minerva 0.2.0

//! Deterministic schedules over the boundary advertisement model.

extern crate alloc;

use alloc::vec;
use alloc::vec::Vec;
use core::num::NonZeroUsize;

use crate::metis::{Cut, EpochPreparation, EpochPreparationMiss, Epochs, Stability, VersionVector};

use super::super::{Moves, Text, d, rank, vector};
use super::{Fleet, MEMBERS, Message, Op, Payload, base_ops};
use crate::metis::dot::RawDot;

/// The directed model pin for the stamp fence, deterministic where the
/// generated sweep is probabilistic: an in-order declaration lands on a
/// full oath table and passes the boundedness assert (so the law's
/// positive branch is provably reached), then the lag-lemma crossing is
/// rebuilt inside the model and a post-declaration advertisement jumps
/// the queue; the fence must reject exactly that delivery, taking the
/// rebuild fallback instead of trusting the overshot meet. Disabling
/// the fence check makes this schedule assert an overshoot, so the
/// defense is mutation-verified by a fixed schedule, not by sampling.
#[test]
fn the_model_fence_detects_and_falls_back_on_a_skewed_advertisement() {
    let mut fleet = Fleet::new();
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // An ordinary own-station mint between the advertisements and the
    // declaration (the sixth-round review's asked case): the held
    // stamps fall strictly below the declaration's dot, because dot,
    // stamps, and mints all speak one allocator.
    ops.push(Op::Grow {
        member: 2,
        station: 2,
    });
    // An ordered declaration from member 2: the fence passes and the
    // boundedness assert runs over the full table.
    ops.push(Op::Declare { member: 2 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // The lawful-duplicate scenario (the third-round review finding):
    // member 2 advertises *after* its declaration (stamp at the
    // declaration's own count), the advertisement is delivered in
    // order, and then the network redelivers the declaration (history
    // index 1: advertisement, declaration, advertisement). The
    // duplicate absorbs by address; an honest channel never trips the
    // fence, however often the transport repeats itself.
    ops.push(Op::Advertise { member: 2 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    ops.push(Op::Replay {
        to: 1,
        from: 2,
        index: 1,
    });
    fleet.run(&ops).expect("the ordered prefix is lawful");
    assert_eq!(fleet.detections, 0);

    // The crossing: every floor grows at station 0 and everyone but
    // member 0 sees it, so member 0's watermark stays behind while the
    // fleet's advertisements move ahead.
    let mut ops: Vec<Op> = Vec::new();
    for member in 0..MEMBERS {
        ops.push(Op::Grow { member, station: 0 });
    }
    ops.extend([
        Op::Gossip { member: 1, of: 0 },
        Op::Gossip { member: 1, of: 2 },
        Op::Gossip { member: 2, of: 0 },
        Op::Gossip { member: 2, of: 1 },
        Op::Advertise { member: 1 },
        Op::Advertise { member: 2 },
        Op::Deliver { to: 1, from: 2 },
        // Member 0 declares at its lagged watermark, then learns of
        // the growth and advertises above its own declared cut.
        Op::Declare { member: 0 },
        Op::Gossip { member: 0, of: 1 },
        Op::Gossip { member: 0, of: 2 },
        Op::Advertise { member: 0 },
        // The post-declaration advertisement jumps the queue; the
        // declaration follows it.
        Op::DeliverSkewed { to: 1, from: 0 },
        Op::Deliver { to: 1, from: 0 },
    ]);
    fleet
        .run(&ops)
        .expect("the skewed delivery is detected, never trusted");
    assert_eq!(
        fleet.detections, 1,
        "the fence fired exactly once, on the outrun declaration"
    );
}

