minerva 0.2.0

//! The recorded admission (S342, ruling R-89; PRD 0028 R1/R2/R3): the
//! machine-held arrival round, the winner's carriage, the adoption
//! assent, and the record that widens the roster.
//!
//! Three halves. The round's own doors, ported from PRD 0027's
//! specification with their outlet re-pointed at the machine; the
//! carriage --- a declaration tags only a complete round, the seal
//! carries what its winner declared, and every seal ends the round; and
//! the falsifier exhibits PRD 0028 pre-registered, the racing-departure
//! composition first among them, because it is the gate R-89 closed and
//! this suite's job is to keep it closed.
//!
//! The argument is PRD 0028 R2 (the carrier rule) and the R-89 entry in
//! `owner-comments.adoc`.

extern crate alloc;

use alloc::vec::Vec;
use core::num::NonZeroUsize;

use crate::kairos::Kairos;
use crate::metis::{
    Admission, ArrivalRefusal, Cut, Departure, Dot, DotSet, EpochAddress, EpochLedgerDecodeBudget,
    EpochLedgerSnapshot, EpochRefusal, Epochs, LineageProofEntry, LineageProofRecord, SealRecord,
    Stability, VersionVector, Vouched,
};

/// Builds an identity literal. Panics on the non-dot counter zero (R-91).
#[track_caller]
fn d(station: u32, counter: u64) -> Dot {
    Dot::from_parts(station, counter).expect("test literal names the non-dot counter zero")
}

const ROSTER: [u32; 2] = [1, 2];
/// The station every basic pin admits.
const JOINER: u32 = 3;

fn horizon() -> NonZeroUsize {
    NonZeroUsize::new(4).expect("positive")
}

fn cut(entries: &[(u32, u64)]) -> Cut {
    let mut vector = VersionVector::new();
    for &(station, counter) in entries {
        vector.observe(station, counter);
    }
    Cut::from_witnessed(vector)
}

/// A tracker over `roster` with every member reporting `reported`.
fn tracker(roster: &[u32], reported: &Cut) -> Stability {
    let mut stability = Stability::new(roster.iter().copied());
    for &station in roster {
        stability.report_cut(station, reported).expect("on roster");
    }
    stability
}

/// Drives every machine in `fleet` through one identical first seal:
/// station 1 declares, every roster member confirms and adopts, and each
/// machine retires the window. Returns the sealed address.
fn seal_first(fleet: &mut [Epochs], roster: &[u32]) -> EpochAddress {
    let reported = cut(&roster.iter().map(|&s| (s, 4)).collect::<Vec<_>>());
    let stability = tracker(roster, &reported);
    let declaration = fleet[0]
        .declare(
            d(1, 5),
            Kairos::new(5, 0, 1, 0u16),
            &stability,
            &Cut::bottom(),
        )
        .expect("the watermark licenses the declaration");
    let winner = declaration.address();
    for machine in &mut fleet[1..] {
        machine
            .deliver(declaration.clone(), &stability, &Cut::bottom())
            .expect("the declaration enters the window");
    }
    let delivered = cut(&roster.iter().map(|&s| (s, 5)).collect::<Vec<_>>());
    let risen = tracker(roster, &delivered);
    for machine in fleet.iter_mut() {
        for &station in roster {
            machine
                .confirm(winner, &Vouched::trust(station, delivered.clone()))
                .expect("a confirmation folds");
        }
    }
    for (index, machine) in fleet.iter_mut().enumerate() {
        let own = roster[index];
        let _ = machine
            .adopt(own, 5, &risen)
            .expect("the confirmation round is complete under the watermark");
        for &station in roster {
            if station != own {
                machine
                    .adopt_report(winner, &Vouched::trust(station, 5))
                    .expect("a peer adoption folds");
            }
        }
        assert!(
            machine.try_seal(&risen).is_some(),
            "the adoption round is complete under the watermark"
        );
    }
    winner
}

/// A two-machine fleet (stations 1 and 2) one seal deep, with the tracker
/// both machines share.
fn founded() -> (Vec<Epochs>, EpochAddress, Stability) {
    let mut fleet = alloc::vec![
        Epochs::new(ROSTER, horizon()),
        Epochs::new(ROSTER, horizon()),
    ];
    let base = seal_first(&mut fleet, &ROSTER);
    let stability = tracker(&ROSTER, &cut(&[(1, 5), (2, 5)]));
    (fleet, base, stability)
}

/// The boundary admitting [`JOINER`] at `base`.
fn boundary(base: EpochAddress) -> Admission {
    Admission::new(base, [JOINER]).expect("one joiner")
}

/// The caller-minted record commitment every basic pin endorses under
/// (PRD 0028 R7): opaque bytes, like the lineage node.
const COMMIT: [u8; 32] = [7u8; 32];

// -- The round's own doors ---------------------------------------------------

/// An admission that admits nobody is refused before anything opens.
#[test]
fn an_admission_needs_at_least_one_joiner() {
    let (_, base, _) = &founded();
    assert_eq!(
        Admission::new(*base, []).unwrap_err(),
        ArrivalRefusal::EmptyAdmission
    );
}

/// A joiner already on the roster is refused first: presence is the
/// question a re-admission asks, and --- because departure never removes a
/// roster seat --- this is the door that forces incarnation.
#[test]
fn a_departed_station_cannot_return_under_its_own_identity() {
    let (mut fleet, base, mut stability) = founded();
    let _ = stability.abandon(2).expect("a survivor remains");
    assert_eq!(
        fleet[0].open_arrival(
            Admission::new(base, [2]).expect("one joiner"),
            COMMIT,
            1,
            &stability
        ),
        Err(ArrivalRefusal::AlreadyPresent { station: 2 })
    );
}

/// Opening endorses in the same act, repeats absorb, and the round names
/// who is holding the admission up.
#[test]
fn opening_endorses_and_shows_the_pending_incumbent() {
    let (mut fleet, base, stability) = founded();
    let endorsement = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    assert_eq!(*endorsement.admission(), boundary(base));
    let again = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("an identical re-open absorbs");
    assert_eq!(endorsement, again);
    let round = fleet[0].arrival().expect("the round is held");
    assert!(!round.complete(), "station 2 has not endorsed");
    assert_eq!(round.pending().collect::<Vec<_>>(), alloc::vec![2]);
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, endorsement), &stability)
        .expect("the peer endorsement folds");
    assert!(fleet[0].arrival().expect("held").complete());
}

/// One round per base: a second boundary is refused loudly, whichever
/// half differs --- the joiner set (`ForeignBoundary`) or the base
/// (`DiscordantRound`) --- and folding is refused the same way.
#[test]
fn a_second_boundary_is_refused_as_discord() {
    let (mut fleet, base, stability) = founded();
    let endorsement = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    assert_eq!(
        fleet[0].open_arrival(
            Admission::new(base, [4]).expect("one joiner"),
            COMMIT,
            1,
            &stability
        ),
        Err(ArrivalRefusal::ForeignBoundary { base })
    );
    let foreign = Admission::new(base, [4]).expect("one joiner");
    let rival = fleet[1]
        .open_arrival(foreign, COMMIT, 2, &stability)
        .expect("the rival round opens at its own machine");
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(2, rival), &stability),
        Err(ArrivalRefusal::ForeignBoundary { base })
    );
    // Neither competing round can complete anywhere, so neither can ever
    // ride: the two-rounds-per-base schedule is a visible livelock, not a
    // fork (PRD 0028 R2).
    assert!(!fleet[0].arrival().expect("held").complete());
    let _ = endorsement;
}

