Define the supported public API surface

[FumingPower3925]

engine/, adaptive, protocol/ and probe are all importable (not internal/), and the transplant machinery (AdoptConn/StartTransplant/Carryover) is exported. Before v1.x compatibility promises harden, decide which of these are supported API vs implementation detail and state it in doc.go — otherwise external code pins to internals.

[FumingPower3925]

Moved to v1.6.0 (maintainer, 2026-09-29). celeris goes public with v1.6.0, and after that, moving an exported package or identifier needs a /v2 import path.

Scope for v1.6.0:

• Decide which importable packages are supported API. Today engine/, adaptive/, protocol/, probe/, observe/ and resource/ are all importable, and the transplant machinery listed above is exported (engine.Carryover is in engine/transplant.go on main fe9264f).
• Move what is not supported under internal/, or state plainly in each package's doc.go that it is unsupported and may change.
• This takes the 'machinery moved off the public surface' half of Stabilize the public engine API/SPI for v2 #453. The documented engine SPI stays in Stabilize the public engine API/SPI for v2 #453 (v2.0.0), because adding it later is not breaking.

[FumingPower3925]

Proposal for #443: the supported public API from v1.6.0

This is an inventory and a proposal. It changes no code. The decision is the maintainer's; the questions are listed at the end.

Base: celeris fe9264f (origin/main, 2026-10-02), docs e13609f, probatorium 38779a4, loadgen 9f8993e, examples d292a65, middlewares fb2f2de. Every number below comes from a script under evidence/lanes-20261002/443-proposal/scripts/ (00 to 08, plus 04b), and the raw outputs are in out/.

Recommendation in one screen

Tier	Packages	Exported top-level / methods
SUPPORTED (stable from v1.6.0)	celeris, celeristest, observe, middleware/** (46 packages, including the 4 nested modules metrics, otel, compress, protobuf), driver/postgres, driver/redis, driver/memcached	52 packages, 619 / 673
MOVE TO internal/	engine, engine/epoll, engine/iouring, engine/std, adaptive, probe, resource, protocol/detect, protocol/h1, protocol/h2, protocol/h2/frame, protocol/h2/stream, driver/redis/protocol, driver/postgres/protocol, driver/memcached/protocol	15 packages, 403 / 307
EXPERIMENTAL (still importable; doc.go says it is unsupported and may change)	validation	1 package, 21 / 4

These changes come with it:

• The nine test hooks on the root package (AcquireTestContext, ReleaseTestContext, TestStream, SetTestStartTime, SetTestFullPath, SetTestTrustedNets, AddTestParam, SetTestHandlers, SetTestScheme) leave the root and go behind an internal bridge. celeristest keeps its API unchanged.
• EngineMetrics gets a supported home in observe.
• The drivers alias the few types their API already returns from protocol and internal/ packages.

Why this split. The risk runs one way:

• A package moved to internal/ now can be published again later at no cost. Stabilize the public engine API/SPI for v2 #453's engine SPI or Spike: explore making io_uring and epoll egines public #254's io_uring package would then be additive: a new path, or aliases.
• A package left supported at v1.6.0 cannot be withdrawn without /v2.
• No code outside goceleris imports any of the 15 packages. pkg.go.dev says "No known importers" for each of them and for validation (scripts 04 and 04b). The root package has 8 known importers, all of them goceleris modules. The local clones confirm this (section 1).

---

1. Inventory

How the counts were made:

• "Top-level" means exported types, funcs, consts and vars. Methods on exported types are counted separately.
• The counts are a union over linux/amd64, linux/arm64, darwin/arm64 and windows/amd64, each with no build tag, with -tags=validation and with -tags=celeris_closeprobe.
• Control: the types and funcs match go doc -short for 67 of the 68 packages. The one exception is validation, whose Endpoint, StartEndpoint and EndpointAddr exist only under -tags=validation, which go doc does not apply (script 08).
• go list ./... excludes internal/ and test/ and the two main packages (cmd/celeris, test/autobahn/server). It lists 68 importable packages.

Importers are counted in non-test code and test code separately. "probatorium" means the refapps, the bench SUT and the tools at origin/main.