/// The directed model pin for the generation discipline, deterministic
/// where the generated sweep is probabilistic: a mature generation
/// advertises high numerals, the fleet seals, prior-generation
/// advertisements replay at the reborn receiver, and a fresh
/// declaration at small reborn numerals is delivered. The oath table
/// must read empty (reset at seal, stale replays excluded), so the
/// declaration finds no meet to overshoot; retaining the table or
/// folding the replays makes this schedule assert a silent overshoot,
/// so both defenses are mutation-verified by a fixed schedule.
#[test]
fn the_model_generation_discipline_survives_seals_and_replays() {
    let mut fleet = Fleet::new();
    let mut ops = base_ops();
    // Maturity: member 0 mints once more and everyone delivers it, so
    // the advertised values sit strictly above anything the reborn
    // coordinate space will declare at first.
    for member in 0..MEMBERS {
        ops.push(Op::Grow { member, station: 0 });
    }
    for member in 0..MEMBERS {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            ops.push(Op::Gossip { member, of });
        }
    }
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // The window that licenses the seals: member 0 declares at the
    // mature watermark and every member delivers the candidate
    // (member 2 first drains the advertisement queued ahead of it).
    ops.push(Op::Declare { member: 0 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 2, from: 0 });
    ops.push(Op::Deliver { to: 2, from: 0 });
    // The fleet seals in lockstep; the receiver's table is reborn.
    ops.extend((0..MEMBERS).map(|member| Op::Seal { member }));
    // Every member's mature advertisement replays at the receiver.
    ops.extend((0..MEMBERS).map(|from| Op::Replay {
        to: 1,
        from,
        index: 0,
    }));
    fleet.run(&ops).expect("seals and stale replays are lawful");
    assert_eq!(fleet.generations, [1; MEMBERS]);
    assert!(
        fleet.held[1].iter().all(Option::is_none),
        "the reborn oath table holds nothing: reset at seal, replays excluded"
    );

    // The reborn generation mints, gossips, and declares at small
    // numerals; with the table empty the declaration finds no meet,
    // and nothing stale can have survived to overshoot it.
    let mut ops = base_ops();
    ops.push(Op::Declare { member: 0 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet
        .run(&ops)
        .expect("the reborn declaration is never overshot");
    assert_eq!(fleet.detections, 0);
}

/// The critical schedule the note's snapshot rule answers (the S282
/// third-round review finding): after a declaration is delivered, the
/// oath meet lawfully keeps rising and may pass the delivered cut, so
/// a candidate's staging is seeded from the base at *its own* delivery
/// moment. The model drives the meet past a delivered cut and proves
/// the next candidate's delivery is still bounded (the per-emitter
/// argument), and the shipped door turns the seeding rule into a
/// refusal: a staging seeded at the delivery moment begins, one seeded
/// after the rise is refused with the exact first offender.
#[test]
fn a_candidates_staging_seeds_at_its_own_delivery_not_later() {
    let mut fleet = Fleet::new();
    // Base: floors (1, 1, 1), fresh views, all three advertisements
    // held at member 1.
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // The first candidate: member 0 declares and member 1 delivers it;
    // the staging seed is the meet at this moment.
    ops.push(Op::Declare { member: 0 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet.run(&ops).expect("the ordered prefix is lawful");
    let snapshot = fleet.oath_meet(1).expect("the table is full");
    let first_cut = vector(&[(0, 1), (1, 1), (2, 1)]);
    assert_eq!(snapshot, first_cut);

    // The meet lawfully rises past the delivered cut: every floor
    // grows, every view refreshes, and all three re-advertise; the
    // declarer's new advertisement is stamped at its declaration's
    // count but follows it through the channel, so an honest order
    // never trips the fence.
    let mut ops: Vec<Op> = Vec::new();
    for member in 0..MEMBERS {
        ops.push(Op::Grow { member, station: 0 });
    }
    for member in 0..MEMBERS {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            ops.push(Op::Gossip { member, of });
        }
    }
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    fleet
        .run(&ops)
        .expect("post-declaration advertisements are lawful");
    let risen = fleet.oath_meet(1).expect("the table stays full");
    assert!(
        first_cut.happens_before(&risen),
        "the oath meet passed the delivered cut, as the schedule allows"
    );

    // The next candidate still finds the meet below its own cut: the
    // boundedness assert inside the run is the proof, exercised on
    // exactly the schedule where the meet already passed an earlier
    // delivered cut.
    let ops = [Op::Declare { member: 2 }, Op::Deliver { to: 1, from: 2 }];
    fleet
        .run(&ops)
        .expect("the second candidate's delivery is bounded");
    assert_eq!(fleet.detections, 0);