/// A report may not fill this replica's own slot, and a speaker outside
/// the family --- the joiner included --- is refused: nobody endorses
/// itself in.
#[test]
fn own_slots_and_foreign_speakers_are_refused() {
    let (mut fleet, base, stability) = founded();
    let endorsement = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(1, endorsement.clone()), &stability),
        Err(ArrivalRefusal::Impersonated { station: 1 })
    );
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(JOINER, endorsement.clone()), &stability),
        Err(ArrivalRefusal::UnknownStation { station: JOINER })
    );
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(9, endorsement), &stability),
        Err(ArrivalRefusal::UnknownStation { station: 9 })
    );
}

/// The base ladder, PRD 0027 R3's refusal order at the new door: no seal
/// to found on, a base ahead (recoverable), a base behind (terminal), and
/// this machine's own generation at another winner (fork evidence).
#[test]
fn the_base_is_located_against_this_machines_own_lineage() {
    let stability = tracker(&ROSTER, &cut(&[(1, 5), (2, 5)]));
    let mut fresh = Epochs::new(ROSTER, horizon());
    let somewhere = EpochAddress::try_from_parts(1, (1, 5)).expect("a valid address");
    assert_eq!(
        fresh.open_arrival(boundary(somewhere), COMMIT, 1, &stability),
        Err(ArrivalRefusal::Unfounded)
    );
    let (mut fleet, base, _) = founded();
    let ahead =
        EpochAddress::try_from_parts(base.generation() + 1, (1, 9)).expect("a valid address");
    assert_eq!(
        fleet[0].open_arrival(boundary(ahead), COMMIT, 1, &stability),
        Err(ArrivalRefusal::Premature {
            base: base.generation() + 1,
            newest: base.generation(),
        })
    );
    let discordant =
        EpochAddress::try_from_parts(base.generation(), (2, 9)).expect("a valid address");
    assert_eq!(
        fleet[0].open_arrival(boundary(discordant), COMMIT, 1, &stability),
        Err(ArrivalRefusal::DiscordantBase {
            held: base,
            offered: discordant,
        })
    );
    // Elapsed needs a second seal; the supersession pin below drives one
    // and asserts it there.
}

/// An abandoned member is not asked to endorse: the family is the meet's,
/// else no fleet that ever evicted could ever admit (PRD 0027 R3).
#[test]
fn an_abandoned_member_need_not_endorse() {
    let roster = [1u32, 2, 3];
    let mut fleet = alloc::vec![Epochs::new(roster, horizon())];
    let base = seal_first(&mut fleet, &roster);
    let mut stability = tracker(&roster, &cut(&[(1, 5), (2, 5), (3, 5)]));
    let _ = stability.abandon(3).expect("survivors remain");
    let admission = Admission::new(base, [4]).expect("one joiner");
    let endorsement = fleet[0]
        .open_arrival(admission, COMMIT, 1, &stability)
        .expect("the round opens over the surviving family");
    let round = fleet[0].arrival().expect("held");
    assert_eq!(round.family().collect::<Vec<_>>(), alloc::vec![1, 2]);
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, endorsement), &stability)
        .expect("the surviving peer completes the round");
    assert!(fleet[0].arrival().expect("held").complete());
}

// -- The carriage ------------------------------------------------------------

/// A declaration tags exactly a complete round: an incomplete one
/// declares plain, and the tag is never a separate caller act.
#[test]
fn a_declaration_tags_only_a_complete_round() {
    let (mut fleet, base, stability) = founded();
    let endorsement = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    let _ = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("the peer opens");
    let reported = cut(&[(1, 5), (2, 5)]);
    let risen = tracker(&ROSTER, &reported);
    let plain = fleet[1]
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &risen, &reported)
        .expect("an incomplete round licenses nothing");
    assert!(plain.admission().is_none());
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, endorsement), &stability)
        .expect("the peer endorsement folds");
    let tagged = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &risen, &reported)
        .expect("a complete round tags");
    assert_eq!(tagged.admission(), Some(&boundary(base)));
}

/// The whole of the design in one exhibit: the round completes at both
/// members, the winner carries the boundary, both seal the identical
/// admission-bearing record, the roster widens at the boundary, the round
/// is consumed, and the next window waits for the joiner --- arrival
/// spends liveness, which is what admitting means.
#[test]
fn the_winner_carries_the_admission_and_the_roster_widens_at_the_seal() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens at 1");
    let b = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("the round opens at 2");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, b), &stability)
        .expect("2's endorsement folds at 1");
    fleet[1]
        .fold_endorsement(&Vouched::trust(1, a), &stability)
        .expect("1's endorsement folds at 2");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("the complete round tags the declaration");
    assert_eq!(declaration.admission(), Some(&boundary(base)));
    fleet[1]
        .deliver(declaration.clone(), &stability, &reported)
        .expect("the tagged candidate validates on agreed inputs");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    let mut records = Vec::new();
    for (index, machine) in fleet.iter_mut().enumerate() {
        for &station in &ROSTER {
            machine
                .confirm(winner, &Vouched::trust(station, delivered.clone()))
                .expect("a confirmation folds");
        }
        let own = ROSTER[index];
        let _ = machine
            .adopt(own, if own == 1 { 6 } else { 5 }, &risen)
            .expect("the assent is this machine's own endorsement");
        for &station in &ROSTER {
            if station != own {
                machine
                    .adopt_report(
                        winner,
                        &Vouched::trust(station, if station == 1 { 6 } else { 5 }),
                    )
                    .expect("a peer adoption folds");
            }
        }
        let sealed = machine
            .try_seal(&risen)
            .expect("the adoption round is complete")
            .clone();
        assert_eq!(sealed.admission(), Some(&boundary(base)));
        records.push(SealRecord::from_sealed(&sealed).to_bytes());
    }
    assert_eq!(records[0], records[1], "one window, one record, both wide");
    for machine in &fleet {
        assert!(
            machine.roster().any(|station| station == JOINER),
            "the joiner is a member from the successor generation"
        );
        assert!(machine.arrival().is_none(), "the seal consumed the round");
    }
    // The widened rounds wait for the joiner: a window over the wider
    // roster cannot even latch until station 3 confirms.
    let reported = cut(&[(1, 6), (2, 5), (3, 5)]);
    let wide = tracker(&[1, 2, 3], &reported);
    let next = fleet[0]
        .declare(d(1, 7), Kairos::new(7, 0, 1, 0u16), &wide, &reported)
        .expect("the next window opens over the widened roster");
    let address = next.address();
    let delivered = cut(&[(1, 7), (2, 5), (3, 5)]);
    let risen = tracker(&[1, 2, 3], &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(address, &Vouched::trust(station, delivered.clone()))
            .expect("an incumbent confirmation folds");
    }
    assert_eq!(
        fleet[0].adopt(1, 7, &risen),
        Err(EpochRefusal::Unconfirmed),
        "the round ranges over the joiner now"
    );
    fleet[0]
        .confirm(address, &Vouched::trust(JOINER, delivered))
        .expect("the joiner's confirmation folds");
    let _ = fleet[0]
        .adopt(1, 7, &risen)
        .expect("the joiner's testimony completes the round");
}

/// The late-completing round and the incomplete round, in one schedule
/// (falsifiers 2 and 5): a plain winner seals, the round --- complete or
/// not --- dies with its base, absence from the record is total, and the
/// stale endorsement is structurally unspendable (`Elapsed`).
#[test]
fn a_plain_seal_supersedes_the_round_and_the_admission_costs_itself() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    // The window opens plain first: the winner declared before the round
    // completed.
    let plain = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("the plain window opens");
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("a round may open mid-window");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("the round completes mid-window");
    assert!(fleet[0].arrival().expect("held").complete());
    let winner = plain.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("a confirmation folds");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adoption");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("the peer adoption folds");
    let sealed = fleet[0]
        .try_seal(&risen)
        .expect("the plain window seals")
        .clone();
    assert!(
        sealed.admission().is_none(),
        "the late-completing round cannot catch the sealed window"
    );
    assert!(
        !fleet[0].roster().any(|station| station == JOINER),
        "absence is total: no partial admission"
    );
    assert!(
        fleet[0].arrival().is_none(),
        "the plain seal superseded the round"
    );
    // The old base is spent: re-agreeing over it refuses terminally, and
    // the cure is the new base.
    assert_eq!(
        fleet[0].open_arrival(boundary(base), COMMIT, 1, &stability),
        Err(ArrivalRefusal::Elapsed {
            base: base.generation(),
            newest: base.generation() + 1,
        })
    );
    let renewed = sealed.declaration();
    assert!(
        fleet[0]
            .open_arrival(boundary(renewed), COMMIT, 1, &stability)
            .is_ok(),
        "the arrival re-agrees over the base the fleet is at"
    );
}

