` is true), so the reason the
+  # adapter suite's R17 test has for the same address does not apply here.
   test "an origin 401 draws no second, Proxy-Authorization-bearing request out of the adapter" do
     proxy = wire(Dexpace::Conformance::Scripts.vendor_status(401, "denied"))
     target = Dexpace::Request.build(method: "GET", url: "http://192.0.2.1/private",
                                     headers: Dexpace::Headers::EMPTY, body: nil,)
     Dexpace.configure do |builder|
       builder.override(Keys::HTTP_PROXY, "http://u:pw@127.0.0.1:#{proxy.port}")
+      builder.override(Keys::HTTPS_PROXY, "") # blank: absent for the preference, masks ENV's
+      builder.override(Keys::NO_PROXY, "")    # blank: no bypass pattern, masks ENV's
     end
 
     response = settle(NetHTTP.build, target)
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
index 641cb56..8680ece 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
@@ -10,8 +10,9 @@
 # 13: never a second fixture hand-rolled beside it), reached through the root Gemfile's path
 # loading and never through this gem's gemspec. No test sleeps to synchronise: every wait is a
 # queue pop, a bounded join or the dribble script's own deliberate delay, which is the thing
-# under test. ResponsePump is a private_constant, reached through const_get. Three nested
-# classes under Metrics/ClassLength (6c's shape): delivery, teardown, and the carried failures.
+# under test. ResponsePump is a private_constant, reached through const_get. Four nested
+# classes under Metrics/ClassLength (6c's shape): delivery, teardown, the carried failures, and
+# a token already cancelled at construction.
 module DexpaceTransportNetHttpResponsePumpTest
   NetHTTP = Dexpace::Transport::NetHTTP
   ResponsePump = NetHTTP.const_get(:ResponsePump)
@@ -172,8 +173,8 @@ class TeardownTest < DexpaceTestCase
                               __dir__,)
       source = File.read(path)
 
-      assert_match(/@thread\.join\(JOIN_DEADLINE_SECONDS\)/, source)
-      refute_match(/@thread\.join\b(?!\(JOIN_DEADLINE_SECONDS\))/, source)
+      assert_match(/@thread&\.join\(JOIN_DEADLINE_SECONDS\)/, source)
+      refute_match(/@thread&?\.join\b(?!\(JOIN_DEADLINE_SECONDS\))/, source)
     end
 
     # P8-15: the borrowing construction. The pump must neither start nor finish a client it does
@@ -309,4 +310,48 @@ def truncated_chunked
       pump.close
     end
   end
+
+  # Review round 1, P8-64: Cancellation::Source runs an already-cancelled hook inline, so the
+  # pump's own subscription can close it from inside its constructor.
+  class AlreadyCancelledTest < DexpaceTestCase
+    include Pumping
+
+    # A pump built over a cancelled token comes back closed, opened no connection, holds no
+    # producer thread (the test base counts threads around every test), and classifies its
+    # first read as the cancellation it was. The fixture holds before headers so that a producer
+    # which DID start would be caught twice over: one connection recorded, and a join spent on
+    # the hold that outlives the constructor.
+    test "a token already cancelled at construction yields a closed pump that sent nothing" do
+      server = wire(Scripts.hang_before_headers)
+      source = Dexpace::Cancellation.source
+      source.cancel(:already)
+
+      pump = pump_for(server, cancellation: source.token)
+
+      assert_predicate(pump, :closed?, "the inline hook closed the pump before #new returned")
+      error = assert_raises(Dexpace::CancelledError) { pump.head_or_raise }
+
+      assert_equal(:already, error.reason)
+      assert_equal(0, server.connections, "a pump closed at construction exchanges nothing")
+      pump.close
+    end
+
+    # The same over the borrowing construction: the permit the exchange would have returned
+    # from the producer's ensure comes back from the constructor instead, exactly once, so the
+    # next borrowed call is not held for a producer that never existed.
+    test "a token already cancelled at construction hands the borrowed permit straight back" do
+      server = wire(Scripts.hang_before_headers)
+      source = Dexpace::Cancellation.source
+      source.cancel(:already)
+      permit = ::Thread::SizedQueue.new(1)
+
+      pump = pump_for(server, cancellation: source.token, owns_connection: false, permit: permit)
+
+      assert_predicate(pump, :closed?)
+      assert_equal(1, permit.size, "the permit is back, once")
+      assert_raises(Dexpace::CancelledError) { pump.readpartial(16) }
+      assert_equal(0, server.connections)
+      pump.close
+    end
+  end
 end
diff --git a/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
index 02a6ec2..c7ef0a1 100644
--- a/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
+++ b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
@@ -4,12 +4,17 @@
 require "zlib"
 require "stringio"
 require "dexpace/conformance"
+require_relative "net_http_hermetic_proxy"
 
