minerva 0.2.0

//! Modeled advertisement fleet and lifecycle laws.

extern crate alloc;

mod cases;

use alloc::collections::{BTreeMap, BTreeSet, VecDeque};
use alloc::vec::Vec;
use core::array;

use proptest::prelude::*;

use crate::metis::VersionVector;

const MEMBERS: usize = 3;
const STATIONS: u32 = 3;

/// One schedule step of the modeled fleet.
#[derive(Clone, Copy, Debug)]
enum Op {
    /// A member's true durable floor rises at one station, inside its
    /// current generation's coordinate space.
    Grow { member: usize, station: u32 },
    /// A member refreshes its (lagged) view of another's floor to the
    /// current truth, tag-checked to the same generation; lag is every
    /// step where this does not happen.
    Gossip { member: usize, of: usize },
    /// A member emits its current watermark as a generation-stamped
    /// advertisement to every peer (and holds its own instantly).
    Advertise { member: usize },
    /// A member declares at its current watermark, to every peer.
    Declare { member: usize },
    /// The oldest in-flight message from `from` is delivered at `to`.
    /// Delivery order is *not* a granted contract: the skewed twin
    /// below can outrun it, and the receiver's stamp fence is the only
    /// defense (the S282 second review finding: no existing transport
    /// law promises cross-kind per-emitter order, so the model checks
    /// the fence instead of assuming the order).
    Deliver { to: usize, from: usize },
    /// One message from `from` jumps the queue at `to` (the second in
    /// flight is delivered first). Composed, this reorders arbitrarily,
    /// including a post-declaration advertisement outrunning its
    /// declaration, the exact schedule the fence must catch.
    DeliverSkewed { to: usize, from: usize },
    /// A member seals its current window and enters the next
    /// generation: the coordinate space is reborn (counter numerals
    /// reused, PRD 0024), the floor, views, emission counter, and oath
    /// table all reset (the `Stability` reset the fleet replica
    /// performs), and messages parked one generation ahead drain
    /// through the ordinary door. Modeled lockstep-bounded: a member
    /// seals only from the fleet's minimum generation, the skew the
    /// roster-complete rounds enforce.
    Seal { member: usize },
    /// A member crashes and rehydrates (the R-51 lifecycle): its own
    /// durable testimony survives (mints, so floor and allocator; its
    /// oaths, so the advertised floor; its round position, so the
    /// window), while everything rebuilt from re-delivered traffic
    /// regresses: the floor views and the receiver-side oath table
    /// (the all-advertised gate re-arms, staging nothing until every
    /// member is re-heard).
    Crash { member: usize },
    /// The network re-delivers one advertisement `from` ever emitted,
    /// picked anywhere in its history: the delayed or replayed
    /// prior-generation traffic the S282 review named. Stale
    /// generations must be excluded at the fold door or the reborn
    /// numerals are overshot.
    Replay {
        to: usize,
        from: usize,
        index: usize,
    },
}

/// The op mix is weighted toward the hazard states (deliveries drain
/// the channels so declarations actually land on full oath tables,
/// seals cross generations, replays resurface old traffic): an
/// unweighted mix leaves the defense branches unreached and their
/// mutation checks toothless.
fn arb_ops() -> impl Strategy<Value = Vec<Op>> {
    let op = prop_oneof![
        2 => (0..MEMBERS, 0..STATIONS).prop_map(|(member, station)| Op::Grow { member, station }),
        2 => (0..MEMBERS, 0..MEMBERS).prop_map(|(member, of)| Op::Gossip { member, of }),
        3 => (0..MEMBERS).prop_map(|member| Op::Advertise { member }),
        2 => (0..MEMBERS).prop_map(|member| Op::Declare { member }),
        6 => (0..MEMBERS, 0..MEMBERS).prop_map(|(to, from)| Op::Deliver { to, from }),
        2 => (0..MEMBERS, 0..MEMBERS).prop_map(|(to, from)| Op::DeliverSkewed { to, from }),
        2 => (0..MEMBERS).prop_map(|member| Op::Seal { member }),
        1 => (0..MEMBERS).prop_map(|member| Op::Crash { member }),
        2 => (0..MEMBERS, 0..MEMBERS, 0..64usize).prop_map(|(to, from, index)| Op::Replay {
            to,
            from,
            index
        }),
    ];
    prop::collection::vec(op, 0..160)
}