/// The unassenting member (falsifier 1): a tagged winner is refused at
/// the adopt door of a machine that never endorsed --- loudly, before any
/// seal exists --- and endorsing is the cure.
#[test]
fn a_tagged_winner_is_refused_without_this_machines_own_endorsement() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens at 1");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("2's endorsement folds at 1");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("the complete round tags");
    // Machine 2 has not opened its round: honest schedules cannot reach
    // this (its endorsement is in the complete round), so this is the
    // liar's price rehearsed with honest hands.
    fleet[1]
        .deliver(declaration.clone(), &stability, &reported)
        .expect("agreed inputs validate");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[1]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("a confirmation folds");
    }
    assert_eq!(
        fleet[1].adopt(2, 5, &risen),
        Err(EpochRefusal::UnassentedAdmission { winner }),
        "no assent without this machine's own endorsement"
    );
    let _ = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("endorsing is the cure");
    let _ = fleet[1]
        .adopt(2, 5, &risen)
        .expect("the endorsement is the assent");
}

/// The stated-limitation exhibit: a fabricated boundary --- a tag whose
/// round no honest member joined --- wedges the window before any seal
/// exists. The liar buys a loud stall the N-of-N posture already grants
/// any member, never an agreed wrong record.
#[test]
fn a_fabricated_boundary_wedges_the_window_before_any_seal() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    // The liar (station 2) forges station 1's endorsement to itself: the
    // caller-side `Vouched::trust` assertion is exactly the trust seam
    // the crate documents, and lying to it is the crate's model of a
    // Byzantine caller.
    let forged = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("the liar's round opens");
    fleet[1]
        .fold_endorsement(&Vouched::trust(1, forged), &stability)
        .expect("the forged endorsement folds at the liar");
    let declaration = fleet[1]
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &stability, &reported)
        .expect("the liar's machine believes its round");
    assert!(declaration.admission().is_some());
    fleet[0]
        .deliver(declaration.clone(), &stability, &reported)
        .expect("agreed inputs cannot expose the forgery");
    let winner = declaration.address();
    let delivered = cut(&[(1, 5), (2, 6)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("a confirmation folds");
    }
    assert_eq!(
        fleet[0].adopt(1, 5, &risen),
        Err(EpochRefusal::UnassentedAdmission { winner }),
        "the honest member never endorsed and refuses"
    );
    // The honest member never adopts, so the winner's adoption round can
    // never complete: no seal exists on either side, and nothing is
    // retained. The wedge is the exhibit.
    assert!(fleet[0].try_seal(&risen).is_none());
    assert!(fleet[0].roster().all(|station| station != JOINER));
}

/// Deliver validates a tagged candidate on agreed inputs, identically
/// everywhere: a foreign base refuses as discord, and a joiner already on
/// the receiving roster refuses as presence.
#[test]
fn deliver_refuses_a_tagged_candidate_on_agreed_inputs() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    // A machine with a different first record: its own declaration won.
    let mut foreign = alloc::vec![Epochs::new(ROSTER, horizon())];
    let other = {
        let reported = cut(&[(1, 4), (2, 4)]);
        let stability = tracker(&ROSTER, &reported);
        let declaration = foreign[0]
            .declare(
                d(2, 5),
                Kairos::new(5, 0, 2, 0u16),
                &stability,
                &Cut::bottom(),
            )
            .expect("the foreign fleet declares");
        let winner = declaration.address();
        let delivered = cut(&[(1, 5), (2, 5)]);
        let risen = tracker(&ROSTER, &delivered);
        for &station in &ROSTER {
            foreign[0]
                .confirm(winner, &Vouched::trust(station, delivered.clone()))
                .expect("confirmation");
        }
        let _ = foreign[0].adopt(2, 5, &risen).expect("adoption");
        foreign[0]
            .adopt_report(winner, &Vouched::trust(1, 5))
            .expect("peer adoption");
        foreign[0].try_seal(&risen).expect("seals").declaration()
    };
    let e = foreign[0]
        .open_arrival(boundary(other), COMMIT, 2, &stability)
        .expect("the foreign round opens");
    foreign[0]
        .fold_endorsement(&Vouched::trust(1, e), &stability)
        .expect("completes");
    let tagged = foreign[0]
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &stability, &reported)
        .expect("tags over the foreign base");
    assert_eq!(
        fleet[0].deliver(tagged, &stability, &reported),
        Err(EpochRefusal::AdmissionBaseDiscord {
            offered: other,
            sealed: Some(base),
        }),
        "a boundary founded on a record this machine did not seal refuses"
    );
    // A machine whose construction roster already holds the joiner ---
    // reachable through the bootstrap door, whose containment is a subset
    // check --- refuses the same candidate as presence.
    let mut wide = {
        let record = SealRecord::from_sealed(fleet[0].newest_sealed().expect("retained"));
        let proof =
            LineageProofRecord::try_new(alloc::vec![LineageProofEntry::new(record, [0u8; 32])])
                .expect("one entry");
        Epochs::bootstrap([1, 2, JOINER], horizon(), &proof).expect("containment is monotone")
    };
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let tagged = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    assert_eq!(
        wide.deliver(tagged, &stability, &reported),
        Err(EpochRefusal::AdmissionAlreadyPresent { station: JOINER })
    );
}

/// The split tag (falsifier 3): an equivocating declarer ships two
/// contents under one dot, and buys exactly the seal-record fork an
/// equivocated declaration already buys --- byte-distinct under the
/// record spelling, same address, caught at the same certificate layer.
#[test]
fn an_equivocated_tag_buys_the_fork_an_equivocated_declaration_already_buys() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    // Two spellings of "the same" declaration: the liar's machine twin
    // with a complete round tags; a twin without one declares plain.
    let mut liar_tagged = fleet[0].clone();
    let e = liar_tagged
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("opens");
    liar_tagged
        .fold_endorsement(&Vouched::trust(1, e), &stability)
        .expect("completes");
    let tagged = liar_tagged
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &stability, &reported)
        .expect("tags");
    let plain = fleet[1]
        .clone()
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &stability, &reported)
        .expect("declares plain");
    assert_eq!(tagged.address(), plain.address(), "one dot, two contents");
    let winner = tagged.address();
    // Machine 1 receives the tagged spelling and assents; machine 2
    // receives the plain one.
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("completes");
    fleet[0]
        .deliver(tagged, &stability, &reported)
        .expect("the tagged spelling validates");
    fleet[1]
        .deliver(plain, &stability, &reported)
        .expect("the plain spelling validates");
    let delivered = cut(&[(1, 5), (2, 6)]);
    let risen = tracker(&ROSTER, &delivered);
    let mut spellings = Vec::new();
    for (index, machine) in fleet.iter_mut().enumerate() {
        for &station in &ROSTER {
            machine
                .confirm(winner, &Vouched::trust(station, delivered.clone()))
                .expect("confirmation");
        }
        let own = ROSTER[index];
        let _ = machine
            .adopt(own, if own == 2 { 6 } else { 5 }, &risen)
            .expect("adoption");
        for &station in &ROSTER {
            if station != own {
                machine
                    .adopt_report(
                        winner,
                        &Vouched::trust(station, if station == 2 { 6 } else { 5 }),
                    )
                    .expect("peer adoption");
            }
        }
        let sealed = machine.try_seal(&risen).expect("seals").clone();
        spellings.push(SealRecord::from_sealed(&sealed).to_bytes());
    }
    assert_eq!(
        fleet[0].newest_sealed().expect("sealed").declaration(),
        fleet[1].newest_sealed().expect("sealed").declaration(),
        "one address"
    );
    assert_ne!(
        spellings[0], spellings[1],
        "two records, byte-distinct under the record spelling"
    );
}