 # The helpers the adapter's own suites share: a tracked WireServer per test, closed in teardown
 # so nothing leaks past DexpaceTestCase's thread count; a request against that server; the one
 # send primitive; and the scripts, clients and environment swaps the exchange tests need. The
 # fixture is dexpace-conformance's own WireServer (design boundary 13), never a second one.
+# Every including suite also runs under NetHTTPHermeticProxy, so a host's proxy variables never
+# reach an owning adapter built here.
 module AdapterFixtures
+  include NetHTTPHermeticProxy
+
   def teardown
     @servers&.each(&:close)
     super
diff --git a/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb b/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb
new file mode 100644
index 0000000..80246fb
--- /dev/null
+++ b/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+# SPDX-License-Identifier: MIT
+
+require "dexpace"
+
+# An owning adapter resolves its proxy through Dexpace.configuration, whose environment tier is
+# the real ENV (CFG-1, CFG-24): on a host that exports HTTPS_PROXY every NetHTTP.build in these
+# suites would route its loopback fixture through that proxy, and a NO_PROXY covering a target
+# would bypass a fixture that plays the proxy -- review round 1's R1-1, measured at fifteen of
+# the adapter suite's thirty-four tests under HTTPS_PROXY=http://127.0.0.1:9. The three keys the
+# resolver reads are overridden blank for every test: the override tier sits above the
+# environment, and a blank is an answer to Configuration#string that the resolver treats as
+# absent (a blank HTTPS_PROXY does not mask HTTP_PROXY, a blank NO_PROXY is no pattern), so
+# nothing falls through to ENV and ENV itself is never touched. Dexpace.configure composes over
+# the current configuration, so a test that configures a proxy of its own keeps these blanks
+# beneath it; every test ends on Configuration::EMPTY. Included by AdapterFixtures and by the
+# suites that build an owning adapter without it. Named for its gem: test:gems loads every
+# gem's suite into one process.
+module NetHTTPHermeticProxy
+  PROXY_KEYS = [
+    Dexpace::Configuration::Keys::HTTP_PROXY,
+    Dexpace::Configuration::Keys::HTTPS_PROXY,
+    Dexpace::Configuration::Keys::NO_PROXY,
+  ].freeze
+
+  def setup
+    super
+    Dexpace.configure { |builder| PROXY_KEYS.each { |key| builder.override(key, "") } }
+  end
+
+  def teardown
+    Dexpace.reset_config!
+    super
+  end
+end

From e21b4e4d8c7549edd396ff922b6f28457b94ba77 Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 18:45:15 +0300
Subject: [PATCH 11/15] test: keep the adapter's token check discriminable from
 the pump's

With the pump refusing a cancelled token on its own (P8-64), the
adapter suite's "already-cancelled token is refused before anything
reaches the wire" case no longer told Adapter#perform's
cancellation.check! from the pump's: removing the check left the same
CancelledError and the same zero connections. P8-52's claim is that
the check runs before anything is MAPPED, so the case now sends a
request carrying a managed header through an adapter with a recording
sink and asserts that no TRANSPORT_HEADER_DROPPED event was logged.
Mutation B is red again: the Expect drop is logged when the check is
gone.
---
 .../dexpace/transport/net_http/adapter_test.rb  | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
index f24c55a..4e06af3 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -3,6 +3,7 @@
 
 require_relative "../../../test_helper"
 require_relative "../../../support/adapter_fixtures"
+require_relative "../../../support/net_http_recording_sink"
 require "dexpace/transport/net_http"
 
 # TRANSPORT-1 to 6, 15, 16, 20, 22, 29, 30 and the constructions (P8-6, P8-10, P8-15). The
@@ -417,15 +418,27 @@ class CancellationTest < DexpaceTestCase
       assert_equal(:early, error.reason)
     end
 
-    test "an already-cancelled token is refused before anything reaches the wire" do
+    # P8-52: `cancellation.check!` runs before anything is MAPPED, not only before the socket --
+    # since review round 2 the pump refuses a cancelled token on its own (P8-64), so the socket
+    # count alone would no longer tell the adapter's check from the pump's. A managed header the
+    # mapper would drop and log at VERBOSE is the observable: a refused call maps nothing, so the
+    # sink sees nothing.
+    test "an already-cancelled token is refused before anything is mapped or reaches the wire" do
       server = wire(Scripts.fixed("ok"))
       source = Dexpace::Cancellation.source
       source.cancel(:gone)
+      sink = NetHTTPRecordingSink.new
+      adapter = NetHTTP.build(logger: Dexpace::Instrumentation::Logger.build(sink: sink))
+      managed = Dexpace::Headers.builder.add("Expect", "100-continue").build
+      request = Dexpace::Request.build(method: "GET", url: "http://127.0.0.1:#{server.port}/",
+                                       headers: managed, body: nil,)
 
       assert_raises(Dexpace::CancelledError) do
-        NetHTTP.build.call(request_for(server), Dexpace::RequestOptions::EMPTY, source.token)
+        adapter.call(request, Dexpace::RequestOptions::EMPTY, source.token)
       end
       assert_equal(0, server.connections)
+      assert_empty(sink.events(Dexpace::Instrumentation::Events::TRANSPORT_HEADER_DROPPED),
+                   "the request was never mapped: no managed-header drop was logged",)
     end
   end
 

