Artifact Description [9ffc65e9bf]

Artifact 9ffc65e9bfcdecc91f077637ce89cb4157ba374c291b7a4642884d941f70bd4f:

• File src/dst.zig
  • 2026-07-20 04:37:48 — part of check-in [464b82c888] on branch h7-degraded — Prove sync liveness under a degraded, never-healed wire

    The sync sweep proved convergence only after the network fully healed, so a protocol that converges on a perfect wire but livelocks under sustained loss would still pass.

    Phase 2b runs a fresh session over a wire held at a fixed drop/dup rate, never healed, asserting the same convergence and termination oracles within a window scaled from the loss rate: expected rounds are the clean window over (1 - p_loss) squared per direction, times a safety factor, recomputed in a comment rather than a magic number. No corruption is injected -- a corrupted body is already a lost round.

    The protocol converges comfortably: over 200 seeds the worst run took 7, 13, and 18 rounds at 10, 25, and 40 percent loss, against windows of 160, 228, and 356 -- no livelock. The gate joins at 10 percent; the soak sweeps the wider rate set. Pinning the window below the real need trips the liveness oracle, so the check is not vacuous. The liveness-under-faults discipline follows TigerBeetle's VOPR. (user: dmestas, size: 31472) [annotate] [blame] [check-ins using]

  • 2026-07-20 04:52:51 — part of check-in [b8ef4a68e5] on branch trunk — Merge h7-degraded: prove sync converges on a wire that never heals

    Phase 2 only ever proved convergence after the network was fully healed, so a protocol that converges on a perfect wire but livelocks under sustained loss would have passed. A new degraded phase holds a fixed, never-healed drop and duplication rate on both links and drives a fresh session through the same safety, convergence and termination oracles, within a window scaled to the loss rate: a round makes progress only if both its request and reply arrive, so the expected round count grows as one over the delivered-fraction squared, times a safety factor, with the derivation in a recomputable comment. It converges with wide margin -- across many seeds the worst run finished in a small fraction of the window at every rate tested -- so there is no livelock. Pinning the window below the real need trips the oracle, so the check is not vacuous. The gate runs one modest rate; the soak sweeps a range. (user: dmestas, size: 31472) [annotate] [blame] [check-ins using]