/// The gate's acceptance test (falsifier 7, the schedule R-88's fourth
/// review round named): a departure attestation applied at one honest
/// replica mid-window and not yet at the other cannot split the record.
/// The admission reads only the winner; the substituted and spoken values
/// coincide by R-86's forcing argument; the records are byte-identical.
#[test]
fn a_racing_departure_attestation_cannot_split_the_record() {
    let roster = [1u32, 2, 3];
    let mut fleet = alloc::vec![
        Epochs::new(roster, horizon()),
        Epochs::new(roster, horizon()),
    ];
    let base = seal_first(&mut fleet, &roster);
    let reported = cut(&[(1, 5), (2, 5), (3, 5)]);
    let mut stability_a = tracker(&roster, &reported);
    let stability_b = tracker(&roster, &reported);
    let admission = Admission::new(base, [4]).expect("one joiner");
    // The round completes at both machines --- station 3 endorsed before
    // departing.
    let a = fleet[0]
        .open_arrival(admission.clone(), COMMIT, 1, &stability_a)
        .expect("opens at 1");
    let b = fleet[1]
        .open_arrival(admission.clone(), COMMIT, 2, &stability_b)
        .expect("opens at 2");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, b.clone()), &stability_a)
        .expect("folds");
    fleet[0]
        .fold_endorsement(&Vouched::trust(3, a.clone()), &stability_a)
        .expect("3's endorsement folds at 1");
    fleet[1]
        .fold_endorsement(&Vouched::trust(1, a), &stability_b)
        .expect("folds");
    fleet[1]
        .fold_endorsement(&Vouched::trust(3, b), &stability_b)
        .expect("3's endorsement folds at 2");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability_a, &reported)
        .expect("the complete round tags");
    fleet[1]
        .deliver(declaration.clone(), &stability_b, &reported)
        .expect("validates");
    let winner = declaration.address();
    // Station 3 departs. The survivors' round agrees the bound 5, and the
    // attestation lands at machine 1 *mid-window*; machine 2 keeps
    // folding 3's real reports at the same values --- the only values a
    // schedule where both seal can hold (R-86's forcing argument).
    let departed = {
        let mut round = Departure::opened(3, 1, [1, 2]).expect("survivors");
        let mut held = DotSet::new();
        for counter in 1..=5 {
            let _ = held.insert(d(3, counter));
        }
        let _ = round.propose(&held, &DotSet::new()).expect("gap-free");
        round
            .fold(&Vouched::trust(2, 5))
            .expect("survivor proposal");
        round.try_seal().expect("every survivor proposed").clone()
    };
    let _ = stability_a
        .abandon_attested(&departed)
        .expect("the attestation lands at 1");
    let delivered = cut(&[(1, 6), (2, 5), (3, 5)]);
    let risen_b = tracker(&roster, &delivered);
    let mut risen_a = tracker(&roster, &delivered);
    let _ = risen_a
        .abandon_attested(&departed)
        .expect("the attestation stands at 1");
    // Machine 1: 3's slots are substituted --- its spoken words, present
    // or absent, are discarded. Machine 2: 3's real words fold.
    for &station in &[1u32, 2] {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirmation at 1");
    }
    for &station in &roster {
        fleet[1]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirmation at 2");
    }
    let _ = fleet[0]
        .adopt(1, 6, &risen_a)
        .expect("assented adoption at 1");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption at 1");
    let _ = fleet[1]
        .adopt(2, 5, &risen_b)
        .expect("assented adoption at 2");
    fleet[1]
        .adopt_report(winner, &Vouched::trust(1, 6))
        .expect("peer adoption at 2");
    fleet[1]
        .adopt_report(winner, &Vouched::trust(3, 5))
        .expect("3's real adoption folds at 2");
    let sealed_a = fleet[0]
        .try_seal(&risen_a)
        .expect("substitution completes the rounds at 1")
        .clone();
    let sealed_b = fleet[1]
        .try_seal(&risen_b)
        .expect("3's spoken words complete the rounds at 2")
        .clone();
    assert_eq!(sealed_a.admission(), Some(&admission));
    assert_eq!(
        SealRecord::from_sealed(&sealed_a).to_bytes(),
        SealRecord::from_sealed(&sealed_b).to_bytes(),
        "the racing attestation cannot split the record"
    );
}

/// The round freeze, pinned as a cost (falsifier 7's third half): a
/// departure attested while a round is open freezes that round --- no
/// substitution, deliberately --- and the arrival re-agrees over the
/// surviving family at the next base.
#[test]
fn a_departure_racing_an_open_round_freezes_it_and_the_arrival_re_agrees() {
    let roster = [1u32, 2, 3];
    let mut fleet = alloc::vec![Epochs::new(roster, horizon())];
    let base = seal_first(&mut fleet, &roster);
    let reported = cut(&[(1, 5), (2, 5), (3, 5)]);
    let mut stability = tracker(&roster, &reported);
    let admission = Admission::new(base, [4]).expect("one joiner");
    let _ = fleet[0]
        .open_arrival(admission, COMMIT, 1, &stability)
        .expect("opens over {1, 2, 3}");
    let departed = {
        let mut round = Departure::opened(3, 1, [1, 2]).expect("survivors");
        let mut held = DotSet::new();
        for counter in 1..=5 {
            let _ = held.insert(d(3, counter));
        }
        let _ = round.propose(&held, &DotSet::new()).expect("gap-free");
        round
            .fold(&Vouched::trust(2, 5))
            .expect("survivor proposal");
        round.try_seal().expect("sealed").clone()
    };
    let _ = stability
        .abandon_attested(&departed)
        .expect("the attestation lands mid-round");
    let round = fleet[0].arrival().expect("held");
    assert!(
        round.pending().any(|station| station == 3),
        "the departed slot never fills"
    );
    assert!(!round.complete(), "the round is frozen, not substituted");
    // The freeze is enforced, not documented: a delayed word attributed
    // to the attested identity is refused at the folding door (the
    // `Departure::admits` posture), so the slot can never fill late.
    let delayed = fleet[0]
        .open_arrival(
            Admission::new(base, [4]).expect("one joiner"),
            COMMIT,
            1,
            &stability,
        )
        .expect("the identical re-open absorbs and re-mints");
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(3, delayed), &stability),
        Err(ArrivalRefusal::AttestedDeparture { station: 3 })
    );
    let still = fleet[0].arrival().expect("held");
    assert!(!still.complete(), "the delayed word did not thaw the round");
    let tagless = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("declares");
    assert!(tagless.admission().is_none(), "a frozen round never rides");
    // Drive the plain window to its seal; the frozen round dies with its
    // base, and the re-agreed round ranges over the survivors.
    let winner = tagless.address();
    let delivered = cut(&[(1, 6), (2, 5), (3, 5)]);
    let mut risen = tracker(&roster, &delivered);
    let _ = risen.abandon_attested(&departed).expect("stands");
    for &station in &[1u32, 2] {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirmation");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adoption");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let renewed = fleet[0]
        .try_seal(&risen)
        .expect("substitution completes the window rounds")
        .declaration();
    assert!(fleet[0].arrival().is_none(), "the frozen round died");
    let _ = fleet[0]
        .open_arrival(
            Admission::new(renewed, [4]).expect("one joiner"),
            COMMIT,
            1,
            &risen,
        )
        .expect("the re-agreed round opens");
    assert_eq!(
        fleet[0]
            .arrival()
            .expect("held")
            .family()
            .collect::<Vec<_>>(),
        alloc::vec![1, 2],
        "the re-agreed family is the surviving one"
    );
}