From 54136caaa8954b1b6c015a65b8a5c7ff535ae09a Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 21:08:44 +0300
Subject: [PATCH 12/15] test: every raw fixture client takes an explicit nil
 proxy (R2-1)

Review round 2 measured that under an upper-case HTTP_PROXY with no
lower-case http_proxy, every raw Net::HTTP the suites start through
Net::HTTP.new's :ENV default hit uri's "HTTP_PROXY is discouraged"
warning, which the test base makes fatal: 3 failures and 17 errors in
the adapter gem and 6 and 14 in the conformance gem once the warm-up
alone was fixed. Pass the four proxy positionals as nil, exactly as
the adapter's ProxyRoute does, in AdapterFixtures#client_for, the
conformance driver's borrow factory, and the Net::HTTP.start calls in
wire_server_test.rb and scripts_test.rb. The two R17 controls keep
:ENV on purpose and set the lower-case name themselves.

Two guards make the property host-independent: adapter_test.rb's
ProxyTest drives a client_for client through the borrowed adapter with
HTTP_PROXY exported and http_proxy cleared, and wire_server_test.rb's
new PlainClientTest does the same through Fetch#get. A fixture reverted
to :ENV turns each red with the warning itself, whatever the host's
environment says.
---
 .../test/dexpace/conformance/scripts_test.rb  | 10 +++---
 .../dexpace/conformance/wire_server_test.rb   | 36 +++++++++++++++----
 .../transport/net_http/adapter_test.rb        | 18 ++++++++++
 .../transport/net_http/conformance_test.rb    |  5 +--
 .../test/support/adapter_fixtures.rb          |  6 +++-
 5 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
index 1e74d61..4bb3e5d 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance/scripts_test.rb
@@ -14,11 +14,13 @@ module DexpaceConformanceScriptsTest
   WireServer = Dexpace::Conformance::WireServer
   Scripts = Dexpace::Conformance::Scripts
 
-  # One GET through a plain client, with no transparent decompression.
+  # One GET through a plain client, with no transparent decompression, and an explicit nil proxy:
+  # Net::HTTP's `:ENV` default reaches URI#find_proxy, whose upper-case-HTTP_PROXY warning the
+  # test base makes fatal (R2-1).
   module Fetch
     def fetch(script, path: "/", &block)
       WireServer.start(script) do |server|
-        ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+        ::Net::HTTP.start("127.0.0.1", server.port, nil, nil, nil, nil) do |c|
           c.max_retries = 0
           c.read_timeout = 5
           req = ::Net::HTTP::Get.new(path)
@@ -29,7 +31,7 @@ def fetch(script, path: "/", &block)
     end
 
     def get(server, path = "/")
-      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+      ::Net::HTTP.start("127.0.0.1", server.port, nil, nil, nil, nil) do |c|
         c.max_retries = 0
         c.request(::Net::HTTP::Get.new(path))
       end
@@ -128,7 +130,7 @@ class WaitsTest < DexpaceTestCase
     def timing_out(script, read_timeout: 0.2)
       WireServer.start(script) do |server|
         assert_raises(::Net::ReadTimeout) do
-          ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+          ::Net::HTTP.start("127.0.0.1", server.port, nil, nil, nil, nil) do |c|
             c.max_retries = 0
             c.read_timeout = read_timeout
             c.request(::Net::HTTP::Get.new("/before"))
diff --git a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
index 9501caf..b469349 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
@@ -9,16 +9,17 @@
 # #connections is never order-dependent across tests (testing/4ef070df). Every wait is a blocking
 # Queue#pop or a bounded join, never a sleep-poll; and #close closes every accepted socket and joins
 # every handler thread, so a test that started a server leaks nothing DexpaceTestCase's teardown
-# counts. Two nested classes under Metrics/ClassLength (6c's shape): what the server records, and
-# how it closes.
+# counts. Three nested classes under Metrics/ClassLength (6c's shape): what the server records,
+# how it closes, and the plain client the suites drive it with.
 module DexpaceConformanceWireServerTest
   WireServer = Dexpace::Conformance::WireServer
   Scripts = Dexpace::Conformance::Scripts
 