    // Through the shipped door: seeded at the first candidate's
    // delivery, the staging begins; seeded after the rise, it refuses.
    // "Seed at your own delivery" is a refusal, not a convention.
    let mut stability = Stability::new([0, 1, 2]);
    let witnessed = Cut::from_witnessed(first_cut);
    for member in [0, 1, 2] {
        stability.report_cut(member, &witnessed).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let declaration = epochs
        .declare(d(0, 2), rank(2), &stability, &Cut::bottom())
        .unwrap();
    let seeded_at_delivery = Text::from_context(Cut::from_witnessed(snapshot).to_have_set());
    assert!(EpochPreparation::begin(&declaration, seeded_at_delivery, Moves::new()).is_ok());
    let seeded_late = Text::from_context(Cut::from_witnessed(risen).to_have_set());
    assert_eq!(
        EpochPreparation::begin(&declaration, seeded_late, Moves::new()).unwrap_err(),
        EpochPreparationMiss::UnpinnedBase {
            dot: RawDot::new(0, 2)
        }
    );
}

/// A network echo of one's own declaration (the S282 fourth-round
/// review finding): the local candidate is recorded as delivered at
/// its minter the moment `declare` mints it (exactly as the shipped
/// `Epochs::declare` opens the window with it), so the echo absorbs as
/// the duplicate it is, even after a newer self-advertisement has
/// raised the held stamp past the declaration's count. Without the
/// local record, the fence would read the echo as broken order on an
/// honest channel and forfeit the base for nothing.
#[test]
fn a_locally_declared_candidate_absorbs_its_own_redelivery() {
    let mut fleet = Fleet::new();
    let ops = [
        Op::Advertise { member: 0 },
        Op::Declare { member: 0 },
        Op::Advertise { member: 0 },
        // History: advertisement, declaration, advertisement; the echo
        // replays the declaration back at its own minter.
        Op::Replay {
            to: 0,
            from: 0,
            index: 1,
        },
    ];
    fleet.run(&ops).expect("a self echo is lawful");
    assert_eq!(
        fleet.detections, 0,
        "the echo is a duplicate, never a broken order"
    );
}

/// The reconnect schedule (the S282 fifth-round review finding):
/// session-internal delivery order is no substitute for the stamp,
/// because sessions do not survive reconnects. A declaration is left
/// undelivered in its original session (the channel), a
/// post-declaration advertisement arrives through a fresh session (the
/// out-of-band replay), and the declaration then arrives through yet
/// another session's lawful replay; every session was internally
/// ordered, yet the advertisement overtook the declaration. The
/// unconditional stamp comparison detects exactly this before any fold
/// is trusted, so the overtaking is never silent.
#[test]
fn a_reconnect_replay_cannot_silently_overtake_an_undelivered_declaration() {
    let mut fleet = Fleet::new();
    // Base: floors (1, 1, 1), fresh views, all three advertisements
    // held at member 1.
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // Member 0 declares; the declaration stays undelivered in its
    // original session's queue while member 0 learns of new growth
    // and advertises above its own declared cut.
    ops.extend([
        Op::Declare { member: 0 },
        Op::Grow {
            member: 0,
            station: 0,
        },
        Op::Advertise { member: 0 },
    ]);
    // The fresh session: the post-declaration advertisement reaches
    // member 1 out of band (history: advertisement 0, declaration 1,
    // advertisement 2), ahead of the still-queued declaration.
    ops.push(Op::Replay {
        to: 1,
        from: 0,
        index: 2,
    });
    // The third session replays the declaration itself; its first
    // delivery meets the stamp fence, which names the overtaking.
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet
        .run(&ops)
        .expect("the overtaken declaration is detected, never silently folded");
    assert_eq!(
        fleet.detections, 1,
        "every session was ordered, only the stamp saw the overtaking"
    );
}

/// The ceiling pin (the S282 seventh-round review findings): the
/// shipped planes saturate at `u64::MAX` (dot minting and the seal's
/// generation both), and a saturated numeral can be neither strictly
/// fresh (the fence's premise) nor a non-reused tag (the stale
/// exclusion's premise). The oath's posture is the S32 `increment`
/// honesty: exact below the ceiling, refusing at it. A member whose
/// allocator has saturated mints no oath-mode declaration (an honest
/// advertisement already stamped the ceiling would equal the saturated
/// dot and false-positive the fence), and a member at the generation
/// ceiling refuses the seal that would reuse its tag space. Both are
/// one comparison at an unreachable height: a liveness stop, never a
/// soundness loss.
#[test]
fn the_oath_refuses_at_the_numeral_and_generation_ceilings() {
    // The allocator ceiling, one mint below it: the last mint and its
    // advertisement are lawful, the declaration that would saturate is
    // refused. (The ceiling is unreachable by honest schedules; the
    // state is set directly.)
    let mut fleet = Fleet::new();
    fleet.emitted[0] = u64::MAX - 1;
    fleet.floors[0].observe(0, u64::MAX - 1);
    let ops = [
        Op::Grow {
            member: 0,
            station: 0,
        },
        Op::Advertise { member: 0 },
        Op::Declare { member: 0 },
    ];
    fleet
        .run(&ops)
        .expect("the ceiling refusals are silent skips");
    assert_eq!(fleet.emitted[0], u64::MAX, "the last mint landed");
    assert_eq!(
        fleet.history[0].len(),
        1,
        "the advertisement emitted; the saturating declaration refused"
    );
    assert!(!fleet.window[0], "no window opened at the ceiling");
    assert_eq!(fleet.detections, 0);