Package	Top-level / methods	Notable exports	Importers outside the package	What README/docs say	Proposal
celeris (root)	69 / 188	Server, Config, Context, Route, RouteGroup, EngineType, Protocol, WorkloadHint, EngineInfo, EngineMetrics (alias of engine.EngineMetrics), Adapt, ToHandler, plus the 9 test hooks	40 celeris packages; probatorium 24 non-test files; loadgen 1; docs mention the path 34 times in 18 files	the whole README	SUPPORTED, without the 9 test hooks (60 top-level remain)
celeristest	18 / 2	NewContext, NewContextT, ResponseRecorder, With*	40 celeris test packages	README; docs testing.md calls it "the entire supported testing surface"	SUPPORTED
observe	6 / 7	Collector, Snapshot, CPUMonitor, NewCPUMonitor, EngineMetrics (alias)	root (Server.Collector()), middleware/debug (Config.Collector *observe.Collector), middleware/overload (Config.CollectorProvider func() *observe.Collector)	README "Observability"; docs observability.md and middleware-traffic.md use observe.Collector and observe.NewCPUMonitor	SUPPORTED; it becomes the defining package of EngineMetrics
middleware/** (46)	404 / 147	New plus Config per package, and store.KV	probatorium imports 35 of them; docs mention 43	README says "36 importable packages" (36 directories; 45 subpackages plus the umbrella)	SUPPORTED
driver/postgres	37 / 34	Open, Pool, Connector, Rows, Tx, Pool.CopyFrom, PGError (alias of protocol.PGError)	probatorium 2; middleware/session/postgresstore	docs data-stores.md	SUPPORTED, plus aliases (section 4)
driver/redis	53 / 236	NewClient, Client, ClusterClient, Pipeline, Client.Do → *protocol.Value	probatorium 2; the 4 redisstore/jwtcache middleware packages	docs data-stores.md	SUPPORTED, plus aliases
driver/memcached	32 / 59	NewClient, Client, ClusterClient	probatorium 2; the 4 memcachedstore/jwtmccache middleware packages	docs data-stores.md	SUPPORTED, plus aliases
engine	31 / 6 (+96 fields, 72 of them in EngineMetrics)	Engine, EngineMetrics, EventLoopProvider, WorkerLoop, SwitchFreezer, AcceptController, TransplantTarget, Carryover, CapabilityProfile, Tier, FillErrorClasses (its parameter type is in engine/internal)	14 celeris packages; probatorium 2 test files (engine.EngineMetrics in debugvars tests)	doc.go: "User code typically interacts with engines through the top-level celeris package"; docs cite its source 15 times	MOVE
engine/epoll	3 / 18	New(resource.Config, stream.Handler), AdoptConn, StartTransplant, StopTransplant, BeginPauseAccept, Sendfile, Loop	root, adaptive	none	MOVE
engine/iouring	17 / 41	New, Ring (GetSQE() unsafe.Pointer, Submit, RegisterPbufRing, ...), BufferRing, Worker, TierStrategy, SelectTier, AdoptConn, StartTransplant, TransplantCount, SendZC*	root, adaptive; probatorium has no import, only a string naming the path in a stresstally test	README knob table (env vars only)	MOVE
engine/std	3 / 6	New, Bridge	root	none	MOVE
adaptive	4 / 14	New(resource.Config, stream.Handler, engine.CPUMonitor), ForceSwitch, FreezeSwitching, SetFreezeCooldown, SwitchRejectedCount, DriverFDCount, ActiveEngine, TelemetrySampler	root	doc.go: "Users select the adaptive engine via celeris.Config{Engine: celeris.Adaptive}"	MOVE
probe	7 / 2	Probe, ProbeWith, SyscallProber, KernelVersion, DiagnosticReport	adaptive, engine/iouring	doc.go: "Application code typically does not call this package directly"; docs cite its source 3 times	MOVE
resource	13 / 3 (+37 fields)	Config (the engines' config), Resources, WorkloadHint, MinWorkers, DeriveMemoryLimit	root, adaptive, 3 engines	docs configuration.md cites resource/config.go 34 times as the source of the defaults	MOVE
protocol/detect	5 / 0	Detect, MinPeekBytes	epoll, iouring	none	MOVE
protocol/h1	22 / 9	Parser, Request, UnsafeString, Err*	internal/conn	none	MOVE
protocol/h2	0 / 0	doc-only	none	none	MOVE (along with its children)
protocol/h2/frame	30 / 27	Parser, Writer, HeaderEncoder, HeaderDecoder, Frame*	internal/conn, detect	none	MOVE
protocol/h2/stream	36 / 96	Stream, Handler, Processor, Manager, ResponseWriter, ResetForPool	root (AcquireTestContext(*stream.Stream), TestStream), celeristest, 3 engines, adaptive, internal/conn	none	MOVE
driver/postgres/protocol	140 / 31	wire messages, OID consts, TypeCodec, RegisterType, PGError	driver/postgres	postgres doc.go: "Custom type codecs can be registered with protocol.RegisterType"	MOVE, with aliases in postgres
driver/redis/protocol	30 / 20	Value, KV, Type, Ty*, Reader, Writer	driver/redis, middleware/ratelimit/redisstore	none	MOVE, with aliases in redis
driver/memcached/protocol	62 / 34	text and binary wire codecs	driver/memcached	none	MOVE
validation	21 / 4	Snapshot, Counters, Counter vars, RecordPanic; StartEndpoint and SocketPath under -tags=validation	root, engine/iouring, middleware/recovery, middleware/session; probatorium validation/refapp/internal/debugvars/debugvars.go (non-test; a separate module, so it cannot import internal/)	docs binding-and-validation.md: "an internal property-testing facility"	EXPERIMENTAL