// -- The spellings -----------------------------------------------------------

/// Recorded-membership content moves every spelling to its version-2
/// sibling and rides the checkpoint whole; a machine with none spells
/// version 1, byte-compatibly with every older reader.
#[test]
fn recorded_content_rides_version_two_and_dormant_machines_spell_version_one() {
    let (mut fleet, base, stability) = founded();
    // Dormant: version 1, exactly as before this slice.
    let dormant = fleet[1].snapshot().to_bytes();
    assert_eq!(dormant[0], 0x01);
    let plain_record = SealRecord::from_sealed(fleet[1].newest_sealed().expect("retained"));
    assert_eq!(plain_record.to_bytes()[0], 0x01);
    // An open round moves the checkpoint to version 2 and round-trips
    // exactly.
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let frame = fleet[0].snapshot().to_bytes();
    assert_eq!(frame[0], 0x02);
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    let decoded = EpochLedgerSnapshot::from_bytes(&frame, budget).expect("the sibling decodes");
    assert_eq!(decoded.to_bytes(), frame, "canonical bijection");
    let restored = Epochs::rehydrate(&decoded, ROSTER, horizon()).expect("the checkpoint restores");
    assert_eq!(restored, fleet[0], "the round rides the checkpoint whole");
    // A tagged declaration spells version 2 and round-trips.
    let reported = cut(&[(1, 5), (2, 5)]);
    let risen = tracker(&ROSTER, &reported);
    let tagged = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &risen, &reported)
        .expect("tags");
    let bytes = tagged.to_bytes();
    assert_eq!(bytes[0], 0x02);
    assert_eq!(bytes.len(), tagged.encoded_len());
    assert_eq!(
        crate::metis::Declaration::from_bytes(&bytes).expect("decodes"),
        tagged
    );
    // A tagged open window rides the checkpoint too.
    let mid = fleet[0].snapshot().to_bytes();
    assert_eq!(mid[0], 0x02);
    let decoded = EpochLedgerSnapshot::from_bytes(&mid, budget).expect("decodes");
    assert_eq!(
        Epochs::rehydrate(&decoded, ROSTER, horizon()).expect("restores"),
        fleet[0]
    );
}

/// An admission-bearing record spells version 2, round-trips, its
/// lineage rides the checkpoint --- and the joiner has a door: it
/// bootstraps from the heterogeneous proof (PRD 0028 R4, per-generation
/// containment) and participates in the very next seal. The program's
/// first end-to-end admission.
#[test]
fn an_admission_bearing_record_round_trips_and_the_joiner_bootstraps() {
    let (mut fleet, base, _) = founded();
    let founding_record = SealRecord::from_sealed(fleet[0].newest_sealed().expect("sealed"));
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirmation");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adoption");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let sealed = fleet[0].try_seal(&risen).expect("seals").clone();
    let record = SealRecord::from_sealed(&sealed);
    let bytes = record.to_bytes();
    assert_eq!(bytes[0], 0x02);
    assert_eq!(bytes.len(), record.encoded_len());
    let decoded = SealRecord::from_bytes(&bytes).expect("the sibling decodes");
    assert_eq!(decoded, record);
    assert_eq!(decoded.admission(), Some(&boundary(base)));
    // The widened machine's checkpoint carries the admission-bearing
    // lineage and restores against the widened roster.
    let frame = fleet[0].snapshot().to_bytes();
    assert_eq!(frame[0], 0x02);
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    let decoded = EpochLedgerSnapshot::from_bytes(&frame, budget).expect("decodes");
    assert_eq!(decoded.to_bytes(), frame);
    let restored =
        Epochs::rehydrate(&decoded, [1, 2, JOINER], horizon()).expect("restores widened");
    assert_eq!(restored, fleet[0]);
    // The joiner's door: bootstrap re-proves containment per generation
    // --- the founding entry against {1, 2}, the admission-bearing entry
    // against the same family, the widening applied after it --- and
    // installs the heterogeneous lineage whole.
    let proof = LineageProofRecord::try_new(alloc::vec![
        LineageProofEntry::new(founding_record, [0u8; 32]),
        LineageProofEntry::new(record, [0u8; 32]),
    ])
    .expect("two entries");
    let mut joiner = Epochs::bootstrap(ROSTER, horizon(), &proof)
        .expect("the oldest roster grounds the proof, and the admissions widen it");
    assert_eq!(joiner.generation(), fleet[0].generation());
    assert!(joiner.roster().eq(fleet[0].roster()));
    // And the admitted station participates in the very next seal.
    let wide = [1u32, 2, JOINER];
    let reported = cut(&[(1, 6), (2, 5), (3, 5)]);
    let stability = tracker(&wide, &reported);
    let declaration = fleet[0]
        .declare(d(1, 7), Kairos::new(7, 0, 1, 0u16), &stability, &reported)
        .expect("the next window opens over the widened roster");
    joiner
        .deliver(declaration.clone(), &stability, &reported)
        .expect("the joiner's machine folds the declaration");
    let winner = declaration.address();
    let delivered = cut(&[(1, 7), (2, 5), (3, 5)]);
    let risen = tracker(&wide, &delivered);
    for machine in [&mut fleet[0], &mut joiner] {
        for &station in &wide {
            machine
                .confirm(winner, &Vouched::trust(station, delivered.clone()))
                .expect("a confirmation folds");
        }
    }
    let _ = fleet[0].adopt(1, 7, &risen).expect("the incumbent adopts");
    let _ = joiner.adopt(JOINER, 5, &risen).expect("the joiner adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(JOINER, 5))
        .expect("the joiner's adoption folds at the incumbent");
    joiner
        .adopt_report(winner, &Vouched::trust(1, 7))
        .expect("peer adoption");
    joiner
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let a = fleet[0]
        .try_seal(&risen)
        .expect("the incumbent seals")
        .clone();
    let b = joiner.try_seal(&risen).expect("the joiner seals").clone();
    assert_eq!(
        SealRecord::from_sealed(&a).to_bytes(),
        SealRecord::from_sealed(&b).to_bytes(),
        "the admitted station and the incumbent seal one record"
    );
}

/// The review gate's schedule (S342): a frame claiming an *adopted*
/// tagged winner must carry the endorsed round that assented to it.
/// Absent or discordant, the frame refuses whole --- rehydration must
/// not hand `try_seal` an admission this machine never assented to,
/// which is the one bypass of `UnassentedAdmission` a crafted
/// checkpoint could buy.
#[test]
fn a_frame_cannot_claim_an_adopted_tagged_winner_without_its_round() {
    let (mut fleet, base, _) = founded();
    let joiner: u32 = 0xAB12_CD34;
    let admission = Admission::new(base, [joiner]).expect("one joiner");
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let a = fleet[0]
        .open_arrival(admission, COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts with assent");
    let frame = fleet[0].snapshot().to_bytes();
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    assert!(
        EpochLedgerSnapshot::from_bytes(&frame, budget).is_ok(),
        "the honest frame decodes"
    );
    let refused = Err(crate::metis::EpochLedgerDecodeError::InvalidState(
        "an adopted tagged winner without its endorsed arrival round",
    ));
    // Discordant: flip one byte of the *candidate* admission's joiner
    // (its first spelling in the frame; the arrival section's copy is
    // untouched, so the two boundaries no longer agree).
    let pattern = joiner.to_be_bytes();
    let at = frame
        .windows(4)
        .position(|window| window == pattern)
        .expect("the joiner is spelled in the candidate admission");
    let mut discordant = frame.clone();
    discordant[at + 3] ^= 0x01;
    assert_eq!(
        EpochLedgerSnapshot::from_bytes(&discordant, budget),
        refused
    );
    // Absent: strip the arrival section (the frame's tail) down to its
    // empty tag, leaving the adopted tagged winner unbacked.
    let arrival_section = 1 + (8 + 12 + 8 + 4) + 32 + 4 + 8 + 2 * 5;
    let mut absent = frame[..frame.len() - arrival_section].to_vec();
    absent.push(0x00);
    assert_eq!(EpochLedgerSnapshot::from_bytes(&absent, budget), refused);
}