    // The generation ceiling: a member with an open window at the
    // final tag refuses the seal that would rebirth its coordinate
    // space under a reused generation, so the stale exclusion stays
    // exact and pre-ceiling advertisements can never poison a reborn
    // table (no table is ever reborn there).
    let mut fleet = Fleet::new();
    fleet.generations = [u64::MAX; MEMBERS];
    fleet.window[1] = true;
    fleet
        .run(&[Op::Seal { member: 1 }])
        .expect("the refusal is a skip");
    assert_eq!(fleet.generations, [u64::MAX; MEMBERS], "no tag reuse");
    assert!(fleet.window[1], "the window stays open: the seal refused");
}

/// The restart pin (the S282 eighth-round review finding): `Stability`
/// monotonicity is per-instance, and the crash-restart lifecycle
/// rebuilds trackers, so without a durable oath floor a member could
/// advertise high, rehydrate with lagging views, and lawfully declare
/// *below its own advertisement* with a fresh dot the stamp fence
/// cannot fault, silently overshooting the oath meet. The durable
/// floor makes the oath a declarer obligation: the post-crash
/// declaration refuses until the recovered views cover every
/// advertisement the member has made this generation, and the
/// recovered declaration is then bounded as usual.
#[test]
fn a_restarted_declarer_cannot_declare_below_its_advertised_oath() {
    let mut fleet = Fleet::new();
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // Member 0 crashes: its mints, window, and advertised floor
    // survive; its floor views regress to bottom, so its watermark
    // falls below its own last advertisement.
    ops.push(Op::Crash { member: 0 });
    ops.push(Op::Declare { member: 0 });
    fleet.run(&ops).expect("the refused declaration is a skip");
    assert!(
        !fleet.window[0],
        "the post-crash declaration refused: the cut does not cover the oath"
    );
    assert_eq!(fleet.history[0].len(), 1, "only the advertisement emitted");

    // Recovery: the views are re-heard, the watermark covers the
    // advertised floor again, and the declaration mints and is
    // delivered bounded.
    let mut ops: Vec<Op> = Vec::new();
    for of in (0..MEMBERS).filter(|&of| of != 0) {
        ops.push(Op::Gossip { member: 0, of });
    }
    ops.push(Op::Declare { member: 0 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet
        .run(&ops)
        .expect("the recovered declaration is bounded");
    assert!(fleet.window[0], "the recovered declaration minted");
    assert_eq!(fleet.detections, 0);
}

/// The receiver-restart pin (the S282 ninth-round review finding): the
/// fence verdict and the staging snapshot are volatile while the
/// duplicate recognition is durable, so a receiver that detected an
/// overtaking could crash, rebuild an overshooting oath meet from
/// replayed advertisements, and see the declaration again through the
/// duplicate fast path. The rule that closes it: eligibility is
/// written exactly once, at first delivery, and moves only downward;
/// a crash forfeits every pre-crash candidate's fast path (theirs is
/// the eager rebuild, the R-51 posture, since the checkpoint carries
/// the lifecycle window and deliberately not the staging), and a
/// replayed declaration cannot regain it, however the rebuilt meet
/// looks.
#[test]
fn a_receiver_crash_forfeits_the_fast_path_and_a_replay_cannot_regain_it() {
    let mut fleet = Fleet::new();
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // A clean rival from member 2 first: delivered in order, fence
    // passing, fast path granted.
    ops.push(Op::Declare { member: 2 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    // Member 0's declaration is overtaken by its own post-declaration
    // advertisement (an out-of-band replay): detected, fast path
    // refused at first delivery.
    ops.extend([
        Op::Declare { member: 0 },
        Op::Grow {
            member: 0,
            station: 0,
        },
        Op::Advertise { member: 0 },
        Op::Replay {
            to: 1,
            from: 0,
            index: 2,
        },
        Op::Deliver { to: 1, from: 0 },
    ]);
    fleet.run(&ops).expect("the overtaking is detected");
    assert_eq!(fleet.detections, 1);
    let overtaken = *fleet.eligible[1][0].values().next().unwrap();
    let clean = *fleet.eligible[1][2].values().next().unwrap();
    assert!(!overtaken, "the overtaken candidate's fast path is refused");
    assert!(clean, "the clean candidate's fast path was granted");

