Adaptive delivery evaluation contract

This protocol extends the small Mercator delivery fixtures. It is specified before running the changing-regime evaluation. A successful evaluation establishes an operating envelope, not universal robustness. Failed criteria remain reportable results; thresholds must not be relaxed after observing held-out outcomes.

Claims and acceptance criteria

The primary claim is that one unchanged Mercator configuration adapts to changes in connectivity and resource availability. The engine, queues and evidence stay alive across every phase. No experiment controller may select an engine mode, reset routing state or reveal the current phase to a routing engine.

The primary outcome is the fraction of offered messages accepted by the intended recipient before their application deadline. Rejected submissions count as failures. Eventual delivery, latency conditional on delivery, duplicate terminal deliveries, backlog, and per-source delivery are separate outcomes. Every offered message must have a resolved deadline before the run ends.

For the declared nominal envelope, the proposed acceptance gates are:

• At least 90% on-time delivery in stable connected phases.
• At least 80% on-time delivery across changing phases.
• The lower bound of the paired 95% confidence interval for on-time delivery improvement over the training-selected fixed baseline exceeds zero.
• Stable-connected on-time delivery is no more than five percentage points below that baseline, and attempted wire bytes per delivered application byte are no more than twice its cost. Zero-delivery denominators are undefined, never zero.
• Within two application deadlines after a recovery, the rolling deadline success rate returns to within five percentage points of its pre-disruption value. A run with insufficient recovery exposure is unassessed for this gate.
• No duplicate terminal delivery or configured payload-storage ceiling violation.

These are application targets chosen for this study, not physical guarantees. Stress points outside the nominal envelope deliberately test where they fail. Payload storage excludes allocator, collection and routing-evidence overhead; process resident memory must be measured separately in deployment experiments.

Workloads and separation of tuning from evaluation

Use continuous workloads with connected, interrupted, resource-constrained, recovered and rapidly alternating phases. Vary phase order and duration using explicit seeds. Include simultaneous bandwidth/storage/connectivity changes. Rotate host service order deterministically to avoid a permanent node-order advantage. All competing configurations receive identical exogenous scenarios.

Start with 8, 16 and 32 nodes, multiple senders, 128-byte messages and application deadlines of 32 rounds. Sweep per-directed-link budgets of 256, 1024 and 4096 bytes per round, retained payload budgets of 512, 4096 and 16384 bytes per node, and observation delays of 0, 2 and 8 rounds. Include asymmetric links, burst traffic, short contacts, permanent partitions and congested relays. Expand the size range only after profiling the measured implementation, without dropping failed cases.

Keep development seeds 101 through 116 separate from a fresh held-out reserve. The interrupted reserves listed below are development evidence and cannot be reused as held-out runs. Select fixed policies only using development outcomes. Freeze the selected policy and artifact/configuration hashes before evaluating held-out runs. Hold out whole topology/workload families as well as random seeds. Report paired per-run confidence intervals, not intervals that treat correlated messages as independent. Use a predeclared fixed sample count of 64 held-out runs per comparison initially; report interval width and unresolved conclusions rather than silently extending sampling until a favorable result appears.

Observations and resource accounting

The carrier/scorer knows ground truth. Engines receive only local contact information, local resource state, and observations exchanged through transports. Remote adjacency and remote storage cannot be copied from the global scenario. Local contact detection is an explicit lower-layer assumption and its limitations must be stated. Advertisements must be serialized, bounded, delayed, lost and reordered through the same carrier and capacity budget as payloads. Expired peer information must disappear; delayed older advertisements cannot resurrect it.

The changing-regime carrier serializes frames over multiple rounds using a four-frame FIFO per directed link. Link interruption discards partial frames. FIFO occupancy is separate from engine custody storage. Report physically serialized bytes separately from bytes submitted to the transport, since an attempt rejected at queue admission consumes no link capacity.

Count attempted control and payload frames, headers, acknowledgements, retries, dropped attempts and transmitted bytes. Report discovery overhead separately and in total. Do not label a transport-capacity model an energy measurement. Model energy only with explicit calibrated parameters, or leave it unmeasured.