-  # One GET through a plain client.
+  # One GET through a plain client, built with an explicit nil proxy: Net::HTTP's `:ENV` default
+  # reaches URI#find_proxy, whose upper-case-HTTP_PROXY warning the test base makes fatal (R2-1).
   module Fetch
     def get(port, path = "/")
-      ::Net::HTTP.start("127.0.0.1", port) do |c|
+      ::Net::HTTP.start("127.0.0.1", port, nil, nil, nil, nil) do |c|
         c.max_retries = 0
         c.request(::Net::HTTP::Get.new(path))
       end
@@ -56,14 +57,14 @@ class RecordingTest < DexpaceTestCase
 
     test "records a Content-Length request body and a chunked one, so an upload is observable" do
       server = WireServer.start(Scripts.fixed("x"))
-      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+      ::Net::HTTP.start("127.0.0.1", server.port, nil, nil, nil, nil) do |c|
         c.max_retries = 0
         fixed = ::Net::HTTP::Post.new("/fixed")
         fixed["Content-Type"] = "application/octet-stream"
         fixed.body = "caf\xE9".b
         c.request(fixed)
       end
-      ::Net::HTTP.start("127.0.0.1", server.port) do |c|
+      ::Net::HTTP.start("127.0.0.1", server.port, nil, nil, nil, nil) do |c|
         c.max_retries = 0
         chunked = ::Net::HTTP::Post.new("/chunked")
         chunked["Content-Type"] = "application/octet-stream"
@@ -203,4 +204,27 @@ class ClosingTest < DexpaceTestCase
       assert_nil(waiter.value)
     end
   end
+
+  # The plain client every suite of this gem drives the server with.
+  class PlainClientTest < DexpaceTestCase
+    include Fetch
+
+    # R2-1: Fetch#get passes an explicit nil proxy, so an upper-case HTTP_PROXY on the host is
+    # inert; with Net::HTTP's `:ENV` default, URI#find_proxy would warn about that spelling before
+    # its loopback exemption, and DexpaceTestCase makes the warning fatal. The lower-case name is
+    # cleared because find_proxy prefers it and warns only in its absence.
+    test "R2-1: the plain client is inert to an upper-case HTTP_PROXY and reaches the server" do
+      server = WireServer.start(Scripts.fixed("direct"))
+      saved = { "HTTP_PROXY" => ENV.fetch("HTTP_PROXY", nil),
+                "http_proxy" => ENV.fetch("http_proxy", nil), }
+      ENV["HTTP_PROXY"] = "http://127.0.0.1:9"
+      ENV["http_proxy"] = nil
+
+      assert_equal("direct", get(server.port).body)
+      assert_equal(1, server.connections)
+    ensure
+      saved&.each { |name, value| ENV[name] = value }
+      server&.close
+    end
+  end
 end
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
index 4e06af3..a531f78 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -468,6 +468,24 @@ class ProxyTest < DexpaceTestCase
       assert_equal(0, server.connections, "nothing reached the environment's proxy")
     end
 
+    # R2-1: the fixture client (AdapterFixtures#client_for) passes an explicit nil proxy, so an
+    # UPPER-CASE HTTP_PROXY on the host is inert. Net::HTTP's `:ENV` default would reach
+    # URI#find_proxy on `#start`, which warns about that spelling BEFORE its loopback exemption,
+    # and the test base makes the warning fatal -- the R17 control above sets the lower-case
+    # name, which find_proxy accepts silently; this one sets the upper-case name alone, the
+    # spelling review round 2 found aborting both gems' suites. Through the borrowed adapter,
+    # which is how every other test starts this client.
+    test "R2-1: a fixture client is inert to an upper-case HTTP_PROXY and reaches the fixture" do
+      server = wire(Scripts.fixed("direct"))
+      swapped = { "HTTP_PROXY" => "http://127.0.0.1:9", "http_proxy" => nil }
+      body = with_env(swapped) do
+        settle(NetHTTP.using(client_for(server.port)), request_for(server)).body_string
+      end
+
+      assert_equal("direct", body)
+      assert_equal(1, server.connections)
+    end
+
     # TRANSPORT-30: the proxy the SDK resolved IS used -- the fixture plays the proxy and sees
     # the absolute-form request line a proxy is sent. The chain is Configuration::EMPTY, whose
     # environment tier is the real ENV, so every key the resolver reads is overridden: the
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
index 716cfff..a46f6d1 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/conformance_test.rb
@@ -28,9 +28,10 @@ class DexpaceTransportNetHttpConformanceTest < DexpaceTestCase
     # port because a borrowing transport refuses any other origin (P8-15), and max_retries is set
     # by the CALLER, never by `.using`, which refuses a client that lacks it (P8-10). The probe is
     # a real round trip through the client itself: the only thing that proves the transport's
-    # close did not touch it.
+    # close did not touch it. The explicit nil proxy keeps the client off Net::HTTP's `:ENV`
+    # default, whose HTTP_PROXY warning the test base makes fatal (R2-1).
     borrow: lambda do |port|
-      client = ::Net::HTTP.new("127.0.0.1", port)
+      client = ::Net::HTTP.new("127.0.0.1", port, nil, nil, nil, nil)
       client.max_retries = 0
       Dexpace::Conformance::BorrowedPair.build(
         transport: NetHTTP.using(client),
diff --git a/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
index c7ef0a1..43b5930 100644
--- a/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
+++ b/gems/dexpace-transport-net_http/test/support/adapter_fixtures.rb
@@ -26,8 +26,12 @@ def wire(script)
     server
   end
 