    // The receiver crashes: the held table is volatile and every
    // pre-crash candidate's fast path is forfeit, the clean one
    // included (its staging snapshot died with the process).
    let mut ops: Vec<Op> = vec![Op::Crash { member: 1 }];
    // Replays rebuild an overshooting meet, and the declaration
    // arrives again through the duplicate door.
    ops.extend([
        Op::Replay {
            to: 1,
            from: 0,
            index: 0,
        },
        Op::Replay {
            to: 1,
            from: 0,
            index: 2,
        },
        Op::Replay {
            to: 1,
            from: 0,
            index: 1,
        },
    ]);
    fleet
        .run(&ops)
        .expect("the duplicate absorbs without a fresh verdict");
    assert_eq!(fleet.detections, 1, "no second verdict was ever taken");
    assert!(
        fleet.eligible[1]
            .iter()
            .all(|per_emitter| per_emitter.values().all(|&eligible| !eligible)),
        "every pre-crash candidate's fast path stays forfeit; the replay regained nothing"
    );

    // The local mirror (the tenth-round review finding): the
    // declarer's own candidate is recorded eligible at self-delivery
    // through the same table remote candidates use, its crash
    // forfeits it by the same sweep, and its own echo regains
    // nothing.
    let local = *fleet.eligible[0][0].values().next().unwrap();
    assert!(local, "the declarer's own candidate was fast-path eligible");
    fleet
        .run(&[
            Op::Crash { member: 0 },
            Op::Replay {
                to: 0,
                from: 0,
                index: 1,
            },
        ])
        .expect("the self echo after the crash absorbs");
    let local = *fleet.eligible[0][0].values().next().unwrap();
    assert!(
        !local,
        "the declarer's own pre-crash candidate stays forfeit"
    );
}

/// The sender-linearization exhibit (the S282 twelfth-round review
/// finding): shipped `Epochs::declare` takes a caller-minted dot, so a
/// sender could lawfully emit an advertisement stamped at the reserved
/// dot *between* minting and emitting the declaration; by stamps alone
/// that advertisement is indistinguishable from one emitted after the
/// declaration, so the fence must treat it as post-declaration. The
/// duty that makes the fence exact is therefore the sender's: dot
/// reservation, cut capture, and outbox enqueue are one step with
/// respect to that sender's advertisement emissions (the model's
/// `declare` is that duty). This pin drives the violating traffic by
/// hand and shows its exact price: the fence conservatively detects
/// (the rebuild fallback, safety unconditional), while the precision
/// oracle flags the schedule as outside the duty (the precision law is
/// conditional on it, never the safety law).
#[test]
fn a_sender_that_advertises_inside_its_declare_step_costs_a_spurious_rebuild() {
    let mut fleet = Fleet::new();
    // Hand-crafted traffic violating the duty: the advertisement
    // observes the reserved dot (stamp 1) yet precedes the declaration
    // in emission order (positions 0 against 1).
    fleet.channels[0][1].push_back(Message {
        generation: 0,
        counter: 1,
        position: 0,
        payload: Payload::Advertisement(vector(&[(0, 1)])),
    });
    fleet.channels[0][1].push_back(Message {
        generation: 0,
        counter: 1,
        position: 1,
        payload: Payload::Declaration(VersionVector::new()),
    });
    let outcome = fleet.run(&[
        Op::Deliver { to: 1, from: 0 },
        Op::Deliver { to: 1, from: 0 },
    ]);
    assert_eq!(
        fleet.detections, 1,
        "the fence conservatively detects: a rebuild, never a wrong stratum"
    );
    assert!(
        outcome.is_err(),
        "the precision oracle flags the schedule as outside the linearization duty"
    );
}

