SimBleLink.cpp is the socket half of the frozen seam: a loopback TCP
listener, one reader thread that lives in poll(), line framing over
recv boundaries, and a thread safe emit(). SimBleProtocol.{h,cpp} is
the hand rolled JSON codec for the ten client ops. No JSON library is
added: the ops are flat and this branch must not grow a dependency.

Transport decisions worth naming:

- The listener binds 127.0.0.1, never INADDR_ANY. This process runs
  firmware command handling.
- stop() wakes the reader with a self pipe byte. shutdown() on a
  listening socket does not portably wake accept(), and closing a fd
  another thread is polling races a new socket onto that number.
- One line caps at 65536 bytes. Past it the buffer is dropped, one
  error event goes out, and bytes up to the next newline are discarded.
- The reader alone closes the client fd. emit() shuts it down on a
  write failure so teardown stays in one place, and carries a 5 s send
  timeout so a wedged client cannot hang a firmware thread.
- A lost socket synthesizes a disconnect op, so the GATT model does not
  keep believing a central is connected.

tests/sim_ble_link_selftest.{cpp,py} is the gate. It builds against
those two sources alone, so the transport is provable before the GATT
model exists: 65 checks covering every op explicit and defaulted, 20
malformed lines, the cap, the second client refusal, prompt stop() and
concurrent emit. Clean under ASan+UBSan and under TSan.

Adds a "Transport specifics" section with the settled numbers: the
65536 byte line cap and what a longer line does, how stop() wakes a
blocked reader and why the self pipe beats the alternatives, the
loopback only bind and its reason, the second client refusal, the
malformed line answer, emit()'s line atomicity, the synthetic
disconnect on socket loss, and the full default and range table for
every op field.

Flips those claims to [verified] and names the command that showed
them. The GATT half stays [contract]. Every claim carries a file:line.

Header-compatible fake for NimBLE-Arduino's peripheral API, so the firmware's
BLE code runs on the host. No NimBLE source is compiled.

The NimBLE* classes forward; SimBleGatt holds the model, the host thread, the
single per-connection indication slot and the outgoing event JSON. Callbacks
are dispatched on the host thread, never inline on the caller's, because the
firmware is built around the disconnect callback and the sync event it waits
for sharing one task.

Three fidelity points the shim reproduces rather than smooths over: the
indication confirm is out of band and can be withheld, a second indicate()
before a confirm clobbers the first and still returns true, and the client owns
the MTU (default 23).

Self-test: 40 checks, 0 failures, clean under ThreadSanitizer. The real
firmware translation unit compiles against these headers.

Flips the threading model, the four fidelity items and the enforced refusals
from contract to verified, each naming the self-test check that showed it.

Adds what building it turned up: two NimBLE calls the frozen contract list
missed (NimBLEServer::start and setCallbacks' second argument), the indication
slot being per connection rather than per characteristic, and two FreeRTOS
symbols the simulator still lacks that the firmware BLE file needs.

Extends "What it cannot answer" with the one refusal this shim cannot produce:
indicate() never returns false for a busy slot, so the firmware's park-and-flush
path is not exercised here.

The self-test defined a second main() and a second SimBleLink under src/.
library.json has no srcFilter, so both landed in the library archive next to
simulator_main.o and the linker satisfied main() from the test: the simulator
built clean, never ran, printed one line from a global constructor and aborted
in a destructor of code it had never entered.

Moved to tests/, which is where the transport self-test already lives and which
is why only this half broke. No srcFilter: an allowlist has to be remembered
when the next file appears, a directory that is not compiled does not.

The test now ends with fflush(stdout) and _exit() instead of returning, so its
verdict cannot be lost to someone else's teardown.

NimBLEDevice::init() emits stack/up, and init() is also what starts the
listener, so no client can be attached when that line is written and it is
dropped. The event was never racy, it was structurally undeliverable. The gatt
table and the first advertising line have the same problem whenever the firmware
builds them before a client turns up, which is the normal case. A real central
does not have this problem: it scans.

The accept path now synthesizes an `attach` op into the sink, the mirror of the
synthetic disconnect a lost socket already produces, and the GATT model answers
it by emitting what is currently true: stack up, the gatt table if one is built,
then the current advertising state. Not a real BLE event, same status as
clobber. No change to the frozen SimBleLink.h: the op name is a string.

Nothing is replayed about a live connection. A client that was not there for the
connect is not the central that made it.

The transport gate's two connect-time baselines were snapshotted before the
reader had accepted, so they measured the next op against the attach line and
failed intermittently. They now wait for the attach op and assert it arrives,
which adds a check rather than removing one. 65/65 again, plain, ASan/UBSan and
TSan.

tests/sim_ble_gatt_attach_selftest.cpp proves the replay over a real socket: it
builds a table with nobody connected, connects to itself and reads the three
lines. 9 checks.

Records the state replay as its own section, labelled not-a-real-BLE-event the
same way clobber is, so a client author reading a packet trace does not mistake
it for something a phone would see. Says what is not replayed and what a client
that attaches before init() gets.

Rewrites the self-test commands for the new tests/ paths and adds the socket
test. States why test files live in tests/ rather than behind a srcFilter.

Re-checks every file:line citation in the file. The accept-path insertion moved
21 lines of src/SimBleLink.cpp, which stale-dated eleven citations in the
transport section, and the GATT edits moved eighteen of mine. One citation was
already off by one before this pass.

