diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24f9437..5fb2345 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -167,3 +167,50 @@ jobs:
           status=$?
           kill "$broker" 2>/dev/null || true
           exit $status
+
+  # External-toolchain interop: an independent, third-party AMQP 1.0 client
+  # stack (Apache Qpid JMS, pure Java) exercising ramqp-broker — the JMS leg of
+  # broker.md Phase 10, alongside the Rust fe2o3-amqp leg in bench-compare. The
+  # runner fetches qpid-jms, compiles the client, and runs the #[ignore]d
+  # jms_interop test (which starts a loopback broker in-process).
+  interop-jms:
+    name: Interop (Qpid JMS -> ramqp-broker)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Qpid JMS interop
+        run: ramqp-broker/tests/interop/jms/run.sh
+
+  # External-toolchain interop: Apache Qpid Proton (Python, the C-based AMQP 1.0
+  # engine) exercising ramqp-broker — a third independent stack after fe2o3-amqp
+  # (Rust) and Qpid JMS (Java). Installs proton on the runner; run.sh takes the
+  # host path.
+  interop-proton:
+    name: Interop (Qpid Proton -> ramqp-broker)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install python3-qpid-proton
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq python3-qpid-proton
+      - name: Qpid Proton interop
+        run: ramqp-broker/tests/interop/proton/run.sh
+
+  # Process-level split-brain: a 3-node quorum cluster across Linux network
+  # namespaces, iptables-partitioned into majority/minority, asserting the
+  # majority stays available, the minority refuses (never silently accepts),
+  # and no committed message is lost on heal. Needs root (netns + iptables);
+  # the script self-elevates via sudo.
+  partition:
+    name: Partition (netns split-brain)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Network-partition test
+        run: ramqp-broker/tests/partition/run.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd9a734..ee8397e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,9 +4,12 @@ name: Release
 # (Settings -> Secrets and variables -> Actions). Create the token at
 # https://crates.io/settings/tokens with the "publish-update" scope.
 #
-# Publish ORDER matters (see RELEASING.md): `ramqp` depends on `ramqp-core`
-# by version, so core must land on crates.io first. `ramqp-broker` is not
-# published yet (pre-alpha); `bench-compare` is publish = false.
+# Publish ORDER matters (see RELEASING.md): `ramqp` and `ramqp-broker` both
+# depend on `ramqp-core` by version, so core must land on crates.io first.
+# `bench-compare` is publish = false.
+#
+# NOTE: the token needs the "publish-new" scope for a crate's FIRST-ever
+# publish (publish-update alone fails on a new crate name).
 
 on:
   push:
@@ -55,7 +58,29 @@ jobs:
           done
           echo "index never showed ramqp-core $core_version"; exit 1
       - name: Publish ramqp
-        run: cargo publish -p ramqp --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        # Skips cleanly if this version of ramqp is already published
+        # (e.g. a broker-only release retagging the same client version).
+        run: |
+          if cargo publish -p ramqp --token ${{ secrets.CARGO_REGISTRY_TOKEN }} 2>err.log; then
+            echo "ramqp published"
+          elif grep -q "already exists" err.log; then
+            echo "ramqp version already on crates.io; continuing"
+          else
+            cat err.log; exit 1
+          fi
+      - name: Publish ramqp-broker
+        # Same tolerance: a client-only release may retag the same broker
+        # version. The broker's registry dependency is only ramqp-core (the
+        # `ramqp` dev-dependency is path-only and stripped at packaging), so
+        # the core index wait above is the only ordering it needs.
+        run: |
+          if cargo publish -p ramqp-broker --token ${{ secrets.CARGO_REGISTRY_TOKEN }} 2>err.log; then
+            echo "ramqp-broker published"
+          elif grep -q "already exists" err.log; then
+            echo "ramqp-broker version already on crates.io; continuing"
+          else
+            cat err.log; exit 1
+          fi
 
   release:
     name: Create GitHub Release
diff --git a/.gitignore b/.gitignore
index e21a85e..47b0a01 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,6 @@ ramqp-core/fuzz/coverage/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+
+# Generated by bench-compare/tuned/run.sh (provisional numbers live in the README)
+bench-compare/tuned/results.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cc2e3b..c24680e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,29 @@ All notable changes to ramqp will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.2] - unreleased
+
+### Added
+- **`ramqp-broker` publishes to crates.io, first release 0.9.0.** The broker
+  (transient + Raft-replicated quorum + redb-durable queues, clustering with
+  leader routing, policies, transactions, management endpoint) ships as a
+  library crate and the `ramqp-brokerd` daemon (`cargo install ramqp-broker`).
+  Its config types (`BrokerConfig`, `QueuePolicy`, `OverflowBehavior`,
+  `ClusterMemberConfig`) are now `#[non_exhaustive]` — construct via
+  `Default`/`new` and set fields — so future knobs arrive without build
+  breaks. Pre-1.0: the Rust API may still change additively across 0.x.
+
+### Fixed
+- **`ramqp-core` (0.2.5): a session now keys links by (name, role), not name
+  alone.** AMQP 1.0 §2.6.1 identifies a link by container-id + name + *role*, so
+  a peer may open a sender and a receiver that share a link name on one session.
+  The engine previously keyed by name only, so the second same-named attach was
+  misrouted and dropped — breaking Apache Qpid Proton, whose default link names
+  are derived from the address (identical for both directions). Found by the new
+  broker↔proton interop leg; regression-tested in `ramqp-core`. The `ramqp`
+  client is unaffected in practice (it generates unique link names), but ships
+  the corrected engine.
+
 ## [0.8.1] - 2026-07-13
 
 ### Security
diff --git a/Cargo.lock b/Cargo.lock
index 2086ac8..e4836ad 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -125,9 +125,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "bitvec"
@@ -161,9 +161,9 @@ dependencies = [
 
 [[package]]
 name = "borsh"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f3f6da4992df95bbcd9af42a6c7dcb994498fc9048230405f3b36ff7cd3f145"
+checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f"
 dependencies = [
  "borsh-derive",
  "bytes",
@@ -172,15 +172,15 @@ dependencies = [
 
 [[package]]
 name = "borsh-derive"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8fb4fb5740e4b2c4884ff95f5f32f5e8479db1e8fd8eb49ddbe09eb09bb7c"
+checksum = "d8f347189c62a579b8cd5f80714efa178f52e461dc2e6d701d264f5ff22e566c"
 dependencies = [
  "once_cell",
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -225,9 +225,9 @@ dependencies = [
 
 [[package]]
 name = "bytes"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
  "serde",
 ]
@@ -240,9 +240,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.65"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -256,9 +256,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chrono"
@@ -302,9 +302,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -312,9 +312,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -331,7 +331,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -438,9 +438,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -448,18 +448,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crunchy"
@@ -516,7 +516,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -527,7 +527,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -553,7 +553,7 @@ checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "unicode-xid",
 ]
 
@@ -587,7 +587,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -626,9 +626,9 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fe2o3-amqp"
-version = "0.15.1"
+version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc5827661e79f2c6f06bd7ceac88fcd47cb9359cf632fe730652c74eb970c49a"
+checksum = "8d9de0ffb697049b46177ccb5ed8102d8bc61d657be54678efdfd4ec7b6a33d8"
 dependencies = [
  "bytes",
  "fe2o3-amqp-types",
@@ -759,7 +759,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -896,9 +896,9 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.12"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
  "typenum",
 ]
@@ -929,12 +929,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -942,9 +943,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -955,9 +956,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -969,15 +970,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -989,15 +990,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1027,9 +1028,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -1070,9 +1071,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.102"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1135,15 +1136,15 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "wasi",
@@ -1217,7 +1218,7 @@ dependencies = [
  "futures",
  "maplit",
  "openraft-macros",
- "rand 0.8.6",
+ "rand 0.8.7",
  "serde",
  "thiserror 1.0.69",
  "tokio",
@@ -1236,7 +1237,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "semver",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1261,7 +1262,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1289,7 +1290,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7d950ca161dc355eaf28f82b11345ed76c6e1f6eb1f4f4479e0323b9e2fbd0e"
 dependencies = [
  "num-traits",
- "rand 0.8.6",
+ "rand 0.8.7",
  "serde",
 ]
 
@@ -1359,7 +1360,7 @@ checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1493,7 +1494,7 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "ramqp"
-version = "0.8.1"
+version = "0.8.2"
 dependencies = [
  "base64",
  "bytes",
@@ -1534,7 +1535,7 @@ dependencies = [
 
 [[package]]
 name = "ramqp-broker"
-version = "0.8.29"
+version = "0.9.0"
 dependencies = [
  "bytes",
  "futures-util",
@@ -1553,7 +1554,7 @@ dependencies = [
 
 [[package]]
 name = "ramqp-core"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "base64",
  "bytes",
@@ -1571,9 +1572,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -1583,9 +1584,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -1685,14 +1686,14 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1702,9 +1703,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1779,7 +1780,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "rand 0.8.6",
+ "rand 0.8.7",
  "rkyv",
  "serde",
  "serde_json",
@@ -1801,9 +1802,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
 dependencies = [
  "once_cell",
  "ring",
@@ -1815,9 +1816,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
  "zeroize",
 ]
@@ -1835,9 +1836,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "same-file"
@@ -1945,7 +1946,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1975,7 +1976,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1999,14 +2000,14 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "sha1"
-version = "0.10.6"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
@@ -2080,9 +2081,9 @@ checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "socket2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -2130,9 +2131,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2147,7 +2148,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2195,7 +2196,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2206,14 +2207,14 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
@@ -2260,9 +2261,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -2275,9 +2276,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
 dependencies = [
  "bytes",
  "libc",
@@ -2292,13 +2293,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2368,9 +2369,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.12+spec-1.1.0"
+version = "0.25.13+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
 dependencies = [
  "indexmap",
  "toml_datetime",
@@ -2406,7 +2407,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2469,8 +2470,8 @@ dependencies = [
  "http",
  "httparse",
  "log",
- "rand 0.9.4",
- "sha1 0.10.6",
+ "rand 0.9.5",
+ "sha1 0.10.7",
  "thiserror 2.0.18",
 ]
 
@@ -2557,9 +2558,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.3"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -2568,9 +2569,9 @@ dependencies = [
 
 [[package]]
 name = "validit"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4efba0434d5a0a62d4f22070b44ce055dc18cb64d4fa98276aa523dadfaba0e7"
+checksum = "4417835826b78aa6265724624d424df2b1e6e71a33329227d8b04a88950780dc"
 dependencies = [
  "anyerror",
 ]
@@ -2611,18 +2612,18 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
  "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -2633,9 +2634,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2643,22 +2644,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
@@ -2679,9 +2680,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.102"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2748,7 +2749,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2759,7 +2760,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2870,18 +2871,18 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "wit-bindgen"
-version = "0.46.0"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
@@ -2917,28 +2918,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.52"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.52"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2958,7 +2959,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "synstructure",
 ]
 
@@ -2998,11 +2999,11 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/README.md b/README.md
index babdfbe..6712514 100644
--- a/README.md
+++ b/README.md
@@ -12,9 +12,9 @@ broker — with no external AMQP dependencies anywhere.
 
 | Crate | What it is | Status |
 |---|---|---|
-| [`ramqp`](https://crates.io/crates/ramqp) | The async **client** — connects to RabbitMQ 4.x, ActiveMQ Artemis, and other AMQP 1.0 brokers | Published (0.7.2; 0.8.1 pending — see [Upgrading to 0.8](#upgrading-to-08)) |
-| `ramqp-core` | The role-agnostic **engine**: clean-room codec + type system, framing, session/link state machines, SASL (both directions) | 0.2.4, publishes together with `ramqp` 0.8.1 |
-| `ramqp-broker` | The **broker**: store-and-forward AMQP 1.0 server with transient + Raft-replicated quorum queues | In development, working — see [The broker](#the-broker-ramqp-broker) |
+| [`ramqp`](https://crates.io/crates/ramqp) | The async **client** — connects to RabbitMQ 4.x, ActiveMQ Artemis, and other AMQP 1.0 brokers | Published (0.8.1 — see [Upgrading to 0.8](#upgrading-to-08)) |
+| [`ramqp-core`](https://crates.io/crates/ramqp-core) | The role-agnostic **engine**: clean-room codec + type system, framing, session/link state machines, SASL (both directions) | Published (0.2.4) |
+| `ramqp-broker` | The **broker**: store-and-forward AMQP 1.0 server with transient, durable, and Raft-replicated quorum queues | Working, pre-1.0 — first crates.io release (0.9.0) ships with the next tag; see [The broker](#the-broker-ramqp-broker) |
 
 Everything is `#![forbid(unsafe_code)]`, async-first, and MIT.
 
@@ -106,7 +106,7 @@ What's new is *optional*, for your `Cargo.toml` only if you want it:
 ```toml
 ramqp = "0.8"          # the client, exactly as before
 ramqp-core = "0.2"     # just the engine (codec/types/state machines), no client
-ramqp-broker = "0.1"   # embed the broker (pre-alpha; API unstable, not yet published)
+ramqp-broker = "0.9"   # embed the broker (working, pre-1.0; config API still settling)
 ```
 
 A client-only build never compiles broker code, and vice versa — isolation is
@@ -117,7 +117,9 @@ by crate boundary, not feature flags.
 ## The broker (`ramqp-broker`)
 
 A performance-first, highly-available AMQP 1.0 broker on the same clean-room
-engine. **In development and moving fast** — the design, targets, and phased
+engine. **Working, pre-1.0** — the wire behavior is exercised by conformance,
+cross-client interop, and partition/chaos suites; the Rust config API is
+still settling (`#[non_exhaustive]` types). The design, targets, and phased
 plan live in [`broker.md`](broker.md); its §11 checkboxes are the live status.
 
 Working today:
diff --git a/RELEASING.md b/RELEASING.md
index 41fcad6..b061c4b 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -9,7 +9,7 @@ releases work. This page is the checklist.
 |---|---|---|
 | `ramqp-core` | new name (verified available) | **Yes — and always first** |
 | `ramqp` | exists (0.7.2 published) | Yes, after `ramqp-core` |
-| `ramqp-broker` | new name (verified available) | **Not yet** — pre-alpha API; publish once it stabilizes |
+| `ramqp-broker` | first publish: **0.9.0** | Yes — after `ramqp-core` (its only registry dependency; the `ramqp` dev-dependency is path-only and stripped at packaging) |
 | `ramqp-bench-compare` | — | Never (`publish = false`; keeps the `fe2o3-amqp` dev dependency out of the graph) |
 
 ## Why order matters (the Cargo.toml mechanics)
@@ -29,7 +29,11 @@ fails unless a matching `ramqp-core` already exists on crates.io. Hence:
 3. `cargo publish -p ramqp`
 
 `ramqp-broker/Cargo.toml` has the same shaped dependency on `ramqp-core`, so
-the same rule applies whenever it starts publishing.
+the same rule applies to it: core first, then the broker (`release.yml` does
+core → ramqp → broker). The broker's first-ever publish needs the token to
+have the **publish-new** scope, and it resets the version to a deliberate
+**0.9.0** (the pre-publish 0.8.x patch numbers were per-commit workspace
+churn, not a release cadence).
 