The other repos:

• examples is a LICENSE and a README (archived, private).
• middlewares is archived and private, its go.mod retracts every version, and it pins celeris v1.2.4.

Neither constrains v1.6.0.

2. What is promised today

• No package states a stability level. No doc.go contains "experimental", "unsupported", "may change" or "not covered". GOVERNANCE.md has no compatibility section.
• The README's "Project structure" lists adaptive/, engine/, observe/, probe/, protocol/, resource/ and validation/ as directories, with no statement about using them. It does say that CELERIS_DEBUG_* and CELERIS_ADAPTIVE_DEBUG "are not a stable interface".
• The docs already treat most of the engine packages as off limits:
  • engine, probe and adaptive say in their own doc.go that applications use the root package instead.
  • docs testing.md already calls the root test hooks internal: "They take internal types, have no stability guarantees". It has a migration table to celeristest.
  • docs binding-and-validation.md calls validation "an internal property-testing facility".
• The docs do present some of these types as user-facing:
  • observe.Collector, observe.NewCPUMonitor and observe.EngineMetrics (observability, middleware-traffic).
  • EngineMetrics field by field (engines, observability).
  • Server.EventLoopProvider() with NumWorkers() and WorkerLoop(n). engines.md cites engine/provider.go for this, and adds: "You normally don't call this yourself".