/// One in-flight protocol message: the advertised watermark or the
/// declared cut, stamped with the emitter's generation and the shared
/// monotone sequence both records can carry: the emitter's own-station
/// event counter (a declaration already carries it as its dot; an
/// advertisement would stamp its emitter's high water at emission).
#[derive(Clone, Debug)]
enum Payload {
    Advertisement(VersionVector),
    Declaration(VersionVector),
}

#[derive(Clone, Debug)]
struct Message {
    generation: u64,
    counter: u64,
    /// The message's index in its emitter's whole history: a
    /// generation-independent emission position, the model's ground
    /// truth for "emitted before or after". The stamp fence must agree
    /// with it (the precision law), which is what keeps the fence's
    /// per-generation counters honest.
    position: usize,
    payload: Payload,
}

/// The modeled fleet: per-generation monotone floor truths, lagged
/// views, per-emitter FIFO channels that survive seals, per-receiver
/// held advertisements folded by join under the generation tag, a
/// one-generation parking lot (the lockstep skew bound), and the full
/// advertisement history the replay op draws from.
struct Fleet {
    generations: [u64; MEMBERS],
    floors: [VersionVector; MEMBERS],
    views: [[VersionVector; MEMBERS]; MEMBERS],
    emitted: [u64; MEMBERS],
    held: [[Option<(VersionVector, u64)>; MEMBERS]; MEMBERS],
    channels: [[VecDeque<Message>; MEMBERS]; MEMBERS],
    parked: [[VecDeque<Message>; MEMBERS]; MEMBERS],
    history: [Vec<Message>; MEMBERS],
    /// Per receiver and emitter, the declarations already delivered,
    /// keyed `(generation, counter)`: a redelivered declaration is a
    /// lawful duplicate under the registry's idempotency law (PRD
    /// 0025) and must absorb *before* the fence runs, or a replay
    /// arriving after a newer lawful advertisement would false-positive
    /// the order check and forfeit the base on an honest channel (the
    /// S282 third-round review finding).
    delivered: [[BTreeSet<(u64, u64)>; MEMBERS]; MEMBERS],
    /// Per receiver and emitter, the greatest emission position among
    /// the advertisements actually folded this generation: the ground
    /// truth a detection must match (an ordering violation happened
    /// exactly when an advertisement emitted *after* a declaration was
    /// absorbed before that declaration's first delivery). Reset at
    /// seal beside the held table.
    absorbed: [[Option<usize>; MEMBERS]; MEMBERS],
    /// Per receiver and emitter, each first-delivered candidate's
    /// *fast-path eligibility*, keyed `(generation, counter)`: written
    /// exactly once, at first delivery (the fence verdict), and moved
    /// only downward thereafter (a receiver crash forfeits every
    /// pre-crash candidate's fast path, because the staging snapshot
    /// and verdict are volatile by design while the duplicate
    /// recognition is durable; the R-51 checkpoint carries the
    /// lifecycle window, deliberately not the staging). A duplicate
    /// delivery can therefore never re-license the trailing base (the
    /// S282 ninth-round review finding).
    eligible: [[BTreeMap<(u64, u64), bool>; MEMBERS]; MEMBERS],
    /// Per member, the join of its own advertisements this generation:
    /// the *durable oath floor*, sender state in the R-51 minimal
    /// durable set (an advertisement is a durability claim about
    /// future declarations, the report-is-a-durability-claim face
    /// again). An oath-mode declaration refuses a cut that does not
    /// cover it, which is what keeps the oath binding across the
    /// crash-restart lifecycle where `Stability` monotonicity alone
    /// cannot (the S282 eighth-round review finding). Cleared at seal.
    advertised_floor: [VersionVector; MEMBERS],
    /// Per member, whether a same-generation declaration window is
    /// open at it (its own mint or a delivered candidate): the shipped
    /// `Epochs` refuses a new declaration while a window is open, and
    /// the model mirrors that as a skip. Cleared at the member's seal.
    window: [bool; MEMBERS],
    /// How many declaration deliveries the stamp fence rejected (the
    /// rebuild fallback's trigger count), so directed schedules can
    /// assert the defense actually fired rather than being skipped.
    detections: usize,
}