 ### Keeping the version pins in sync
 
diff --git a/bench-compare/README.md b/bench-compare/README.md
index c28e8fc..5e9245a 100644
--- a/bench-compare/README.md
+++ b/bench-compare/README.md
@@ -229,3 +229,42 @@ Known limitation (documented in the code): a paged queue's snapshot keeps
 spilled bodies **external** (node-local refs) — follower catch-up *via
 snapshot* for a deep paged queue is not yet supported (log-replay catch-up
 is); segment shipping is the follow-up.
+
+## Tuned-incumbent re-run — Phase 10 (provisional)
+
+The Phase 4/6 tables above ran RabbitMQ at stock defaults; broker.md §3.4 asks
+for a re-run against a **tuned** incumbent, and for the quorum leg to be
+**durability-parity** (our quorum fsyncs its Raft log via `store-redb`, matched
+against RabbitMQ's fsync-backed quorum queue — closing the "in-memory vs fsync"
+caveat that made the Phase 6 quorum gap partly a durability gap). Every leg here
+runs **over loopback TCP against a broker process**, so the transport path is
+identical for all rows (the Phase 4 table compared ours in-process vs RabbitMQ
+in docker; this is fairer).
+
+Closed-loop e2e latency, µs, 20 000 samples ([`tuned/rabbitmq.conf`](tuned/rabbitmq.conf);
+tuned Artemis = NIO journal + autotune off). Representative run:
+
+| leg | p50 | p99 | p99.9 |
+|---|--:|--:|--:|
+| ramqp-broker transient            | 93.7 | 263.0 | 340.4 |
+| RabbitMQ 4.x classic (**tuned**)  | 249.1 | 467.4 | 650.6 |
+| Artemis (**tuned**, NIO)          | 292.1 | 704.2 | 1132.5 |
+| ramqp-broker quorum (`store-redb`, fsync) | 304.3 | 665.3 | 866.9 |
+| RabbitMQ 4.x quorum (fsync)       | 2260.5 | 3834.4 | 7303.2 |
+
+The headline holds under tuning and at durability parity: transient p50 ≈ 2.7×
+below tuned RabbitMQ classic and ≈ 3× below tuned Artemis, and — the point of
+the re-run — our **fsync-backed quorum** is ≈ 7× below RabbitMQ's fsync quorum,
+so the Phase 6 gap was *not* merely a durability artifact.
+
+> **⚠️ PROVISIONAL — indicative only.** These numbers were taken on a
+> shared/virtualized box (WSL2), not quiet bare metal, so they are directional,
+> not the "defend-forever" figures broker.md §3.4 requires. Reproduce (and
+> generate the real numbers on isolated hardware) with the one command:
+>
+> ```sh
+> bench-compare/tuned/run.sh    # stands up tuned RabbitMQ (5673) + Artemis (5674), runs all legs
+> ```
+>
+> Remaining §3.4 items: the bare-metal run, and a latency-under-N-concurrent-
+> connections sweep (this table is single-connection closed-loop).
diff --git a/bench-compare/src/bin/depth.rs b/bench-compare/src/bin/depth.rs
index a6e813b..02fe774 100644
--- a/bench-compare/src/bin/depth.rs
+++ b/bench-compare/src/bin/depth.rs
@@ -65,12 +65,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let samples = env_usize("DEPTH_SAMPLES", 2_000);
     let data_dir = std::env::var("DEPTH_DATA_DIR").ok();
 
-    let config = ramqp_broker::BrokerConfig {
-        max_queue_depth: target + samples * 8 + 10_000,
-        data_dir: data_dir.clone().map(Into::into),
-        resident_bytes_max: env_usize("DEPTH_RESIDENT_MAX", 64 * 1024 * 1024),
-        ..Default::default()
-    };
+    let mut config = ramqp_broker::BrokerConfig::default();
+    config.max_queue_depth = target + samples * 8 + 10_000;
+    config.data_dir = data_dir.clone().map(Into::into);
+    config.resident_bytes_max = env_usize("DEPTH_RESIDENT_MAX", 64 * 1024 * 1024);
     if let Some(dir) = &data_dir {
         // Fresh run: stale spill/snapshot dirs would skew nothing, but a
         // stale durable store would.
@@ -143,7 +141,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         received += 1;
         if received == filled {
             last = Some(d);
-        } else if received % 64 == 0 {
+        } else if received.is_multiple_of(64) {
             consumer.accept_through(&d).await?;
         }
     }
diff --git a/bench-compare/src/bin/drain.rs b/bench-compare/src/bin/drain.rs
index 1d0d7bf..a9315de 100644
--- a/bench-compare/src/bin/drain.rs
+++ b/bench-compare/src/bin/drain.rs
@@ -12,14 +12,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let session = conn.begin_session().await?;
     let mut consumer = session.create_consumer(&address).await?;
     let mut drained = 0usize;
-    loop {
-        match tokio::time::timeout(std::time::Duration::from_secs(1), consumer.recv()).await {
-            Ok(Ok(d)) => {
-                drained += 1;
-                consumer.accept(&d).await?;
-            }
-            _ => break,
-        }
+    while let Ok(Ok(d)) =
+        tokio::time::timeout(std::time::Duration::from_secs(1), consumer.recv()).await
+    {
+        drained += 1;
+        consumer.accept(&d).await?;
     }
     println!("drained {drained} leftover messages from {address}");
     conn.close().await?;
diff --git a/bench-compare/tuned/rabbitmq.conf b/bench-compare/tuned/rabbitmq.conf
new file mode 100644
index 0000000..1a45546
--- /dev/null
+++ b/bench-compare/tuned/rabbitmq.conf
@@ -0,0 +1,26 @@
+# Latency-tuned RabbitMQ 4.x config for the ramqp-broker comparison.
+#
+# The published Phase 4/6 tables ran RabbitMQ at stock defaults; broker.md §3.4
+# calls for a re-run against a *tuned* incumbent so the comparison isn't
+# flattered by the incumbent's out-of-box settings. This gives RabbitMQ its
+# best shot: cut per-message and per-connection overhead, and keep the
+# scheduler/GC quiet during a run.
+
+# Low latency: disable Nagle on the AMQP listener.
+tcp_listen_options.nodelay = true
+
+# Don't let the memory alarm throttle publishers mid-run on a busy box.
+vm_memory_high_watermark.relative = 0.8
+
+# Management/stats collection adds per-message and periodic overhead; stretch
+# the interval right out (we read results from the bench, not the UI).
+collect_statistics_interval = 60000
+
+# Bigger frames + more channels so the client-side credit window isn't the
+# bottleneck (the bench uses a 1000-credit window).
+frame_max = 1048576
+channel_max = 2047
+
+# Classic-queue v2 index/store defaults are fine on 4.x; the durability-parity
+# leg declares a quorum queue (x-queue-type=quorum) which fsyncs its Raft log —
+# the apples-to-apples comparison against ramqp-broker's store-redb quorum.
diff --git a/bench-compare/tuned/run.sh b/bench-compare/tuned/run.sh
new file mode 100755
index 0000000..080b95b
--- /dev/null
+++ b/bench-compare/tuned/run.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# Tuned-incumbent comparison for broker.md §3.4 / Phase 10: re-run the closed-
+# loop latency bench against a *tuned* RabbitMQ (rabbitmq.conf here) instead of
+# stock defaults, plus a durability-parity quorum leg (our store-redb quorum vs
+# RabbitMQ's fsync-backed quorum queue).
+#
+# Fairness note: unlike the original Phase 4 table (ours in-process vs RabbitMQ
+# in docker), EVERY leg here runs over loopback TCP against a broker PROCESS, so
+# the transport path is identical for all rows.
+#
+#   bench-compare/tuned/run.sh
+#
+# Emits a Markdown table to stdout and to $OUT (default bench-compare/tuned/
+# results.md). Requires docker + cargo. Numbers from a shared/virtualized box
+# (e.g. WSL2) are INDICATIVE ONLY — see the caveat the script prints.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+OUT="${OUT:-$HERE/results.md}"
+LAT_N="${LAT_N:-20000}"
+RABBIT_IMAGE="${RABBIT_IMAGE:-rabbitmq:4-management}"
+BRK="$ROOT/target/release/ramqp-brokerd"
+LAT="$ROOT/target/release/latency"
+
+OURS_PORT=5680
+OURS_Q_PORT=5681
+# Non-default host ports so a pre-existing dev `rabbit` on 5672/15672 is untouched.
+RABBIT_PORT="${RABBIT_PORT:-5673}"
+RABBIT_MGMT_PORT="${RABBIT_MGMT_PORT:-15673}"
+declare -a PIDS=()
+DATA_DIR="$(mktemp -d)"
+
+ARTEMIS_IMAGE="${ARTEMIS_IMAGE:-apache/activemq-artemis:latest-alpine}"
+ARTEMIS_PORT="${ARTEMIS_PORT:-5674}"
+ARTEMIS_CORE_PORT="${ARTEMIS_CORE_PORT:-61617}"
+
+cleanup() {
+    set +e
+    for p in "${PIDS[@]:-}"; do kill "$p" 2>/dev/null; done
+    pkill -f "$BRK" 2>/dev/null
+    docker rm -f rabbit-tuned artemis-tuned >/dev/null 2>&1
+    rm -rf "$DATA_DIR"
+}
+trap cleanup EXIT
+
+echo ">> building release bench + brokerd (store-redb) ..."
+cargo build -p ramqp-bench-compare --release --bin latency >/dev/null
+cargo build -p ramqp-broker --release --bin ramqp-brokerd --features store-redb >/dev/null
+
+# --- tuned RabbitMQ ------------------------------------------------------
+echo ">> starting tuned RabbitMQ ($RABBIT_IMAGE) ..."
+docker rm -f rabbit-tuned >/dev/null 2>&1 || true
+docker run -d --name rabbit-tuned \
+    -p $RABBIT_PORT:5672 -p $RABBIT_MGMT_PORT:15672 \
+    -v "$HERE/rabbitmq.conf:/etc/rabbitmq/conf.d/10-tuned.conf:ro" \
+    "$RABBIT_IMAGE" >/dev/null
+echo ">> waiting for RabbitMQ management ..."
+for _ in $(seq 1 60); do
+    if curl -fsS -u guest:guest http://localhost:$RABBIT_MGMT_PORT/api/overview >/dev/null 2>&1; then break; fi
+    sleep 2
+done
+curl -fsS -u guest:guest -X PUT http://localhost:$RABBIT_MGMT_PORT/api/queues/%2F/rq_classic \
+    -H content-type:application/json -d '{"durable":true}' >/dev/null
+curl -fsS -u guest:guest -X PUT http://localhost:$RABBIT_MGMT_PORT/api/queues/%2F/rq_quorum \
+    -H content-type:application/json -d '{"durable":true,"arguments":{"x-queue-type":"quorum"}}' >/dev/null
+echo ">> RabbitMQ queues declared (rq_classic, rq_quorum)."
+
+# --- tuned Artemis -------------------------------------------------------
+# Tuning applied at `artemis create` time (ARTEMIS_EXTRA_ARGS): NIO journal,
+# autotune off, no message paging cap — a low-latency, throughput-oriented
+# config (its best shot, mirroring the RabbitMQ tuning intent).
+echo ">> starting tuned Artemis ($ARTEMIS_IMAGE) ..."
+docker rm -f artemis-tuned >/dev/null 2>&1 || true
+docker run -d --name artemis-tuned \
+    -p $ARTEMIS_PORT:5672 -p $ARTEMIS_CORE_PORT:61616 \
+    -e ARTEMIS_USER=guest -e ARTEMIS_PASSWORD=guest \
+    -e "ARTEMIS_EXTRA_ARGS=--no-autotune --journal-type NIO --global-max-messages -1 --relax-jolokia --http-host 0.0.0.0" \
+    "$ARTEMIS_IMAGE" >/dev/null
+echo ">> waiting for Artemis + declaring an ANYCAST queue ..."
+artemis_ready=0
+for _ in $(seq 1 40); do
+    if docker exec artemis-tuned /var/lib/artemis-instance/bin/artemis queue create \
+        --name bench_artemis --address bench_artemis --anycast --durable \
+        --preserve-on-no-consumers --auto-create-address \
+        --url "tcp://localhost:61616" --user guest --password guest --silent >/dev/null 2>&1; then
+        artemis_ready=1
+        break
+    fi
+    sleep 2
+done
+[ "$artemis_ready" -eq 1 ] && echo ">> Artemis queue declared (bench_artemis)." \
+    || echo "!! Artemis did not become ready — its rows will show n/a."
+
+# --- our broker: transient + durable single-node quorum ------------------
+echo ">> starting ramqp-brokerd (transient) on :$OURS_PORT ..."
+RAMQP_LISTEN=127.0.0.1:$OURS_PORT "$BRK" >"$DATA_DIR/ours.log" 2>&1 &
+PIDS+=($!)
+echo ">> starting ramqp-brokerd (durable single-node quorum, store-redb) on :$OURS_Q_PORT ..."
+RAMQP_LISTEN=127.0.0.1:$OURS_Q_PORT \
+    RAMQP_NODE_ID=1 RAMQP_CLUSTER_LISTEN=127.0.0.1:7481 RAMQP_SEEDS=1=127.0.0.1:7481 \
+    RAMQP_DATA_DIR="$DATA_DIR/redb" "$BRK" >"$DATA_DIR/ours-q.log" 2>&1 &
+PIDS+=($!)
+sleep 5
+
+# --- run one latency leg, extract p50/p99/p99.9 --------------------------
+# usage: leg <label> <url|-> <address>   ('-' url means in-process, unused here)
+run_leg() {
+    local label="$1" url="$2" addr="$3" line
+    if line="$(LAT_URL="$url" LAT_ADDRESS="$addr" LAT_N="$LAT_N" "$LAT" 2>/dev/null \
+        | grep -E 'latency .* p50')"; then
+        local p50 p99 p999
+        p50="$(echo "$line" | sed -n 's/.*p50 \([0-9.]*\).*/\1/p')"
+        p99="$(echo "$line" | sed -n 's/.*p99 \([0-9.]*\).*p99\.9.*/\1/p')"
+        p999="$(echo "$line" | sed -n 's/.*p99\.9 \([0-9.]*\).*/\1/p')"
+        printf '| %-34s | %8s | %8s | %8s |\n' "$label" "${p50:-?}" "${p99:-?}" "${p999:-?}"
+    else
+        printf '| %-34s | %8s | %8s | %8s |\n' "$label" "n/a" "n/a" "n/a"
+    fi
+}
+
+echo ">> running latency legs ($LAT_N samples each) ..."
+{
+    echo "## Tuned-incumbent latency (provisional)"
+    echo
+    echo "Closed-loop e2e latency, µs — all legs over loopback TCP, $LAT_N samples."
+    echo
+    echo "| leg | p50 | p99 | p99.9 |"
+    echo "|---|--:|--:|--:|"
+    run_leg "ramqp-broker transient"            "amqp://127.0.0.1:$OURS_PORT"   "/queues/bench"
+    run_leg "RabbitMQ 4.x classic (tuned)"      "amqp://guest:guest@127.0.0.1:$RABBIT_PORT" "/queues/rq_classic"
+    run_leg "Artemis (tuned, NIO)"              "amqp://guest:guest@127.0.0.1:$ARTEMIS_PORT" "bench_artemis"
+    run_leg "ramqp-broker quorum (store-redb)"  "amqp://127.0.0.1:$OURS_Q_PORT" "/quorum/bench"
+    run_leg "RabbitMQ 4.x quorum (fsync)"       "amqp://guest:guest@127.0.0.1:$RABBIT_PORT" "/queues/rq_quorum"
+} | tee "$OUT"
+
+echo
+echo ">> results written to $OUT"
+echo "!! PROVISIONAL: numbers from a shared/virtualized box are indicative only;"
+echo "!! the defend-forever figures come from quiet bare metal (same script)."
diff --git a/broker.md b/broker.md
index 666f24c..230f17c 100644
--- a/broker.md
+++ b/broker.md
@@ -6,7 +6,7 @@ shared `ramqp-core`, then adding a server crate on top. Clean-room, no external
 AMQP dependencies (same constraint as the client). Clustered from v1; single
 protocol, done excellently; **fast and light before anything else**.
 
-> **Status: building — Phases 0–9 complete; Phase 10 partially done** (fe2o3 interop, in-process fault injection, and the runtime decision are in; external-toolchain interop legs, a unified conformance harness, process-level partition testing, and tuned-incumbent benchmarks remain). See §11 checkboxes. The broker runs **clustered**:
+> **Status: building — Phases 0–9 complete; Phase 10 substantially done** (in CI/verified: fe2o3 + Qpid JMS + Qpid Proton interop against our broker, the unified conformance harness, in-process fault injection **and** process-level netns split-brain with a concurrent load sweep, the runtime decision, and the tuned-incumbent + durability-parity + Artemis-tuned bench re-run (provisional). Remaining: bare-metal bench numbers, a latency-under-N-connections bench sweep, and — deferred — our-client⇄Qpid Broker-J (image-config quirk, already covered by the RabbitMQ + Artemis interop jobs)). See §11 checkboxes. The broker runs **clustered**:
 > a 3-node cluster forms from static seeds over the inter-node fabric (one
 > multiplexed TCP connection per peer pair carrying every Raft group + the
 > forwarded data plane), quorum queues are declared through the replicated
@@ -515,11 +515,11 @@ link/session → negotiate/mux/heartbeat → txn/sasl splits.
 - [x] Management/admin API + Prometheus metrics export (off the hot path): `BrokerConfig::management_listen` / brokerd `--management-listen` serves a dependency-free HTTP endpoint — `GET /metrics` (Prometheus text: connections, RSS, per-queue ready/unacked/consumer gauges) and `GET /queues` (JSON inspection). All queue stats are collected at scrape time by asking the actors (a `Stats` mailbox message) — nothing on the message path. Queue delete + a richer admin protocol ride with the management follow-up. Commit.
 
