Module stream 

WU4: the streaming state machine (SPEC §3) — the ordered, backpressured, cancelable, bidirectionally half-closable channel every long-lived directed exchange rides.

What this module owns

• StreamSession — the pure, crypto-free per-stream state machine: the OPEN → OPEN_ACK → DATA → CLOSE lifecycle, strictly-monotonic per-direction seq (gap / reorder / replay → REJECT), credit backpressure, and independent per-direction half-close + RESET (SPEC §3). Pure so every transition is unit-testable without touching crypto.
• StreamEndpoint — the per-peer registry that wraps the seal around the state machine: it seals EVERY frame with a FRESH ephemeral via seal_message (SPEC §5.1 forward secrecy — never a fixed or session-wide ephemeral, so ChaCha20Poly1305 nonce-reuse is impossible), opens + fully verifies every inbound frame via open_message, enforces the MAX_CONCURRENT_STREAMS per-peer cap (SPEC §3 DoS gate), and RESETs a stream on any failed verify / protocol violation (defense-in-depth gate item — a garbage or forged frame never poisons a stream silently).

Per-frame sealing (CUSTODY-critical)

Each frame is an independent WU2 sealed envelope: BLS-G2 signed over the transcript (which binds the stream_frame + stream_seq, SPEC §5.1) and G1-DHKEM auth-sealed under its OWN fresh ephemeral. Cross-session frame replay is rejected two ways: the persistent ReplayGuard (per-sender monotonic counter + freshness window) drops a captured frame re-injected later, and a frame’s correlation_id must match a live session — a frame from another stream/session addresses a different correlation_id and finds no session.

Transport ordering (the layer BELOW)

The reliable mTLS-WS transport (dig-gossip) delivers frames in order and its bounded StreamReassembler (256 chunks / 4 MiB per stream) restores order across any out-of-order transport delivery. That reassembler is a SINGLE-stream transport primitive that sits UNDER dig-message and is wired at the dig-node integration layer (WU6); dig-message does not depend on the heavy dig-gossip crate (it must stay wasm-compilable + crates.io-publishable). This state machine is the layer ABOVE: it enforces the seq contract end-to-end and bounds the number of CONCURRENT streams — exactly the responsibility the reassembler’s own docs assign to “the streaming state machine (WU4)”.

Structs

StreamEndpoint

The per-peer streaming registry (SPEC §3): it multiplexes many concurrent streams to ONE peer, bounds their count (MAX_CONCURRENT_STREAMS), seals every outbound frame with a fresh ephemeral, and opens + fully verifies every inbound frame — RESETting a stream on any failed verify (gate items DIG-Network/dig_ecosystem#1162).

StreamSession

The pure, crypto-free per-stream state machine (SPEC §3). One instance tracks BOTH directions of one stream: our sending half (send_*) and the peer’s sending half we receive (recv_*), with independent half-close so either side can finish sending while the other continues.

Enums

StreamAccept

The outcome of StreamEndpoint::accept (SPEC §3, RESET-on-failed-verify gate item #1162).

StreamEvent

A verified, in-order stream event delivered to the caller by StreamEndpoint::accept (SPEC §3).

StreamState

The observable lifecycle position of a stream (SPEC §3), derived from the half-close + reset flags.