/// The straggler cliff and its policy cure (the RQ3 brief's question,
/// answered in the note's section 6): a silent roster member pins the
/// full all-advertised gate closed, so the chooser-agnostic reader
/// banks nothing; a *scoped* oath meet whose scope the caller has
/// narrowed past the straggler reads, serves the in-scope
/// fence-passing declaration (the chooser-scoping kernel asserted
/// inside the run), and prices the straggler's own later declaration
/// as the base seam's detected rebuild, never a wrong stratum. The
/// scope is data, not a timeout: a scope that still contains the
/// silent member stays closed, so dropping a member is an explicit
/// caller act (the idle-mark cure the anti-avenues refuse arrives
/// here as policy, with exactness intact).
#[test]
fn a_scoped_oath_meet_serves_in_scope_declarers_past_a_silent_straggler() {
    let mut fleet = Fleet::new();
    let mut ops = base_ops();
    // Member 0 mints once more and everyone delivers it, then members
    // 0 and 1 refresh every view while member 2 gossips nothing: the
    // active pair's watermarks rise to (0: 2, 1: 1, 2: 1) while the
    // straggler's stays at the base. Members 0 and 1 advertise;
    // member 2 stays silent in the advertisement plane.
    for member in 0..MEMBERS {
        ops.push(Op::Grow { member, station: 0 });
    }
    for member in 0..2 {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            ops.push(Op::Gossip { member, of });
        }
    }
    ops.push(Op::Advertise { member: 0 });
    ops.push(Op::Advertise { member: 1 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet.run(&ops).expect("the ordered prefix is lawful");

    // The full gate is pinned closed by the straggler, and so is any
    // scope that still contains it; the narrowed scope reads.
    assert_eq!(fleet.oath_meet(1), None);
    assert_eq!(fleet.scoped_oath_meet(1, &[0, 1, 2]), None);
    let scoped = fleet
        .scoped_oath_meet(1, &[0, 1])
        .expect("every scope member has advertised");
    assert_eq!(scoped, vector(&[(0, 2), (1, 1), (2, 1)]));

    // The in-scope declaration is delivered fence-passing: the
    // kernel (the declarer's own held join bounds its cut) is
    // asserted inside the run, and the scoped meet inherits the
    // bound by the meet law.
    let ops = [Op::Declare { member: 0 }, Op::Deliver { to: 1, from: 0 }];
    fleet.run(&ops).expect("the in-scope candidate is bounded");
    assert_eq!(fleet.detections, 0);

    // Through the shipped doors: the trailing base advanced to the
    // scoped meet serves the in-scope declarer's cut exactly.
    let in_scope_cut = Cut::from_witnessed(vector(&[(0, 2), (1, 1), (2, 1)]));
    let mut stability = Stability::new([0, 1, 2]);
    for member in [0, 1, 2] {
        stability.report_cut(member, &in_scope_cut).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let in_scope = epochs
        .declare(d(0, 3), rank(3), &stability, &Cut::bottom())
        .unwrap();
    let trailing = Text::from_context(Cut::from_witnessed(scoped.clone()).to_have_set());
    assert!(EpochPreparation::begin(&in_scope, trailing, Moves::new()).is_ok());

    // The straggler was never bound by the scope: its own lawful
    // declaration (its lagged watermark, nothing adversarial)
    // undershoots the scoped meet, and the base seam refuses the
    // advanced base with the exact first offender: the detected
    // rebuild that prices the policy, never a wrong stratum.
    let straggler_cut = Cut::from_witnessed(vector(&[(0, 1), (1, 1), (2, 1)]));
    let mut stability = Stability::new([0, 1, 2]);
    for member in [0, 1, 2] {
        stability.report_cut(member, &straggler_cut).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let straggler = epochs
        .declare(d(2, 2), rank(2), &stability, &Cut::bottom())
        .unwrap();
    assert!(straggler.cut().as_vector().happens_before(&scoped));
    let trailing = Text::from_context(Cut::from_witnessed(scoped).to_have_set());
    assert_eq!(
        EpochPreparation::begin(&straggler, trailing, Moves::new()).unwrap_err(),
        EpochPreparationMiss::UnpinnedBase {
            dot: RawDot::new(0, 2)
        }
    );
}