 ### Phase 10 — Interop, conformance, perf, docs 🟡 (external-toolchain legs remain)
-- [~] Interop matrix: **our-client⇄our-broker is in CI** (the same `tests/broker.rs` suite that runs against RabbitMQ/Artemis, run against ramqp-broker); **`fe2o3-amqp`⇄our-broker landed** (`bench-compare/tests/fe2o3_interop.rs`: an independent AMQP 1.0 implementation exercises our handshake, links, transfers, dispositions incl. release/redelivery, and quorum queues). Remaining: Qpid/proton and JMS client legs (external toolchains) and our-client⇄Qpid broker.
-- [~] Spec conformance: core carries golden byte-vector codec tests + a spec-conformance audit; broker-side conformance lives across `tests/adversarial.rs` (duplicate open, unmapped channels, oversized frames, slow-loris), the smoke/flow/settlement suites, and the SASL/SCRAM RFC vectors. A dedicated single conformance harness (framing/flow/settlement/error-condition matrix in one place) remains.
-- [~] **Jepsen-style HA fault injection** — landed in-process: kill-the-leader-mid-stream zero-accepted-loss (3 scopes), **rolling leader kills to the availability boundary** (2/3 alive → recovers and accepts; 1/3 alive → quorum lost → publishes cleanly refused, never silently accepted, never hung — CP behavior verified), and **follower-loss transparency** (no refusals, no loss). The rolling-kill test flushed out a real bug: a dying node's still-open fabric connections could lazily resurrect an EMPTY group member, whose conflict replies below the leader's matched index panic openraft ("follower log reversion") — nodes now refuse member creation once stopping. Remaining: true network partitions/split-brain via process-level fault injection (iptables/namespaces) under sustained load.
+- [x] Interop matrix: **our-client⇄our-broker is in CI** (the same `tests/broker.rs` suite that runs against RabbitMQ/Artemis, run against ramqp-broker); **`fe2o3-amqp`⇄our-broker landed** (`bench-compare/tests/fe2o3_interop.rs`: an independent AMQP 1.0 implementation exercises our handshake, links, transfers, dispositions incl. release/redelivery, and quorum queues); **Apache Qpid JMS⇄our-broker landed** (`tests/jms_interop.rs` + `tests/interop/jms/`, CI job `interop-jms`: the pure-Java Qpid JMS 2.x client round-trips through our broker); **Apache Qpid Proton (Python/C)⇄our-broker landed** (`tests/interop/proton/`, CI job `interop-proton`) — a third independent stack. The proton leg flushed out a real engine bug: `ramqp-core` keyed session links by name alone, so proton's identical sender/receiver link names (both derived from the address) collided; fixed to key by (name, role) per §2.6.1 (core 0.2.5, regression-tested). All verified locally. our-client⇄Qpid Broker-J: **deferred** — our client's reference-broker interop is already covered by the RabbitMQ + Artemis CI jobs, and adding Broker-J stalled on the `apache/qpid-broker-j` image (no env-var substitution for its admin creds, Plain-only auth, REST 405 on queue create) rather than anything in rAMQP; see `tests/interop/README.md`.
+- [x] Spec conformance: core carries golden byte-vector codec tests + a spec-conformance audit; the SASL/SCRAM RFC vectors live in `ramqp-core`. **The single broker-side conformance harness landed** (`tests/conformance.rs` + the shared `tests/harness/`): one matrix across framing (header/open, directional max-frame), error-conditions (each violation asserts the *exact* `amqp:*` condition symbol — duplicate open, unmapped channel, slow-loris), flow (credit ceiling via manual-credit client), and settlement (terminal `accepted` removes the message). The old `tests/adversarial.rs` raw-socket cases were folded in (and its `error.is_some()` checks tightened to exact symbols); behavioral queue semantics stay in `produce_consume`/`quorum_queue`.
+- [~] **Jepsen-style HA fault injection** — landed in-process: kill-the-leader-mid-stream zero-accepted-loss (3 scopes), **rolling leader kills to the availability boundary** (2/3 alive → recovers and accepts; 1/3 alive → quorum lost → publishes cleanly refused, never silently accepted, never hung — CP behavior verified), and **follower-loss transparency** (no refusals, no loss). The rolling-kill test flushed out a real bug: a dying node's still-open fabric connections could lazily resurrect an EMPTY group member, whose conflict replies below the leader's matched index panic openraft ("follower log reversion") — nodes now refuse member creation once stopping. **Process-level split-brain landed** (`tests/partition/run.sh` + the `partition_probe` example, CI job `partition`): a 3-node quorum cluster across real Linux network namespaces, iptables-partitioned into majority/minority — majority stays available (including an 8-connection × 5-publish concurrent **load sweep** driven through the partition), minority refuses (never silently accepts), and no committed message is lost on heal. Verified locally.
 - [x] **Runtime-model escalation decision (§3.3): STAY on tokio work-stealing (revisit-on-evidence).** The benchmark decides, and the benchmark says the targets are met without escalation: p50 92µs / p99.9 260–430µs single-connection (2–3× below both incumbents at every percentile), p99.9/p50 ≈ 3–5× (target ≤10×), tails flat from empty to 1M-deep queues. Escalation triggers that reopen this: p99.9/p50 exceeding ~10× under multi-connection load, per-core throughput scaling flattening below ~linear, or a competitor benchmark demonstrating a tail gap attributable to scheduler jitter. The dispatch layer remains shard-partitioned (per-queue actors, per-connection tasks) so sharded-tokio/io_uring stays a cheap move.
-- [~] Publish the full tail-latency/RSS comparison vs tuned incumbents: the published matrix (bench-compare/README) covers transient/quorum/clustered/deep-queue legs vs **default-config** RabbitMQ 4.3.1 and Artemis with honest caveats; the **tuned**-incumbent isolated re-run (and the Phase-7 durability-parity quorum re-run vs fsync-backed RabbitMQ) remains the standing §3.4 deliverable. README + docs updated per phase. Commit.
+- [~] Publish the full tail-latency/RSS comparison vs tuned incumbents: the published matrix (bench-compare/README) covers transient/quorum/clustered/deep-queue legs vs **default-config** RabbitMQ 4.3.1 and Artemis with honest caveats. **Tuned re-run + durability-parity quorum landed** (`bench-compare/tuned/`: `rabbitmq.conf` + one-command `run.sh`, all legs over loopback TCP for identical transport): transient p50 ≈ 2.8× below *tuned* RabbitMQ classic, and — closing the "in-memory vs fsync" caveat — our `store-redb` fsync quorum p50 ≈ 8× below RabbitMQ's fsync quorum. **Tuned Artemis leg added** too (NIO journal, autotune off): transient p50 ≈ 3× below it. **Numbers are provisional (WSL2, indicative only)**; the defend-forever figures come from quiet bare metal via the same script. Remaining: bare-metal run, and a latency-under-N-concurrent-connections sweep (the table is single-connection closed-loop). README + docs updated per phase.
 
 ---
 
diff --git a/ramqp-broker/Cargo.toml b/ramqp-broker/Cargo.toml
index 7df08f3..111f179 100644
--- a/ramqp-broker/Cargo.toml
+++ b/ramqp-broker/Cargo.toml
@@ -1,19 +1,25 @@
 [package]
 name = "ramqp-broker"
-version = "0.8.29"
+version = "0.9.0"
 edition = "2024"
-description = "A performance-first, highly-available AMQP 1.0 broker in Rust (in development)."
+description = "A performance-first, highly-available AMQP 1.0 broker in Rust: transient, durable, and Raft-replicated quorum queues."
 license = "MIT"
 repository = "https://github.com/ZerosAndOnesLLC/rAMQP"
+readme = "README.md"
 keywords = ["amqp", "amqp1", "broker", "messaging", "async"]
 categories = ["network-programming", "asynchronous"]
-# Held back from crates.io: pre-alpha API surface (config/auth/addressing still
-# moving). Publish deliberately once it stabilizes — until then this guard stops
-# an accidental `cargo publish -p ramqp-broker`. (RELEASING.md, Option A.)
-publish = false
+
+# The integration tests drive the broker with the `ramqp` client, a path-only
+# dev-dependency that packaging strips — so inside the published .crate they
+# could never compile. Keep them out of the package (they live in the repo).
+exclude = ["tests"]
+
+[package.metadata.docs.rs]
+# Build docs with every feature so `/durable/*` (store-redb) items appear.
+all-features = true
 
 [dependencies]
-ramqp-core = { path = "../ramqp-core", version = "0.2.4", features = ["transaction", "scram"] }
+ramqp-core = { path = "../ramqp-core", version = "0.2.5", features = ["transaction", "scram"] }
 bytes = { version = "1", features = ["serde"] }
 futures-util = "0.3"
 tokio = { version = "1", features = ["sync", "io-util", "net", "rt", "rt-multi-thread", "macros", "time", "signal"] }
diff --git a/ramqp-broker/README.md b/ramqp-broker/README.md
index ada6c80..4daf27d 100644
--- a/ramqp-broker/README.md
+++ b/ramqp-broker/README.md
@@ -1,13 +1,17 @@
 # ramqp-broker
 
 A **performance-first, highly-available AMQP 1.0 broker** in Rust, built on
-[`ramqp-core`](../ramqp-core) — the same clean-room protocol engine as the
-[`ramqp`](https://crates.io/crates/ramqp) client.
-
-> **Status: in development, working.** The design, performance targets, and
-> phased plan live in [`broker.md`](../broker.md) at the repository root; its
-> §11 checkboxes are the live status. Not yet published to crates.io (the API
-> is pre-alpha).
+[`ramqp-core`](https://crates.io/crates/ramqp-core) — the same clean-room
+protocol engine as the [`ramqp`](https://crates.io/crates/ramqp) client.
+
+> **Status: working, pre-1.0.** The wire protocol, queue semantics, and HA
+> behavior are exercised by a conformance suite, cross-client interop
+> (`ramqp`, `fe2o3-amqp`, Qpid JMS, Qpid Proton), and partition/chaos tests.
+> The **Rust API is still settling** (config types are `#[non_exhaustive]`);
+> expect additive change across 0.x. The design, performance targets, and
+> phased plan live in
+> [`broker.md`](https://github.com/ZerosAndOnesLLC/rAMQP/blob/main/broker.md)
+> in the repository.
 
 ## Working today
 
@@ -40,9 +44,13 @@ A **performance-first, highly-available AMQP 1.0 broker** in Rust, built on
 ## Run it
 
 ```sh
-cargo run -p ramqp-broker --bin ramqp-brokerd -- --listen 0.0.0.0:5672
+cargo install ramqp-broker            # installs the ramqp-brokerd daemon
+ramqp-brokerd --listen 0.0.0.0:5672
 ```
 
+(or from a repo checkout:
+`cargo run -p ramqp-broker --bin ramqp-brokerd -- --listen 0.0.0.0:5672`)
+
 The daemon uses **jemalloc** as its global allocator by default: glibc's malloc
 fragments its per-thread arenas under high connection open/close churn, growing
 RSS and collapsing throughput over a long run (issue #23); jemalloc keeps both
@@ -67,7 +75,8 @@ RAMQP_URL=amqp://localhost:5672 RAMQP_ADDRESS=/queues/demo \
     cargo run -p ramqp --example produce_consume
 ```
 
-Or embed it:
+Or embed it (`ramqp-broker = "0.9"` in `Cargo.toml`; add the `store-redb`
+feature for `/durable/*` queues):
 
 ```rust,no_run
 use ramqp_broker::{Broker, BrokerConfig};
@@ -81,7 +90,9 @@ bound.run().await
 ## Testing
 
 Beyond the in-tree suite (`cargo test --all-features`), a re-runnable battery
-lives in [`scripts/`](scripts) — the same checks build over build, so
+lives in
+[`scripts/`](https://github.com/ZerosAndOnesLLC/rAMQP/tree/main/ramqp-broker/scripts)
+— the same checks build over build, so
 regressions in correctness, memory, HA, interop, or robustness surface before a
 release. It is **not** wired into CI; run it by hand:
 
@@ -96,14 +107,16 @@ nodes with a zero-accepted-loss verifier, plus durable crash recovery), an
 interop matrix (`ramqp` and `fe2o3-amqp` clients × ramqp-broker / RabbitMQ /
 Artemis), robustness floods, and `cargo-fuzz` on the wire decoders. Performance
 (`scripts/bench.sh`) and coverage (`scripts/cov.sh`) are manual and never gate.
-See [`scripts/README.md`](scripts/README.md).
+See
+[`scripts/README.md`](https://github.com/ZerosAndOnesLLC/rAMQP/blob/main/ramqp-broker/scripts/README.md).
 
 ## Numbers
 
 Untuned first numbers vs RabbitMQ 4.3.1 and Artemis on the same machine —
 2–3× lower latency at every percentile, 4–6× the throughput, at a fraction of
 the footprint — with methodology and caveats in
-[`bench-compare/README.md`](../bench-compare/README.md). Performance is the
-product here: targets and the hot-path rules are `broker.md` §3.
+[`bench-compare/README.md`](https://github.com/ZerosAndOnesLLC/rAMQP/blob/main/bench-compare/README.md).
+Performance is the product here: targets and the hot-path rules are
+`broker.md` §3.
 
 `#![forbid(unsafe_code)]`. MIT license.
diff --git a/ramqp-broker/examples/partition_probe.rs b/ramqp-broker/examples/partition_probe.rs
new file mode 100644
index 0000000..2f6fa11
--- /dev/null
+++ b/ramqp-broker/examples/partition_probe.rs
@@ -0,0 +1,226 @@
+//! Partition-test client probe: connect the `ramqp` client to one broker node
+//! and drive a small, timeout-bounded workload, reporting the outcome via the
+//! process exit code. Used by `tests/partition/run.sh` to assert CP behavior
+//! across a real network partition (each invocation runs inside a network
+//! namespace via `ip netns exec`).
+//!
+//! Usage: partition_probe <url> <address> <mode> [count]
+//!   modes:
+//!     expect-accept   — every send must be ACCEPTED within the timeout (exit 0
+//!                       iff all `count` sends succeed)
+//!     expect-refused  — no send may be accepted: each must error, be rejected,
+//!                       or time out (exit 0 iff none were accepted — the
+//!                       silent-loss guard)
+//!     consume         — drain up to `count` messages within a window and print
+//!                       the number received (always exit 0)
+//!     load            — `count` concurrent connections each send `[arg5]`
+//!                       messages; exit 0 iff every send is accepted (a
+//!                       multi-connection availability sweep). Prints
+//!                       "LOADED <accepted>/<expected>".
+
+use std::time::Duration;
+
+use ramqp::{ConnectionBuilder, Message};
+
+const SEND_TIMEOUT: Duration = Duration::from_secs(3);
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+
+#[tokio::main]
+async fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    if args.len() < 4 {
+        eprintln!("usage: partition_probe <url> <address> <mode> [count]");
+        std::process::exit(2);
+    }
+    let url = args[1].clone();
+    let address = args[2].clone();
+    let mode = args[3].clone();
+    let count: usize = args.get(4).and_then(|s| s.parse().ok()).unwrap_or(1);
+
+    let code = match mode.as_str() {
+        "expect-accept" => run_expect_accept(&url, &address, count).await,
+        "expect-refused" => run_expect_refused(&url, &address, count).await,
+        "consume" => run_consume(&url, &address, count).await,
+        "load" => {
+            // load <connections=count(arg4)> <per_conn(arg5)>
+            let connections = count.max(1);
+            let per_conn: usize = args.get(5).and_then(|s| s.parse().ok()).unwrap_or(1);
+            run_load(&url, &address, connections, per_conn).await
+        }
+        other => {
+            eprintln!("unknown mode: {other}");
+            2
+        }
+    };
+    std::process::exit(code);
+}
+
+async fn connect(url: &str) -> Option<ramqp::Connection> {
+    match tokio::time::timeout(CONNECT_TIMEOUT, ConnectionBuilder::new(url).connect()).await {
+        Ok(Ok(c)) => Some(c),
+        Ok(Err(e)) => {
+            eprintln!("connect error: {e}");
+            None
+        }
+        Err(_) => {
+            eprintln!("connect timed out");
+            None
+        }
+    }
+}
+
+/// Every send must be accepted; exit 0 only if all `count` succeed.
+async fn run_expect_accept(url: &str, address: &str, count: usize) -> i32 {
+    let Some(conn) = connect(url).await else {
+        return 1;
+    };
+    let session = match conn.begin_session().await {
+        Ok(s) => s,
+        Err(e) => {
+            eprintln!("session error: {e}");
+            return 1;
+        }
+    };
+    let producer = match session.create_producer(address).await {
+        Ok(p) => p,
+        Err(e) => {
+            eprintln!("producer attach error: {e}");
+            return 1;
+        }
+    };
+    for i in 0..count {
+        match tokio::time::timeout(SEND_TIMEOUT, producer.send(Message::text(format!("m{i}"))))
+            .await
+        {
+            Ok(Ok(_)) => {}
+            Ok(Err(e)) => {
+                eprintln!("send {i} refused (expected accept): {e}");
+                return 1;
+            }
+            Err(_) => {
+                eprintln!("send {i} timed out (expected accept)");
+                return 1;
+            }
+        }
+    }
+    println!("ACCEPTED {count}");
+    let _ = conn.close().await;
+    0
+}
+
+/// No send may be accepted; exit 0 only if every send errors, is rejected, or
+/// times out. An accepted publish without quorum is the silent-loss hazard.
+async fn run_expect_refused(url: &str, address: &str, count: usize) -> i32 {
+    let Some(conn) = connect(url).await else {
+        // Not being able to connect at all still satisfies "nothing accepted".
+        println!("REFUSED {count} (no connection)");
+        return 0;
+    };
+    let session = match conn.begin_session().await {
+        Ok(s) => s,
+        Err(_) => {
+            println!("REFUSED {count} (no session)");
+            return 0;
+        }
+    };
+    let producer = match tokio::time::timeout(SEND_TIMEOUT, session.create_producer(address)).await
+    {
+        Ok(Ok(p)) => p,
+        _ => {
+            // Attach that hangs/fails without quorum also means nothing accepted.
+            println!("REFUSED {count} (no attach)");
+            return 0;
+        }
+    };
+    let mut refused = 0;
+    for i in 0..count {
+        match tokio::time::timeout(SEND_TIMEOUT, producer.send(Message::text(format!("nq{i}"))))
+            .await
+        {
+            Ok(Ok(_)) => {
+                eprintln!("ACCEPTED a publish without quorum — silent-loss hazard");
+                return 1;
+            }
+            Ok(Err(_)) | Err(_) => refused += 1,
+        }
+    }
+    println!("REFUSED {refused}");
+    let _ = conn.close().await;
+    0
+}
+
+/// Drain up to `count` messages within a window; print how many arrived.
+async fn run_consume(url: &str, address: &str, count: usize) -> i32 {
+    let Some(conn) = connect(url).await else {
+        return 1;
+    };
+    let session = match conn.begin_session().await {
+        Ok(s) => s,
+        Err(e) => {
+            eprintln!("session error: {e}");
+            return 1;
+        }
+    };
+    let mut consumer = match session.create_consumer(address).await {
+        Ok(c) => c,
+        Err(e) => {
+            eprintln!("consumer attach error: {e}");
+            return 1;
+        }
+    };
+    let mut got = 0;
+    while got < count {
+        match tokio::time::timeout(Duration::from_secs(2), consumer.recv()).await {
+            Ok(Ok(d)) => {
+                let _ = consumer.accept(&d).await;
+                got += 1;
+            }
+            _ => break,
+        }
+    }
+    println!("CONSUMED {got}");
+    let _ = conn.close().await;
+    0
+}
+
+/// Multi-connection availability sweep: `connections` producers send `per_conn`
+/// messages each, concurrently. Exit 0 iff every send is accepted.
+async fn run_load(url: &str, address: &str, connections: usize, per_conn: usize) -> i32 {
+    let mut tasks = Vec::with_capacity(connections);
+    for c in 0..connections {
+        let url = url.to_string();
+        let address = address.to_string();
+        tasks.push(tokio::spawn(async move {
+            let Some(conn) = connect(&url).await else {
+                return 0usize;
+            };
+            let Ok(session) = conn.begin_session().await else {
+                return 0;
+            };
+            let Ok(producer) = session.create_producer(&address).await else {
+                return 0;
+            };
+            let mut ok = 0;
+            for i in 0..per_conn {
+                match tokio::time::timeout(
+                    SEND_TIMEOUT,
+                    producer.send(Message::text(format!("c{c}-m{i}"))),
+                )
+                .await
+                {
+                    Ok(Ok(_)) => ok += 1,
+                    _ => break,
+                }
+            }
+            let _ = conn.close().await;
+            ok
+        }));
+    }
+    let mut accepted = 0;
+    for t in tasks {
+        accepted += t.await.unwrap_or(0);
+    }
+    let expected = connections * per_conn;
+    println!("LOADED {accepted}/{expected}");
+    if accepted == expected { 0 } else { 1 }
+}
diff --git a/ramqp-broker/src/config.rs b/ramqp-broker/src/config.rs
index 5763394..86d5a59 100644
--- a/ramqp-broker/src/config.rs
+++ b/ramqp-broker/src/config.rs
@@ -10,7 +10,12 @@ use ramqp_core::config::{ConnectionConfig, SessionConfig};
 /// `open`), guarding against a client that opens the socket then stalls
 /// (slow-loris); its client-only fields (`command_buffer`, `reconnect`) are
 /// unused by the broker.
+///
+/// Marked `#[non_exhaustive]`: construct via [`BrokerConfig::default()`] and
+/// set the fields you need — new knobs then arrive as minor-version additions
+/// instead of build breaks.
 #[derive(Debug, Clone)]
+#[non_exhaustive]
 pub struct BrokerConfig {
     /// Connection-level settings (also the source of our `open`).
     pub connection: ConnectionConfig,
@@ -84,7 +89,11 @@ pub struct BrokerConfig {
 }
 