impl Fleet {
    fn new() -> Self {
        Self {
            generations: [0; MEMBERS],
            floors: array::from_fn(|_| VersionVector::new()),
            views: array::from_fn(|_| array::from_fn(|_| VersionVector::new())),
            emitted: [0; MEMBERS],
            held: array::from_fn(|_| array::from_fn(|_| None)),
            channels: array::from_fn(|_| array::from_fn(|_| VecDeque::new())),
            parked: array::from_fn(|_| array::from_fn(|_| VecDeque::new())),
            history: array::from_fn(|_| Vec::new()),
            delivered: array::from_fn(|_| array::from_fn(|_| BTreeSet::new())),
            absorbed: array::from_fn(|_| array::from_fn(|_| None)),
            eligible: array::from_fn(|_| array::from_fn(|_| BTreeMap::new())),
            advertised_floor: array::from_fn(|_| VersionVector::new()),
            window: [false; MEMBERS],
            detections: 0,
        }
    }

    /// PRD 0011's read over the modeled views: each member's own floor
    /// is held fresh, every other member's through the lagged view.
    fn watermark(&self, member: usize) -> VersionVector {
        (0..MEMBERS)
            .map(|of| {
                if of == member {
                    &self.floors[member]
                } else {
                    &self.views[member][of]
                }
            })
            .fold(None, |meet: Option<VersionVector>, view| {
                Some(meet.map_or_else(|| view.clone(), |held| held.meet(view)))
            })
            .unwrap_or_default()
    }

    /// The oath meet at a receiver, `None` until every member's
    /// advertisement is held *within the current generation* (a silent
    /// member, and a freshly sealed table, pin the read at "stage
    /// nothing", never at the vacuous top: the right-adjoint
    /// empty-family rule, re-armed per generation). The full roster is
    /// the one scope whose bound no lawful declaration can undershoot
    /// (the S285 maximality pin), so it is the scoped read's
    /// chooser-agnostic instance, stated once.
    fn oath_meet(&self, member: usize) -> Option<VersionVector> {
        let roster: [usize; MEMBERS] = array::from_fn(|index| index);
        self.scoped_oath_meet(member, &roster)
    }

    /// The scoped oath meet (the note's section 6): the meet over a
    /// caller-chosen sub-roster of held advertisements, `None` until
    /// every *scope* member has advertised within the current
    /// generation. The scope is policy data (ruling R-4: participation
    /// is caller-side, permanently), never a mechanism default: a
    /// silent member inside the scope pins the read closed exactly as
    /// the full gate does (narrowing the scope is an explicit caller
    /// act, never an idleness timeout), a member outside the scope
    /// pins nothing, and the empty scope reads `None` (the empty meet
    /// is the vacuous lattice top, "everything"; the read overrides
    /// it to "stage nothing", PRD 0011's override again).
    /// A scoped bound is safe *against its scope* by the
    /// chooser-scoping kernel asserted in `absorb`; against an
    /// out-of-scope declarer it is a speculation whose miss the base
    /// seam detects on data in hand (the third shape's cure serving
    /// the fourth shape's policy axis).
    fn scoped_oath_meet(&self, member: usize, scope: &[usize]) -> Option<VersionVector> {
        scope
            .iter()
            .try_fold(None, |meet: Option<VersionVector>, &of| {
                let (held, _) = self.held[member][of].as_ref()?;
                Some(Some(
                    meet.map_or_else(|| held.clone(), |folded| folded.meet(held)),
                ))
            })?
    }

    fn hold(&mut self, member: usize, of: usize, advertised: &VersionVector, counter: u64) {
        let slot = &mut self.held[member][of];
        *slot = Some(slot.take().map_or_else(
            || (advertised.clone(), counter),
            |(folded, held)| (folded.merge(advertised), held.max(counter)),
        ));
    }