+  # An explicit nil proxy, as the adapter's own ProxyRoute passes: Net::HTTP.new's `:ENV`
+  # default reaches URI#find_proxy on `#start`, whose upper-case-HTTP_PROXY warning the test
+  # base makes fatal (R2-1; test/support/net_http_warmup.rb has the mechanism). The two R17
+  # controls that want `:ENV` build their own client and set http_proxy themselves.
   def client_for(port)
-    client = ::Net::HTTP.new("127.0.0.1", port)
+    client = ::Net::HTTP.new("127.0.0.1", port, nil, nil, nil, nil)
     client.max_retries = 0
     client
   end

From ed71b2b2f5a669059229b0c456e7bf3c6ffd03cf Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 21:13:38 +0300
Subject: [PATCH 13/15] test: say which half of the proxy hermeticity the
 module covers

NetHTTPHermeticProxy blanks the SDK's three configuration keys and
nothing else; the library's own :ENV default is the other reader of the
environment, and the fixtures keep off it by passing an explicit nil
proxy. The module's comment now names both halves, the uri warning that
makes the second one necessary, the fixture sites that honour it, and
the two guards that hold it on any host (review round 2's R2-1).
---
 .../test/support/net_http_hermetic_proxy.rb         | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb b/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb
index 80246fb..8c5694d 100644
--- a/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb
+++ b/gems/dexpace-transport-net_http/test/support/net_http_hermetic_proxy.rb
@@ -16,6 +16,19 @@
 # beneath it; every test ends on Configuration::EMPTY. Included by AdapterFixtures and by the
 # suites that build an owning adapter without it. Named for its gem: test:gems loads every
 # gem's suite into one process.
+#
+# This module covers the SDK's own chain and nothing else. The library has a second reader of
+# the environment, Net::HTTP.new's `:ENV` default, which consults URI#find_proxy on `#start`
+# and warns "The environment variable HTTP_PROXY is discouraged" for the upper-case name with no
+# lower-case one -- before its loopback exemption, before NO_PROXY, on every row's uri -- and
+# the test base makes that warning fatal (review round 2's R2-1). So no fixture in this
+# repository ever reaches that default: every raw Net::HTTP a suite starts passes an explicit
+# nil proxy (AdapterFixtures#client_for, the conformance driver's borrow factory, the plain
+# clients in dexpace-conformance's suites, test/support/net_http_warmup.rb), and the two R17
+# controls that reach `:ENV` on purpose set the lower-case name themselves. Together the two
+# arrangements make both gems' suites hermetic under HTTP_PROXY, http_proxy, HTTPS_PROXY and
+# NO_PROXY alike; adapter_test.rb's "R2-1" case and wire_server_test.rb's PlainClientTest guard
+# the fixture half on any host.
 module NetHTTPHermeticProxy
   PROXY_KEYS = [
     Dexpace::Configuration::Keys::HTTP_PROXY,

From a36a9d2bef06192f7d9cf25ea44bcb5b50857b8f Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Sun, 20 Sep 2026 23:02:24 +0300
Subject: [PATCH 14/15] test: guard the chunked length, the closed-pump read
 and the handler join

Review round 3's R3-1, R3-2 and R3-3, on the tests layer.

R3-1: response_mapper_test.rb's BodyTest gains a case over a native
head carrying both Transfer-Encoding: chunked and a Content-Length of 5,
asserting the -1 sentinel, the raw header in the caller's Headers and
the whole ten-byte body through #body_string; a coding LIST ("gzip,
chunked") answers -1 too, because the predicate is net-http's own
#chunked?. adapter_test.rb's WireTest drives the same head through the
real adapter against WireServer in both directions -- a short header
through #each, which truncated to "01234", and a long one through
#to_replayable, which raised StreamError.short_transfer -- and asserts
the whole body from each. With the code fix reverted the unit case
fails on the sentinel and the wire case errors with the StreamError.

R3-2: response_pump_test.rb's TeardownTest gains the two cases the
closed-pump guard at the top of #readpartial lacked: a one-byte read
leaves residue in the pump, then a close (resp. a cancel through the
token) and the next one-byte read raises ClosedError (resp.
CancelledError with the reason) instead of serving the residue. Every
earlier test drained with a large maxlen or through #body_string, where
the residue is empty and #fill's own check fires; with the #readpartial
guard removed both new cases fail with "nothing was raised".