 /// Per-queue behavior policies: TTL, length bounds, dead-lettering.
+///
+/// Marked `#[non_exhaustive]`: construct via [`QueuePolicy::default()`] and
+/// set the fields you need.
 #[derive(Debug, Clone, Default)]
+#[non_exhaustive]
 pub struct QueuePolicy {
     /// Messages older than this are expired instead of delivered (checked
     /// lazily when a message reaches the head of the queue, RabbitMQ-classic
@@ -122,6 +131,7 @@ pub struct QueuePolicy {
 
 /// Overflow behavior at [`QueuePolicy::max_length`].
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+#[non_exhaustive]
 pub enum OverflowBehavior {
     /// Refuse the new publish (`rejected`, `resource-limit-exceeded`) — the
     /// default, matching the broker-wide depth cap.
@@ -149,7 +159,10 @@ pub enum OverflowBehavior {
 /// a private VLAN/VPC, a WireGuard mesh, or strict firewall rules limiting
 /// the port to the cluster's own nodes. The broker logs a warning at
 /// startup when the fabric binds a non-loopback address.
+/// Marked `#[non_exhaustive]`: construct via [`ClusterMemberConfig::new`]
+/// and adjust fields (e.g. `replicas`) afterwards.
 #[derive(Debug, Clone)]
+#[non_exhaustive]
 pub struct ClusterMemberConfig {
     /// This node's id (must appear in `seeds`, unique per node).
     pub node_id: u64,
diff --git a/ramqp-broker/src/connection.rs b/ramqp-broker/src/connection.rs
index c9d905b..dc6a526 100644
--- a/ramqp-broker/src/connection.rs
+++ b/ramqp-broker/src/connection.rs
@@ -1094,7 +1094,7 @@ impl<S: IoStream> BrokerConnection<S> {
                     .sessions
                     .get(&local)
                     .expect("bound channel")
-                    .knows_link(&attach.name)
+                    .knows_link(&attach.name, attach.role)
                 {
                     // A response to a link WE initiated — of which there are
                     // none today (the broker never initiates links), so this
diff --git a/ramqp-broker/src/lib.rs b/ramqp-broker/src/lib.rs
index 6914072..b49907e 100644
--- a/ramqp-broker/src/lib.rs
+++ b/ramqp-broker/src/lib.rs
@@ -5,11 +5,28 @@
 //! architecture and phased plan.
 //!
 //! # Status
-//! Phase 4 single-node MVP: TCP acceptor, server-order handshake (protocol
-//! header → SASL ANONYMOUS/PLAIN → `open`), a per-connection driver, and
-//! in-memory **transient queues** (one lock-free actor per queue) with
-//! competing consumers, credit-based dispatch, and settlement→ack/requeue.
-//! Durability lands in Phase 7; clustering (per-queue Raft) in Phases 5–6.
+//! Working, pre-1.0. Any AMQP 1.0 client connects (TCP acceptor, server-order
+//! handshake, SASL ANONYMOUS/PLAIN behind a pluggable [`auth::Authenticator`]).
+//! Three queue families, selected by address:
+//!
+//! - `/queues/<name>` — **transient**: one lock-free actor per queue,
+//!   competing consumers, credit-based dispatch, settlement → ack/requeue,
+//!   bounded depth.
+//! - `/quorum/<name>` — **quorum**: each queue its own Raft group (openraft);
+//!   the accepted disposition is the replicated-commit durability confirm.
+//! - `/durable/<name>` — **durable** (feature `store-redb` + a `data_dir`):
+//!   on-disk via redb, group-commit fsync, full restart recovery.
+//!
+//! Clustering: a metadata Raft group plus a multiplexed inter-node fabric;
+//! any node serves any queue via leader-following proxying, with failover.
+//! Per-queue policies (TTL, length bounds, overflow, dead-lettering,
+//! delivery-attempt caps), transactions, and a Prometheus/JSON management
+//! endpoint are in. Interop is exercised against the `ramqp` and
+//! `fe2o3-amqp` clients, JMS (Qpid JMS), and Qpid Proton.
+//!
+//! The API (notably [`config::BrokerConfig`]) is still settling — hence
+//! `#[non_exhaustive]` config types and the 0.x version. Architecture and
+//! phased plan: `broker.md` in the repository.
 //!
 //! ```no_run
 //! use ramqp_broker::{Broker, BrokerConfig};
diff --git a/ramqp-broker/src/policy.rs b/ramqp-broker/src/policy.rs
index be3fa9a..ea0eae6 100644
--- a/ramqp-broker/src/policy.rs
+++ b/ramqp-broker/src/policy.rs
@@ -238,6 +238,10 @@ impl EffectivePolicy {
     /// that resolves once the copy's fate is known (durably stored, refused,
     /// or dropped). A durable source orders its own Remove after it; `None`
     /// means the message simply dropped and the caller may proceed at once.
+    ///
+    /// Only the durable store (`durable.rs`) needs the ordered variant, so it is
+    /// gated to `store-redb` to keep default-feature builds warning-clean.
+    #[cfg(feature = "store-redb")]
     pub fn dead_letter_ordered(
         &self,
         queue: &str,
diff --git a/ramqp-broker/tests/adversarial.rs b/ramqp-broker/tests/adversarial.rs
deleted file mode 100644
index c37b7cc..0000000
--- a/ramqp-broker/tests/adversarial.rs
+++ /dev/null
@@ -1,237 +0,0 @@
-//! Adversarial / raw-socket tests: a hand-driven peer that violates the
-//! protocol after a valid handshake, asserting the broker answers with a
-//! `close{error}` carrying an AMQP condition rather than a bare TCP reset.
-
-use bytes::BytesMut;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-use ramqp_broker::{Broker, BrokerConfig};
-use ramqp_core::config::ConnectionConfig;
-use ramqp_core::transport::frame::{Frame, FrameBody, FramedTransport, decode_frame};
-use ramqp_core::transport::header::ProtocolHeader;
-use ramqp_core::types::performatives::{Begin, Open, Performative};
-
-async fn start() -> (std::net::SocketAddr, ramqp_broker::ShutdownHandle) {
-    let bound = Broker::new(BrokerConfig::default())
-        .bind("127.0.0.1:0")
-        .await
-        .expect("bind");
-    let addr = bound.local_addr();
-    let shutdown = bound.shutdown_handle();
-    tokio::spawn(bound.run());
-    (addr, shutdown)
-}
-
-/// Drive the header + `open` exchange by hand (bare AMQP — the default broker
-/// offers it), leaving an established connection ready to misbehave on.
-async fn handshake(addr: std::net::SocketAddr) -> FramedTransport<tokio::net::TcpStream> {
-    let mut stream = tokio::net::TcpStream::connect(addr).await.expect("connect");
-    ProtocolHeader::AMQP
-        .negotiate(&mut stream)
-        .await
-        .expect("header negotiation");
-    let mut transport = FramedTransport::new(stream, 65536);
-    let mut open = Open::new("adversary");
-    open.max_frame_size = 65536;
-    transport
-        .send_amqp(0, &Performative::Open(open), None)
-        .await
-        .expect("send open");
-    // Consume the broker's open (skipping any empty keep-alive frames).
-    loop {
-        match transport.read_frame().await.expect("read broker open").body {
-            FrameBody::Amqp(Performative::Open(_), _) => break,
-            FrameBody::Empty => continue,
-            other => panic!("expected broker open, got {other:?}"),
-        }
-    }
-    transport
-}
-
-/// Encode one AMQP frame to its exact wire bytes (via a scratch transport).
-async fn encode_frame(channel: u16, performative: &Performative) -> Vec<u8> {
-    let (a, mut b) = tokio::io::duplex(1 << 16);
-    let mut t = FramedTransport::new(a, 1 << 16);
-    t.send_amqp(channel, performative, None)
-        .await
-        .expect("encode frame");
-    let mut buf = vec![0u8; 1 << 16];
-    let n = b.read(&mut buf).await.expect("read encoded frame");
-    buf.truncate(n);
-    buf
-}
-
-/// Read one whole AMQP frame from a raw stream, decoding with a generous limit.
-async fn read_raw_frame(stream: &mut tokio::net::TcpStream, buf: &mut BytesMut) -> Frame {
-    loop {
-        if let Some(frame) = decode_frame(buf, 1 << 20).expect("decode") {
-            return frame;
-        }
-        let mut chunk = [0u8; 4096];
-        let n = stream.read(&mut chunk).await.expect("read");
-        assert!(n > 0, "stream closed before a full frame");
-        buf.extend_from_slice(&chunk[..n]);
-    }
-}
-
-/// max-frame-size is directional (spec §2.7.1): a client may advertise a small
-/// receive limit yet legally send frames as large as the BROKER advertised.
-/// The broker's inbound decode must honor its own advertised max, not the
-/// negotiated min — otherwise it kills a spec-legal oversized frame.
-#[tokio::test]
-async fn oversized_inbound_frame_from_small_advertiser_is_accepted() {
-    // Broker advertises the default (128 KiB); the raw client advertises 4 KiB.
-    let (addr, shutdown) = start().await;
-    let mut stream = tokio::net::TcpStream::connect(addr).await.expect("connect");
-    ProtocolHeader::AMQP
-        .negotiate(&mut stream)
-        .await
-        .expect("header");
-
-    let mut small_open = Open::new("small-advertiser");
-    small_open.max_frame_size = 4096;
-    stream
-        .write_all(&encode_frame(0, &Performative::Open(small_open)).await)
-        .await
-        .expect("send open");
-
-    let mut buf = BytesMut::new();
-    // Consume the broker's open.
-    loop {
-        match read_raw_frame(&mut stream, &mut buf).await.body {
-            FrameBody::Amqp(Performative::Open(_), _) => break,
-            FrameBody::Empty => continue,
-            other => panic!("expected broker open, got {other:?}"),
-        }
-    }
-
-    // Build an 8 KiB Begin frame (> the client's advertised 4 KiB, <= the
-    // broker's 128 KiB): pad the encoded Begin and fix its size header. The
-    // padding decodes as ignored trailing payload.
-    let begin = Begin {
-        next_outgoing_id: 0,
-        incoming_window: 8,
-        outgoing_window: 8,
-        handle_max: 16,
-        ..Default::default()
-    };
-    let mut big = encode_frame(0, &Performative::Begin(begin)).await;
-    assert!(big.len() < 8192);
-    big.resize(8192, 0);
-    big[0..4].copy_from_slice(&(8192u32).to_be_bytes());
-    stream.write_all(&big).await.expect("send big begin");
-
-    // The broker must ACCEPT the oversized frame — a Begin response, not a
-    // close{error: framing-error} from an over-strict inbound limit.
-    match read_raw_frame(&mut stream, &mut buf).await.body {
-        FrameBody::Amqp(Performative::Begin(_), _) => {}
-        FrameBody::Amqp(Performative::Close(c), _) => {
-            panic!(
-                "broker rejected a spec-legal oversized frame: {:?}",
-                c.error
-            )
-        }
-        other => panic!("expected a begin response, got {other:?}"),
-    }
-
-    shutdown.shutdown();
-}
-
-/// Read frames until a `close` arrives; returns whether it carried an error.
-async fn wait_for_close(transport: &mut FramedTransport<tokio::net::TcpStream>) -> Option<bool> {
-    loop {
-        match transport.read_frame().await {
-            Ok(frame) => match frame.body {
-                FrameBody::Amqp(Performative::Close(c), _) => return Some(c.error.is_some()),
-                _ => continue,
-            },
-            Err(_) => return None, // socket closed with no close frame
-        }
-    }
-}
-
-/// A duplicate `open` is a connection-level protocol violation. The broker must
-/// answer with `close{error}` (framing-error) before the socket drops, not a
-/// silent reset.
-#[tokio::test]
-async fn duplicate_open_gets_close_with_error() {
-    let (addr, shutdown) = start().await;
-    let mut transport = handshake(addr).await;
-
-    // Violation: a second open on an already-open connection.
-    transport
-        .send_amqp(0, &Performative::Open(Open::new("dup")), None)
-        .await
-        .expect("send duplicate open");
-
-    match wait_for_close(&mut transport).await {
-        Some(has_error) => assert!(has_error, "close must carry an error condition"),
-        None => panic!("broker dropped the socket without a close performative"),
-    }
-
-    shutdown.shutdown();
-}
-
-/// Slow-loris guard: a peer that connects then sends nothing must be dropped
-/// once the inbound-handshake timeout fires, rather than pinning a task
-/// forever. We observe the drop as EOF on our end.
-#[tokio::test]
-async fn stalled_handshake_is_timed_out() {
-    let config = BrokerConfig {
-        connection: ConnectionConfig {
-            connect_timeout: Some(std::time::Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..Default::default()
-    };
-    let bound = Broker::new(config).bind("127.0.0.1:0").await.expect("bind");
-    let addr = bound.local_addr();
-    let shutdown = bound.shutdown_handle();
-    tokio::spawn(bound.run());
-
-    // Connect but never send the protocol header (the slow-loris).
-    let mut stream = tokio::net::TcpStream::connect(addr).await.expect("connect");
-    let mut buf = [0u8; 1];
-    // The broker times out the handshake and drops the socket → EOF (Ok(0)).
-    let observed = tokio::time::timeout(std::time::Duration::from_secs(2), stream.read(&mut buf))
-        .await
-        .expect("broker must drop the stalled handshake well before 2s");
-    assert!(
-        matches!(observed, Ok(0)),
-        "expected EOF from the timed-out handshake, got {observed:?}"
-    );
-
-    shutdown.shutdown();
-}
-
-/// A frame on a channel that was never begun is a protocol violation; it, too,
-/// earns a `close{error}` rather than a bare disconnect.
-#[tokio::test]
-async fn frame_on_unmapped_channel_gets_close_with_error() {
-    let (addr, shutdown) = start().await;
-    let mut transport = handshake(addr).await;
-
-    // Violation: a detach naming a link on a session (channel 7) we never
-    // began. Unlike End (which tolerates an end/end race), a link frame on an
-    // unmapped channel is a hard framing error.
-    use ramqp_core::types::performatives::Detach;
-    transport
-        .send_amqp(
-            7,
-            &Performative::Detach(Detach {
-                handle: 0,
-                closed: true,
-                error: None,
-            }),
-            None,
-        )
-        .await
-        .expect("send detach on unmapped channel");
-
-    match wait_for_close(&mut transport).await {
-        Some(has_error) => assert!(has_error, "close must carry an error condition"),
-        None => panic!("broker dropped the socket without a close performative"),
-    }
-
-    shutdown.shutdown();
-}
diff --git a/ramqp-broker/tests/cluster.rs b/ramqp-broker/tests/cluster.rs
index 4a9d869..505b201 100644
--- a/ramqp-broker/tests/cluster.rs
+++ b/ramqp-broker/tests/cluster.rs
@@ -34,14 +34,12 @@ async fn start_cluster(n: usize) -> Vec<Node> {
     let seeds: Vec<(u64, String)> = (1..=n as u64).zip(fabric_addrs).collect();
     let mut nodes = Vec::new();
     for (id, fabric_addr) in &seeds {
-        let config = BrokerConfig {
-            cluster: Some(ClusterMemberConfig::new(
-                *id,
-                fabric_addr.clone(),
-                seeds.clone(),
-            )),
-            ..Default::default()
-        };
+        let mut config = BrokerConfig::default();
+        config.cluster = Some(ClusterMemberConfig::new(
+            *id,
+            fabric_addr.clone(),
+            seeds.clone(),
+        ));
         let broker = Broker::new(config);
         let bound = broker
             .clone()
diff --git a/ramqp-broker/tests/conformance.rs b/ramqp-broker/tests/conformance.rs
new file mode 100644
index 0000000..6021967
--- /dev/null
+++ b/ramqp-broker/tests/conformance.rs
@@ -0,0 +1,300 @@
+//! Unified AMQP 1.0 conformance matrix for the broker.
+//!
+//! One place that pins the broker's *wire-level* obedience to the spec across
+//! four axes — **framing**, **error conditions**, **flow/credit**, and
+//! **settlement** — against a loopback instance, no external broker involved.
+//! It complements (does not duplicate) the behavioral suites: `produce_consume`
+//! / `quorum_queue` prove queue semantics, `adversarial`'s raw-socket cases are
+//! folded in here, and the SASL/SCRAM RFC vectors live in `ramqp-core`.
+//!
+//! The distinguishing value over "does a message round-trip" tests is that the
+//! error-condition axis asserts the *exact* `amqp:*` condition symbol the
+//! broker returns, and the flow axis asserts the credit ceiling at the
+//! protocol level.
+
+mod harness;
+
+use harness::*;
+
+// ---------------------------------------------------------------------------
+// Framing: the byte/frame-level rules independent of any queue.
+// ---------------------------------------------------------------------------
+mod framing {
+    use super::*;
+    use bytes::BytesMut;
+    use tokio::io::AsyncWriteExt;
+
+    use ramqp_core::transport::frame::FrameBody;
+    use ramqp_core::transport::header::ProtocolHeader;
+    use ramqp_core::types::performatives::{Begin, Close, Open, Performative};
+
+    /// The baseline handshake: bare-AMQP header, `open`/`open`, then a graceful
+    /// `close` is echoed with no error.
+    #[tokio::test]
+    async fn header_open_and_graceful_close() {
+        let lb = loopback().await;
+        let mut peer = RawPeer::open(lb.addr, "conformance", 65536).await;
+
+        peer.send(0, Performative::Close(Close { error: None }))
+            .await;
+        match peer.wait_for_close().await {
+            CloseOutcome::Clean | CloseOutcome::Dropped => {}
+            CloseOutcome::Error(e) => panic!("graceful close drew an error: {}", e.condition),
+        }
+    }
+
+    /// max-frame-size is directional (spec §2.7.1): a peer may advertise a small
+    /// *receive* limit yet legally send frames as large as the BROKER
+    /// advertised. The broker's inbound decode must honor its own advertised
+    /// max, not the negotiated min — otherwise it kills a spec-legal frame.
+    #[tokio::test]
+    async fn oversized_inbound_frame_from_small_advertiser_is_accepted() {
+        // Broker advertises the default (128 KiB); the raw client advertises 4 KiB.
+        let lb = loopback().await;
+        let mut stream = tokio::net::TcpStream::connect(lb.addr)
+            .await
+            .expect("connect");
+        ProtocolHeader::AMQP
+            .negotiate(&mut stream)
+            .await
+            .expect("header");
+
+        let mut small_open = Open::new("small-advertiser");
+        small_open.max_frame_size = 4096;
+        stream
+            .write_all(&encode_frame(0, &Performative::Open(small_open)).await)
+            .await
+            .expect("send open");
+
+        let mut buf = BytesMut::new();
+        loop {
+            match read_raw_frame(&mut stream, &mut buf).await.body {
+                FrameBody::Amqp(Performative::Open(_), _) => break,
+                FrameBody::Empty => continue,
+                other => panic!("expected broker open, got {other:?}"),
+            }
+        }
+
+        // Build an 8 KiB Begin frame (> the client's advertised 4 KiB, <= the
+        // broker's 128 KiB): pad the encoded Begin and fix its size header. The
+        // padding decodes as ignored trailing payload.
+        let begin = Begin {
+            next_outgoing_id: 0,
+            incoming_window: 8,
+            outgoing_window: 8,
+            handle_max: 16,
+            ..Default::default()
+        };
+        let mut big = encode_frame(0, &Performative::Begin(begin)).await;
+        assert!(big.len() < 8192);
+        big.resize(8192, 0);
+        big[0..4].copy_from_slice(&(8192u32).to_be_bytes());
+        stream.write_all(&big).await.expect("send big begin");
+
+        // The broker must ACCEPT the oversized frame — a Begin response, not a
+        // close{error} from an over-strict inbound limit.
+        match read_raw_frame(&mut stream, &mut buf).await.body {
+            FrameBody::Amqp(Performative::Begin(_), _) => {}
+            FrameBody::Amqp(Performative::Close(c), _) => {
+                panic!(
+                    "broker rejected a spec-legal oversized frame: {:?}",
+                    c.error
+                )
+            }
+            other => panic!("expected a begin response, got {other:?}"),
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Error conditions: which protocol violation earns which `amqp:*` condition.
+// This axis asserts the *exact* symbol, not just that an error was present.
+// ---------------------------------------------------------------------------
+mod error_conditions {
+    use super::*;
+    use tokio::io::AsyncReadExt;
+
+    use ramqp_broker::{Broker, BrokerConfig};
+    use ramqp_core::config::ConnectionConfig;
+    use ramqp_core::types::performatives::{Detach, Open, Performative};
+
+    /// A duplicate `open` on an already-open connection is a connection-level
+    /// framing error — answered with `close{error}`, never a silent reset.
+    #[tokio::test]
+    async fn duplicate_open() {
+        let lb = loopback().await;
+        let mut peer = RawPeer::open(lb.addr, "dup", 65536).await;
+
+        peer.send(0, Performative::Open(Open::new("dup-again")))
+            .await;
+
+        match peer.wait_for_close().await {
+            CloseOutcome::Error(e) => {
+                assert_eq!(e.condition.as_str(), "amqp:connection:framing-error")
+            }
+            other => panic!("expected close with error, got {other:?}"),
+        }
+    }
+
+    /// A link frame on a channel that was never begun is a hard framing error
+    /// (unlike `end`, which tolerates an end/end race).
+    #[tokio::test]
+    async fn frame_on_unmapped_channel() {
+        let lb = loopback().await;
+        let mut peer = RawPeer::open(lb.addr, "unmapped", 65536).await;
+
+        peer.send(
+            7,
+            Performative::Detach(Detach {
+                handle: 0,
+                closed: true,
+                error: None,
+            }),
+        )
+        .await;
+
+        match peer.wait_for_close().await {
+            CloseOutcome::Error(e) => {
+                assert_eq!(e.condition.as_str(), "amqp:connection:framing-error")
+            }
+            other => panic!("expected close with error, got {other:?}"),
+        }
+    }
+
+    /// Slow-loris guard: a peer that connects then sends nothing is dropped once
+    /// the inbound-handshake timeout fires, observed as EOF on our end.
+    #[tokio::test]
+    async fn stalled_handshake_is_timed_out() {
+        let mut config = BrokerConfig::default();
+        config.connection = ConnectionConfig {
+            connect_timeout: Some(std::time::Duration::from_millis(200)),
+            ..Default::default()
+        };
+        let lb = loopback_with(Broker::new(config)).await;
+
+        // Connect but never send the protocol header (the slow-loris).
+        let mut stream = tokio::net::TcpStream::connect(lb.addr)
+            .await
+            .expect("connect");
+        let mut buf = [0u8; 1];
+        let observed =
+            tokio::time::timeout(std::time::Duration::from_secs(2), stream.read(&mut buf))
+                .await
+                .expect("broker must drop the stalled handshake well before 2s");
+        assert!(
+            matches!(observed, Ok(0)),
+            "expected EOF from the timed-out handshake, got {observed:?}"
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Flow: the broker must never put more deliveries in flight than granted
+// link-credit (spec §2.6.7), driven through the client's manual-credit mode.
+// ---------------------------------------------------------------------------
+mod flow {
+    use super::*;
+    use ramqp::Message;
+    use ramqp::config::CreditMode;
+
+    #[tokio::test]
+    async fn broker_never_exceeds_granted_credit() {
+        let lb = loopback().await;
+        let conn = connect(&lb.url()).await;
+        let session = conn.begin_session().await.expect("session");
+
+        let producer = session
+            .create_producer("/queues/flow-credit")
+            .await
+            .expect("producer");
+        for i in 0..5 {
+            producer
+                .send(Message::text(format!("m{i}")))
+                .await
+                .expect("send");
+        }
+
+        // Manual credit: no automatic window, we grant explicitly.
+        let mut consumer = session
+            .create_consumer_with("/queues/flow-credit", CreditMode::Manual)
+            .await
+            .expect("consumer");
+
+        // Grant exactly 2 against a queue of 5.
+        consumer.credit(2).await.expect("grant credit");
+        let d0 = consumer.recv().await.expect("first");
+        let d1 = consumer.recv().await.expect("second");
+        consumer.accept(&d0).await.expect("accept 0");
+        consumer.accept(&d1).await.expect("accept 1");
+
+        // A 3rd delivery must NOT arrive without more credit.
+        let third =
+            tokio::time::timeout(std::time::Duration::from_millis(300), consumer.recv()).await;
+        assert!(
+            third.is_err(),
+            "broker sent a 3rd delivery beyond the granted credit of 2"
+        );
+
+        // Grant the rest; the remaining 3 then flow.
+        consumer.credit(3).await.expect("grant more");
+        for _ in 0..3 {
+            let d = tokio::time::timeout(std::time::Duration::from_secs(2), consumer.recv())
+                .await
+                .expect("delivery after top-up")
+                .expect("recv");
+            consumer.accept(&d).await.expect("accept");
+        }
+
+        conn.close().await.expect("close");
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Settlement: the terminal `accepted` outcome removes a message — the
+// complement of produce_consume's "unacked is requeued" cases.
+// ---------------------------------------------------------------------------
+mod settlement {
+    use super::*;
+    use ramqp::Message;
+
+    #[tokio::test]
+    async fn accepted_delivery_is_not_redelivered() {
+        let lb = loopback().await;
+        let conn = connect(&lb.url()).await;
+        let session = conn.begin_session().await.expect("session");
+
+        let producer = session
+            .create_producer("/queues/settle-accept")
+            .await
+            .expect("producer");
+        producer
+            .send(Message::text("only-once"))
+            .await
+            .expect("send");
+
+        // First consumer receives and accepts. We keep it attached: detaching
+        // races the accept disposition against the link's in-flight-requeue on
+        // teardown, which would test teardown, not the `accepted` outcome.
+        let mut c1 = session
+            .create_consumer("/queues/settle-accept")
+            .await
+            .expect("c1");
+        let d = c1.recv().await.expect("recv");
+        assert_eq!(text_of(&d), "only-once");
+        c1.accept(&d).await.expect("accept");
+
+        // Let the accept disposition settle at the broker before probing.
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        // A second consumer on the same queue must find it empty — the accepted
+        // message is gone, not merely invisible to c1.
+        let mut c2 = session
+            .create_consumer("/queues/settle-accept")
+            .await
+            .expect("c2");
+        let again = tokio::time::timeout(std::time::Duration::from_millis(300), c2.recv()).await;
+        assert!(again.is_err(), "an accepted delivery was redelivered");
+
+        conn.close().await.expect("close");
+    }
+}
diff --git a/ramqp-broker/tests/durable.rs b/ramqp-broker/tests/durable.rs
index ddec4d6..cd8d5e2 100644
--- a/ramqp-broker/tests/durable.rs
+++ b/ramqp-broker/tests/durable.rs
@@ -16,10 +16,9 @@ async fn start(config: BrokerConfig) -> (std::net::SocketAddr, ShutdownHandle) {
 }
 