Baselines and mechanism attribution

Compare adaptive Mercator with its connected-only and fixed-path ablations and a fixed policy selected on development scenarios. All share the same reliability implementation and budgets. Parameter tuning and behavior ablation are different comparisons: an adaptive configuration with fixed parameters is still adaptive.

Add actual terminal-delivery instrumentation for representative connected and deferred engines. Compare common application contracts, clearly identifying engine-native reliability and any shared application reliability layer. Never substitute route publication, simulator graph reachability or send acceptance for recipient delivery. Missing implementations remain unmeasured.

Failure search and scope

Search the parameter grid for missed deadlines, sustained backlog, route oscillation, unfairness, budget exhaustion and recovery failure. Save complete seed/configuration records for reproducible regression fixtures. Report failures alongside successes and retain an untouched held-out set after fixes.

This evaluation is simulation-only, as requested by the project author. Physical deployments and separate-process socket tests are outside its scope. Results establish behavior under the explicit simulated carrier, local contact detection and observation assumptions. They do not establish radio performance or deployed resource consumption. Volatile custody does not imply survival across restarts.

Required artifacts and completion evidence

• Versioned contract and configurations, training selection record and hashes.
• Raw per-message and per-round traces with phase, resource and observation data.
• Paired summaries, confidence intervals, contract pass/fail/unassessed results.
• Time-series figure comparing adaptation with the strongest fixed baseline.
• Failure boundary table and reproducible regression cases.
• Explicit simulation assumptions and limits on transfer to deployments.
• Updated routing analysis PDF and blog claims supported by those artifacts.

This document specifies required work. Its presence is not evidence that the experiments or acceptance gates have been completed.

Frozen study layout

The primary comparison equally weights six nominal cells: 8, 16 and 32 nodes in seed-generated ring-with-chords and two-cluster graphs. Nominal cells use 4096 wire bytes per directed link per round, 16384 retained payload bytes per node, and zero additional observation-processing delay. The two-cluster family is excluded from baseline selection. Both nominal families have informed protocol repairs on excluded reserves, so neither is an unseen topology family for algorithm development. The burst, cyclic-mobility and permanent-partition workload families remain absent from baseline selection and saved recovery-readiness replay. Each cell has 64 held-out seeds. The primary interval resamples seed clusters, retaining all six cells of each seed. Per-cell intervals and stress-grid intervals are exploratory comparisons.

Development evaluates eight fixed policies: connected-only or fixed-path mode, retry interval 1 or 2 ticks, and lifetime 32 or 64 ticks. Sixteen development seeds alternate 8/16 nodes and vary link capacity and observation delay. Maximum mean deadline success selects one policy, breaking ties by attempted wire bytes, then policy name. Adaptive Mercator keeps retry 2 and lifetime 64 throughout. Fixed-path and connected-only defaults remain mechanism ablations. Babel and Scatter are additional implementation comparisons, with their native reliability behavior explicitly reported. Babel’s host application adds destination framing, a hop limit and duplicate suppression, without custody or retries.

The full stress grid crosses all three sizes, link capacities, storage budgets and observation delay bases (81 cells). Adaptive and the selected fixed policy run on all 64 held-out seeds per cell. Additional paired 16-node workloads test bursts, cyclic changes in which devices are adjacent, and a partition that never recovers. Each held-out run retains its full message and round trace.

Hosts warm up for four rounds per node before the first workload phase. Six phases have seed-dependent lengths of 80 through 99 rounds. Interrupted and constrained phases exchange order; recovery follows both disruption and rapid alternation. Interruptions have six contact rounds in every 24-round period. Constrained phases combine quarter-capacity links, 10% loss, removal of some shortcuts and zero new-storage admission at every third relay. Alternating phases change directed cross-group contacts every three rounds. Burst trials offer eight messages every 32 rounds rather than two every eight rounds, keeping mean offered load constant. Every message is 128 bytes with a 32-round deadline.

