carlos / platform Public

rollout sim: comments for M15's witness and the rewake draw

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 305cd54798316f1573ba390e29c59954f4e4db1f parent f1c2582

2 files changed, +9 −7

diff --git a/internal/rollout/sim_test.go b/internal/rollout/sim_test.go

index b2c9435b9..995290fc0 100644

--- a/internal/rollout/sim_test.go

+++ b/internal/rollout/sim_test.go

@@ -397,9 +397,9 @@ type sim struct {

fr *rand.Rand

// The crash-epoch hard limit (I9, I10), on the seeds whose book is on

- // disk. gr draws the grants, their deliveries, the agent restarts and

- // the box rebuilds, apart from r and fr. cancel ends the running agent's

- // Manager (its ack writer).

+ // disk. gr draws the grants, their deliveries, the agent restarts, the

+ // box rebuilds and the rewakes (rewakeArm), apart from r and fr. cancel

+ // ends the running agent's Manager (its ack writer).

gr *rand.Rand

cancel context.CancelFunc

// grants are the signed host retries the console issued, oldest first,

diff --git a/internal/rollout/testdata/rolloutsim/mutate.sh b/internal/rollout/testdata/rolloutsim/mutate.sh

index 3fbda0f60..16c0173c1 100755

--- a/internal/rollout/testdata/rolloutsim/mutate.sh

+++ b/internal/rollout/testdata/rolloutsim/mutate.sh

@@ -114,10 +114,12 @@ TIMEOUT_MIN=$((SEEDS * 3 / 100 + 20))

# catches nothing: the pointer's clear, ClearHoldRanOnPointer, moves

# the generation on its own line.)

# M15 the reopen's seq keeps only the file's own seq, halved: I9. The

-# reopened book hands out again generations it had published, so a

-# grant issued before the restart matches a restriction a failure

-# after it made (reused numbers; the saved generations and markers

-# that would have repaired the max are not read).

+# max over the saved generations and markers (highestSaved), which

+# would repair a lowered seq, is not taken, so the reopened book

+# hands out again generations it had published (each restart halves

+# it again), and a grant issued before a restart, still pending,

+# matches a restriction that a failure after it made, typically an

+# intent the restart reconciled.

# M16 RetryHostAt skips the book-identity comparison: I9. A box rebuild

# opens a new book whose generations start again from one, so a

# grant for the old book, still pending, matches a restriction the