Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Capture a baseline
Connect to /ws, send ping, subscribe to your own room, and save directions, timestamps, opcodes, sizes, and hashes.
Enable interception
Pause one outbound ping. Edit only data, forward it, then pause a second frame and drop it. Verify the timeline marks original, modified, forwarded, and dropped states.
Replay a saved frame
Replay the same secure subscription as User A and User B. Identity is the only changed input.
Exercise cancellation and recovery
Cancel while connected, reconnect once, and confirm no old queued event appears in the new session. Record any recovery error rather than retrying forever.
Prove it before moving on.
The timeline preserves an unmodified baseline plus one edited, one dropped, and one identity-replayed frame.