The bullet claiming the simulator lacked pdMS_TO_TICKS and
xSemaphoreCreateBinary, and that the firmware BLE file therefore did not build
in-tree, is false on all three counts now. Deleted rather than softened. The
firmware side documents its own fix; a second account of it here would drift.

The same claim was embedded in the firmware syntax-check recipe as a
placeholder -include line. Removed. The recipe now says only what it is for:
anything the -include flags miss surfaces as a FreeRTOS name, not a NimBLE one.
The stronger evidence replaces it: the whole firmware builds against the shim
with no NimBLE symbol missing.

Three more stale facts found by auditing content rather than line numbers:

- The status line still called the file a seed written before the
  implementation, contradicting its own next sentence. Both halves are built.
- Fault injection was marked all contract. Withholding a confirm and sending a
  malformed frame are both demonstrated now; the other two need a transfer, so
  they need the firmware.
- The busy-slot bullet listed its refusals as if exhaustive and omitted the
  stack being down.

The heap, radio, peer-GATT-stack and busy-slot bullets are unchanged in
substance. All 54 citations still resolve.

The shim's own doc was written from its self-tests. Real firmware has now
been driven through it: pin the gatt event's props type on the wire (the one
field nobody typed, and it broke every client), record what the socket
structurally cannot answer (throughput, MTU negotiation, an over-MTU
refusal, radio loss, a hole from a withheld confirm, storage failures),
note that auto_confirm survives a client disconnect, add speed as a fifth
fidelity hazard in both directions, and promote the four fault-injection
cases that needed firmware from contract to verified.

Also: a grep over call syntax cannot detect a stale API contract, and six
firmware citations had drifted.

NIMBLE_PROPERTY::READ was 0x0001. That is BLE_GATT_CHR_F_BROADCAST. Read is
0x0002 (nimble/host/include/host/ble_gatt.h:133), and standard GATT agrees, so
it was not a NimBLE quirk being matched.

Harmless today and wrong for upstream. No firmware characteristic sets READ, so
nothing observable rode on it and no test could have caught it. But the property
bitmask now goes out on the wire as an integer and a client decodes it back into
names, so a readable characteristic would have made the shim say "broadcast"
where the device meant "read".

WRITE, NOTIFY and INDICATE were already right: 0x0008, 0x0010 and 0x0020, at
ble_gatt.h:139, :142 and :145. Each constant now carries its source line, and
the block says why 0x0001 is not read. WRITE_NO_RSP and the four flags above
INDICATE stay undeclared: the firmware does not use them.

The doc's props decoding table said `1` read, propagated from the same mistake.
Corrected, and it now names the header to check rather than asking the reader to
trust the table.

The shim returned false from indicate() when nothing was connected, when nobody
was subscribed, and when the characteristic lacked NOTIFY/INDICATE, under a
comment claiming those were refusals the real stack makes. It makes none of
them.

The firmware calls the two-argument indicate(), so connHandle defaults to
BLE_HS_CONN_HANDLE_NONE (NimBLECharacteristic.h:60) and the call lands in
sendValue (NimBLECharacteristic.cpp:272-328). That function has no connection
check, no CCCD check and no property check: rc starts at 0, only the peer loop
can move it, and with no peers the loop body never runs. It returns true.
ble_gatts_indicate_custom refuses only on out of memory or, under
BLE_GATT_CACHING, an unaware peer (ble_gattc.c:4888-4936), so an unsubscribed
peer gets a real indication PDU and the pending slot is genuinely taken.

Measured against the real firmware with a connected-but-unsubscribed peer:

  false: reply indicate failed after 40 attempts   ~1008 ms, flag never set
  true:  reply unconfirmed after 3000 ms            3000 ms, flag set

Different duration, different branch, different log line, and different
persistent state: only the second sets lastConfirmTimedOut_, which is what
suppresses FETCH_CANCEL downstream. The simulator was sending developers into
code the device never reaches.

Nothing connected returns true and leaves the slot alone, emitting nothing:
real NimBLE builds and sends nothing there, and filling the slot would let a
later connect-then-confirm confirm a payload from before the link existed. A
connected but unsubscribed peer takes the slot and gets the indicate event,
because the PDU really does go out -- but no auto-confirm is scheduled, since a
client with the CCCD off has nothing to confirm. That is what reproduces the
firmware's confirm timeout.

Two more corrections found in the same read. An empty payload is a different
operation in real NimBLE, not a refusal: it falls through to
ble_gatts_chr_updated and still returns true. The stack-down and null-pointer
guards stay false and are now labelled as shim guards, because real NimBLE
dereferences a null server there rather than returning anything.

Clobber semantics are untouched: a second indicate() before a confirm still
overwrites and still returns true.

The two self-test checks that asserted the inversion are inverted rather than
deleted, with the consequence added: unsubscribed indicate is true, the event
still goes out, and nothing confirms it. The disconnect check that leaned on
the old return value now proves the subscription cleared by its consequence --
no confirm on the new link, and a confirm again after re-subscribing. 50 checks.

Nineteen comment and doc references pointed at BlePositionServer.cpp and
FREEINK_CAP_BLE_PERIPHERAL -- a file and a build flag that do not exist upstream,
which made the branch unreviewable by anyone outside this fork.

Each one now states the behaviour instead of the address. Nothing load-bearing
was lost: the authority in these comments was always NimBLE's own source
(NimBLECharacteristic.cpp, ble_gattc.c, ble_gatt.h), which an upstream reader can
check, and the firmware was only ever provenance. The syntax-check recipe keeps
its shape with placeholders rather than one fork's paths.

Gates unchanged: 50 GATT checks, 9 attach checks, 65 transport checks.