gw-05 — Verification

One command

cd gw-05-websockets-pushy && bash scripts/verify.sh

Test	Invariant
`TestAcceptKey`	the RFC 6455 §1.3 accept-key derivation is exact
`TestFrameRoundTripMasked`	masked client→server frames encode/decode (unmask) correctly
`TestHandshakeAndMessage`	full upgrade handshake + a request/response message over a real connection
`TestPingAutoPong`	a ping is auto-answered with a pong on the wire (app-layer keepalive)
`TestRegistryTTL`	registry entries expire (crashed-node cleanup; expired = miss)
`TestDeliveryRouting`	a published event is routed to the owning node purely via registry lookup
`TestRegistryMissPolicy`	a push to an unconnected device is a counted miss, not a crash
`TestSlowConsumerIsolation`	a full per-device queue drops (doesn't block); other devices unaffected
`TestReconnectJitterSpread`	full-jitter reconnect delays spread across all buckets (no stampede)
`TestAtLeastOnceDedup`	a redelivered MsgID is suppressed (idempotent client)
`TestBackoffWithinCap`	exponential backoff with jitter stays within the cap

All under -race with a 60s timeout (the timeout guards against the net.Pipe-style deadlocks discussed in GUIDE §1).

No TLS / device identity. Production terminates TLS and authenticates each connection (gw-07).
In-memory registry. A real registry is a replicated KV with a reconciliation sweep (GUIDE §7.3).
No full drain loop wired in. drain.go provides the primitives; wiring SIGTERM → reconnect signals → bounded wait is an exercise (GUIDE §7.1) and needs Kubernetes' long terminationGracePeriodSeconds (gw-09).
Density not measured here. The 60k→200k journey is a profiling exercise (GUIDE §7.5).