a green handshake that forwarded nothing

A handshake can complete while carrying nothing. Our relay had been built in stages, and one stage — the branch that fetches a peer's pre-published one-time handshake key and forwards it to the requester — was still a stub. The stub compiled. It emitted a well-formed response with the key fields present and empty.

Every test passed. The tests checked what is easy to check: that the request was answered, that both parties reached the same state, that the connection closed cleanly. None of them looked inside the payload, because the payload had been trustworthy in the previous stage and the framing layer already guaranteed its shape. So a message that was structurally valid and semantically empty travelled through a green test suite and into a release candidate.

What made it dangerous is the shape of the failure. It did not error, it did not time out, and it did not write a log line. A consumer of that response would have received a key of zero bytes, and the next layer would have failed somewhere else entirely, with an error naming a different subsystem.

The fix was small: carry the key material through the gated result instead of a pair of counters, and delete the placeholder comments that had made the stub look intentional. The lasting change was to the tests. A relay test now asserts on what it forwards, not only on the fact that a conversation ended. Silence is the failure mode that costs the most to find, so it is the one worth spending assertions on — and the willingness to assert on contents rather than on completion is what separates a test suite from a formality.