3. Constraints

• Go semver. 40 v1 releases (v1.0.0 to v1.5.11) are on the Go proxy. Removing a package inside v1 breaks Go's v1 compatibility rules.
  • The maintainer decided on 2026-09-29 to accept that once, in v1.6.0, before the public launch. It is cheap now because nothing outside goceleris imports these packages.
  • After v1.6.0, every one of these moves needs /v2.
  • The release note must list each moved path.
• Stabilize the public engine API/SPI for v2 #453 (engine SPI, v2.0.0) is additive. A designed EventLoopProvider and WorkerLoop SPI can later be published at a new public path, or at engine/ again, using aliases to the internal types. Nothing at that path exists in v1.6.x, so adding it breaks nobody.
• Spike: explore making io_uring and epoll egines public #254 / Make io_uring package #245 (a public io_uring package). engine/iouring is not a general binding, so freezing it would not serve Make io_uring package #245:
  • It exports no opcodes, no SQE layout and no prep helpers.
  • Ring.GetSQE() returns an unsafe.Pointer.
  • Its Engine and Worker belong to the HTTP engine.
  • Make io_uring package #245 asks for socket, pipe and splice support. That is a designed package (or a separate module) for later, which is also additive.
  • Freezing the current shape at v1.6.0 would lock in the engine-internal API and make the real design harder.
• The adaptive engine's public config stays where it is, in the root package and the environment: Config.Engine = Adaptive, Config.WorkloadHint, CELERIS_ADAPTIVE_START. Moving adaptive takes the adaptive.Engine control methods off the supported surface (ForceSwitch, FreezeSwitching, SetFreezeCooldown, SwitchRejectedCount). Today a program reaches them either by building adaptive.New itself or by asserting srv.EventLoopProvider() to engine.SwitchFreezer. Nothing in probatorium or loadgen does either. If users need to freeze switching, a Server method can be added later, additively.
  • Caveat: internal/ hides the names, not the methods. A type assertion to an anonymous interface on the value that Server.EventLoopProvider() returns still reaches FreezeSwitching. The doc should say that this is unsupported.
• Freedom to change engine code after v1.6.0. Decompose the H2 stream processor mega-functions #439 (decompose the H2 processor, v1.7.0) works in protocol/h2/stream. io_uring: fixed-file support is unimplemented behind a malformed accept SQE — readiness checklist before it can be enabled #541 (fixed files), further kernel gates like io_uring: every async cancel fails with -EINVAL on Linux 5.10-5.18 (IORING_ASYNC_CANCEL flags are 5.19+) #682, and new EngineMetrics fields (io_uring: publish SQE-submitted and CQE-completed totals so the validator can judge queue accounting (probatorium#395) #688) all change engine and protocol code. With these packages supported, every exported signature they touch would be frozen.
• The supported API already leaks. Some exported signatures name types that callers cannot import (script 03):
  • redis.Client.Do, Eval, EvalSHA and ClusterClient.Do return *protocol.Value.
  • postgres documents protocol.RegisterType as its extension point.
  • All three drivers return async.PoolStats from Stats() or PoolStats(), and take eventloop.ServerProvider in WithEngine (and, for redis and memcached, in Config.Engine). Both types are under driver/internal/, so users cannot name them today.
  • The root package exposes *stream.Stream through AcquireTestContext and TestStream.
  • observe.EngineMetrics and celeris.EngineMetrics are aliases of engine.EngineMetrics.

4. What each move breaks, and what has to change with it

The internal/ rule is based on import paths. Every package under github.com/goceleris/celeris/... may import celeris/internal/..., including the nested modules and test/.... Inside the celeris repo, nothing breaks except import paths. Outside it, only the items below break.

