# BACKLOG
src/ops/other.rs:91 | wireshift-fallback | silent-fallback | medium | REPOPULATE 2026-07-16: fd_in.seek fails, error is discarded via let _, fallback reads from current file offset resulting in silent corruption of splice output | surface loudly by propagating the seek error using ? and add a proving test asserting seek failure on a non-seekable file descriptor is surfaced | status=done | FIXED (Law 10 fail-closed): the non-Linux splice fallback did `let _ = fd_in.seek(SeekFrom::Start(off));` then read from the CURRENT offset on failure - silently producing corrupt splice output. Extracted the seek+copy into a generic `splice_fallback_copy<I: Read+Seek, O: Write>` (gated `#[cfg(any(not(target_os=linux), test))]` so it is testable on Linux where the `not(linux)` call site is not compiled) that propagates the seek error as `Error::io("splice fallback seek failed", ..)` via `?`. Proving tests (splice_fallback_tests): seek_failure_with_input_offset_is_surfaced_not_silently_ignored (a Seek-implementing reader whose seek returns Unsupported -> Err containing "seek" AND zero bytes written, so no corruption), successful_seek_copies_from_the_requested_offset (offset 3, len 7 -> exactly b"3456789"), no_offset_copies_from_current_position. `cargo test -p wireshift-fallback --lib` = 7 new-area tests pass, EXIT=0.
src/net_ops.rs:111 | wireshift-fallback | silent-fallback | low | REPOPULATE 2026-07-16: stream.set_read_timeout fails, error is discarded via let _, fallback executes read without a timeout which can cause the worker thread to hang | fail closed by propagating the socket timeout configuration error with ? and add proving test checking error on invalid timeout value | status=done | FIXED (Law 10 fail-closed): `execute_recv` did `let _ = stream.set_read_timeout(Some(t));` then read with NO timeout on failure (worker-thread hang). Extracted `apply_read_timeout(&stream, timeout)` which propagates the config error as `Error::io("recv set_read_timeout failed", ..)` via `?`; execute_recv now calls it with `?`. Proving tests: apply_read_timeout_surfaces_invalid_zero_duration (a real connected TcpStream + `Some(Duration::ZERO)` - which the OS rejects - yields Err whose message contains "timeout"), apply_read_timeout_accepts_valid_duration_and_none (guard: 50ms and None both Ok). EXIT=0.
src/net_ops.rs:77 | wireshift-fallback | performance | medium | REPOPULATE 2026-07-16: TcpListener.accept WouldBlock loops on fixed 10ms sleep, no value substituted, introduces up to 10ms of connection latency under load | surface loudly by replacing fixed sleep with polling or event-driven wait on socket readiness and add a proving test verifying connection latency is sub-millisecond | status=done | FIXED (Law 7 hot-path latency): the accept WouldBlock arm did `thread::sleep(Duration::from_millis(10))`, adding up to a full 10ms to every connection that arrived mid-quantum. Replaced with `wait_for_listener_readiness(&listener, remaining)` which does an event-driven `libc::poll(POLLIN)` on the listener fd (libc already a dep), capped at min(remaining, 10ms) so cancellation/deadline are still re-checked promptly and the overall timeout is never overshot. A pending connection makes the listener readable immediately, so poll returns sub-ms instead of after a sleep quantum; removed the now-unused `std::thread` import. Proving test accept_wakes_on_connection_without_fixed_sleep_latency: accept starts BEFORE any peer (parks in poll), a peer connects after 25ms, and connect->accept-return latency is asserted < 5ms (discriminates the old 10ms sleep) with the result a CompletionPayload::Stream. EXIT=0.