/// The reset half of the RQ3 brief's question: the all-advertised
/// gate re-arms per generation, so after a seal the full reader waits
/// on the whole roster's fresh advertisements while a scoped reader
/// waits only on its scope's, the re-arm cliff shortened to the
/// scope. The generation discipline is inherited whole: the reborn
/// scoped read opens at the new generation's bottom (which is exactly
/// where the boundary commit's universal promise rebases to, the
/// note's vacuity claim: seeding the table at the seal could buy
/// nothing more), and a replayed prior-generation advertisement from
/// the straggler cannot poison a scope that includes it into opening.
#[test]
fn a_seal_re_arms_the_scoped_gate_on_scope_advertisements_only() {
    let mut fleet = Fleet::new();
    // A full first generation: everyone advertises, the receiver
    // holds the roster, member 0's candidate is delivered everywhere,
    // and the fleet seals in lockstep.
    let mut ops = base_ops();
    ops.extend((0..MEMBERS).map(|member| Op::Advertise { member }));
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 1, from: 2 });
    ops.push(Op::Declare { member: 0 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    ops.push(Op::Deliver { to: 2, from: 0 });
    ops.push(Op::Deliver { to: 2, from: 0 });
    ops.extend((0..MEMBERS).map(|member| Op::Seal { member }));
    fleet.run(&ops).expect("the sealed generation is lawful");
    assert_eq!(fleet.generations, [1; MEMBERS]);

    // The reborn generation: only the scope re-advertises. The
    // scoped gate opens at the reborn bottom while the full gate
    // stays closed on the still-silent straggler.
    let ops = [
        Op::Advertise { member: 0 },
        Op::Advertise { member: 1 },
        Op::Deliver { to: 1, from: 0 },
    ];
    fleet
        .run(&ops)
        .expect("the reborn advertisements are lawful");
    assert_eq!(fleet.oath_meet(1), None);
    assert_eq!(
        fleet.scoped_oath_meet(1, &[0, 1]),
        Some(VersionVector::new()),
        "the scoped gate re-arms on its scope alone, at the reborn bottom"
    );

    // The straggler's mature prior-generation advertisement replays;
    // the fold door excludes it, so a scope that includes the
    // straggler still reads closed instead of opening over a stale
    // value (the exclusion the scoped read inherits from the held
    // table, not a second mechanism).
    fleet
        .run(&[Op::Replay {
            to: 1,
            from: 2,
            index: 0,
        }])
        .expect("the stale replay is excluded");
    assert_eq!(fleet.scoped_oath_meet(1, &[0, 1, 2]), None);
    assert_eq!(fleet.oath_meet(1), None);
}

/// The scope lifecycle invariant (the S285 review's second and third
/// findings, absorbed): the trailing base cannot back up (the note's
/// section 3), so a base is protected against exactly the members
/// whose held oaths *cover* it (base at or below the member's
/// per-emitter join), a comparison on data in hand, not a history.
/// Advancing to the current scope's meet preserves coverage for
/// every scope member (the meet sits below each entry, and entries
/// only rise within a generation), so shrinking never breaks it, and
/// *widening is safe exactly when the admitted member's held oath
/// covers the current base* (equivalently, when the widened meet
/// does not fall below it): one comparison at the admission door. An
/// uncovered admission stays speculative, the base seam's detected
/// rebuild, until the member's oath rises to cover the base or the
/// base is reborn. The pin drives all three arms: the uncovered
/// widening (the straggler's lagged oath sits below the base, its
/// lawful cut refused with the exact first offender), the *covering*
/// widening (the same member catches up and re-advertises, its held
/// join rises to cover the base, and its fence-passing cut is served
/// from the same base, no rebuild and no seal), and the shrink
/// (coverage trivially retained, the retained member served).
/// Safety never moved (detection, not silence); what the invariant
/// fixes is the *price* claim: fast-path protection follows oath
/// coverage of the base, nothing else.
#[test]
fn a_scope_change_protects_exactly_the_members_whose_oaths_cover_the_base() {
    let mut fleet = Fleet::new();
    // The straggler schedule again: the active pair rises to
    // (0: 2, 1: 1, 2: 1) and advertises; member 2 lags at the base
    // truth and advertises nothing yet.
    let mut ops = base_ops();
    for member in 0..MEMBERS {
        ops.push(Op::Grow { member, station: 0 });
    }
    for member in 0..2 {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            ops.push(Op::Gossip { member, of });
        }
    }
    ops.push(Op::Advertise { member: 0 });
    ops.push(Op::Advertise { member: 1 });
    ops.push(Op::Deliver { to: 1, from: 0 });
    fleet.run(&ops).expect("the ordered prefix is lawful");
    let advanced = fleet
        .scoped_oath_meet(1, &[0, 1])
        .expect("the pair scope reads");
    assert_eq!(advanced, vector(&[(0, 2), (1, 1), (2, 1)]));