1. Proposed layout: put internal/ in front of each path. That gives internal/engine/{,epoll,iouring,std}, internal/adaptive, internal/probe, internal/resource, internal/protocol/{detect,h1,h2,h2/frame,h2/stream}, and driver/{redis,postgres,memcached}/internal/protocol. The existing engine/internal/* packages become internal/engine/internal/*. No name collides with the existing internal/ packages (internal itself and 11 subpackages).
2. Size of the mechanical part (script 06):
   • 344 files move, 324 of them .go.
   • 555 import lines in 288 .go files are rewritten. 133 of those files are outside the moved directories.
   • CI references to the moved directories: ci.yml, test-coverage.yml, codspeed.yml (./protocol/..., so CodSpeed restarts the baseline for those benchmarks), codecov.yml components, .coderabbit.yaml path rules, magefile.go, mage_compliance.go and mage_driver.go. Script 05 counts 20 references for engine/iouring, 6 for adaptive, 5 for epoll, 4 for protocol/h1 and 1 for engine, and none for the other packages.
   • There are no go:linkname directives, and no non-import strings name these paths in celeris code.
3. EngineMetrics stays a supported type: README, observability.md and probatorium's debugvars use it.
   • Define the struct in observe. internal/engine then aliases it, and celeris.EngineMetrics becomes an alias of observe.EngineMetrics.
   • This needs one import cycle cut, because today observe imports internal/cpumon, which imports engine for CPUSample and CPUMonitor. Move those two types into internal/cpumon and alias them in internal/engine.
   • Sequence this after Remove every deprecated public API before the public v1.6.0 release #830, which removes EngineMetrics.Throughput from engine/engine.go.
4. Root test hooks. An internal/testhooks package holds function variables that the root package sets in init. celeristest calls them and asserts the results back to *celeris.Context.
   • This removes 9 exported functions. celeristest's API does not change.
   • 5 in-tree test files call the hooks directly: middleware/sse ×4 and middleware/redirect ×1.
   • docs testing.md loses its "Do not call these directly" table.
5. Driver aliases. All of these are additive:
   • redis: Value, KV, Type and the Ty* constants.
   • postgres: TypeCodec, RegisterType, LookupOID (PGError is already aliased).
   • All three drivers: PoolStats and ServerProvider.
   • These aliases would be worth adding even if nothing moved, because today users cannot name the types the drivers return.
6. Server.EventLoopProvider() stays exported. The drivers' ServerProvider interface needs the method to be exported, because *celeris.Server satisfies that interface from another package.
   • Its return type becomes internal/engine.EventLoopProvider. Callers can use the returned value (engines.md's p.NumWorkers() example still compiles), but they cannot name its type.
   • The doc should say: "for celeris drivers; the provider's type is not supported API until Stabilize the public engine API/SPI for v2 #453".
7. Root doc comments that link [resource.Config.DisableDeferAccept] (2 places) are rewritten in terms of celeris.Config. The README's "Project structure" is updated, and a "Compatibility" section is added to GOVERNANCE.md (section 6).
8. What breaks outside celeris:
   • probatorium:
     • debugvars tests use engine.EngineMetrics in 2 files. They switch to celeris.EngineMetrics.
     • The default package pattern and its description in celeris-stress.yml (./engine/iouring, ./adaptive/...) need the new paths.
     • The hint string in tools/stresstally/plan.go needs the new path. Its self-test pins an old celeris SHA, so it keeps working.
     • All of this goes in the repin PR that picks up the move (RULE 93-style catch-up).
   • The queued celeris-stress rows in the cluster queue pin celeris SHAs from before the move, so they are unaffected. The exception is one row whose B=<...> ref is not filled in yet: if it gets a SHA from after the move, its package pattern must use the new path.
   • docs: 54 source citations to moved files go stale (resource 34, engine 15, probe 3, epoll 1, iouring 1). This needs a companion docs PR. No docs code sample imports a moved package.
   • loadgen: nothing. Its testserver imports only the root package.
9. validation stays at its path because probatorium's refapps (a separate module) read validation.Snapshot() in process. Its doc.go gets the EXPERIMENTAL paragraph.
   • Optional: rename it, for example to x/invariant. docs binding-and-validation.md spends a section on people mistaking it for input validation. The rename costs 21 importer files (cmd/celeris among them), probatorium debugvars and that docs section.

5. Options and work estimates

The estimates are judgement, not measurements. They include running the full suites in the Linux container, the cross-compiles and watching CI.

Option	What	Breaks	Work
A, recommended	The split above, with the items in section 4	The 15 moved import paths; the 9 root test hooks; the validation contract becomes explicitly experimental	celeris PR about 1.5 to 2 days; docs PR about 0.5 day; probatorium catch-up about 2 h; each engine branch in flight when the move lands needs about 0.5 to 1 h of rebase
B, label only	All 16 non-supported packages stay importable with an EXPERIMENTAL paragraph in doc.go (8 of them have no doc.go yet), plus the GOVERNANCE section. gRPC-Go labels its experimental APIs this way inside a v1 module	Nothing now. Breaking those packages later is allowed by policy, but Go tooling and users treat it as a v1 break	About 0.5 day. The lasting cost: 403 top-level identifiers and 307 methods stay importable and listed on pkg.go.dev, and they will get pinned anyway
C, freeze everything	Every package is SUPPORTED as it is	Nothing now	About 1 h. The lasting cost: 1,043 top-level identifiers and 984 methods in 68 packages are frozen until /v2, including the transplant machinery, the raw ring and the parsers

Variants of A, if the maintainer wants to keep something visible:

• engine EXPERIMENTAL instead of moved. Only EventLoopProvider, WorkerLoop and the three Err* sentinels would stay; the rest moves. That gives third-party drivers a preview of Stabilize the public engine API/SPI for v2 #453 now, but there is no known demand for it. Cost: about 2 h more.
• engine/iouring EXPERIMENTAL for Make io_uring package #245. This is not recommended (see section 3).
• Driver protocol packages EXPERIMENTAL instead of moved. This saves about 3 h, but then a supported redis.Client.Do returns a type from an unsupported package.

