Step only the observer network clock by plus or minus 45 seconds after the transaction-bearing parent validates, then restore after six elapsed seconds. Exercise all RNG/Export enablement combinations, assert the injected clock offset is observed, and verify canonical recovery and extension effects.
Exercise manifest-delayed shares after real validator restart, late RNG proofs, accepted evidence retention, ordinary-set changes, and lifecycle controls. Characterize missing-origin recovery and publication deadline boundaries with observer and required-signer scenarios.
Track publication-window calibration under TODO(2031); leave the value and runtime behavior unchanged.
Scope receive suppression to the share wire hash, validated sequence and resolved master identity. A valid share received before its manifest can then be retried at the same validated ledger without reopening work for unrelated manifest churn. Log the attribution used for suppression.
Reproduced with a real token-based validator restart and delayed manifest processing: four later copies were suppressed, leaving two of three contributions. The fix admits exactly one copy. Verified RNG on/off and manifests-first/late DSF cases with three replays each; 11 suites, 202 cases, zero failures. DSF fixtures remain in the integration worktree for separate landing.
Sort the weak peer snapshot by ID only in stepping mode before broadcast and relay callbacks consume the injected random engine. Preserve the existing dispatch order outside stepping.
Reserve an unused pair of simulated peer IDs between replays and require the same ledger payload, event fingerprint and count. This exercises allocation history without changing applications, ports or clocks.
The dev merge brought #765's server_definitions test, whose default-Env
case assumed every supported amendment is config-forced. The jtx fixture
on this lineage deliberately leaves ConsensusEntropy out of the default
set, so enabled is now expected exactly for the Env's configured
features, with ledger_enabled still false. Also formats the include the
merge brought into ServerDefinitions.cpp.
The fault-injection draws moved from PeerImp.cpp and
ConsensusExtensions.cpp into RuntimeFaultRandom.h; the allowlist still
named the old files, so the tripwire went red on the pushed head.
Traffic is a 3-validator mesh, and its payload hash covers ledger
hashes plus transaction ids and sequences. The hub pin is five
validators linked only to one non-validator hub.
Replace pre-delivery sampling and formatted-log matching with actual stale-proposal dispatch plus a typed collector commit in the same authenticated proposal job. Capture the round parent even in open phase, require exact carried material, and run with observer trace disabled so enhanced logging cannot change the oracle.
The dispute and fork tables and the traffic and CSF event-order pins
live in goldens/dsf.h. --unittest-arg=goldens=print writes the observed
values. The assertions are unchanged.
forkCheckedSeqs counts the sequences validatedForkFree walks. The pinned
2000 is a max consumed beat, Kind weights profiled cost, eventCost rejects
overflow, and fingerprints require a nanosecond clock. Pinned rows unchanged.
Every unittest process, including one job, removes and recreates the
shared-memory object and message queue. Give that pair a parent-pid
suffix and publish the names in the environment so spawned children
and the in-process child open only that pair.
Use the per-node PRNG only in single-threaded stepping mode. Preserve separate per-thread MT engines outside stepping so threaded fault hooks do not race an injected engine. Test all four draw domains and three bit-for-bit RuntimeConfig drop/claim/reveal replays; jitter timer delivery remains out of scope.
Fix issue 2029: live clocks advance while a stopped node has no TimeKeeper. Keep the threaded runner network-time cursor and apply it before startup on restart or late add, preserving existing per-tick conversion and stepping clock semantics. A 25-second offline regression reconnects through production handshake checks; restoring the old stop-time snapshot makes it fail with the observed clock exception.
Closes the catch-up review finding that the before-lock probe was masked by earlier accept-time acquisitions. Rendezvous immediately before onPreBuild and observe a failed try_lock on that same mutex, with bounded waits and captured-job cleanup.
The catch-up review found that makeLiveBuildTxSet reads only its immutable argument. Avoid holding C during its transaction-count-sized scan; retain and measure the state-dependent ordering-salt and materialization locks.
Use one strict predicate in both unwitnessed fallback oracles and the directed held-material scenario. Assert live at deadline-1 and deadline, then a positive expired classification after the deadline on real accepted history.
Closes the catch-up review finding that unwitnessed pending latches could be labeled expired using only submission-based run targets. Require accepted history to pass the latch deadline; equality remains live.
Closes the catch-up review finding in 020db70424: do not call a consuming stop predicate again while classifying the exit. Cover a one-shot predicate and heartbeat/step budgets that never evaluate it.
The profiled dispute takes a seed base. Two K=3 rows: 0x1000000000000001
resolves at beat 54, and the default seed accepts at 10, saturates under
K=3, and recovers in 6 beats at K=0. The profiled loop records its stop
reason. Recovery beats are recorded only on success. No consensus policy
changed.
numeric_limits digits is the storage width, not how many values the
engine emits. A 32-bit engine in a 64-bit result type was treated as
a full word, which biases a range and can reject forever. A full
64-bit range is still one draw. Other power-of-two ranges are
concatenated. The rest follow the standard independent_bits rejection.
The dsf lineage pins its own constants. Its schedule is not the donor
branch, so the #814 fingerprints never held here. These are the macOS
values on this branch.
The four direct uniform_int_distribution calls on this lineage were still
stdlib-defined. Peer send drop and delay jitter, and the RNG claim and
reveal drops, now use rand_int. A zero jitter adds nothing, because
rand_int rejects a zero-width range.
std::sample is not the same on libstdc++ and libc++, so saturated
acquisition cells diverged on Linux after rand_int was made portable.
Selection-sample the id-sorted peer list with rand_int, and take a
must-keep tail without a zero-width draw.
std::uniform_int_distribution is not the same on libc++ and libstdc++,
so a seeded engine produced different harness event streams on Linux.
Rejection-sample a closed range from the engine's own 64-bit output.
Seeding overloads are unchanged.
Validator 2 is absent from node 0's peer positions while its stale
proposals arrive, and present again after the delay is lifted. The wire
count and the later collector commit stay positive.