/// The review gate's second schedule (S342): a crafted checkpoint that
/// places a joiner's coordinate in a generation before the record that
/// admits it must refuse --- each retained generation is contained in
/// the roster *of its own generation*, reconstructed from the retained
/// admissions (PRD 0028 R4, falsifier 6's decode half).
#[test]
fn a_checkpoint_cannot_place_a_joiners_coordinate_before_its_admission() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let a = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, a), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let _ = fleet[0].try_seal(&risen).expect("seals the admission");
    let frame = fleet[0].snapshot().to_bytes();
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    assert!(
        EpochLedgerSnapshot::from_bytes(&frame, budget).is_ok(),
        "the honest heterogeneous lineage decodes"
    );
    // Rewrite record 1's join entry for station 2 into one for the
    // joiner: the join stays ascending and inside the *final* roster, so
    // only the per-generation reconstruction can see that the joiner had
    // no coordinate before its admission.
    let entry: Vec<u8> = 2u32
        .to_be_bytes()
        .iter()
        .chain(5u64.to_be_bytes().iter())
        .copied()
        .collect();
    let at = frame
        .windows(entry.len())
        .position(|window| window == entry)
        .expect("record 1's join carries station 2 at counter 5");
    let mut crafted = frame;
    crafted[at..at + 4].copy_from_slice(&JOINER.to_be_bytes());
    assert_eq!(
        EpochLedgerSnapshot::from_bytes(&crafted, budget),
        Err(crate::metis::EpochLedgerDecodeError::InvalidState(
            "sealed join covers a station outside the roster",
        ))
    );
}

/// The review gate's fourth round (S342): the assent binds to the round's
/// own voice. A round opened as one station cannot authorize another
/// station's adoption of a tagged winner, and a re-open under a different
/// voice is refused rather than absorbed.
#[test]
fn the_assent_binds_to_the_rounds_own_voice() {
    let (mut fleet, base, _) = founded();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    // A liar's twin with a forged complete round mints the tagged winner.
    let mut liar = fleet[0].clone();
    let forged = liar
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    liar.fold_endorsement(&Vouched::trust(2, forged), &stability)
        .expect("the forged endorsement folds");
    let declaration = liar
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    // Machine 2 holds an *incomplete* round opened as station 1 --- a
    // caller confused about its own identity --- and must not spend that
    // round as station 2's assent.
    let _ = fleet[1]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens as station 1");
    assert_eq!(
        fleet[1].open_arrival(boundary(base), COMMIT, 2, &stability),
        Err(ArrivalRefusal::DiscordantVoice {
            held: 1,
            offered: 2
        })
    );
    fleet[1]
        .deliver(declaration, &stability, &reported)
        .expect("agreed inputs validate");
    let winner = EpochAddress::try_from_parts(base.generation() + 1, (1, 6)).expect("valid");
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[1]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    assert_eq!(
        fleet[1].adopt(2, 5, &risen),
        Err(EpochRefusal::UnassentedAdmission { winner }),
        "another voice's round is not this station's assent"
    );
}

/// The review gate's fourth round, second half (S342): a crafted lineage
/// admitting one station twice must refuse --- the live doors refuse a
/// joiner already on the roster, so a twice-admitting checkpoint is state
/// no machine run can produce.
#[test]
fn a_checkpoint_cannot_admit_one_station_twice() {
    let first: u32 = 0xAA01;
    let second: u32 = 0xAA02;
    let (mut fleet, base, _) = founded();
    // Two widening cycles: admit `first` at generation 2, `second` at 3.
    let widen =
        |machine: &mut Epochs, base: EpochAddress, joiner: u32, roster: &[u32], dot: Dot| {
            let reported = cut(&roster
                .iter()
                .map(|&s| (s, dot.counter() - 1))
                .collect::<Vec<_>>());
            let stability = tracker(roster, &reported);
            let admission = Admission::new(base, [joiner]).expect("one joiner");
            let e = machine
                .open_arrival(admission, COMMIT, 1, &stability)
                .expect("opens");
            for &station in roster {
                if station != 1 {
                    machine
                        .fold_endorsement(&Vouched::trust(station, e.clone()), &stability)
                        .expect("folds");
                }
            }
            let declaration = machine
                .declare(
                    dot,
                    Kairos::new(dot.counter(), 0, 1, 0u16),
                    &stability,
                    &reported,
                )
                .expect("tags");
            let winner = declaration.address();
            let delivered = cut(&roster
                .iter()
                .map(|&s| {
                    (
                        s,
                        if s == 1 {
                            dot.counter()
                        } else {
                            dot.counter() - 1
                        },
                    )
                })
                .collect::<Vec<_>>());
            let risen = tracker(roster, &delivered);
            for &station in roster {
                machine
                    .confirm(winner, &Vouched::trust(station, delivered.clone()))
                    .expect("confirms");
            }
            let _ = machine
                .adopt(1, dot.counter(), &risen)
                .expect("adopts with assent");
            for &station in roster {
                if station != 1 {
                    machine
                        .adopt_report(winner, &Vouched::trust(station, dot.counter() - 1))
                        .expect("peer adoption");
                }
            }
            machine.try_seal(&risen).expect("seals").declaration()
        };
    let second_base = widen(&mut fleet[0], base, first, &[1, 2], d(1, 6));
    let _ = widen(&mut fleet[0], second_base, second, &[1, 2, first], d(1, 7));
    let frame = fleet[0].snapshot().to_bytes();
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    assert!(
        EpochLedgerSnapshot::from_bytes(&frame, budget).is_ok(),
        "the honest twice-widened lineage decodes"
    );
    // Rewrite the third record's admission joiner to the second record's:
    // the last spelling of `second` in the frame is that admission's.
    let pattern = second.to_be_bytes();
    let at = frame
        .windows(4)
        .rposition(|window| window == pattern)
        .expect("the second joiner is spelled in the third record's admission");
    let mut crafted = frame;
    crafted[at..at + 4].copy_from_slice(&first.to_be_bytes());
    assert_eq!(
        EpochLedgerSnapshot::from_bytes(&crafted, budget),
        Err(crate::metis::EpochLedgerDecodeError::InvalidState(
            "sealed admission joiner is already a member",
        ))
    );
}