 fn config_with(dir: &std::path::Path) -> BrokerConfig {
-    BrokerConfig {
-        data_dir: Some(dir.to_path_buf()),
-        ..Default::default()
-    }
+    let mut config = BrokerConfig::default();
+    config.data_dir = Some(dir.to_path_buf());
+    config
 }
 
 fn text_of(delivery: &ramqp::Delivery) -> String {
@@ -79,14 +78,10 @@ async fn durable_produce_consume_round_trip() {
 async fn durable_dead_letter_lands_in_a_durable_dlq() {
     let dir = tempfile::tempdir().expect("tempdir");
     let mut config = config_with(dir.path());
-    config.policies.push((
-        "ttl-src".to_owned(),
-        ramqp_broker::QueuePolicy {
-            message_ttl: Some(std::time::Duration::from_millis(200)),
-            dead_letter: Some("/durable/ttl-dlx".to_owned()),
-            ..Default::default()
-        },
-    ));
+    let mut policy = ramqp_broker::QueuePolicy::default();
+    policy.message_ttl = Some(std::time::Duration::from_millis(200));
+    policy.dead_letter = Some("/durable/ttl-dlx".to_owned());
+    config.policies.push(("ttl-src".to_owned(), policy));
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
@@ -368,14 +363,15 @@ async fn quorum_messages_survive_a_broker_restart() {
 #[tokio::test(flavor = "multi_thread")]
 async fn clustered_catalog_and_queue_survive_a_restart() {
     let dir = tempfile::tempdir().expect("tempdir");
-    let cluster_config = |listen: String| BrokerConfig {
-        cluster: Some(ramqp_broker::ClusterMemberConfig::new(
+    let cluster_config = |listen: String| {
+        let mut config = BrokerConfig::default();
+        config.cluster = Some(ramqp_broker::ClusterMemberConfig::new(
             1,
             listen.clone(),
             vec![(1, listen)],
-        )),
-        data_dir: Some(dir.path().to_path_buf()),
-        ..Default::default()
+        ));
+        config.data_dir = Some(dir.path().to_path_buf());
+        config
     };
     // Reserve a fabric port so both lives use the same seed address.
     let l = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
diff --git a/ramqp-broker/tests/harness/client.rs b/ramqp-broker/tests/harness/client.rs
new file mode 100644
index 0000000..eed035d
--- /dev/null
+++ b/ramqp-broker/tests/harness/client.rs
@@ -0,0 +1,21 @@
+//! Client-side helpers: connect the published `ramqp` client to a loopback
+//! broker and pull typed bodies out of deliveries.
+
+/// Connect the published `ramqp` client to a loopback broker.
+pub async fn connect(url: &str) -> ramqp::Connection {
+    ramqp::ConnectionBuilder::new(url)
+        .connect()
+        .await
+        .expect("client connects to broker")
+}
+
+/// Extract the text body of a delivery, panicking if it is not a string value.
+pub fn text_of(delivery: &ramqp::Delivery) -> String {
+    use ramqp::codec::Value;
+    use ramqp::types::messaging::Body;
+    let msg = delivery.message().expect("decodable message");
+    match msg.body {
+        Body::Value(Value::String(s)) => s,
+        other => panic!("expected text body, got {other:?}"),
+    }
+}
diff --git a/ramqp-broker/tests/harness/loopback.rs b/ramqp-broker/tests/harness/loopback.rs
new file mode 100644
index 0000000..034c875
--- /dev/null
+++ b/ramqp-broker/tests/harness/loopback.rs
@@ -0,0 +1,52 @@
+//! Loopback-broker starter: bind a broker on an ephemeral `127.0.0.1` port and
+//! hand back an address plus a self-shutting handle.
+
+use ramqp_broker::{Broker, BrokerConfig, ShutdownHandle};
+
+/// A running loopback broker plus the handle that stops it. Dropping it shuts
+/// the broker down, so a test can simply keep it in scope; call
+/// [`shutdown`](Loopback::shutdown) to stop it early (e.g. to observe a peer's
+/// reaction to the broker going away).
+pub struct Loopback {
+    pub addr: std::net::SocketAddr,
+    shutdown: Option<ShutdownHandle>,
+}
+
+impl Loopback {
+    /// The `amqp://host:port` URL a `ramqp` client connects to.
+    pub fn url(&self) -> String {
+        format!("amqp://{}", self.addr)
+    }
+
+    /// Stop the broker now (rather than at drop).
+    pub fn shutdown(mut self) {
+        if let Some(h) = self.shutdown.take() {
+            h.shutdown();
+        }
+    }
+}
+
+impl Drop for Loopback {
+    fn drop(&mut self) {
+        if let Some(h) = self.shutdown.take() {
+            h.shutdown();
+        }
+    }
+}
+
+/// Start a default-config broker on an ephemeral loopback port.
+pub async fn loopback() -> Loopback {
+    loopback_with(Broker::new(BrokerConfig::default())).await
+}
+
+/// Start a caller-configured broker on an ephemeral loopback port.
+pub async fn loopback_with(broker: Broker) -> Loopback {
+    let bound = broker.bind("127.0.0.1:0").await.expect("bind");
+    let addr = bound.local_addr();
+    let shutdown = bound.shutdown_handle();
+    tokio::spawn(bound.run());
+    Loopback {
+        addr,
+        shutdown: Some(shutdown),
+    }
+}
diff --git a/ramqp-broker/tests/harness/mod.rs b/ramqp-broker/tests/harness/mod.rs
new file mode 100644
index 0000000..4517f93
--- /dev/null
+++ b/ramqp-broker/tests/harness/mod.rs
@@ -0,0 +1,21 @@
+//! Shared broker test harness.
+//!
+//! One place for the loopback-broker starter and the raw-frame peer used to
+//! drive hand-built (including deliberately illegal) AMQP against the broker.
+//! Consolidates the per-file `start()` duplication and the raw helpers that
+//! used to live inline in `adversarial.rs`, so the conformance matrix and the
+//! functional suites share one vocabulary.
+//!
+//! Each integration-test binary that needs it does `mod harness;` — Cargo
+//! compiles this module into that binary. Not every binary uses every helper,
+//! hence the module-level `dead_code`/`unused_imports` allowances (a binary that
+//! uses only a subset of the harness must not warn).
+#![allow(dead_code, unused_imports)]
+
+mod client;
+mod loopback;
+mod raw_peer;
+
+pub use client::{connect, text_of};
+pub use loopback::{Loopback, loopback, loopback_with};
+pub use raw_peer::{CloseOutcome, RawPeer, encode_frame, read_raw_frame};
diff --git a/ramqp-broker/tests/harness/raw_peer.rs b/ramqp-broker/tests/harness/raw_peer.rs
new file mode 100644
index 0000000..bc350ea
--- /dev/null
+++ b/ramqp-broker/tests/harness/raw_peer.rs
@@ -0,0 +1,124 @@
+//! Hand-driven raw-frame AMQP peer: negotiate the header + `open`, then send
+//! arbitrary (including spec-illegal) performatives and read the broker's
+//! replies. This is the surface conformance tests use to assert the broker's
+//! exact wire reaction to protocol violations.
+
+use bytes::BytesMut;
+use tokio::io::AsyncReadExt;
+
+use ramqp_core::transport::frame::{Frame, FrameBody, FramedTransport, decode_frame};
+use ramqp_core::transport::header::ProtocolHeader;
+use ramqp_core::types::definitions::Error as WireError;
+use ramqp_core::types::performatives::{Open, Performative};
+
+/// What a peer observed while waiting for the connection to close.
+#[derive(Debug)]
+pub enum CloseOutcome {
+    /// A `close` performative arrived carrying this error condition.
+    Error(WireError),
+    /// A `close` performative arrived with no error (graceful close).
+    Clean,
+    /// The socket dropped with no `close` performative at all.
+    Dropped,
+}
+
+/// A hand-driven AMQP peer over a real TCP socket to the broker.
+pub struct RawPeer {
+    transport: FramedTransport<tokio::net::TcpStream>,
+}
+
+impl RawPeer {
+    /// Connect and negotiate only the protocol header (no `open` yet).
+    pub async fn connect(addr: std::net::SocketAddr, max_frame: u32) -> Self {
+        let mut stream = tokio::net::TcpStream::connect(addr).await.expect("connect");
+        ProtocolHeader::AMQP
+            .negotiate(&mut stream)
+            .await
+            .expect("header negotiation");
+        RawPeer {
+            transport: FramedTransport::new(stream, max_frame),
+        }
+    }
+
+    /// Connect, negotiate the header, send `open`, and consume the broker's
+    /// `open` — leaving an established connection ready to be driven or abused.
+    pub async fn open(addr: std::net::SocketAddr, container_id: &str, max_frame: u32) -> Self {
+        let mut peer = Self::connect(addr, max_frame).await;
+        let mut open = Open::new(container_id);
+        open.max_frame_size = max_frame;
+        peer.send(0, Performative::Open(open)).await;
+        peer.expect_open().await;
+        peer
+    }
+
+    /// Send one performative on `channel`.
+    pub async fn send(&mut self, channel: u16, perf: Performative) {
+        self.transport
+            .send_amqp(channel, &perf, None)
+            .await
+            .expect("send performative");
+    }
+
+    /// Read the next frame (panics on transport error).
+    pub async fn read(&mut self) -> Frame {
+        self.transport.read_frame().await.expect("read frame")
+    }
+
+    /// Consume frames until the broker's `open` arrives (skipping keep-alives).
+    pub async fn expect_open(&mut self) {
+        loop {
+            match self.read().await.body {
+                FrameBody::Amqp(Performative::Open(_), _) => return,
+                FrameBody::Empty => continue,
+                other => panic!("expected broker open, got {other:?}"),
+            }
+        }
+    }
+
+    /// Read until a `close` arrives (or the socket drops), reporting what
+    /// happened so a test can assert the exact error condition.
+    pub async fn wait_for_close(&mut self) -> CloseOutcome {
+        loop {
+            match self.transport.read_frame().await {
+                Ok(frame) => match frame.body {
+                    FrameBody::Amqp(Performative::Close(c), _) => {
+                        return match c.error {
+                            Some(e) => CloseOutcome::Error(e),
+                            None => CloseOutcome::Clean,
+                        };
+                    }
+                    _ => continue,
+                },
+                Err(_) => return CloseOutcome::Dropped,
+            }
+        }
+    }
+}
+
+/// Encode one AMQP frame to its exact wire bytes (via a scratch duplex
+/// transport). Used by byte-level framing tests that must hand-craft or mutate
+/// the wire form before writing it to a raw socket.
+pub async fn encode_frame(channel: u16, perf: &Performative) -> Vec<u8> {
+    let (a, mut b) = tokio::io::duplex(1 << 16);
+    let mut t = FramedTransport::new(a, 1 << 16);
+    t.send_amqp(channel, perf, None)
+        .await
+        .expect("encode frame");
+    let mut buf = vec![0u8; 1 << 16];
+    let n = b.read(&mut buf).await.expect("read encoded frame");
+    buf.truncate(n);
+    buf
+}
+
+/// Read one whole AMQP frame from a raw stream, decoding with a generous limit.
+pub async fn read_raw_frame(stream: &mut tokio::net::TcpStream, buf: &mut BytesMut) -> Frame {
+    loop {
+        if let Some(frame) = decode_frame(buf, 1 << 20).expect("decode") {
+            return frame;
+        }
+        let mut chunk = [0u8; 4096];
+        let n = stream.read(&mut chunk).await.expect("read");
+        assert!(n > 0, "stream closed before a full frame");
+        buf.extend_from_slice(&chunk[..n]);
+    }
+}
diff --git a/ramqp-broker/tests/interop/README.md b/ramqp-broker/tests/interop/README.md
new file mode 100644
index 0000000..2992586
--- /dev/null
+++ b/ramqp-broker/tests/interop/README.md
@@ -0,0 +1,68 @@
+# External-toolchain interop
+
+Independent, third-party AMQP 1.0 stacks exercising **ramqp-broker** — proof
+its wire behavior isn't accidentally tailored to our own `ramqp` client. This
+is the "external toolchain" half of broker.md Phase 10; the Rust `fe2o3-amqp`
+leg lives in [`bench-compare/tests/fe2o3_interop.rs`](../../../bench-compare/tests/fe2o3_interop.rs).
+
+## Legs
+
+| Leg | Client stack | Direction | Where | Status |
+|---|---|---|---|---|
+| `fe2o3-amqp` | Rust (`fe2o3-amqp`) | client → our broker | `bench-compare/tests/fe2o3_interop.rs` | ✅ landed |
+| **Qpid JMS** | Java (Apache Qpid JMS 2.x, Jakarta Messaging) | client → our broker | `jms/` + `tests/jms_interop.rs` | ✅ landed |
+| **Qpid Proton** | Python/C (`python3-qpid-proton`) | client → our broker | `proton/` | ✅ landed |
+| our client → Qpid | `ramqp` | client → Qpid Broker-J | — | ⏸️ deferred (see note) |
+
+**Note on our-client → Qpid Broker-J:** attempted, deferred. Our client's
+reference-broker interop is already covered by the `interop-rabbitmq` and
+`interop-artemis` CI jobs (the `ramqp/tests/broker.rs` suite against two
+independent brokers). Adding Qpid Broker-J as a third stalled on the
+`apache/qpid-broker-j` image itself, not on rAMQP: it does not substitute
+`QPID_ADMIN_USER`/`QPID_ADMIN_PASSWORD` into its config (the admin account stays
+the literal `${QPID_ADMIN_USER}`), its Plain auth provider offers no ANONYMOUS,
+and its REST returns 405 for queue creation — so neither pre-declaring a queue
+nor connecting cleanly worked without deeper image surgery. Revisit with a
+purpose-built Broker-J config (a mounted `initial-config.json` with a plain
+password file + `nodeAutoCreationPolicies`) if a third reference broker is
+wanted.
+
+## Qpid JMS leg
+
+`jms/JmsInterop.java` is a minimal Qpid JMS client: connect, produce + consume