    /// The one fold door: the generation tag decides before any value
    /// is trusted. Stale generations are excluded (the review's replay
    /// hazard), the next generation parks until the receiver's own
    /// seal, and only the current generation folds or asserts.
    fn absorb(&mut self, to: usize, from: usize, message: Message) -> Result<(), TestCaseError> {
        if message.generation < self.generations[to] {
            return Ok(());
        }
        if message.generation > self.generations[to] {
            self.parked[to][from].push_back(message);
            return Ok(());
        }
        match message.payload {
            Payload::Advertisement(advertised) => {
                self.hold(to, from, &advertised, message.counter);
                let position = &mut self.absorbed[to][from];
                *position =
                    Some(position.map_or(message.position, |held| held.max(message.position)));
            }
            Payload::Declaration(declared) => {
                // A redelivered declaration absorbs by address before
                // the fence runs (the PRD 0025 idempotency posture):
                // its first delivery already ran the check, and a
                // duplicate arriving after a newer lawful
                // advertisement must not read as broken order.
                if !self.delivered[to][from].insert((message.generation, message.counter)) {
                    return Ok(());
                }
                self.window[to] = true;
                // The stamp fence, run as a *check*, never assumed: a
                // held advertisement whose own-station stamp has
                // reached the declaration's dot count was emitted
                // after it, so delivery order broke and the trailing
                // base is forfeit for this boundary (the full-rebuild
                // fallback, the third shape's cure). A declaration
                // mints its dot above every earlier stamp, so the
                // comparison is exact in both directions.
                let detected = self.held[to][from]
                    .as_ref()
                    .is_some_and(|(_, held)| *held >= message.counter);
                if detected {
                    self.detections += 1;
                }
                // The fast-path verdict is written exactly once, at
                // first delivery; the delivered set above guarantees
                // this door never runs twice for one candidate.
                let verdict = self.eligible[to][from]
                    .insert((message.generation, message.counter), !detected);
                prop_assert!(
                    verdict.is_none(),
                    "a candidate's fast-path verdict is written exactly once",
                );
                // The precision law: the fence's per-generation stamp
                // verdict must equal the ground truth read off the
                // generation-independent emission positions. A
                // detection with no genuine ordering violation would
                // forfeit bases on honest channels; a genuine
                // violation without a detection would silently
                // overshoot. Both directions are asserted at every
                // first delivery.
                let genuine =
                    self.absorbed[to][from].is_some_and(|advertised| advertised > message.position);
                prop_assert!(
                    detected == genuine,
                    "fence verdict {detected} disagrees with emission order {genuine}",
                );
                // The chooser-scoping kernel (S285, the note's
                // section 6): wherever the fence did not fire, the
                // declarer's *own* held join already bounds its cut.
                // Every scoped meet whose scope contains the declarer
                // inherits the bound (a meet sits below each of its
                // arguments), so the full-meet law below is this
                // kernel's corollary and the roster meet is the union
                // bound over an unknown declarer, nothing more.
                if !detected && let Some((held, _)) = self.held[to][from].as_ref() {
                    let scoped = held <= &declared;
                    prop_assert!(
                        scoped,
                        "the declarer's held join {held:?} overshoots its declared {declared:?}",
                    );
                }
                // The no-silent-overshoot law: wherever the fence did
                // not fire, the oath meet bounds the declared cut. An
                // overshoot can therefore never reach the staged fold
                // undetected, whatever the delivery order did.
                if !detected && let Some(meet) = self.oath_meet(to) {
                    let bounded = meet <= declared;
                    prop_assert!(
                        bounded,
                        "undetected oath meet {meet:?} overshoots declared {declared:?}",
                    );
                }
            }
        }
        Ok(())
    }

    /// One member's declaration, mirroring the shipped door: skipped
    /// while a window is open (`EpochRefusal::WindowOpen`) and at the
    /// allocator ceiling (a declaration dot must be strictly above
    /// every earlier stamp, which a saturated allocator cannot
    /// promise: an honest advertisement already stamped `u64::MAX`
    /// would equal the saturated dot and false-positive the fence).
    /// Rivals stay possible: a member that has neither declared nor
    /// delivered a candidate this generation has no open window.
    fn declare(&mut self, member: usize) -> Result<(), TestCaseError> {
        if self.window[member] || self.emitted[member] == u64::MAX {
            return Ok(());
        }
        // The durable oath-floor refusal: the cut must cover every
        // advertisement this member has made this generation, or a
        // tracker rebuilt mid-generation (the crash-restart lifecycle)
        // could lawfully declare below its own oath with a fresh dot
        // the stamp fence cannot fault. Pre-declaration advertisements
        // are bounded by this refusal; post-declaration ones by the
        // fence; together they close the meet under every delivered
        // cut. The mint below cannot raise the watermark (its own
        // coordinate is bound by the lagging views), so the check runs
        // on the would-be cut.
        let would_declare = self.watermark(member);
        let covers_oath = self.advertised_floor[member] <= would_declare;
        if !covers_oath {
            return Ok(());
        }
        // The declaration mints a fresh dot from the same allocator
        // every event and stamp speaks, so it sits above every
        // earlier stamp *and* above its own cut (the shipped
        // `StaleDeclaration` refusal cannot fire; the assert
        // documents it).
        self.emitted[member] += 1;
        let own = u32::try_from(member).expect("members index stations");
        self.floors[member].observe(own, self.emitted[member]);
        let declared = self.watermark(member);
        prop_assert!(
            self.emitted[member] > declared.get(own),
            "a modeled declaration is always fresh above its cut",
        );
        self.window[member] = true;
        // Self-delivery is instant: the declarer's own held oath meet
        // already bounds its own declaration.
        if let Some(meet) = self.oath_meet(member) {
            prop_assert!(meet <= declared);
        }
        let message = Message {
            generation: self.generations[member],
            counter: self.emitted[member],
            position: self.history[member].len(),
            payload: Payload::Declaration(declared),
        };
        // The local candidate is recorded as delivered at its own
        // minter (shipped `Epochs::declare` opens the window with
        // it), so a network echo of one's own declaration absorbs as
        // the duplicate it is instead of tripping the fence against a
        // newer self-advertisement; its fast-path eligibility is
        // recorded through the same table remote candidates use
        // (self-delivery is trivially in order), so a crash forfeits
        // the local candidate exactly as it forfeits every other.
        let _ = self.delivered[member][member].insert((message.generation, message.counter));
        let _ = self.eligible[member][member].insert((message.generation, message.counter), true);
        self.history[member].push(message.clone());
        for to in (0..MEMBERS).filter(|&to| to != member) {
            self.channels[member][to].push_back(message.clone());
        }
        Ok(())
    }