The observation directory supplies static identities, endpoints and capabilities in advance. It contains no remote adjacency or live resource state. Local outgoing contacts are supplied by an assumed lower-layer detector. A bounded advertisement protocol exchanges remote adjacency and storage observations over the measured carrier. Processing delay is 0, 1 or 2 times the configured base, determined by origin identity. This induces delay and reordering, while packet loss and congestion also affect advertisements. The protocol has no adversarial authentication or autonomous discovery of previously unprovisioned identities.

Control next-hop changes are an oscillation diagnostic from installed forwarding snapshots, not a count of actual payload hops. Recovery gates use the first full deadline-wide creation cohort in each recovered phase and require its deadlines to resolve within two deadlines of the phase start. No offered cohort or insufficient observation time is unassessed. Native engine comparisons do not isolate reliability mechanisms; Mercator ablations provide that attribution.

The fifth reserve, seeds 5001 through 5064, is excluded development evidence. Execution stopped after diagnostic replay confirmed that the selected fixed-path baseline could leave accepted messages with an unbound initial path indefinitely, even while newer messages from the same sender were delivered. Its apparent comparison advantage cannot establish adaptive improvement. The frozen executable, manifest and partial recipient ledgers remain preserved in the fifth artifact run. At that checkpoint no final reserve was executing and no completed acceptance claim was made. The earlier interrupted pilot reserves are also excluded from final evidence. Seeds 1001 through 1064 exposed host-round error handling under outbound queue exhaustion. Seeds 2001 through 2064 exposed the node preset’s short default service lease: it expired at tick 128 and made Scatter reject later submissions. The fixture now guarantees that provisioned route services remain valid through the entire observation window. Preflight validation and late-trial admission tests enforce that assumption. Seeds 3001 through 3064 were excluded after an audit found that phase samples formed as hash(seed + counter) shared shifted inputs across neighboring seeds. The final generator encodes seed, domain and counter separately before hashing; carrier draws similarly include distinct fields and full node identities. These corrections concern the harness and declared service availability; no routing-policy parameter is selected using the interrupted reserves. The runtime and configuration are frozen afresh before executing the final reserve.

All final-study engines use 320 inbound and outbound host queue slots, matching the reference client’s combined-engine assembly. This keeps the host’s default single-engine 64-slot queue from unnecessarily constraining native control-plane bursts. Both limits are finite and identical across comparisons; queue metadata is excluded from the retained-payload metric. A separate regression reproduces the 64-slot backpressure failure and verifies recovery and ingress accounting.

Cross-policy traffic summaries use the common horizon ending at the final offered application deadline. Full-retention traces can differ in length because policy lifetimes differ, so their total traffic is exported separately. The prespecified primary delivery, stable-phase cost and recovery gates retain their definitions. Report generation recomputes outcomes from complete raw recipient ledgers and checks that cached primary outcomes agree, in addition to checking raw hashes.

The carrier models independent directed channels. Encoded protocol headers count in traffic; IP/MAC/PHY overhead, shared-medium interference and hardware CPU time do not. Local resource advertisements report the exogenous admission allowance available to the engine. They do not subtract that engine’s current occupancy; the engine separately checks its retained bytes when accepting each message. Thus this workload tests changing admission allowances and actual buffer backpressure, not a complete measurement of physical free RAM. Payload/reassembly ceilings exclude packet metadata, routing evidence, carrier queues and harness logs. These exclusions must remain explicit when interpreting resource bounds.

The frozen Mercator configuration keeps the default evidence and planning bounds across sizes: 16 neighbors, 8 candidate brokers, 16 service-evidence records, 8 corridor alternatives and 4 repair attempts. Only the declared delivery fields are overridden. Network growth does not automatically increase these budgets. The native engine comparisons concern these implementations and configurations, not optimization over every engine parameter. Diagnosing a failed sender still requires evidence beyond a difference in source success.

Development resumed before a full evaluation

The author stopped the fourth reserve (4001 through 4064) after early 32-node failures demonstrated missing service even before disruption. This interrupted reserve is now diagnostic development evidence, not a final held-out evaluation. The full matrix and automatic report generation were stopped. Development then repaired engine-owned route discovery and recovery using small reproducible cases before freezing a new executable and an untouched evaluation reserve. Acceptance thresholds are unchanged; no completed broad study is claimed.