+a text message on a transient queue, verify the body, print `INTEROP_OK`. The
+`#[ignore]`d `jms_interop` rust test starts a loopback broker in-process and
+spawns the Java client at it.
+
+Run it (fetches the jars, compiles, runs the test):
+
+```sh
+ramqp-broker/tests/interop/jms/run.sh
+```
+
+Requires a JVM (`java`/`javac`), `curl`, `tar`, and `cargo`. CI runs the same
+script in the `interop-jms` job. The qpid-jms version is pinned by
+`QPID_JMS_VERSION` (default `2.10.0`); jars cache under `target/interop/`.
+
+## Qpid Proton leg
+
+`proton/proton_interop.py` is a minimal Apache Qpid Proton (Python) client —
+the C-based proton engine, a third independent stack. Proton needs a native
+library, so `proton/run.sh` runs it one of two ways:
+
+```sh
+ramqp-broker/tests/interop/proton/run.sh
+```
+
+- **host** — if `python3 -c "import proton"` works (CI installs
+  `python3-qpid-proton`), the broker binds loopback and proton runs on the host;
+- **docker fallback** — otherwise the broker binds `0.0.0.0` and proton runs in
+  an `ubuntu` container that installs `python3-qpid-proton` and reaches the host
+  via `host-gateway` (dev boxes where system packages can't be touched).
+
+CI runs the host path in the `interop-proton` job.
+
+> This leg is why `ramqp-core` gained the `(name, role)` link keying fix
+> (session/state.rs): proton names a sender and a receiver to the same address
+> identically, which the broker previously rejected — see the regression test
+> `same_name_sender_and_receiver_both_attach`.
diff --git a/ramqp-broker/tests/interop/jms/JmsInterop.java b/ramqp-broker/tests/interop/jms/JmsInterop.java
new file mode 100644
index 0000000..d3dbf37
--- /dev/null
+++ b/ramqp-broker/tests/interop/jms/JmsInterop.java
@@ -0,0 +1,64 @@
+// Apache Qpid JMS (pure-Java, AMQP 1.0) interop client for ramqp-broker.
+//
+// An independent, third-party AMQP 1.0 client stack exercising OUR broker:
+// connect, create a producer + consumer on a transient queue, round-trip a
+// text message, and verify the body. Prints "INTEROP_OK" and exits 0 on
+// success; prints the failure and exits 1 otherwise.
+//
+// Usage: java -cp <classes>:<qpid-jms-lib>/* JmsInterop amqp://host:port
+//
+// qpid-jms 2.x uses the Jakarta Messaging namespace (jakarta.jms.*).
+
+import jakarta.jms.Connection;
+import jakarta.jms.ConnectionFactory;
+import jakarta.jms.Destination;
+import jakarta.jms.Message;
+import jakarta.jms.MessageConsumer;
+import jakarta.jms.MessageProducer;
+import jakarta.jms.Session;
+import jakarta.jms.TextMessage;
+
+import org.apache.qpid.jms.JmsConnectionFactory;
+
+public final class JmsInterop {
+    public static void main(String[] args) {
+        String url = args.length > 0 ? args[0] : "amqp://127.0.0.1:5672";
+        // Transient queue on our broker (auto-declared under /queues/<name>).
+        String address = args.length > 1 ? args[1] : "/queues/jms-interop";
+        String payload = "hello-from-qpid-jms";
+
+        ConnectionFactory factory = new JmsConnectionFactory(url);
+        try (Connection connection = factory.createConnection()) {
+            connection.start();
+            Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
+            Destination queue = session.createQueue(address);
+
+            // Send first so the transient queue exists and holds the message.
+            MessageProducer producer = session.createProducer(queue);
+            producer.send(session.createTextMessage(payload));
+
+            MessageConsumer consumer = session.createConsumer(queue);
+            Message received = consumer.receive(5000);
+            if (received == null) {
+                System.err.println("INTEROP_FAIL: no message received within 5s");
+                System.exit(1);
+            }
+            if (!(received instanceof TextMessage)) {
+                System.err.println("INTEROP_FAIL: expected TextMessage, got " + received.getClass());
+                System.exit(1);
+            }
+            String body = ((TextMessage) received).getText();
+            if (!payload.equals(body)) {
+                System.err.println("INTEROP_FAIL: body mismatch: expected '" + payload
+                        + "', got '" + body + "'");
+                System.exit(1);
+            }
+            System.out.println("INTEROP_OK: round-tripped '" + body + "' via Qpid JMS");
+            System.exit(0);
+        } catch (Exception e) {
+            System.err.println("INTEROP_FAIL: " + e);
+            e.printStackTrace();
+            System.exit(1);
+        }
+    }
+}
diff --git a/ramqp-broker/tests/interop/jms/run.sh b/ramqp-broker/tests/interop/jms/run.sh
new file mode 100755
index 0000000..8bfc441
--- /dev/null
+++ b/ramqp-broker/tests/interop/jms/run.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Fetch Apache Qpid JMS, compile the JMS interop client, and run the (ignored)
+# `jms_interop` rust test against a loopback ramqp-broker. Used both locally and
+# by the `interop-jms` CI job.
+#
+#   ramqp-broker/tests/interop/jms/run.sh
+#
+# Requires: a JVM (java + javac), curl, tar, and cargo.
+set -euo pipefail
+
+QPID_JMS_VERSION="${QPID_JMS_VERSION:-2.10.0}"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$HERE/../../../.." && pwd)" # repo root: jms -> interop -> tests -> ramqp-broker -> root
+CACHE="${QPID_JMS_CACHE:-$ROOT/target/interop/qpid-jms}"
+DIST="$CACHE/apache-qpid-jms-$QPID_JMS_VERSION"
+LIB="$DIST/lib"
+CLASSES="$CACHE/classes"
+
+mkdir -p "$CACHE" "$CLASSES"
+
+if [ ! -d "$LIB" ]; then
+    echo ">> downloading qpid-jms $QPID_JMS_VERSION (binary distribution) ..."
+    url="https://repo1.maven.org/maven2/org/apache/qpid/apache-qpid-jms/$QPID_JMS_VERSION/apache-qpid-jms-$QPID_JMS_VERSION-bin.tar.gz"
+    curl -fsSL -o "$CACHE/qpid-jms.tar.gz" "$url"
+    tar xzf "$CACHE/qpid-jms.tar.gz" -C "$CACHE"
+fi
+
+echo ">> compiling JmsInterop.java ..."
+javac -cp "$LIB/*" -d "$CLASSES" "$HERE/JmsInterop.java"
+
+echo ">> running the interop test (Qpid JMS -> ramqp-broker) ..."
+export QPID_JMS_CP="$LIB"
+export QPID_JMS_CLASSES="$CLASSES"
+cd "$ROOT"
+cargo test -p ramqp-broker --test jms_interop -- --ignored --nocapture
diff --git a/ramqp-broker/tests/interop/proton/proton_interop.py b/ramqp-broker/tests/interop/proton/proton_interop.py
new file mode 100644
index 0000000..cf4fdfa
--- /dev/null
+++ b/ramqp-broker/tests/interop/proton/proton_interop.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+# Apache Qpid Proton (Python, AMQP 1.0) interop client for ramqp-broker.
+#
+# A third, independent AMQP 1.0 stack (the C-based proton engine) exercising OUR
+# broker, alongside the Rust fe2o3-amqp and Java Qpid JMS legs: connect, send a
+# message, receive it back, verify the body. Prints "INTEROP_OK" and exits 0 on
+# success; prints the failure and exits 1 otherwise.
+#
+# Usage: python3 proton_interop.py [amqp://host:port] [address]
+
+import sys
+
+from proton import Message
+from proton.utils import BlockingConnection
+
+url = sys.argv[1] if len(sys.argv) > 1 else "amqp://127.0.0.1:5680"
+address = sys.argv[2] if len(sys.argv) > 2 else "/queues/proton-interop"
+payload = "hello-from-qpid-proton"
+
+conn = BlockingConnection(url, timeout=15)
+try:
+    # Send first so the transient queue exists and holds the message.
+    sender = conn.create_sender(address)
+    sender.send(Message(body=payload))
+
+    receiver = conn.create_receiver(address, credit=1)
+    msg = receiver.receive(timeout=15)
+    receiver.accept()
+
+    if msg.body != payload:
+        print("INTEROP_FAIL: body mismatch: expected %r, got %r"
+              % (payload, msg.body), file=sys.stderr)
+        sys.exit(1)
+
+    print("INTEROP_OK: round-tripped %r via Qpid proton" % (msg.body,))
+    sys.exit(0)
+except Exception as e:  # noqa: BLE001 — any failure is an interop failure
+    print("INTEROP_FAIL: %s" % (e,), file=sys.stderr)
+    sys.exit(1)
+finally:
+    try:
+        conn.close()
+    except Exception:  # noqa: BLE001
+        pass
diff --git a/ramqp-broker/tests/interop/proton/run.sh b/ramqp-broker/tests/interop/proton/run.sh
new file mode 100755
index 0000000..8c0275e
--- /dev/null
+++ b/ramqp-broker/tests/interop/proton/run.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Apache Qpid Proton (Python) interop against ramqp-broker — the proton leg of
+# broker.md Phase 10, alongside the fe2o3-amqp (Rust) and Qpid JMS (Java) legs.
+#
+#   ramqp-broker/tests/interop/proton/run.sh
+#
+# Proton needs a native library, so this runs the client one of two ways:
+#   - HOST: if `python3 -c "import proton"` works (CI installs python3-qpid-proton
+#     via apt), the broker binds loopback and proton runs on the host.
+#   - DOCKER fallback: otherwise (e.g. a dev box where we can't touch system
+#     packages) the broker binds 0.0.0.0 and proton runs in an ubuntu container
+#     that apt-installs python3-qpid-proton and reaches the host via host-gateway.
+#
+# Requires cargo, and either host python3-qpid-proton or docker.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$HERE/../../../.." && pwd)" # proton -> interop -> tests -> ramqp-broker -> root
+BRK="$ROOT/target/debug/ramqp-brokerd"
+SCRIPT="$HERE/proton_interop.py"
+ADDRESS="/queues/proton-interop"
+declare -a PIDS=()
+
+cleanup() {
+    set +e
+    for p in "${PIDS[@]:-}"; do kill "$p" 2>/dev/null; done
+    pkill -f "$BRK" 2>/dev/null
+}
+trap cleanup EXIT
+
+echo ">> building ramqp-brokerd ..."
+cargo build -p ramqp-broker --bin ramqp-brokerd >/dev/null
+
+if python3 -c "import proton" >/dev/null 2>&1; then
+    echo ">> proton found on host — running host path ..."
+    RAMQP_LISTEN=127.0.0.1:5680 "$BRK" >/tmp/ramqp-brokerd-proton.log 2>&1 &
+    PIDS+=($!)
+    sleep 2
+    out="$(python3 "$SCRIPT" amqp://127.0.0.1:5680 "$ADDRESS")"
+elif command -v docker >/dev/null 2>&1; then
+    echo ">> proton not on host — running docker fallback ..."
+    RAMQP_LISTEN=0.0.0.0:5680 "$BRK" >/tmp/ramqp-brokerd-proton.log 2>&1 &
+    PIDS+=($!)
+    sleep 2
+    out="$(docker run --rm --add-host=host.docker.internal:host-gateway \
+        -v "$SCRIPT:/proton_interop.py:ro" ubuntu:24.04 \
+        bash -c "apt-get update -qq >/dev/null 2>&1 && \
+                 DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-qpid-proton >/dev/null 2>&1 && \
+                 python3 /proton_interop.py amqp://host.docker.internal:5680 $ADDRESS")"
+else
+    echo "!! neither host python3-qpid-proton nor docker available — cannot run proton interop" >&2
+    exit 2
+fi
+
+echo "$out"
+case "$out" in
+*INTEROP_OK*) echo ">> proton interop PASSED" ;;
+*) echo "!! proton interop FAILED" >&2; exit 1 ;;
+esac
diff --git a/ramqp-broker/tests/jms_interop.rs b/ramqp-broker/tests/jms_interop.rs
new file mode 100644
index 0000000..2e4b612
--- /dev/null
+++ b/ramqp-broker/tests/jms_interop.rs
@@ -0,0 +1,48 @@
+//! External-toolchain interop: Apache Qpid JMS (a pure-Java, independent AMQP
+//! 1.0 client stack) exercising OUR broker end-to-end. This is the JMS leg of
+//! broker.md Phase 10, complementing `bench-compare/tests/fe2o3_interop.rs`
+//! (the Rust `fe2o3-amqp` leg): a second, unrelated implementation proving our
+//! broker's wire behavior isn't accidentally tailored to our own client.
+//!
+//! `#[ignore]`d — it needs a JVM and the qpid-jms classpath. The runner
+//! `tests/interop/jms/run.sh` fetches the jars, compiles the Java client, sets
+//! the env vars below, and invokes this with `--ignored`; the `interop-jms` CI
+//! job does the same. The test starts a loopback broker in-process, spawns the
+//! Java client against it, and asserts the round-trip.
+
+mod harness;
+
+use harness::*;
+
+/// Required env (set by `tests/interop/jms/run.sh`):
+/// - `QPID_JMS_CP`      — directory of qpid-jms `lib/*.jar` (used as `<dir>/*`)
+/// - `QPID_JMS_CLASSES` — directory holding the compiled `JmsInterop.class`
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "requires a JVM + qpid-jms classpath; run via tests/interop/jms/run.sh (CI: interop-jms)"]
+async fn qpid_jms_roundtrips_through_our_broker() {
+    let lib = std::env::var("QPID_JMS_CP")
+        .expect("QPID_JMS_CP (qpid-jms lib dir) must be set — run tests/interop/jms/run.sh");
+    let classes = std::env::var("QPID_JMS_CLASSES").expect(
+        "QPID_JMS_CLASSES (compiled JmsInterop dir) must be set — run tests/interop/jms/run.sh",
+    );
+
+    let lb = loopback().await;
+    let url = lb.url();
+
+    let output = tokio::process::Command::new("java")
+        .arg("-cp")
+        .arg(format!("{classes}:{lib}/*"))
+        .arg("JmsInterop")
+        .arg(&url)
+        .output()
+        .await
+        .expect("spawn java qpid-jms client");
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        output.status.success() && stdout.contains("INTEROP_OK"),
+        "Qpid JMS interop failed (status {:?}).\n--- stdout ---\n{stdout}\n--- stderr ---\n{stderr}",
+        output.status.code()
+    );
+}
diff --git a/ramqp-broker/tests/mgmt.rs b/ramqp-broker/tests/mgmt.rs
index b009d63..8dff230 100644
--- a/ramqp-broker/tests/mgmt.rs
+++ b/ramqp-broker/tests/mgmt.rs
@@ -35,10 +35,8 @@ async fn metrics_and_queue_inspection() {
     let mgmt_addr = l.local_addr().unwrap();
     drop(l);
 