    // The straggler now advertises its lagged watermark and the
    // caller widens the scope to the full roster: the widened meet
    // reads, and it sits strictly below the already-advanced base,
    // the hazard made visible in data.
    fleet
        .run(&[Op::Advertise { member: 2 }, Op::Deliver { to: 1, from: 2 }])
        .expect("the late advertisement is lawful");
    let widened = fleet
        .scoped_oath_meet(1, &[0, 1, 2])
        .expect("the widened scope reads once the straggler advertises");
    assert!(widened.happens_before(&advanced));

    // The uncovered admission: the newly admitted member declares at
    // its oath, in scope at delivery, fence-passing, and still the
    // base advanced under the old scope overshoots it; the seam
    // refuses with the first offender, because the member's held
    // oath never covered the base.
    let admitted_cut = Cut::from_witnessed(vector(&[(0, 1), (1, 1), (2, 1)]));
    let mut stability = Stability::new([0, 1, 2]);
    for member in [0, 1, 2] {
        stability.report_cut(member, &admitted_cut).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let admitted = epochs
        .declare(d(2, 2), rank(2), &stability, &Cut::bottom())
        .unwrap();
    let trailing = Text::from_context(Cut::from_witnessed(advanced.clone()).to_have_set());
    assert_eq!(
        EpochPreparation::begin(&admitted, trailing, Moves::new()).unwrap_err(),
        EpochPreparationMiss::UnpinnedBase {
            dot: RawDot::new(0, 2)
        }
    );

    // The covering admission: the same member catches up, its
    // watermark rises to the base, and its fresh advertisement joins
    // its held oath up to coverage; the widened meet returns to the
    // base, and the member's fence-passing declaration at its
    // covering cut is served from the very same base, no rebuild and
    // no seal. Widening is safe exactly here.
    fleet
        .run(&[
            Op::Gossip { member: 2, of: 0 },
            Op::Gossip { member: 2, of: 1 },
            Op::Advertise { member: 2 },
            Op::Deliver { to: 1, from: 2 },
        ])
        .expect("the covering advertisement is lawful");
    let covered = fleet
        .scoped_oath_meet(1, &[0, 1, 2])
        .expect("the widened scope still reads");
    assert_eq!(covered, advanced, "the widened meet rose back to the base");
    let covering_cut = Cut::from_witnessed(vector(&[(0, 2), (1, 1), (2, 1)]));
    let mut stability = Stability::new([0, 1, 2]);
    for member in [0, 1, 2] {
        stability.report_cut(member, &covering_cut).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let covering = epochs
        .declare(d(2, 2), rank(4), &stability, &Cut::bottom())
        .unwrap();
    let trailing = Text::from_context(Cut::from_witnessed(advanced.clone()).to_have_set());
    assert!(EpochPreparation::begin(&covering, trailing, Moves::new()).is_ok());

    // The shrink direction: the scope narrows to member 0 alone, the
    // shrunken meet sits at or above the base (fewer members, higher
    // meet), and the retained member's declaration is served exactly.
    let shrunken = fleet
        .scoped_oath_meet(1, &[0])
        .expect("the shrunken scope reads");
    assert!(advanced <= shrunken);
    let retained_cut = Cut::from_witnessed(vector(&[(0, 2), (1, 1), (2, 1)]));
    let mut stability = Stability::new([0, 1, 2]);
    for member in [0, 1, 2] {
        stability.report_cut(member, &retained_cut).unwrap();
    }
    let mut epochs = Epochs::new([0, 1, 2], NonZeroUsize::new(1).unwrap());
    let retained = epochs
        .declare(d(0, 3), rank(3), &stability, &Cut::bottom())
        .unwrap();
    let trailing = Text::from_context(Cut::from_witnessed(advanced).to_have_set());
    assert!(EpochPreparation::begin(&retained, trailing, Moves::new()).is_ok());
}