The focused repair work adds engine-owned bounded route queries, expiring path replies, payload-size admission claims and compact payload framing. The 32-node seed 4001 case is a development regression: it requires at least 90% deadline success for the formerly starved sender in the initial connected and recovered cohorts. Passing that regression does not establish intermittent-contact or resource-scarcity targets. Those mechanisms require further small-case checks before any new full evaluation is scheduled.

The focused local-only suite in simulator/healing now exercises engine-owned queries and offers, bounded custody exploration, acknowledged returns, reconnect receipt replay, MTU fragmentation and shared ACK-clocked windows. Its eight six-node scenarios run on four development seeds. These mechanism regressions must pass before the interrupted broad evaluation is replaced by a new frozen study. They do not establish the larger-network operating contract by themselves.

A four-seed 32-node development preflight restored connected and recovered service but still exposed poor intermittent delivery, including no interrupted phase delivery from sender 1. This kept the full evaluation stopped during repair. A reduced intermittent-bridge case reproduces a related failure: blind custody exploration moves a message away from its recent recipient contact and misses the next opportunity. The engine now retains that opportunity while recipient acknowledgement evidence is fresh, without preventing known alternate paths. This evidence expires using the existing discovery validity bound. The reduced regression is a mechanism check. Repeating the same four 32-node development seeds increased interrupted-phase deadline success from 29 of 90 to 80 of 90, and alternating-phase success from 57 of 92 to 92 of 92. Connected success stayed at 93 of 94 and recovery stayed at 172 of 172. These paired diagnostics are not held-out estimates. Constrained-phase failures remained for the admission-aware diagnosis below. Raw ledgers and executable hashes are retained under the first two healing-readiness artifact runs.

Admission-aware scoring confirms that sender 16 has no connected custody path throughout the constrained phase in development seeds 4001, 4003 and 4004: every physical path crosses a relay refusing new custody. Seed 4002 retains an eight-hop admissible path. The round ledger records both physical reachability and reachability admitting one new 128-byte item at every receiving hop. The latter uses exogenous admission allowances and ignores current buffer occupancy, contact duration and serialization delay. It is a diagnostic upper opportunity, not a delivery guarantee or a temporal reachability test. Both projections are scorer-only and never enter engine observations.

The simulated hosts share an aligned logical Tick domain for packet, query and service lifetimes. Clock skew and independent lifetime epochs are outside this evaluation. This is an explicit operating assumption, not a demonstrated clock synchronization protocol.

The fifth reserve also exposed three failed adaptive recovery cohorts. Read-only pending-message traces reproduced the original recipient ledgers exactly and showed exhausted handoff budgets after avoidable detours. The repair prunes visited nodes before corridor ranking, limits planning to remaining handoffs and carries the actual selected path to the next custodian. Connected-only forwarding may use a valid carried path without waiting. Fixed-path forwarding binds its first path after deferred admission but does not replace a chosen path in flight. Focused regressions precede any new freeze. The carried end-to-end handoff limit and acceptance gates remain unchanged; the excluded reserve must not supply final comparison estimates.

The sixth reserve, seeds 6001 through 6064, is also excluded development evidence. A checkpoint found two failed recovery cohorts among the first 192 adaptive runs. Exact recipient-ledger replays showed one message repeatedly revisiting earlier failed branches because returned custody recreated its pending state without that history. Another exhausted its handoff allowance through unguided forwarding. Execution stopped before the full matrix completed. Its executable, complete manifest, partial ledgers and source archive remain preserved. At that checkpoint no held-out evaluation was running. Further repairs must pass focused regressions before a new independent reserve is frozen. Acceptance gates and the per-copy end-to-end handoff allowance remain unchanged.

Development repair readiness

The saved recovery failures are replayed before another held-out freeze. These replays diagnose and test implementation changes; they are not independent estimates of generalization. Their original executable and recipient-ledger hashes remain in the versioned failure fixtures. Each candidate replay records its own immutable executable, configuration and raw-ledger hashes separately.