-    let config = BrokerConfig {
-        management_listen: Some(mgmt_addr.to_string()),
-        ..Default::default()
-    };
+    let mut config = BrokerConfig::default();
+    config.management_listen = Some(mgmt_addr.to_string());
     let bound = Broker::new(config).bind("127.0.0.1:0").await.expect("bind");
     let addr = bound.local_addr();
     let shutdown = bound.shutdown_handle();
diff --git a/ramqp-broker/tests/partition/README.md b/ramqp-broker/tests/partition/README.md
new file mode 100644
index 0000000..285d73c
--- /dev/null
+++ b/ramqp-broker/tests/partition/README.md
@@ -0,0 +1,40 @@
+# Process-level partition tests
+
+Jepsen-style split-brain against real broker **processes** across real Linux
+**network namespaces** — the process-level half of broker.md Phase 10's HA
+fault-injection axis. The in-process leg (leader kills, rolling kills to the
+availability boundary, follower-loss transparency) lives in
+[`tests/cluster.rs`](../cluster.rs); this one adds true network partitions.
+
+## What it asserts
+
+A 3-node quorum cluster (one `ramqp-brokerd` per namespace, bridged on
+`10.42.0.0/24`) is partitioned into a majority `{n1,n2}` and a minority `{n3}`
+via `iptables` DROP rules inside the minority's namespace. Then:
+
+- **majority stays available** — publishes to `n1` are still accepted (2/3 quorum),
+- **minority refuses** — publishes to `n3` are refused/never accepted (the
+  silent-loss guard: an accepted publish without quorum would fail the test),
+- **no loss on heal** — after the partition clears, every committed message is
+  still consumable.
+
+## Running
+
+```sh
+ramqp-broker/tests/partition/run.sh
+```
+
+Run it as your normal user: it builds `ramqp-brokerd` + the `partition_probe`
+example, then re-execs itself under `sudo` (it needs root for network
+namespaces, veth pairs, and `iptables`). Everything is torn down on exit
+(namespaces, bridge, broker processes) via an `EXIT` trap. CI runs the same
+script in the `partition` job.
+
+The client workload is driven by [`examples/partition_probe.rs`](../../examples/partition_probe.rs),
+invoked per node; its exit code reports the outcome (`expect-accept` /
+`expect-refused` / `consume`).
+
+> Note: the clustered nodes run without on-disk Raft persistence (no
+> `store-redb`/`data_dir`), so this exercises **partition availability**, not
+> node-restart durability — restart-durability is covered by the `store-redb`
+> durable suite.
diff --git a/ramqp-broker/tests/partition/run.sh b/ramqp-broker/tests/partition/run.sh
new file mode 100755
index 0000000..3f85141
--- /dev/null
+++ b/ramqp-broker/tests/partition/run.sh
@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# Process-level network-partition test for ramqp-broker's quorum queues — the
+# Jepsen-style split-brain leg of broker.md Phase 10, run against real broker
+# PROCESSES across real network namespaces (not the in-process fault injection
+# in tests/cluster.rs).
+#
+# Topology: a Linux bridge (10.42.0.254/24) with three network namespaces
+# ns1..ns3 (10.42.0.1..3), one ramqp-brokerd per namespace forming a 3-node
+# quorum cluster. We then iptables-partition ns3 (the minority) away from ns1/ns2
+# and assert CP behavior:
+#   - majority {n1,n2} keeps ACCEPTING publishes (2/3 quorum),
+#   - minority {n3} REFUSES publishes (never silently accepts — the loss guard),
+#   - after healing, every committed message is still there (no loss).
+#
+# Needs root (network namespaces + iptables). Run it as your normal user; it
+# builds the binaries, then re-execs itself under `sudo -E`:
+#
+#   ramqp-broker/tests/partition/run.sh
+#
+# CI runs the same script in the `partition` job.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$HERE/../../.." && pwd)" # partition -> tests -> ramqp-broker -> root
+BRK="$ROOT/target/debug/ramqp-brokerd"
+PROBE="$ROOT/target/debug/examples/partition_probe"
+
+# Phase 1 (unprivileged): build, then re-exec under sudo.
+if [ "$(id -u)" -ne 0 ]; then
+    echo ">> building brokerd + partition_probe ..."
+    cargo build -p ramqp-broker --bin ramqp-brokerd --example partition_probe
+    echo ">> re-executing under sudo for network-namespace setup ..."
+    exec sudo "$0" "$@"
+fi
+
+# Phase 2 (root): the actual test.
+SUBNET="10.42.0"
+BRIDGE="br-ramqp"
+QUEUE="/quorum/partition"
+LOGDIR="$(mktemp -d)"
+declare -a PIDS=()
+
+log() { echo ">> $*"; }
+fail() {
+    echo "!! PARTITION TEST FAILED: $*" >&2
+    exit 1
+}
+
+cleanup() {
+    set +e
+    for p in "${PIDS[@]:-}"; do kill "$p" 2>/dev/null; done
+    # brokerd runs as a child of `ip netns exec`; make sure none survive.
+    pkill -f "$BRK" 2>/dev/null
+    for i in 1 2 3; do
+        ip netns pids "ns$i" 2>/dev/null | xargs -r kill 2>/dev/null
+        ip netns del "ns$i" 2>/dev/null
+        ip link del "veth$i-br" 2>/dev/null
+    done
+    ip link del "$BRIDGE" 2>/dev/null
+    rm -rf "$LOGDIR"
+}
+trap cleanup EXIT
+
+# --- topology ------------------------------------------------------------
+log "creating bridge $BRIDGE and namespaces ns1..ns3 ..."
+ip link add "$BRIDGE" type bridge
+ip addr add "$SUBNET.254/24" dev "$BRIDGE"
+ip link set "$BRIDGE" up
+for i in 1 2 3; do
+    ip netns add "ns$i"
+    ip link add "veth$i" type veth peer name "veth$i-br"
+    ip link set "veth$i" netns "ns$i"
+    ip link set "veth$i-br" master "$BRIDGE"
+    ip link set "veth$i-br" up
+    ip netns exec "ns$i" ip addr add "$SUBNET.$i/24" dev "veth$i"
+    ip netns exec "ns$i" ip link set "veth$i" up
+    ip netns exec "ns$i" ip link set lo up
+done
+
+# --- start the cluster ---------------------------------------------------
+SEEDS="1=$SUBNET.1:7472,2=$SUBNET.2:7472,3=$SUBNET.3:7472"
+log "starting a ramqp-brokerd in each namespace ..."
+for i in 1 2 3; do
+    ip netns exec "ns$i" env \
+        RAMQP_NODE_ID="$i" \
+        RAMQP_LISTEN="$SUBNET.$i:5672" \
+        RAMQP_CLUSTER_LISTEN="$SUBNET.$i:7472" \
+        RAMQP_SEEDS="$SEEDS" \
+        "$BRK" >"$LOGDIR/node$i.log" 2>&1 &
+    PIDS+=($!)
+done
+
+# --- readiness: retry a seed publish until the cluster serves ------------
+probe() { "$PROBE" "$@"; }
+log "waiting for the cluster to form (seed publishes to n1) ..."
+ready=0
+for _ in $(seq 1 20); do
+    if probe "amqp://$SUBNET.1:5672" "$QUEUE" expect-accept 5 >/dev/null 2>&1; then
+        ready=1
+        break
+    fi
+    sleep 1
+done
+[ "$ready" -eq 1 ] || { cat "$LOGDIR"/node*.log; fail "cluster never accepted the seed publishes"; }
+log "cluster healthy — 5 messages committed."
+
+# --- partition the minority (ns3) ---------------------------------------
+log "partitioning ns3 away from ns1/ns2 (iptables DROP) ..."
+for peer in 1 2; do
+    ip netns exec ns3 iptables -A INPUT -s "$SUBNET.$peer" -j DROP
+    ip netns exec ns3 iptables -A OUTPUT -d "$SUBNET.$peer" -j DROP
+done
+
+log "letting Raft notice the partition ..."
+sleep 6
+
+# --- majority must keep accepting ---------------------------------------
+log "majority check: publishing to n1 (expect ACCEPT) ..."
+probe "amqp://$SUBNET.1:5672" "$QUEUE" expect-accept 3 \
+    || fail "majority {n1,n2} refused a publish it should have accepted"
+log "majority accepted 3 more (8 committed total)."
+
+# Multi-connection load sweep: sustained concurrent producers against the
+# majority DURING the partition (8 connections x 5 = 40 publishes), all accepted.
+LOAD_CONNS=8
+LOAD_PER=5
+LOAD_TOTAL=$((LOAD_CONNS * LOAD_PER))
+log "majority load sweep: $LOAD_CONNS connections x $LOAD_PER publishes to n1 ..."
+load_out="$(probe "amqp://$SUBNET.1:5672" "$QUEUE" load "$LOAD_CONNS" "$LOAD_PER")" \
+    || fail "majority dropped a publish under concurrent load: $load_out"
+log "load sweep: $load_out (all accepted)."
+COMMITTED=$((8 + LOAD_TOTAL))
+
+# --- minority must refuse, never silently accept ------------------------
+log "minority check: publishing to n3 (expect REFUSED, never accepted) ..."
+probe "amqp://$SUBNET.3:5672" "$QUEUE" expect-refused 3 \
+    || fail "minority {n3} accepted a publish without quorum — silent-loss hazard"
+log "minority refused cleanly."
+
+# --- heal and verify no committed message was lost ----------------------
+log "healing the partition ..."
+ip netns exec ns3 iptables -F
+sleep 6
+
+log "consuming from n1 to check for loss ..."
+out="$(probe "amqp://$SUBNET.1:5672" "$QUEUE" consume $((COMMITTED + 20)))" || fail "consume probe failed"
+got="$(echo "$out" | sed -n 's/^CONSUMED \([0-9]*\)$/\1/p')"
+[ -n "$got" ] || fail "could not parse consume output: $out"
+log "consumed $got messages (expected >= $COMMITTED committed)."
+[ "$got" -ge "$COMMITTED" ] \
+    || fail "message loss: only $got of the $COMMITTED committed messages survived"
+
+echo
+echo "PARTITION TEST PASSED: majority available (incl. $LOAD_TOTAL-publish concurrent load), minority refused, no committed-message loss."
diff --git a/ramqp-broker/tests/policies.rs b/ramqp-broker/tests/policies.rs
index 293213b..4969bf1 100644
--- a/ramqp-broker/tests/policies.rs
+++ b/ramqp-broker/tests/policies.rs
@@ -28,17 +28,11 @@ fn text_of(delivery: &ramqp::Delivery) -> String {
 /// TTL: an expired message is dead-lettered instead of delivered.
 #[tokio::test]
 async fn expired_messages_dead_letter_instead_of_delivering() {
-    let config = BrokerConfig {
-        policies: vec![(
-            "ttl-".to_owned(),
-            QueuePolicy {
-                message_ttl: Some(Duration::from_millis(150)),
-                dead_letter: Some("/queues/dead".to_owned()),
-                ..Default::default()
-            },
-        )],
-        ..Default::default()
-    };
+    let mut policy = QueuePolicy::default();
+    policy.message_ttl = Some(Duration::from_millis(150));
+    policy.dead_letter = Some("/queues/dead".to_owned());
+    let mut config = BrokerConfig::default();
+    config.policies = vec![("ttl-".to_owned(), policy)];
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
@@ -89,18 +83,12 @@ async fn expired_messages_dead_letter_instead_of_delivering() {
 /// the displaced head.
 #[tokio::test]
 async fn drop_head_keeps_newest_and_dead_letters_the_oldest() {
-    let config = BrokerConfig {
-        policies: vec![(
-            "ring-".to_owned(),
-            QueuePolicy {
-                max_length: Some(3),
-                overflow: OverflowBehavior::DropHead,
-                dead_letter: Some("/queues/displaced".to_owned()),
-                ..Default::default()
-            },
-        )],
-        ..Default::default()
-    };
+    let mut policy = QueuePolicy::default();
+    policy.max_length = Some(3);
+    policy.overflow = OverflowBehavior::DropHead;
+    policy.dead_letter = Some("/queues/displaced".to_owned());
+    let mut config = BrokerConfig::default();
+    config.policies = vec![("ring-".to_owned(), policy)];
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
@@ -154,17 +142,11 @@ async fn drop_head_keeps_newest_and_dead_letters_the_oldest() {
 /// instead of redelivering forever.
 #[tokio::test]
 async fn delivery_limit_dead_letters_poison_messages() {
-    let config = BrokerConfig {
-        policies: vec![(
-            "poison-".to_owned(),
-            QueuePolicy {
-                max_delivery_attempts: Some(2),
-                dead_letter: Some("/queues/poison-dlx".to_owned()),
-                ..Default::default()
-            },
-        )],
-        ..Default::default()
-    };
+    let mut policy = QueuePolicy::default();
+    policy.max_delivery_attempts = Some(2);
+    policy.dead_letter = Some("/queues/poison-dlx".to_owned());
+    let mut config = BrokerConfig::default();
+    config.policies = vec![("poison-".to_owned(), policy)];
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
@@ -221,17 +203,11 @@ async fn delivery_limit_dead_letters_poison_messages() {
 /// failure increments and fired late (or never).
 #[tokio::test]
 async fn quorum_delivery_limit_fires_exactly() {
-    let config = BrokerConfig {
-        policies: vec![(
-            "qpoison-".to_owned(),
-            QueuePolicy {
-                max_delivery_attempts: Some(2),
-                dead_letter: Some("/queues/qpoison-dlx".to_owned()),
-                ..Default::default()
-            },
-        )],
-        ..Default::default()
-    };
+    let mut policy = QueuePolicy::default();
+    policy.max_delivery_attempts = Some(2);
+    policy.dead_letter = Some("/queues/qpoison-dlx".to_owned());
+    let mut config = BrokerConfig::default();
+    config.policies = vec![("qpoison-".to_owned(), policy)];
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
@@ -289,17 +265,11 @@ async fn quorum_delivery_limit_fires_exactly() {
 /// enforcement; expiry timestamps ride the replicated log).
 #[tokio::test]
 async fn quorum_queues_honor_ttl_and_dead_lettering() {
-    let config = BrokerConfig {
-        policies: vec![(
-            "qttl-".to_owned(),
-            QueuePolicy {
-                message_ttl: Some(Duration::from_millis(150)),
-                dead_letter: Some("/queues/qdead".to_owned()),
-                ..Default::default()
-            },
-        )],
-        ..Default::default()
-    };
+    let mut policy = QueuePolicy::default();
+    policy.message_ttl = Some(Duration::from_millis(150));
+    policy.dead_letter = Some("/queues/qdead".to_owned());
+    let mut config = BrokerConfig::default();
+    config.policies = vec![("qttl-".to_owned(), policy)];
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
diff --git a/ramqp-broker/tests/produce_consume.rs b/ramqp-broker/tests/produce_consume.rs
index 093ae63..5258346 100644
--- a/ramqp-broker/tests/produce_consume.rs
+++ b/ramqp-broker/tests/produce_consume.rs
@@ -106,10 +106,8 @@ async fn consumer_handle_reuse_across_queues_never_cross_delivers() {
 /// bad address must never tear the whole session down.
 #[tokio::test]
 async fn link_refusal_keeps_the_session_alive() {
-    let config = BrokerConfig {
-        max_queues: 1,
-        ..Default::default()
-    };
+    let mut config = BrokerConfig::default();
+    config.max_queues = 1;
     let bound = Broker::new(config).bind("127.0.0.1:0").await.expect("bind");
     let addr = bound.local_addr();
     let shutdown = bound.shutdown_handle();
@@ -420,10 +418,8 @@ async fn cross_connection_produce_consume() {
 