    /// The schedule interpreter, shared by the generated law and the
    /// directed model pins so both drive the identical semantics.
    fn run(&mut self, ops: &[Op]) -> Result<(), TestCaseError> {
        for &op in ops {
            match op {
                Op::Grow { member, station } => {
                    // One causal allocator per member: growth at the
                    // member's own station *is* an ordinary event mint
                    // (floor and allocator advance together, so
                    // advertisement stamps and declaration dots speak
                    // the same sequence the shipped protocol does);
                    // growth at a foreign station is a delivery,
                    // capped by what that station's owner has actually
                    // minted in the same generation.
                    let owner = usize::try_from(station).expect("stations index members");
                    if owner == member {
                        // The allocator ceiling: shipped dot minting
                        // saturates at `u64::MAX`, and a saturated
                        // numeral cannot be strictly fresh, so the
                        // model refuses the mint exactly where the
                        // oath's exactness would end (the ceiling
                        // posture the S32 `increment` honesty set).
                        if self.emitted[member] == u64::MAX {
                            continue;
                        }
                        self.emitted[member] += 1;
                        self.floors[member].observe(station, self.emitted[member]);
                    } else if self.generations[member] == self.generations[owner] {
                        let next = (self.floors[member].get(station) + 1).min(self.emitted[owner]);
                        self.floors[member].observe(station, next);
                    }
                }
                Op::Gossip { member, of } => {
                    if member != of && self.generations[member] == self.generations[of] {
                        self.views[member][of] = self.views[member][of].merge(&self.floors[of]);
                    }
                }
                Op::Advertise { member } => {
                    // An advertisement consumes no event dot: it is
                    // stamped with the emitter's current own-station
                    // counter, the shared sequence a declaration
                    // carries as its dot.
                    let counter = self.emitted[member];
                    let advertised = self.watermark(member);
                    let message = Message {
                        generation: self.generations[member],
                        counter,
                        position: self.history[member].len(),
                        payload: Payload::Advertisement(advertised.clone()),
                    };
                    let position = message.position;
                    self.advertised_floor[member] =
                        self.advertised_floor[member].merge(&advertised);
                    self.history[member].push(message.clone());
                    self.hold(member, member, &advertised, counter);
                    let held = &mut self.absorbed[member][member];
                    *held = Some(held.map_or(position, |prior| prior.max(position)));
                    for to in (0..MEMBERS).filter(|&to| to != member) {
                        self.channels[member][to].push_back(message.clone());
                    }
                }
                Op::Declare { member } => self.declare(member)?,
                Op::Crash { member } => {
                    self.views[member] = array::from_fn(|_| VersionVector::new());
                    self.held[member] = array::from_fn(|_| None);
                    self.absorbed[member] = array::from_fn(|_| None);
                    // The staging snapshot and fence verdict were
                    // volatile: rehydration forfeits the fast path
                    // for every candidate delivered before the
                    // crash, and the duplicate door can never grant
                    // it back.
                    for from in 0..MEMBERS {
                        for verdict in self.eligible[member][from].values_mut() {
                            *verdict = false;
                        }
                    }
                }
                Op::Deliver { to, from } => {
                    if let Some(message) = self.channels[from][to].pop_front() {
                        self.absorb(to, from, message)?;
                    }
                }
                Op::DeliverSkewed { to, from } => {
                    if let Some(message) = self.channels[from][to].remove(1) {
                        self.absorb(to, from, message)?;
                    }
                }
                Op::Seal { member } => {
                    // A seal closes a declared window (a generation
                    // with no candidate cannot seal), at the fleet's
                    // minimum generation (the roster-complete rounds
                    // keep any member at most one window ahead). The
                    // round conditions themselves (confirmation and
                    // adoption joins) are deliberately
                    // over-approximated: the model may seal earlier
                    // than the shipped machine would, which only adds
                    // schedules, and every oath law is asserted over
                    // the superset.
                    // The generation ceiling: the shipped seal
                    // saturates its generation at `u64::MAX`, where a
                    // rebirth would reuse the tag and break the stale
                    // exclusion, so oath-mode refuses the seal that
                    // would saturate (exact below the ceiling,
                    // refusing at it).
                    let minimum = self.generations.iter().copied().min().unwrap_or(0);
                    if self.window[member]
                        && self.generations[member] == minimum
                        && self.generations[member] < u64::MAX
                    {
                        self.window[member] = false;
                        self.generations[member] += 1;
                        self.floors[member] = VersionVector::new();
                        self.views[member] = array::from_fn(|_| VersionVector::new());
                        self.emitted[member] = 0;
                        self.advertised_floor[member] = VersionVector::new();
                        self.held[member] = array::from_fn(|_| None);
                        self.absorbed[member] = array::from_fn(|_| None);
                        for from in 0..MEMBERS {
                            while let Some(message) = self.parked[member][from].pop_front() {
                                self.absorb(member, from, message)?;
                            }
                        }
                    }
                }
                Op::Replay { to, from, index } => {
                    // The network may redeliver anything ever emitted,
                    // in any order: the fold door's three defenses
                    // (the generation tag, the delivered-address
                    // recognition, the stamp fence) are what stand
                    // between a replay and the staged fold.
                    if !self.history[from].is_empty() {
                        let message = self.history[from][index % self.history[from].len()].clone();
                        self.absorb(to, from, message)?;
                    }
                }
            }
        }
        Ok(())
    }
}