Repairs retain failed-peer history across custody returns and distinguish an unacknowledged hop from a returned dead end. Fresh local willingness can reopen the former; the latter needs a fresh complete path that avoids visited ancestors and fits the remaining handoff allowance. A speculative recipient waits for a supported path or a new contact before another blind handoff. A parent receiving a return can explore an unfailed branch. Receiving a custody offer alone does not demonstrate progress toward the destination.

Acknowledging a newer custody generation now requires adopting its matching immutable message first. Fragmented newer copies must finish reassembly before a whole-message acknowledgement. This prevents a relay holding an older, returning copy from acknowledging a newer transfer without retaining that transfer. Failed-peer evidence survives generation adoption. Custody discovery demand ends when custody leaves; persistent explicit route requests retain their own maintenance behavior. Complete-path replies precede offers and query floods within the existing control budget.

The candidate preceding the broader replay passed both recovery cohorts in all eleven saved fixtures, without duplicate terminal delivery or a payload-storage ceiling violation. Its workspace tests, strict lint, formatting, five compiler policy suites and fast policy checks passed. The completed broader replay passed 192 of 194 recovery cases and retained the duplicate-delivery and storage invariants in all cases. Two additional two-cluster failures are now saved as development fixtures. Exact recipient-ledger replays show speculative relays returning custody despite an unvisited local branch. Repeated early returns can spend the handoff allowance or delay discovery past the application deadline. The next repair distinguishes a genuine dead end from a relay waiting to learn an onward path. No additional held-out execution has started.

The next reserve is seeds 7001 through 7064. An artifact-manifest audit found no prior execution manifests using those seeds. This allocation does not start an evaluation: the broader readiness replay and code checks must complete before selection, executable/source freezing and held-out execution. The six earlier reserves remain excluded development evidence. The sample count, matrix and acceptance gates remain unchanged.

Subsequent focused repairs separate the corridor search horizon from following a complete discovered path, start the return timer when a learned path requires an ancestor, and let intermediates answer queries using sufficiently fresh cached paths. Cached replies must cover the query’s lifetime and admission floor; they consume the existing transport budget and do not stop alternate flooding. The resulting candidate passes both recovery cohorts in all thirteen saved fixtures, with no duplicate terminal delivery or payload-storage violation. Fixed-path mode has the same initial discovered-path capability and rejects an initially unavailable cached first contact, without replacing a chosen path. A new complete 194-case development replay is underway. These focused results do not establish the full adaptive-delivery contract or replace the independent evaluation.

The later development replay also exposes a latency boundary. In a 32-node two-cluster run, a message created in round 584 obtains its first complete path in round 605 and arrives in round 617, one round beyond its application deadline. The exact recipient-ledger replay shows continued forwarding after discovery, with final-hop send-window delay. This case remains a saved failure, separate from custody-ownership defects. A further repair lets an unsent custody return use a newly learned onward path, while retaining any return already attempted. Neither change relaxes the recovery gate. The independent evaluation must still report a failed contract if any required gate fails; successful local ownership and storage checks alone cannot establish the nominal delivery target.

Historical protocol-1 evaluation (seeds 7001 through 7064)

The final development-readiness replay assessed 194 recovery cases. The frozen candidate passed 193, retaining the one-round latency failure described above. That known development boundary did not relax the independent acceptance gates. The subsequent independent study completed all 13,056 prespecified runs on seeds 7001 through 7064 after 128 development runs selected FixedPath-r2-t32. No cell or seed was dropped. The full audit verified every raw-ledger and configuration hash, the frozen executable and source archive, and all 64 seeds in each cell.

Across the six nominal cells, adaptive Mercator achieved 95.9% mean deadline success versus 94.2% for the selected fixed policy. The paired difference was 1.7 percentage points, with a 95% seed-cluster bootstrap interval of 1.4 to 2.0 points. Stable and changing-condition means were 99.7% and 91.9%. Stable wire cost per delivered application byte was about 0.4% above baseline.

The nominal recovery gate failed: 766 of 768 assessed windows passed. Exact recipient-ledger replays reproduced both failed windows, with three messages arriving four to eight rounds late. The messages remained retained and were eventually delivered; that outcome does not satisfy their deadlines. The full nominal contract is therefore not established. No terminal duplicate delivery or configured payload-storage violation occurred anywhere in the full study.

