Enforce bind direction, cap segments per message and pin the README examples

todo.md

@@ -5,7 +5,7 @@ rules there constrain every item below.
 
 ## Status
 
-The rewrite is **feature complete and green**: 210 tests, lint and typecheck clean, verified on Node
+The rewrite is **feature complete and green**: 223 tests, lint and typecheck clean, verified on Node
 18, 20, 22 and 24. What is left is release work and a few things worth adding before or after 1.0.0.
 
 ```bash
@@ -54,12 +54,50 @@ Rules the API follows:
 | Stream framing | `test/pdu-framer.test.ts` |
 | Delivery receipt parsing, TLV and text | `test/dlr.test.ts` |
 | Session, client, server: bind, auth, send, reassembly, DLRs, timeouts, abort, send window | `test/session.test.ts` |
-| Merged multipart DLRs, reconnect, reassembly bounds, per-send abort | `test/session-extras.test.ts` |
+| Merged multipart DLRs, reconnect, reassembly bounds, per-send abort, the segment cap | `test/session-extras.test.ts` |
+| Every runnable README example | `test/readme.test.ts` |
 | Cross-checked against node-smpp both ways and over a live session | `test/interop.test.ts` |
 | CI on Node 18/20/22/24, Renovate, tag-triggered publish | `.github/workflows/` |
 
 Every defect listed in the AGENTS.md table has a regression test naming the behaviour.
 
+## The GitHub backlog, once this branch is `master`
+
+Nothing below is closed while `master` is still 0.4.0 — declining a security bump on a live default
+branch is worse than leaving it open. Work through this immediately after the merge.
+
+**Close as fixed by 1.0.0**, naming the replacement in the comment:
+
+| | Fixed by |
+| --- | --- |
+| [#4](https://github.com/larvit/larvitsmpp/issues/4) DLR errors with `message_state` missing | `dlrFromPdu()` parses the `stat:` receipt text when the TLVs are absent |
+| [#33](https://github.com/larvit/larvitsmpp/issues/33) Large inbound text arrives as raw `Buffer` segments | `IncomingRequests` reassembles a UDH-carrying `deliver_sm` into one `sms` event |
+| [#3](https://github.com/larvit/larvitsmpp/issues/3) Tests for flash messages | `test/session.test.ts` |
+| [#20](https://github.com/larvit/larvitsmpp/issues/20) Tests fail on current dependency versions | The mocha suite is gone; `node:test` on Node 18/20/22/24 |
+| [#2](https://github.com/larvit/larvitsmpp/issues/2) Tests for the README examples | `test/readme.test.ts` |
+| [#17](https://github.com/larvit/larvitsmpp/issues/17) `addr_ton`/`addr_npi` should be settable | `sendSms()` takes all four, documented and tested |
+| [#16](https://github.com/larvit/larvitsmpp/issues/16) Support all three bind types | Bound and enforced in both directions |
+| [#13](https://github.com/larvit/larvitsmpp/issues/13) Limit a long SMS to fewer segments | The `maxSegments` send option |
+| [#68](https://github.com/larvit/larvitsmpp/pull/68) `message_id` in `submit_sm_resp`, spec DLR codes | All four hold: `sendResp()` always answers a `message_id`, per segment; `stat:UNDELIV` is the 7-character code. Credit the reporter — the fork found real defects. |
+
+**Close as superseded**, all against 0.4.0 dependencies the rewrite does not have — `async`,
+`coveralls`, `eslint`, `iconv-lite`, `larvitutils`, `mocha`, `mocha-eslint`, `portfinder`, `uuid`:
+[#40](https://github.com/larvit/larvitsmpp/pull/40), [#41](https://github.com/larvit/larvitsmpp/pull/41),
+[#42](https://github.com/larvit/larvitsmpp/pull/42), [#45](https://github.com/larvit/larvitsmpp/pull/45),
+[#46](https://github.com/larvit/larvitsmpp/pull/46), [#47](https://github.com/larvit/larvitsmpp/pull/47),
+[#59](https://github.com/larvit/larvitsmpp/pull/59), [#63](https://github.com/larvit/larvitsmpp/pull/63),
+[#64](https://github.com/larvit/larvitsmpp/pull/64), [#65](https://github.com/larvit/larvitsmpp/pull/65),
+[#67](https://github.com/larvit/larvitsmpp/pull/67), [#70](https://github.com/larvit/larvitsmpp/pull/70).
+[#70](https://github.com/larvit/larvitsmpp/pull/70) is the open `uuid` advisory GitHub reports on the
+default branch; it disappears with the runtime dependencies rather than being fixed.
+
+[#60](https://github.com/larvit/larvitsmpp/issues/60) is Renovate's dashboard — leave it, it
+re-baselines itself against the new `package.json`.
+
+**Leave open:** [#8](https://github.com/larvit/larvitsmpp/issues/8), the socket's remote host and
+port on log messages. Only `server - incoming connection` carries them today; putting them on every
+session message is a change to every call site.
+
 ## Before publishing 1.0.0
 
 - [ ] Create the `@larvit/smpp` package on npm and add `NPM_TOKEN` to the repository secrets, which
@@ -71,10 +109,19 @@ Every defect listed in the AGENTS.md table has a regression test naming the beha
 
 ## Worth doing, not blocking
 
+- [ ] **An `async` event listener that rejects escapes the guard.** `Session.emit()` wraps
+      `super.emit()` in try/catch, which catches a listener that throws synchronously but not one
+      that returns a rejected promise — that surfaces as an unhandled rejection and takes the
+      process down, which hard rule 1 says must not happen. Every README example uses
+      `session.on('sms', async sms => …)`, so the shape is the one applications will write. The
+      library's own calls inside such a listener never reject, so the examples themselves are safe.
+      Fixing it means dispatching `rawListeners()` by hand in `emit()` and routing a rejection to
+      `sessionError` — a change to the hottest path, so it needs a decision before 1.0.0.
+
 - [ ] **In-flight sends across a reconnect.** They currently fail with "Session closed before a
       response arrived" and the caller retries. Re-queueing them automatically would be friendlier
       but risks duplicate delivery, so it needs a decision before it is built.
-- [ ] **`session.ts` is 459 lines.** The one seam left in it is a socket-to-PDU transport, which
+- [ ] **`session.ts` is 386 lines.** The one seam left in it is a socket-to-PDU transport, which
       would move the deliberately public `sock` field out of `Session` or turn it into a getter —
       a public-surface change, so it waits for a decision.
 - [ ] **Group the session's collaborators under `src/session/`.** Only `session.ts` imports