R3-3: wire_server_test.rb's "promptly" test takes its thread baseline
BEFORE WireServer.start and asserts the count is back to it after
#close (both threads gone, not merely one), with the two-threads-alive
count asserted before the close; and a source-scan case, the shape the
pump's JOIN_DEADLINE test uses, asserts the accept-thread join, the
per-handler join and that no join in the fixture is unbounded -- on MRI
IO#close on the accepted socket usually lets the handler finish before
#close returns, so the count alone tells the join from its absence only
when the handler loses that race (three of five runs here); the scan
tells them apart every time.
---
 .../dexpace/conformance/wire_server_test.rb   | 27 ++++++++++++++---
 .../transport/net_http/adapter_test.rb        | 28 +++++++++++++++++
 .../net_http/response_mapper_test.rb          | 21 +++++++++++++
 .../transport/net_http/response_pump_test.rb  | 30 +++++++++++++++++++
 4 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
index b469349..9e1aebc 100644
--- a/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
+++ b/gems/dexpace-conformance/test/dexpace/conformance/wire_server_test.rb
@@ -172,8 +172,11 @@ class ClosingTest < DexpaceTestCase
 
     # The teardown property every test in every suite relies on: a handler blocked on a socket --
     # hang_after_headers never answers -- is woken by #close closing the accepted socket, so the
-    # thread ends and the test's own thread count is unchanged (DexpaceTestCase#teardown).
+    # thread ends and the test's own thread count is unchanged (DexpaceTestCase#teardown). The
+    # baseline is taken BEFORE the server starts, so the count after #close says both of its
+    # threads are gone and not merely that one is (review round 3's R3-3).
     test "#close wakes a handler blocked on its socket and joins it, promptly" do
+      baseline = ::Thread.list.size
       entered = ::Thread::Queue.new
       server = WireServer.start(Scripts.hang_after_headers(on_headers_written: lambda {
         entered.push(true)
@@ -181,19 +184,35 @@ class ClosingTest < DexpaceTestCase
       client = ::TCPSocket.new("127.0.0.1", server.port)
       client.write("GET / HTTP/1.1\r\nHost: x\r\n\r\n")
       entered.pop
-      threads_before_close = ::Thread.list.size
 
+      assert_equal(baseline + 2, ::Thread.list.size, "the accept thread and one handler are alive")
       t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       server.close
       elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0
       client.close
 
       assert_operator(elapsed, :<, 1.0)
-      assert_operator(::Thread.list.size, :<, threads_before_close,
-                      "the accept and handler threads ended",)
+      assert_equal(baseline, ::Thread.list.size, "the accept AND the handler thread ended")
       assert_equal(1, server.closed_connections)
     end
 
+    # XCUT-13: both joins in #close are bounded by JOIN_DEADLINE_SECONDS, asserted over the
+    # source as the pump's own join is (net_http/response_pump_test.rb), because the one handler
+    # that can outlive the deadline -- a script that survives its socket's close and blocks on
+    # something else -- would cost the suite the whole deadline to observe. The handler join's
+    # PRESENCE is asserted the same way: on MRI, `IO#close` on the accepted socket waits for the
+    # reader to leave its syscall and the handler finishes before #close returns, so no thread
+    # count taken after #close can tell the join from its absence (review round 3's R3-3).
+    test "#close joins the accept thread and every handler, bounded by JOIN_DEADLINE_SECONDS" do
+      path = File.expand_path("../../../lib/dexpace/conformance/wire_server.rb", __dir__)
+      source = File.read(path)
+
+      assert_match(/@accept_thread\.join\(JOIN_DEADLINE_SECONDS\)/, source)
+      assert_match(/handlers\.each \{ \|handler\| handler\.join\(JOIN_DEADLINE_SECONDS\) \}/,
+                   source,)
+      refute_match(/\.join\b(?!\(JOIN_DEADLINE_SECONDS\))/, source, "every join is bounded")
+    end
+
     test "a waiter that outlives the server gets nil from #await_closed_connection, not a hang" do
       server = WireServer.start(Scripts.fixed("x"))
       waiter = ::Thread.new { server.await_closed_connection }
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
index a531f78..6b49409 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/adapter_test.rb
@@ -337,6 +337,34 @@ class WireTest < DexpaceTestCase
       assert_equal(Encoding::BINARY, bytes.encoding)
     end
 
