[ritzylab-dev]

What this adds

Four tests for the TLS configuration lifetime introduced in #186: a second configure() while connected replaces the staged
set (two sets live, not three); a rejected configure() discards the staged set and the next connection uses the original;
a promoted set survives its own failed handshake; mutual TLS credentials survive staging. The host-only debug function reports
an attempt in flight instead of reading the session object the connect thread owns.

Evidence

52/52 in the TLS test binary; leak check clean. No production code changes: the only non-test hunks are inside the host-only
diagnostic block.

🤖 Generated with Claude Code

[ritzylab-dev]

Reviewed 253d189 against dev b087ff1. No blocking findings; ready to merge.

The complete source tree is identical to the previously reviewed/tested 0c462ac (tree 997b9e3105ef4176dfd3ba80975f1849ce3e9e1b), where my independent TLS run passed 52/52. The diff is exactly the two expected files. The debug guard avoids accessing worker-owned SSL state during a connect attempt, and both copies of the test-only snapshot layout match.

Exact-head CI run 41741764175 now passes: normal Linux 33/33; TSan 33/33, with 0 report files, 0 distinct findings and 0 runtime aborts. No redundant local rerun performed because the entire tree is identical to the independently tested tree.

Nonblocking coverage note, already recorded: the double-staging test uses identical credential content for both replacements, so it proves bounded live-set counts and promotion but does not distinguish first versus second payload selection. No production defect identified. No merge performed in this review.