6. If A is chosen: execution plan

• Order:
  1. Remove every deprecated public API before the public v1.6.0 release #830 first, because it edits engine/engine.go.
  2. fix(iouring): hold a closed connection's send buffer until its SEND_ZC notification, past the release backstop (celeris#812) #813 (9 iouring files, 2 adaptive files, 1 engine file) and fix(epoll): never read a driver conn's descriptor number after UnregisterConn has returned (celeris#710) #772 (2 epoll files) land first, or rebase onto the move. Git's rename detection carries their edits across, but files they add at old paths need moving by hand.
  3. Pause new engine branches on the day of the move.
• celeris PR (draft, breaking, area/api, milestone v1.6.0). One commit per step, with the mechanical step reviewable on its own:
  • (a) EngineMetrics into observe, plus the cpumon cycle cut.
  • (b) the internal/testhooks bridge.
  • (c) the driver aliases.
  • (d) git mv and the import rewrite, with no other edits.
  • (e) CI, codecov, CodeRabbit, mage and README paths.
  • (f) the doc.go stability paragraphs and the GOVERNANCE "Compatibility" section. The section says:
    • packages outside internal/ that are not marked experimental follow Go's v1 compatibility rules;
    • packages marked experimental may change in a minor release, and the release notes say when they do;
    • internal/**, cmd/celeris and the CELERIS_DEBUG_*, CELERIS_ADAPTIVE_DEBUG and CELERIS_IOURING_FIXED_FILES variables are not covered.
• Verification:
  • Build and vet on the four GOOS/GOARCH pairs.
  • Run the full suites, with the engine packages in the Linux container in the CI shape.
  • gorelease -base=v1.5.11 (golang.org/x/exp/cmd/gorelease) produces the list of incompatible changes for the release note, and shows that nothing supported changed beyond what was intended.
  • Prove that step (d) changes no generated code, without a benchmark: compare go tool nm -size of a test binary before and after, with the package-path prefix normalised. Equal per-function sizes mean the hot path is unchanged.
  • Optional, cheap, and it prevents the surface from growing unnoticed: a checked-in API golden file (like Go's own api/), compared in CI.
• Companion PRs: a docs draft (the 54 citations; observability's EngineMetrics location; testing.md; validation marked experimental; the EventLoopProvider wording) and the probatorium repin catch-up (section 4, item 8).
• Release-note line: "Breaking: the engine and protocol implementation packages moved under internal/ and are no longer importable: engine, engine/epoll, engine/iouring, engine/std, adaptive, probe, resource, protocol/..., driver/{redis,postgres,memcached}/protocol. Select an engine with celeris.Config.Engine; read engine counters as celeris.EngineMetrics or observe.EngineMetrics; Redis replies are redis.Value; Postgres codecs register with postgres.RegisterType. The root test hooks (AcquireTestContext, ReleaseTestContext, TestStream, SetTest*, AddTestParam) are removed; use celeristest. validation is documented as experimental."
• No bare-metal run is needed for the move itself, because the codegen comparison above covers it. The next perf checkpoint of main covers it anyway.

7. Decisions for the maintainer

1. Option A, B or C, and any of the variants in section 5.
2. Should validation keep its path (recommended) or be renamed now?
3. The tuning variables in the README table: which are supported? The proposal is that CELERIS_ADAPTIVE_START, CELERIS_MAX_IOURING_TIER and CELERIS_IOURING_SEND_ZC are supported as documented, and that CELERIS_IOURING_MULTISHOT_RECV and CELERIS_IOURING_PBUF_COUNT are experimental.
4. Should the API golden-file check be added?