+    # Review round 3's R3-1: net-http reads this response under the chunked framing, so the
+    # Content-Length beside it is never the body's length; taken as one, #each, #write_to and
+    # #to_replayable -- which copy exactly `content_length` bytes -- delivered "01234" for a short
+    # header and raised StreamError.short_transfer for a long one, while #body_string read all
+    # ten bytes. Two exchanges, one per direction, because a ResponseBody is single-use.
+    test "TRANSPORT-27 / R3-1: a Content-Length beside a chunked encoding reads the whole body" do
+      chunked_with_length = lambda do |length|
+        lambda do |conn, _head|
+          conn.write("HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Length: #{length}" \
+                     "\r\n\r\n5\r\n01234\r\n5\r\n56789\r\n0\r\n\r\n")
+        end
+      end
+      short = settle(NetHTTP.build, request_for(wire(chunked_with_length.call(5))))
+      long = settle(NetHTTP.build, request_for(wire(chunked_with_length.call(50))))
+      yielded = (+"").b
+      round_trip = (+"").b
+
+      short.body.each { |chunk| yielded << chunk }
+      long.body.to_replayable.each { |chunk| round_trip << chunk }
+
+      assert_equal(-1, short.body.content_length)
+      assert_equal(["5"], short.headers["Content-Length"], "the wire value reaches the caller")
+      assert_equal("0123456789", yielded, "#each yields the whole chunked body, not five bytes")
+      assert_equal("0123456789", round_trip, "#to_replayable round-trips the whole body")
+      short.close
+      long.close
+    end
+
     test "TRANSPORT-25: closing the response releases the connection, seen from the server" do
       server = wire(Scripts.large(5 * 1024 * 1024, hold: true))
 
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
index 72c9a4f..b31f8e2 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_mapper_test.rb
@@ -175,6 +175,27 @@ class BodyTest < DexpaceTestCase
                  "deleted from the NATIVE response before read_body, as any refused value is",)
     end
 
+    # Review round 3's R3-1: net-http frames a response carrying Transfer-Encoding: chunked under
+    # the chunked framing whatever Content-Length sits beside it (read_body_0 asks #chunked?
+    # first, 0.4.1 through 0.9.1), so a syntactically valid Content-Length there is RFC 9112
+    # section 6.3's overridden one and never the number of bytes the pump delivers; taken as the
+    # length, it made #each, #write_to and #to_replayable copy exactly that many bytes. The raw
+    # header still reaches the caller; only the interpretation is the sentinel.
+    test "R3-1: a Content-Length beside Transfer-Encoding: chunked is the -1 sentinel" do
+      native = ok("Transfer-Encoding" => "chunked", "Content-Length" => "5")
+
+      response = build(native, pump: pump_of("01234", "56789"))
+
+      assert_equal(-1, response.body.content_length)
+      assert_equal(["5"], response.headers["Content-Length"], "the raw header reaches the caller")
+      assert_equal(["chunked"], response.headers["Transfer-Encoding"])
+      assert_equal("0123456789", response.body_string, "the whole chunked body, not five bytes")
+      listed = ok("Transfer-Encoding" => "gzip, chunked", "Content-Length" => "5")
+
+      assert_equal(-1, build(listed, pump: pump_of("x")).body.content_length,
+                   "the predicate is net-http's own #chunked?, which reads a coding list",)
+    end
+
     test "TRANSPORT-27: a malformed Content-Type downgrades to nil rather than raising" do
       response = build(ok("Content-Type" => "not a/;;media type", "Content-Length" => "0"))
 
diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
index 8680ece..e3adce0 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/response_pump_test.rb
@@ -131,6 +131,36 @@ class TeardownTest < DexpaceTestCase
       assert_raises(Dexpace::ClosedError) { pump.readpartial(1) }
     end
 
+    # Review round 3's R3-2: the guard at the top of #readpartial, not the one in #fill. A small
+    # reader -- BufferedSource.wrapping hands the pump the CALLER's count, so a #getbyte or a
+    # #read_into over a 16 KiB net-http chunk leaves the rest in the residue -- must not be served
+    # buffered residue after the pump is closed; every other test drains with a large maxlen or
+    # through #body_string, where the residue is empty and #fill's own check fires instead.
+    test "a closed pump refuses a small read even with residue buffered, as ClosedError" do
+      pump = pump_for(wire(Scripts.fixed("abcdef")))
+      pump.head_or_raise
+
+      assert_equal("a", pump.readpartial(1), "the residue now holds the rest of the chunk")
+      pump.close
+
+      assert_raises(Dexpace::ClosedError) { pump.readpartial(1) }
+    end
+
+    test "a pump closed by a cancel refuses a small read over residue as the cancellation" do
+      source = Dexpace::Cancellation.source
+      pump = pump_for(wire(Scripts.fixed("abcdef")), cancellation: source.token)
+      pump.head_or_raise
+
+      assert_equal("a", pump.readpartial(1))
+      source.cancel(:mid_body)
+
+      assert_predicate(pump, :closed?, "the subscription closed the pump")
+      error = assert_raises(Dexpace::CancelledError) { pump.readpartial(1) }
+
+      assert_equal(:mid_body, error.reason)
+      pump.close
+    end
+
     test "closing before any read, and with the producer blocked on the queue, both return" do
       early = pump_for(wire(Scripts.fixed("x" * 100_000)))
 