proptest! {
    #![proptest_config(ProptestConfig::with_cases(512))]

    /// The oath-fenced frontier's laws (the boundary-schedule note's
    /// fourth shape, marked *tested* there), over every schedule of
    /// monotone floor growth, arbitrarily lagged views, *arbitrarily
    /// reordered delivery* (nothing grants emission order; the skewed
    /// delivery op breaks it at will), lockstep-bounded seals that
    /// rebirth the coordinate space, and delayed or replayed
    /// prior-generation advertisements: wherever the stamp fence did
    /// not fire, the generation-scoped oath meet sits at or below the
    /// cut of the delivered same-generation declaration, so an
    /// overshoot never reaches the staged fold undetected; and on
    /// emission-ordered channels the fence never fires, so the fast
    /// path is the common one. The first-order impossibility is the
    /// lag lemma's directed pin above; the cross-generation hazard is
    /// the stale-advertisement pin; these are the laws that survive
    /// both.
    #[test]
    fn prop_the_oath_meet_precedes_every_delivered_declaration(ops in arb_ops()) {
        Fleet::new().run(&ops)?;
    }
}

/// The shared lawful preface: every member mints one own-station event
/// (one allocator drives floor, stamps, and dots together, the
/// sixth-round review's coupling), every member delivers everyone
/// else's mint, and every view refreshes, leaving all floors at
/// (1, 1, 1) with every allocator at 1.
fn base_ops() -> Vec<Op> {
    let mut ops = Vec::new();
    for member in 0..MEMBERS {
        let station = u32::try_from(member).expect("members index stations");
        ops.push(Op::Grow { member, station });
    }
    for member in 0..MEMBERS {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            let station = u32::try_from(of).expect("members index stations");
            ops.push(Op::Grow { member, station });
        }
    }
    for member in 0..MEMBERS {
        for of in (0..MEMBERS).filter(|&of| of != member) {
            ops.push(Op::Gossip { member, of });
        }
    }
    ops
}