[FumingPower3925]

For the inventory: #906 (celeris#893, lane F3) adds four exported identifiers to protocol/h2/stream. The proposal above moves that package to internal/. If the package stays importable instead, each of these needs a decision:

• const OutboundBudget (4 MiB, the per-connection outbound budget). Outside the package only tests and two engine comments use it.
• (*Manager).OutboundHeld() int64. Only tests use it (protocol/h2/stream and internal/conn).
• (*Stream).TryBufferOutbound(data []byte, endStream bool) bool. internal/conn's pool response adapter calls it.
• (*Stream).AwaitSendWindow() bool. The same adapter calls it.

The last two have to stay exported for as long as internal/conn lives in another package. The first two exist for tests. The round-1 review of #906 asked for them to be unexported or listed here, and this comment is the listing. The tests in internal/conn need OutboundHeld across the package boundary, so unexporting it would cost that test its end-to-end budget check.

[FumingPower3925]

Update to the #906 entry above (issuecomment-5965097979): round 2 of #906 changes the last identifier to (*Stream).AwaitSendWindow(deadline time.Time) error. It now returns nil (window open), context.Canceled (the stream was reset or its connection closed) or os.ErrDeadlineExceeded (the deadline passed; the caller resets the stream). The caller is the same: internal/conn's pool response adapter, which passes the server's WriteTimeout. The other three are unchanged.

[FumingPower3925]

Freeze start (T0), 2026-10-03 21:16Z: the option A move of this issue has begun.

Until the move PR merges, please open no new branch or lane that edits a file under the 8 moved roots:

• engine/ (with engine/epoll, engine/iouring, engine/std)
• adaptive/
• probe/
• resource/
• protocol/ (with protocol/detect, protocol/h1, protocol/h2, protocol/h2/frame, protocol/h2/stream)
• driver/redis/protocol/, driver/postgres/protocol/, driver/memcached/protocol/

All other work continues as usual. That includes driver/internal/eventloop (#932, #933, #934), the driver packages themselves, the middleware and the root package.

• The move PR is being built on refactor/443-internal, cut from main at 28383e8 (fix(postgres): keep a conn's descriptor number until Close has made its last call on it (celeris#859) #935). It follows the move lane's plan. The default layout puts the driver codecs at internal/driver/<db>/protocol, and every design decision in it can be reversed in review.
• Preconditions: fix(h2): clear the write queue's pending flag before the drain takes the shards, so a frame enqueued during the drain is not stranded (celeris#837) #900, fix(api): an error or panic before a taken StreamWriter sends anything is still answered, so an SSE OnConnect rejection reaches the client (celeris#835) #901, fix(cache, compress, etag, singleflight): pass a 206 Partial Content through instead of storing, encoding, tagging or sharing it like a 200 (celeris#832) #902, fix(h2): bound the response bytes a connection holds for the peer's window; over the budget, handlers run on the pool and send as the windows open (celeris#893) #906, fix(epoll, iouring): a stopped engine no longer hands its loop threads back to the scheduler pinned to one CPU (celeris#905) #907 and fix(router, conn, sse): answer HEAD with the GET route and OPTIONS with the Allow list; a streamed HEAD sends no body (celeris#421, celeris#833) #841 have merged. No open PR adds files under a moved root.
• ci: check the exported API against golden files in api/, so every API change shows in review (celeris#443) #914 (API golden files) is rebased onto 28383e8 at b5a6f6b, and api/ is regenerated. The move PR will then show its API change as an api/ diff.
• A branch that edits a moved root after the move lands rebases with the recipe in the plan: git rebase origin/main, then git add each added file at the path git suggests, then rerun the import rewrite.

The freeze ends (T1) once the move PR has merged and the branches it held have rebased. That will be a second comment here.

[FumingPower3925]

Freeze exception: #836 (security).

The 24 h soak at main ed3b7fb (goceleris/probatorium run 37140355449) showed that #916 makes the old #836 panic ("context: internal error: missing cancel error") reachable on any unmatched path, whenever a global middleware derives from c.Context() (for example timeout). An h2c client can therefore crash such an app. The evidence and the test arms are on #836.

#836 is being fixed now, on the current paths under protocol/h2/stream.

This does not conflict with #938. Its rebase recipe (PLAN 1.7(i)) re-runs move.sh on the new main, so the fix moves with its files, new test files included. Apart from this, the freeze stands.