Routing proof waits out nginx's reload handoff and names who answered #8
2026-11-14
Pin the route handoff window, cadence, signer label and unchanged-route guard
The handoff loop reads its clock through a test-held virtual clock, so the window and poll cadence are asserted exactly and no host load moves them; the fails-at-once tests assert through stable_hits and the absence of sleeps. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Routing proof waits out nginx's reload handoff and names who answered
systemctl reload only signals nginx's master; old workers keep answering the stable listener until the new config is parsed and they are told to quit, so Idunn's first challenge could reach the incumbent and fail the attempt, rolling the fragment back. An answer naming the preflight's incumbent instance is now not-yet for 10 s (one challenge per 250 ms, never admitting, never actuating). Every failed proof now carries a RouteProofAnswer context: the runtime instance and activation signer ids the answer claimed (unauthenticated, ids only, 96 bytes each), so the journal line and abort last_error say who answered. Tests drive Routing through the stub runtime with incumbent-first, never-lets-go, foreign-activation and stranger replies. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>