Restart-gated Decoy Fast-Track

Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>

src/config/hot_reload.rs

@@ -21,6 +21,8 @@
 //! `server.port`, `censorship.*`, `network.*`, `use_middle_proxy`) are **not**
 //! applied; a warning is emitted. SYN limiter rules are process-owned and are
 //! reconciled only during privileged startup.
+//! `web.decoy_fasttrack_mode` is also restart-only so one process never mixes
+//! capability timing policies or process-lifetime counter semantics.
 //! Non-hot changes are never mixed into the runtime config snapshot.
 
 use std::collections::BTreeSet;

src/config/hot_reload/tests.rs

@@ -47,6 +47,43 @@ fn write_web_reload_config(path: &Path, carriers: &str, carrier_learning: bool)
     std::fs::write(path, config).unwrap();
 }
 
+fn write_web_fasttrack_reload_config(path: &Path, mode: &str, ad_tag: &str) {
+    let config = format!(
+        r#"
+                [general]
+                ad_tag = "{ad_tag}"
+
+                [access.users]
+                alice = "000102030405060708090a0b0c0d0e0f"
+
+                [[server.listeners]]
+                ip = "127.0.0.1"
+                port = 18080
+                transport = "web"
+                proxy_protocol = false
+                web_client_ip_source = "x_forwarded_for"
+                web_trusted_proxy_cidrs = ["127.0.0.1/32"]
+
+                [web]
+                enabled = true
+                decoy_fasttrack_mode = "{mode}"
+
+                [[web.vhosts]]
+                host = "proxy.example.com"
+                public_addr = "203.0.113.10:443"
+
+                [web.vhosts.decoy]
+                mode = "http_upstream"
+                upstream = "http://127.0.0.1:18081"
+
+                [[web.vhosts.profiles]]
+                user = "alice"
+                secret_mode = "plain"
+            "#,
+    );
+    std::fs::write(path, config).unwrap();
+}
+
 fn temp_config_path(prefix: &str) -> PathBuf {
     let nonce = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -135,7 +172,10 @@ fn decoy_fasttrack_mode_is_deferred_until_restart() {
         applied.web.decoy_fasttrack_mode,
         old.web.decoy_fasttrack_mode
     );
-    assert_eq!(HotFields::from_config(&old), HotFields::from_config(&applied));
+    assert_eq!(
+        HotFields::from_config(&old),
+        HotFields::from_config(&applied)
+    );
 }
 
 #[test]
@@ -378,6 +418,39 @@ fn reload_keeps_hot_apply_when_non_hot_fields_change() {
     let _ = std::fs::remove_file(path);
 }
 
+#[test]
+fn reload_rebuilds_vhosts_with_the_effective_fasttrack_mode() {
+    let initial_tag = "abababababababababababababababab";
+    let final_tag = "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd";
+    let path = temp_config_path("telemt_web_fasttrack_reload");
+
+    write_web_fasttrack_reload_config(&path, "off", initial_tag);
+    let initial_cfg = Arc::new(ProxyConfig::load(&path).unwrap());
+    let initial_hash = ProxyConfig::load_with_metadata(&path)
+        .unwrap()
+        .rendered_hash;
+    let (config_tx, _config_rx) = watch::channel(Arc::clone(&initial_cfg));
+    let (log_tx, _log_rx) = watch::channel(initial_cfg.general.log_level.clone());
+    let mut reload_state = ReloadState::new(Some(initial_hash));
+
+    write_web_fasttrack_reload_config(&path, "enforce", final_tag);
+    reload_config(&path, &config_tx, &log_tx, None, None, &mut reload_state).unwrap();
+
+    let applied = config_tx.borrow().clone();
+    assert_eq!(applied.general.ad_tag.as_deref(), Some(final_tag));
+    assert_eq!(
+        applied.web.decoy_fasttrack_mode,
+        crate::config::WebDecoyFastTrackMode::Off
+    );
+    let runtime = applied.web.runtime.as_ref().unwrap();
+    assert_eq!(
+        runtime.vhosts["proxy.example.com"].decoy_fasttrack_mode,
+        crate::config::WebDecoyFastTrackMode::Off
+    );
+
+    let _ = std::fs::remove_file(path);
+}
+
 #[test]
 fn reload_publishes_web_negotiation_policy_outside_hot_field_reporting() {
     let path = temp_config_path("telemt_web_negotiation_reload");

src/config/tests/load_basic_tests/web_tests.rs

@@ -43,10 +43,7 @@ fn web_config_builds_canonical_runtime_snapshot() {
     assert_eq!(vhost.profiles.len(), 1);
     assert_eq!(vhost.capabilities.len(), vhost.profiles.len());
     assert_eq!(vhost.capabilities[0], vhost.profiles[0].capability);
-    assert_eq!(
-        vhost.decoy_fasttrack_mode,
-        WebDecoyFastTrackMode::Off
-    );
+    assert_eq!(vhost.decoy_fasttrack_mode, WebDecoyFastTrackMode::Off);
     assert_eq!(vhost.profiles[0].user, "alice");
     assert_eq!(vhost.profiles[0].secret_mode, WebSecretMode::Dd);
     assert_eq!(vhost.profiles[0].carrier, WebCarrier::HttpsLanes);
@@ -76,20 +73,12 @@ fn web_decoy_fasttrack_mode_is_typed_and_defaults_off() {
     ] {
         let configured = WEB_CONFIG.replace(
             "carrier = \"https-lanes\"",
-            &format!(
-                "carrier = \"https-lanes\"\ndecoy_fasttrack_mode = \"{token}\""
-            ),
+            &format!("carrier = \"https-lanes\"\ndecoy_fasttrack_mode = \"{token}\""),
         );
         let config = load_config_from_temp_toml(&configured);
         assert_eq!(config.web.decoy_fasttrack_mode, expected);
         assert_eq!(
-            config
-                .web
-                .runtime
-                .as_ref()
-                .unwrap()
-                .vhosts["proxy.example.com"]
-                .decoy_fasttrack_mode,
+            config.web.runtime.as_ref().unwrap().vhosts["proxy.example.com"].decoy_fasttrack_mode,
             expected
         );
     }

src/config/types/web.rs

@@ -203,7 +203,7 @@ pub struct WebLimitsConfig {
     /// Process-wide retained and in-flight WEB debug byte ceiling.
     #[serde(default = "default_web_debug_bytes_global")]
     pub debug_bytes_global: usize,
-    /// Declared process envelope for HTTP, queues, lane state, learning, and static snapshots.
+    /// Declared process envelope for HTTP, queues, capabilities, learning, and static snapshots.
     #[serde(default = "default_web_memory_envelope_bytes")]
     pub memory_envelope_bytes: usize,
     /// Sustained process-wide bootstrap issuance rate.