 #[tokio::test]
 async fn queue_overflow_rejects_the_publish() {
-    let config = BrokerConfig {
-        max_queue_depth: 3,
-        ..Default::default()
-    };
+    let mut config = BrokerConfig::default();
+    config.max_queue_depth = 3;
     let bound = Broker::new(config).bind("127.0.0.1:0").await.expect("bind");
     let addr = bound.local_addr();
     let shutdown = bound.shutdown_handle();
diff --git a/ramqp-broker/tests/quorum_queue.rs b/ramqp-broker/tests/quorum_queue.rs
index 4e1e220..109e346 100644
--- a/ramqp-broker/tests/quorum_queue.rs
+++ b/ramqp-broker/tests/quorum_queue.rs
@@ -131,10 +131,8 @@ async fn quorum_consumer_drop_requeues_unacked() {
 
 #[tokio::test]
 async fn quorum_overflow_rejects_the_publish() {
-    let config = BrokerConfig {
-        max_queue_depth: 2,
-        ..Default::default()
-    };
+    let mut config = BrokerConfig::default();
+    config.max_queue_depth = 2;
     let (addr, shutdown) = start(config).await;
     let conn = ConnectionBuilder::new(format!("amqp://{addr}"))
         .connect()
diff --git a/ramqp-broker/tests/smoke.rs b/ramqp-broker/tests/smoke.rs
index 609e2f2..f1a308d 100644
--- a/ramqp-broker/tests/smoke.rs
+++ b/ramqp-broker/tests/smoke.rs
@@ -98,10 +98,8 @@ async fn sessions_can_end_and_reopen() {
 
 #[tokio::test]
 async fn connection_limit_refuses_excess_then_recovers() {
-    let config = BrokerConfig {
-        max_connections: 1,
-        ..Default::default()
-    };
+    let mut config = BrokerConfig::default();
+    config.max_connections = 1;
     let (addr, shutdown) = start(Broker::new(config)).await;
 
     // The first connection establishes and holds the sole permit.
diff --git a/ramqp-broker/tests/transactions.rs b/ramqp-broker/tests/transactions.rs
index 421a3dc..65a2b12 100644
--- a/ramqp-broker/tests/transactions.rs
+++ b/ramqp-broker/tests/transactions.rs
@@ -249,13 +249,9 @@ async fn transactions_commit_into_quorum_queues() {
 #[tokio::test]
 async fn commit_with_a_full_queue_applies_nothing() {
     let mut config = BrokerConfig::default();
-    config.policies.push((
-        "txn-full".to_owned(),
-        ramqp_broker::QueuePolicy {
-            max_length: Some(1),
-            ..Default::default()
-        },
-    ));
+    let mut policy = ramqp_broker::QueuePolicy::default();
+    policy.max_length = Some(1);
+    config.policies.push(("txn-full".to_owned(), policy));
     let bound = Broker::new(config).bind("127.0.0.1:0").await.expect("bind");
     let addr = bound.local_addr();
     let shutdown = bound.shutdown_handle();
diff --git a/ramqp-core/Cargo.toml b/ramqp-core/Cargo.toml
index 2644eb7..e123ca2 100644
--- a/ramqp-core/Cargo.toml
+++ b/ramqp-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "ramqp-core"
-version = "0.2.4"
+version = "0.2.5"
 edition = "2024"
 description = "Role-agnostic AMQP 1.0 engine (codec, framing, session/link state machines) shared by the ramqp client and ramqp-broker."
 license = "MIT"
diff --git a/ramqp-core/src/session/state.rs b/ramqp-core/src/session/state.rs
index 95ac24e..d409f3e 100644
--- a/ramqp-core/src/session/state.rs
+++ b/ramqp-core/src/session/state.rs
@@ -82,10 +82,13 @@ pub struct Session {
     handles: HandleAllocator,
     remote_handles: RemoteHandleMap,
     links: HashMap<u32, Link>,
-    /// Index of link name -> local handle, so a peer `attach` response binds in
-    /// O(1) instead of scanning every link. Kept in lockstep with `links` via
-    /// [`Session::forget_link`].
-    link_handles: HashMap<String, u32>,
+    /// Index of (link name, our local role) -> local handle, so a peer `attach`
+    /// response binds in O(1) instead of scanning every link. Keyed by role as
+    /// well as name because AMQP 1.0 §2.6.1 identifies a link by container-id +
+    /// name + *role*: a sender and a receiver may legitimately share a name on
+    /// one session (e.g. a Qpid Proton client opening both to the same address).
+    /// Kept in lockstep with `links` via [`Session::forget_link`].
+    link_handles: HashMap<(String, Role), u32>,
     events: mpsc::UnboundedSender<SessionEvent>,
     pending_begin: Option<Reply<SessionOpened, SessionError>>,
     pending_end: Option<Reply<(), SessionError>>,
@@ -270,7 +273,9 @@ impl Session {
         };
         attach.handle = handle;
         let name = attach.name.clone();
-        self.link_handles.insert(name.clone(), handle);
+        // Our local role for a self-initiated attach is `attach.role`.
+        self.link_handles
+            .insert((name.clone(), attach.role), handle);
         let link = match attach.role {
             Role::Sender => {
                 if attach.initial_delivery_count.is_none() {
@@ -306,7 +311,12 @@ impl Session {
         attach: Attach,
         transport: &mut FramedTransport<S>,
     ) {
-        let Some(&local) = self.link_handles.get(&attach.name) else {
+        // This is the peer's *response* to a link we initiated: the frame's role
+        // is the peer's, so our local endpoint plays the opposite role.
+        let Some(&local) = self
+            .link_handles
+            .get(&(attach.name.clone(), attach.role.opposite()))
+        else {
             return;
         };
         // Only bind a link still awaiting its peer attach (ignore a duplicate
@@ -353,12 +363,15 @@ impl Session {
         }
     }
 
-    /// Whether a link with this name was initiated locally (so an inbound
-    /// `attach` for it is the peer's *response*, handled by
-    /// [`Session::on_peer_attach`]). An unknown name on a server is a
-    /// peer-initiated attach for [`Session::accept_peer_attach`].
-    pub fn knows_link(&self, name: &str) -> bool {
-        self.link_handles.contains_key(name)
+    /// Whether the link an inbound `attach` (carrying `remote_role`) refers to
+    /// was initiated locally — i.e. this attach is the peer's *response*,
+    /// handled by [`Session::on_peer_attach`]. Matched by name **and** role
+    /// (our local endpoint plays `remote_role.opposite()`), so a peer opening a
+    /// same-named link in the *other* direction is correctly seen as a new
+    /// peer-initiated attach for [`Session::accept_peer_attach`], not a response.
+    pub fn knows_link(&self, name: &str, remote_role: Role) -> bool {
+        self.link_handles
+            .contains_key(&(name.to_string(), remote_role.opposite()))
     }
 
     /// Diagnostics: per sender link, what is still queued locally, what the
@@ -399,22 +412,26 @@ impl Session {
         events: mpsc::Sender<LinkEvent>,
         transport: &mut FramedTransport<S>,
     ) -> Result<AcceptedLink, LinkError> {
-        if self.link_handles.contains_key(&attach.name) {
+        // We take the mirror role of the peer's.
+        let our_role = attach.role.opposite();
+        // Reject only a duplicate of the *same* link (name + our role); a
+        // same-named link in the other direction is a distinct link (§2.6.1).
+        if self
+            .link_handles
+            .contains_key(&(attach.name.clone(), our_role))
+        {
             return Err(LinkError::msg(
                 ErrorKind::ProtocolViolation,
-                format!("duplicate attach for link name {:?}", attach.name),
+                format!(
+                    "duplicate attach for link name {:?} (role {:?})",
+                    attach.name, our_role
+                ),
             ));
         }
         let local = self.handles.allocate().ok_or_else(|| {
             LinkError::msg(ErrorKind::Capacity, "handle-max exhausted accepting attach")
         })?;
 
-        // We take the mirror role of the peer's.
-        let our_role = match attach.role {
-            Role::Sender => Role::Receiver,
-            Role::Receiver => Role::Sender,
-        };
-
         let mut response = Attach {
             name: attach.name.clone(),
             handle: local,
@@ -467,7 +484,8 @@ impl Session {
         let mut link = link;
         link.set_remote_handle(attach.handle);
         link.mark_attached();
-        self.link_handles.insert(attach.name.clone(), local);
+        self.link_handles
+            .insert((attach.name.clone(), our_role), local);
         self.remote_handles.bind(attach.handle, local);
         self.links.insert(local, link);
 
@@ -797,11 +815,11 @@ impl Session {
     /// `links` across the (three) detach paths.
     fn forget_link(&mut self, local: u32) {
         if let Some(link) = self.links.remove(&local) {
-            let name = match &link {
-                Link::Sender(s) => &s.name,
-                Link::Receiver(r) => &r.name,
+            let key = match &link {
+                Link::Sender(s) => (s.name.clone(), Role::Sender),
+                Link::Receiver(r) => (r.name.clone(), Role::Receiver),
             };
-            self.link_handles.remove(name);
+            self.link_handles.remove(&key);
         }
         self.handles.release(local);
     }
@@ -1398,7 +1416,7 @@ mod tests {
             other => panic!("expected detach, got {other:?}"),
         }
         // The throwaway handle was released: the session can still attach links.
-        assert!(!session.knows_link("bad"));
+        assert!(!session.knows_link("bad", Role::Sender));
     }
 
     #[tokio::test]
@@ -1463,6 +1481,78 @@ mod tests {
         }
     }
 
+    /// A peer may open a sender and a receiver that SHARE a link name on one
+    /// session — AMQP 1.0 §2.6.1 identifies a link by name AND role. Both must
+    /// attach. Regression: the broker once keyed links by name alone, so the
+    /// second same-named attach was misrouted/dropped, breaking Qpid Proton's
+    /// default link naming (`<container>-<address>` for both directions).
+    #[tokio::test]
+    async fn same_name_sender_and_receiver_both_attach() {
+        let begin = peer_begin();
+        let (mut session, _resp, _evt, mut transport, _far) = server_session(&begin);
+
+        // Peer's sender named "shared" (we mirror as receiver).
+        let (tx1, _rx1) = mpsc::channel(16);
+        let s = session
+            .accept_peer_attach(
+                Attach {
+                    name: "shared".into(),
+                    handle: 0,
+                    role: Role::Sender,
+                    ..Default::default()
+                },
+                CreditMode::Manual,
+                0,
+                None,
+                tx1,
+                &mut transport,
+            )
+            .expect("sender attach accepted");
+
+        // Peer's receiver with the SAME name (we mirror as sender).
+        let (tx2, _rx2) = mpsc::channel(16);
+        let r = session
+            .accept_peer_attach(
+                Attach {
+                    name: "shared".into(),
+                    handle: 1,
+                    role: Role::Receiver,
+                    ..Default::default()
+                },
+                CreditMode::Manual,
+                0,
+                None,
+                tx2,
+                &mut transport,
+            )
+            .expect("same-name receiver attach accepted");
+
+        assert_ne!(
+            s.handle, r.handle,
+            "the two links get distinct local handles"
+        );
+
+        // A genuine duplicate (same name AND same role) is still refused.
+        let (tx3, _rx3) = mpsc::channel(16);
+        let dup = session.accept_peer_attach(
+            Attach {
+                name: "shared".into(),
+                handle: 2,
+                role: Role::Sender,
+                ..Default::default()
+            },
+            CreditMode::Manual,
+            0,
+            None,
+            tx3,
+            &mut transport,
+        );
+        assert!(
+            dup.is_err(),
+            "a same-name same-role duplicate is still rejected"
+        );
+    }
+
     #[tokio::test]
     async fn session_flow_without_handle_resumes_stalled_senders() {
         // Peer advertises a 2-transfer incoming window; we have credit for 3.
diff --git a/ramqp-core/src/types/definitions.rs b/ramqp-core/src/types/definitions.rs
index b2bcdc2..d0d1097 100644
--- a/ramqp-core/src/types/definitions.rs
+++ b/ramqp-core/src/types/definitions.rs
@@ -30,7 +30,7 @@ pub type MessageFormat = u32;
 
 /// The directional role of a link endpoint. Encoded as a `boolean`
 /// (`false` = sender, `true` = receiver).
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
 pub enum Role {
     /// The endpoint is the sending side.
     #[default]
@@ -39,6 +39,17 @@ pub enum Role {
     Receiver,
 }
 
+impl Role {
+    /// The mirror role — what the *other* end of a link plays. A peer's `attach`
+    /// carrying role `R` references our local link endpoint of role `R.opposite()`.
+    pub fn opposite(self) -> Role {
+        match self {
+            Role::Sender => Role::Receiver,
+            Role::Receiver => Role::Sender,
+        }
+    }
+}
+
 impl Encode for Role {
     fn encode(&self, buf: &mut BytesMut) {
         matches!(self, Role::Receiver).encode(buf)
diff --git a/ramqp/Cargo.toml b/ramqp/Cargo.toml
index deec6d9..2d5e430 100644
--- a/ramqp/Cargo.toml
+++ b/ramqp/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "ramqp"
-version = "0.8.1"
+version = "0.8.2"
 edition = "2024"
 description = "Async AMQP 1.0 client for Rust on tokio — connects to RabbitMQ 4.x, ActiveMQ Artemis, and other AMQP 1.0 brokers."
 license = "MIT"
@@ -18,7 +18,7 @@ name = "ramqp"
 path = "src/lib.rs"
 
 [dependencies]
-ramqp-core = { path = "../ramqp-core", version = "0.2.4" }
+ramqp-core = { path = "../ramqp-core", version = "0.2.5" }
 bytes = "1"
 thiserror = "2"
 ordered-float = "5"