/// The review gate's fifth round (S342): the freeze holds at the tagging
/// door too. A round *completed* before the attestation landed still
/// never tags --- a departed identity's word cannot be spent --- and the
/// arrival re-agrees over the next base with the surviving family, where
/// it tags freely.
#[test]
fn an_attestation_freezes_even_a_complete_round_at_the_tag_door() {
    let roster = [1u32, 2, 3];
    let mut fleet = alloc::vec![Epochs::new(roster, horizon())];
    let base = seal_first(&mut fleet, &roster);
    let reported = cut(&[(1, 5), (2, 5), (3, 5)]);
    let mut stability = tracker(&roster, &reported);
    let admission = Admission::new(base, [4]).expect("one joiner");
    let e = fleet[0]
        .open_arrival(admission, COMMIT, 1, &stability)
        .expect("opens over {1, 2, 3}");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e.clone()), &stability)
        .expect("folds");
    fleet[0]
        .fold_endorsement(&Vouched::trust(3, e), &stability)
        .expect("3 endorsed before departing");
    assert!(fleet[0].arrival().expect("held").complete());
    let departed = {
        let mut round = Departure::opened(3, 1, [1, 2]).expect("survivors");
        let mut held = DotSet::new();
        for counter in 1..=5 {
            let _ = held.insert(d(3, counter));
        }
        let _ = round.propose(&held, &DotSet::new()).expect("gap-free");
        round
            .fold(&Vouched::trust(2, 5))
            .expect("survivor proposal");
        round.try_seal().expect("sealed").clone()
    };
    let _ = stability
        .abandon_attested(&departed)
        .expect("the attestation lands after completion");
    let plain = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("declares");
    assert!(
        plain.admission().is_none(),
        "a departed identity's word cannot be spent, even latched"
    );
    // Drive the plain window through its seal, then re-agree over the
    // new base with the surviving family: there the tag fires.
    let winner = plain.address();
    let delivered = cut(&[(1, 6), (2, 5), (3, 5)]);
    let mut risen = tracker(&roster, &delivered);
    let _ = risen.abandon_attested(&departed).expect("stands");
    for &station in &[1u32, 2] {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirmation");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adoption");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let renewed = fleet[0]
        .try_seal(&risen)
        .expect("substitution completes the window rounds")
        .declaration();
    let e = fleet[0]
        .open_arrival(
            Admission::new(renewed, [4]).expect("one joiner"),
            COMMIT,
            1,
            &risen,
        )
        .expect("re-agrees over the surviving family");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &risen)
        .expect("the survivor completes the round");
    let reported = cut(&[(1, 6), (2, 5), (3, 5)]);
    let risen2 = {
        let mut tracker = tracker(&roster, &reported);
        let _ = tracker.abandon_attested(&departed).expect("stands");
        tracker
    };
    let tagged = fleet[0]
        .declare(d(1, 7), Kairos::new(7, 0, 1, 0u16), &risen2, &reported)
        .expect("declares over the new base");
    assert!(
        tagged.admission().is_some(),
        "the re-agreed round tags over the surviving family"
    );
}

/// The checkpoint-identity residue, exhibited (the R-57 pattern): the
/// frame carries no "this machine is station N", so another station's
/// honest checkpoint decodes and restores --- and the misconfiguration
/// turns loud at the caller's next `open_arrival`, as `DiscordantVoice`.
#[test]
fn restoring_another_stations_checkpoint_turns_loud_at_the_next_open() {
    let (mut fleet, base, stability) = founded();
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens as station 1");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let frame = fleet[0].snapshot().to_bytes();
    // The arrival section's tail: own (4), family count (8), two slots
    // (5 each). Rewrite `own` from 1 to 2: station 2's slot is endorsed
    // in the complete round, so this is exactly station 2's honest
    // checkpoint of the same round.
    let own_at = frame.len() - (4 + 8 + 2 * 5);
    let mut foreign = frame;
    foreign[own_at..own_at + 4].copy_from_slice(&2u32.to_be_bytes());
    let budget = EpochLedgerDecodeBudget::new(8, 8, 8, 64, 8);
    let decoded = EpochLedgerSnapshot::from_bytes(&foreign, budget)
        .expect("another station's honest checkpoint decodes");
    let mut restored = Epochs::rehydrate(&decoded, ROSTER, horizon()).expect("restores");
    assert_eq!(
        restored.open_arrival(boundary(base), COMMIT, 1, &stability),
        Err(ArrivalRefusal::DiscordantVoice {
            held: 2,
            offered: 1
        }),
        "the wrong-checkpoint misconfiguration is loud, not silent"
    );
}

/// The review gate's sixth round (S342): the candidate and joiner counts
/// are unrelated, so a tight candidate budget must not refuse legitimate
/// membership growth --- a one-candidate record admitting two stations
/// decodes under `SealDecodeBudget::new(1)`, and joiners stay bounded by
/// the input bytes alone.
#[test]
fn a_tight_candidate_budget_does_not_refuse_membership_growth() {
    let (mut fleet, base, _) = founded();
    let admission = Admission::new(base, [3, 4]).expect("two joiners");
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let e = fleet[0]
        .open_arrival(admission.clone(), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let sealed = fleet[0].try_seal(&risen).expect("seals").clone();
    let record = SealRecord::from_sealed(&sealed);
    let bytes = record.to_bytes();
    let decoded =
        SealRecord::from_bytes_with_budget(&bytes, crate::metis::SealDecodeBudget::new(1))
            .expect("one candidate fits the budget; joiners are not candidates");
    assert_eq!(decoded.admission(), Some(&admission));
}

/// Falsifier 6's sharp half at the proof door: a joiner's coordinate in
/// a generation before its admission refuses, because bootstrap proves
/// each retained entry against the roster of that entry's own
/// generation.
#[test]
fn a_joiners_dots_before_its_admission_refuse_at_bootstrap() {
    let (mut fleet, base, _) = founded();
    let founding_bytes =
        SealRecord::from_sealed(fleet[0].newest_sealed().expect("sealed")).to_bytes();
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let widening = SealRecord::from_sealed(fleet[0].try_seal(&risen).expect("seals"));
    // Rewrite the founding record's join entry for station 2 into one
    // for the joiner: inside the final roster, ascending, and exactly one
    // generation too early.
    let entry: Vec<u8> = 2u32
        .to_be_bytes()
        .iter()
        .chain(5u64.to_be_bytes().iter())
        .copied()
        .collect();
    let at = founding_bytes
        .windows(entry.len())
        .rposition(|window| window == entry)
        .expect("the founding join carries station 2 at counter 5");
    let mut crafted = founding_bytes;
    crafted[at..at + 4].copy_from_slice(&JOINER.to_be_bytes());
    let founding = SealRecord::from_bytes(&crafted).expect("structurally canonical");
    let proof = LineageProofRecord::try_new(alloc::vec![
        LineageProofEntry::new(founding, [0u8; 32]),
        LineageProofEntry::new(widening, [0u8; 32]),
    ])
    .expect("two entries");
    assert!(matches!(
        Epochs::bootstrap(ROSTER, horizon(), &proof),
        Err(crate::metis::EpochBootstrapError::ForeignStation {
            generation: 1,
            station: JOINER,
        })
    ));
}

/// The review gate's fourteenth round: the oldest roster is the caller's
/// independent ground, never derived by subtracting the proof's own
/// admissions --- so a crafted proof that "admits" a founding member
/// refuses as already present instead of rewriting membership history.
#[test]
fn a_founding_member_cannot_be_re_admitted_by_a_crafted_proof() {
    let (mut fleet, base, _) = founded();
    let founding_record = SealRecord::from_sealed(fleet[0].newest_sealed().expect("sealed"));
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let bytes = SealRecord::from_sealed(fleet[0].try_seal(&risen).expect("seals")).to_bytes();
    // Rewrite the widening record's joiner into founding member 2: the
    // admission's last joiner spelling sits right before the trailing
    // 32-byte commitment.
    let pattern = JOINER.to_be_bytes();
    let at = bytes
        .windows(4)
        .rposition(|window| window == pattern)
        .expect("the joiner is spelled in the admission section");
    let mut crafted = bytes;
    crafted[at..at + 4].copy_from_slice(&2u32.to_be_bytes());
    let widening = SealRecord::from_bytes(&crafted).expect("structurally canonical");
    let proof = LineageProofRecord::try_new(alloc::vec![
        LineageProofEntry::new(founding_record, [0u8; 32]),
        LineageProofEntry::new(widening, [0u8; 32]),
    ])
    .expect("two entries");
    assert!(matches!(
        Epochs::bootstrap(ROSTER, horizon(), &proof),
        Err(crate::metis::EpochBootstrapError::AdmissionAlreadyMember {
            generation: 2,
            station: 2,
        })
    ));
}