From 705d86430503a5dd18f931ca0e535e254944f57b Mon Sep 17 00:00:00 2001
From: Mohammad Wahbeh <wahbehmo20@gmail.com>
Date: Mon, 21 Sep 2026 09:27:31 +0300
Subject: [PATCH 15/15] test: un-guard the generator slice's codec half now
 that 7a is on the tree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The slice test's third case names phase 7a's Dexpace::Serde::JSON::Codec,
which 8a's base did not carry, so it was written under a `skip` guard
that could never run. Reconciling the 8a stack onto the tree that holds
the whole of phase 7 removes the guard and runs the case for real.

Two repairs by the minimum, both to the test alone: an explicit
`require "dexpace/serde/json"` beside the existing cross-gem require of
the conformance gem, because nothing else on the adapter's load path
defines the codec; and the three lines that read the mapped error's
headers and body, written against 4b's design names (`#headers`,
`#body`, `#read_fully`), now read `#response.headers` and
`#response.body_string` -- the as-built ProtocolError carries the
buffered response, and body_string over BODY-30's BufferBody is what
makes "readable twice after the socket is gone" a real assertion.

The suite's skip count drops from two to one: the remaining skip is
conformance_test.rb's TRANSPORT-18 vacuity, reported as a Minitest skip
by design §9.3.
---
 .../transport/net_http/generator_slice_test.rb  | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
index 3df16ed..193b5a6 100644
--- a/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
+++ b/gems/dexpace-transport-net_http/test/dexpace/transport/net_http/generator_slice_test.rb
@@ -5,14 +5,16 @@
 require_relative "../../../support/adapter_fixtures"
 require "dexpace/transport/net_http"
 require "dexpace/conformance"
+require "dexpace/serde/json"
 
 # The generator slice, end to end over the first real socket in the repository: SEAM-26 (the
 # operation descriptor), SEAM-27 (the typed response), SERDE-28 (the status-aware handler),
 # RECOV-15 (the error carrying a buffered body), PIPE-39 (the standard pipeline over a builder),
 # HTTP-52/BODY-30 (Tristate omission; the snapshot error body). None is 8a's row: this is the
 # composition test, and it adds no implementation. The codec half names phase 7a's
-# Dexpace::Serde::JSON::Codec, which this base does not carry, so that one test is GUARDED and
-# 7a un-guards it; the two socket-only halves run here.
+# Dexpace::Serde::JSON::Codec: it was guarded with a skip while 8a was built one base apart from
+# 7a, and it runs against the real codec since the stack was reconciled onto the tree that holds
+# it (2026-09-21); the two socket-only halves never needed the guard.
 class DexpaceTransportNetHttpGeneratorSliceTest < DexpaceTestCase
   include AdapterFixtures
 
@@ -85,13 +87,10 @@ def base_url(server)
     assert_equal("GET /pets/7 HTTP/1.1", server.requests.first.request_line)
   end
 
-  # SEAM-27, SERDE-28, RECOV-15, BODY-30 and HTTP-52 in one guarded test: a 200 decodes to the
+  # SEAM-27, SERDE-28, RECOV-15, BODY-30 and HTTP-52 in one test: a 200 decodes to the
   # witness's type; a 404 raises an error whose buffered body is still readable after the socket
   # is gone; an ABSENT field is omitted from a PATCH body and a NULL one is not.
   test "SEAM-27/SERDE-28/RECOV-15/BODY-30/HTTP-52: the codec half of the slice" do
-    skip "phase 7a's Dexpace::Serde::JSON::Codec is not on this base; 7a un-guards" \
-      unless defined?(Dexpace::Serde::JSON::Codec)
-
     serde = Dexpace::Serde
     codec = serde::JSON::Codec.default
     handler = serde::StatusAwareHandler.build(serde: codec, witness: Pet)
@@ -112,9 +111,9 @@ def base_url(server)
     end
 
     assert_equal(404, error.status.code)
-    refute_nil(error.headers)
-    assert_match(/no such pet/, error.body.source.read_fully)
-    assert_match(/no such pet/, error.body.source.read_fully) # twice, after the socket is gone
+    refute_nil(error.response.headers)
+    assert_match(/no such pet/, error.response.body_string)
+    assert_match(/no such pet/, error.response.body_string) # twice, after the socket is gone
 
     patch = Dexpace::Operation.build(method: "PATCH", template: "/pets/{id}",
                                      projections: { id: [:path, "id"], body: [:body, "body"] },)