a73x

bde1af57

test: e2e — (a) death asserted across the window; (d) ceiling reasoning; (e) evidence note

a73x   2026-08-11 18:39

Commit message
test: e2e — (a) death asserted across the window; (d) ceiling reasoning; (e) evidence note

All three from the Task 7 spec review, none changing what the suite covers.

(a) The cold scenario claimed bytes could only be riding QUIC because the
ssh that carried the announce was dead. It observed that death at ONE
instant, before the second marker was typed; it now re-observes it after
the marker has made its round trip, which is the claim the scenario
actually rests on — dead across the whole window, not dead once. The
`kill -0` idiom was checked both ways before being trusted: it exits 1 on
a live pid and 0 on a dead one under set -eu, so it is a check that can
fail rather than a line that always passes.

(d) The ceiling stays 10000ms where the plan suggested deadline+3s, and
the comment now says why instead of leaving the difference looking like an
oversight: it separates bounded from hung and is asked to do nothing
finer. Measured spread is 2026-2129ms over 13 runs, and an overrun does
not arrive a few hundred milliseconds late — it arrives at the
connection's idle timeout, 15000ms, the only other bound in the dial. A
tighter number would catch nothing more and would make the one scenario
that already pays 2s by design the most load-sensitive check here.

(e) Two of its three assertions have never been exercised by a mutation,
because the suite stops at its first failure and every mutation so far
dies earlier. That is now written at the assertions themselves. They are
untested rather than unfalsifiable — the absent-grep is the same shape as
(c)'s, which the deleted-fallback-line mutation killed — and saying so is
worth more than a comment that implies coverage nobody has demonstrated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/e2e.sh
Old New
@@ -2321,6 +2321,17 @@ wait_for "$OUT.h1" "cold-two" 20 || {
2321 echo "e2e FAIL: cold handoff: the session stopped converging once ssh was gone," 2321 echo "e2e FAIL: cold handoff: the session stopped converging once ssh was gone,"
2322 echo " so the bytes were riding the pipe rather than QUIC" 2322 echo " so the bytes were riding the pipe rather than QUIC"
2323 cat "$OUT.h1" "$OUT.h1.err" 2>/dev/null; exit 1; } 2323 cat "$OUT.h1" "$OUT.h1.err" 2>/dev/null; exit 1; }
2324 # Dead at one INSTANT is not the claim this scenario makes; dead across the
2325 # whole WINDOW is. The wait above proves the pid was gone before the second
2326 # marker was typed, and this proves it stayed gone while that marker made
2327 # its round trip — so nothing could have carried those bytes on the pipe
2328 # for any part of the journey. Cheap, and it closes the only reading under
2329 # which the observation above and the marker below are both true of a
2330 # session still riding ssh.
2331 kill -0 "$HSHIMPID" 2>/dev/null && {
2332 echo "e2e FAIL: cold handoff: ssh pid $HSHIMPID is alive again after the second"
2333 echo " marker; the death observed earlier was not the whole window"
2334 exit 1; }
2324 set +e 2335 set +e
2325 wait "$H1PID" 2336 wait "$H1PID"
2326 RC=$? 2337 RC=$?
@@ -2512,6 +2523,16 @@ grep -q "^mux: quic://127.0.0.1:$HQPORT unreachable, attaching over ssh$" "$OUT.
2512 # and it sits below the 2000ms budget only by the slack the measurement 2523 # and it sits below the 2000ms budget only by the slack the measurement
2513 # itself needs. The ceiling is what proves the budget bounds anything at 2524 # itself needs. The ceiling is what proves the budget bounds anything at
2514 # all: without it a hang reads as a pass that took a while. 2525 # all: without it a hang reads as a pass that took a while.
2526 #
2527 # That ceiling is 10000 and not the plan's deadline+3s, and the difference
2528 # is a decision rather than an oversight. It separates "bounded" from
2529 # "hung" and is not asked to do anything finer: the observed spread is
2530 # 2026-2129ms across 13 runs, and a regression that overruns the budget
2531 # does not overrun it by a few hundred milliseconds — it overruns to the
2532 # connection's idle timeout, 15000ms, because that is the only other bound
2533 # in the dial. A tighter ceiling would therefore catch nothing this one
2534 # misses, while making the single scenario that already pays 2s by design
2535 # the most load-sensitive check in the suite.
2515 [ "$HMS" -ge 1500 ] || { 2536 [ "$HMS" -ge 1500 ] || {
2516 echo "e2e FAIL: the fallback came after ${HMS}ms, too fast to have spent the" 2537 echo "e2e FAIL: the fallback came after ${HMS}ms, too fast to have spent the"
2517 echo " 2000ms QUIC budget — the dial cannot have happened" 2538 echo " 2000ms QUIC budget — the dial cannot have happened"
@@ -2575,6 +2596,17 @@ grep -q '^muxd endpoint: .*staying on ssh' "$OUT.h5.err" || {
2575 cat "$OUT.h5.err"; exit 1; } 2596 cat "$OUT.h5.err"; exit 1; }
2576 # ...and said nothing about a fallback, because nothing fell back: the 2597 # ...and said nothing about a fallback, because nothing fell back: the
2577 # client never held coordinates to fail with. 2598 # client never held coordinates to fail with.
2599 #
2600 # EVIDENCE NOTE, and it is written down precisely because a comment that
2601 # implied otherwise would be worse than the gap. Of this scenario's three
2602 # assertions only the staying-on-ssh grep above has been SHOWN able to
2603 # fail: deleting announceKey's create_failed message kills it, at 19
2604 # checkpoints. This absent-grep and the budget bound below have never been
2605 # exercised by any mutation — the suite stops at its first failure and
2606 # every mutation tried so far dies in an earlier scenario. Neither is
2607 # unfalsifiable: this grep is the same shape as (c)'s, which the
2608 # deleted-fallback-line mutation did kill. They are untested, which is a
2609 # different thing, and Task 8's regrade can take one if it comes cheap.
2578 grep -q 'unreachable, attaching over ssh' "$OUT.h5.err" && { 2610 grep -q 'unreachable, attaching over ssh' "$OUT.h5.err" && {
2579 echo "e2e FAIL: announce-none printed the fallback line; no dial was ever possible" 2611 echo "e2e FAIL: announce-none printed the fallback line; no dial was ever possible"
2580 cat "$OUT.h5.err"; exit 1; } 2612 cat "$OUT.h5.err"; exit 1; }