/// The concord's stronger reading (PRD 0028 R7, forced in review): the
/// round agrees the record commitment beside the boundary, so an
/// endorsement over the same base and joiners but another commitment ---
/// a forked record under one winner, which the address concord cannot
/// see --- refuses as discord at both doors.
#[test]
fn a_commitment_discord_is_fork_evidence_the_address_cannot_see() {
    let (mut fleet, base, stability) = founded();
    let endorsement = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("the round opens");
    assert_eq!(
        fleet[0].open_arrival(boundary(base), [9u8; 32], 1, &stability),
        Err(ArrivalRefusal::CommitmentDiscord { base })
    );
    let forked = fleet[1]
        .open_arrival(boundary(base), [9u8; 32], 2, &stability)
        .expect("the forked peer's round opens at its own machine");
    assert_eq!(
        fleet[0].fold_endorsement(&Vouched::trust(2, forked), &stability),
        Err(ArrivalRefusal::CommitmentDiscord { base })
    );
    assert!(
        !fleet[0].arrival().expect("held").complete(),
        "discord latches nothing"
    );
    let _ = endorsement;
    // And the concord travels with the winner: a tag minted under the
    // forked commitment is refused at the honest adopt door, so a forked
    // predecessor under one address cannot feed a recorded admission.
    let mut liar = fleet[1].clone();
    let e = liar
        .open_arrival(boundary(base), [9u8; 32], 2, &stability)
        .expect("the liar's round opens");
    liar.fold_endorsement(&Vouched::trust(1, e), &stability)
        .expect("the forged endorsement folds");
    let reported = cut(&[(1, 5), (2, 5)]);
    let forked_tag = liar
        .declare(d(2, 6), Kairos::new(6, 0, 2, 0u16), &stability, &reported)
        .expect("tags under the forked commitment");
    fleet[0]
        .deliver(forked_tag, &stability, &reported)
        .expect("agreed inputs validate");
    let winner = EpochAddress::try_from_parts(base.generation() + 1, (2, 6)).expect("valid");
    let delivered = cut(&[(1, 5), (2, 6)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    assert_eq!(
        fleet[0].adopt(1, 5, &risen),
        Err(EpochRefusal::UnassentedAdmission { winner }),
        "the assent compares the commitment too"
    );
}

/// The joiner ceiling is its own knob (the review gate's tenth round): a
/// tight joiner budget refuses a wide admission even with candidates in
/// budget, and the ceiling never couples back to the candidate one.
#[test]
fn the_joiner_ceiling_is_independent_and_bounds_the_decoder() {
    let (mut fleet, base, _) = founded();
    let admission = Admission::new(base, [3, 4]).expect("two joiners");
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let e = fleet[0]
        .open_arrival(admission, COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let bytes = SealRecord::from_sealed(fleet[0].try_seal(&risen).expect("seals")).to_bytes();
    assert!(matches!(
        SealRecord::from_bytes_with_budget(
            &bytes,
            crate::metis::SealDecodeBudget::new(1).with_max_joiners(1),
        ),
        Err(crate::metis::SealDecodeError::TooManyJoiners {
            count: 2,
            budget: 1
        })
    ));
    assert!(
        SealRecord::from_bytes_with_budget(&bytes, crate::metis::SealDecodeBudget::new(1)).is_ok(),
        "the default ceiling admits legitimate growth under a tight candidate budget"
    );
}

/// The proof frame versions by content too (the review gate's eleventh
/// round): an admission-bearing proof never begins with `0x01`, its
/// serialized form round-trips, a nominally version-1 proof embedding a
/// version-2 seal refuses, and a version-2 proof without admissions is
/// non-canonical.
#[test]
fn a_heterogeneous_proof_spells_version_two_and_round_trips() {
    let (mut fleet, base, _) = founded();
    let founding = SealRecord::from_sealed(fleet[0].newest_sealed().expect("sealed"));
    let reported = cut(&[(1, 5), (2, 5)]);
    let stability = tracker(&ROSTER, &reported);
    let e = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, e), &stability)
        .expect("completes");
    let declaration = fleet[0]
        .declare(d(1, 6), Kairos::new(6, 0, 1, 0u16), &stability, &reported)
        .expect("tags");
    let winner = declaration.address();
    let delivered = cut(&[(1, 6), (2, 5)]);
    let risen = tracker(&ROSTER, &delivered);
    for &station in &ROSTER {
        fleet[0]
            .confirm(winner, &Vouched::trust(station, delivered.clone()))
            .expect("confirms");
    }
    let _ = fleet[0].adopt(1, 6, &risen).expect("adopts");
    fleet[0]
        .adopt_report(winner, &Vouched::trust(2, 5))
        .expect("peer adoption");
    let widening = SealRecord::from_sealed(fleet[0].try_seal(&risen).expect("seals"));
    let proof = LineageProofRecord::try_new(alloc::vec![
        LineageProofEntry::new(founding.clone(), [0u8; 32]),
        LineageProofEntry::new(widening, [0u8; 32]),
    ])
    .expect("two entries");
    let bytes = proof.to_bytes();
    assert_eq!(bytes[0], 0x02, "an admission-bearing proof is version 2");
    assert_eq!(bytes.len(), proof.encoded_len());
    assert_eq!(
        LineageProofRecord::from_bytes(&bytes).expect("round-trips"),
        proof
    );
    // A nominally version-1 spelling of the same body refuses at the
    // embedded version-2 seal: the frozen v1 contract embeds only v1.
    let mut downgraded = bytes;
    downgraded[0] = 0x01;
    assert!(matches!(
        LineageProofRecord::from_bytes(&downgraded),
        Err(crate::metis::LineageProofDecodeError::AdmissionInVersionOne { generation: 2 })
    ));
    // And a version-2 spelling of an admissionless proof is
    // non-canonical.
    let plain =
        LineageProofRecord::try_new(alloc::vec![LineageProofEntry::new(founding, [0u8; 32])])
            .expect("one entry");
    let mut upgraded = plain.to_bytes();
    assert_eq!(upgraded[0], 0x01);
    upgraded[0] = 0x02;
    assert!(matches!(
        LineageProofRecord::from_bytes(&upgraded),
        Err(crate::metis::LineageProofDecodeError::VersionTwoWithoutAdmissions)
    ));
}

/// An endorsement travels as its parts (the review gate's fifteenth
/// round): a remote receiver rebuilds it with
/// [`Endorsement::from_parts`] from the transported boundary and
/// commitment, the caller's transport authenticates the speaker, and
/// the rebuilt claim folds and completes the round exactly as the
/// minted original.
#[test]
fn an_endorsement_travels_as_its_parts() {
    let (mut fleet, base, stability) = founded();
    let minted = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("the peer endorses at its own machine");
    let _ = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    // The wire carries (boundary, commitment); the receiver rebuilds.
    let rebuilt =
        crate::metis::Endorsement::from_parts(minted.admission().clone(), *minted.commitment());
    assert_eq!(rebuilt, minted);
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, rebuilt), &stability)
        .expect("the rebuilt claim folds");
    assert!(fleet[0].arrival().expect("held").complete());
}

/// The endorsement frame closes the transport loop (S346; PRD 0028 R7,
/// sequencing step six): the claim a machine mints travels as its
/// canonical bytes, the receiver decodes the identical claim, binds it
/// to the envelope's authenticated speaker, and the round completes ---
/// no hand-carried parts anywhere on the path.
#[test]
fn an_endorsement_travels_as_its_wire_frame() {
    let (mut fleet, base, stability) = founded();
    let minted = fleet[1]
        .open_arrival(boundary(base), COMMIT, 2, &stability)
        .expect("the peer endorses at its own machine");
    let _ = fleet[0]
        .open_arrival(boundary(base), COMMIT, 1, &stability)
        .expect("opens");
    let frame = minted.to_bytes();
    assert_eq!(minted.encoded_len(), frame.len());
    let decoded = crate::metis::Endorsement::from_bytes(&frame).expect("the frame decodes");
    assert_eq!(decoded, minted);
    fleet[0]
        .fold_endorsement(&Vouched::trust(2, decoded), &stability)
        .expect("the decoded claim folds");
    assert!(fleet[0].arrival().expect("held").complete());
}