Exploratory comparisons expose additional limits. Adaptive deadline success was 87.6% versus 81.0% for messages created under nominal resource pressure, but 88.9% versus 90.6% during nominal contact gaps. In the resource grid, one 16-node case at 256 link bytes per round lost 12.7 percentage points against the fixed policy. Cyclic mobility favored adaptive delivery, 97.8% versus 82.6%, while bursts favored fixed delivery, 97.5% versus 96.7%. Permanent-partition aggregate success includes messages delivered before separation and does not establish delivery across an absent contact. These comparisons do not establish simultaneous superiority across all cells.

The report now includes the complete native-engine comparison, acceptance-gate table, prespecified execution timeline, 81-cell resource grid, and separate workload results. Its provenance distinguishes the archived runtime source from the later reporting source and binds the saved recovery replay audit. The report exporter and result validator require complete coverage and recompute results from raw recipient ledgers.

Common-service comparison (protocol 2)

The completed evaluation extends the native-delivery comparison to all seven engines. All 15,744 declared configurations completed on the frozen implementation. The earlier completed study remains historical evidence, including its failed recovery gate and contact-gap regression. Its outcomes may inform development repairs, but they are not independent evidence for those repairs. A partial execution of seeds 8001 through 8064 was excluded after 2,441 completed configurations exposed a Pathway clock defect: it ignored the host-owned current tick and rejected fresh relay leases using older observation time. The corrected engine consumes the host tick without refreshing evidence or extending lease windows. That interrupted batch is development evidence and cannot be resumed or reported as a held-out evaluation.

This evaluation uses seeds 9001 through 9064. An audit of 24,915 configured execution files and 2,917 experiment manifests found no prior use of that reserve. A regression requires actual multi-hop Pathway recipient delivery, in addition to lease-start and exclusive-end checks with an older observation.

Every engine receives the same application objective and host policy: best-effort connected service, permission to wait, link protection, identical finite host queues and the declared resource ceilings. Partition tolerance and repairability are not mandatory admission floors. This prevents the reference client’s engine-dependent default profiles from imposing incompatible requirements. Connected engines use the same bounded application relay and duplicate filter, without added acknowledgements or retries. Pathway’s native hexadecimal payload framing is decoded at application ingress; its full encoded wire length counts. Pathway’s host retention store has the same configured payload byte ceiling and reports its current and peak occupancy. Uninstrumented storage must not become a zero measurement.

The common service dimensions are:

• Deadline success among all offered messages, including rejected submissions.
• Worst-source deadline success, taking the minimum source fraction within each run, then equally weighting cells and seeds.
• Recovery to at least 90% deadline success for a complete deadline-wide creation cohort after each disruption. The cohort must resolve within the recovery phase; absent exposure is unassessed. Report the fraction reaching this target within two deadlines, recovery times and unrecovered observation windows.
• Actual serialized link bytes through the last application deadline per on-time recipient delivery. Sum traffic from failed runs too; a zero-delivery denominator is undefined. Attempted traffic remains a backpressure diagnostic.
• Peak engine-owned payload/reassembly buffer bytes per node and time to clear retained payload queues after workload admission ends. Clearance must persist through the observation tail. An uncleared queue is censored, and expiry is distinct from delivery.

All policies receive at least 64 rounds of post-workload observation. Control state, allocator overhead and carrier queues remain outside the payload-storage metric. These are independent directed simulated links, not radio energy or shared-medium measurements. Both nominal topology families and the workload families have now informed development, so fresh seeds do not establish unseen family generalization.

The declared matrix contains 15,744 held-out runs: six nominal cells with ten engine/mode variants (3,840 runs), the complete 81-cell adaptive/fixed resource grid (10,368 runs), and three behavior workloads with all seven engines plus the selected fixed policy (1,536 runs). Every cell has 64 seeds. The fixed policy is selected on the 128 development runs by maximum mean deadline success, breaking ties by actual serialized bytes per on-time delivery and then policy name. Nominal comparisons equally weight cells within each paired seed cluster. Per-cell and per-phase comparisons remain exploratory.

The prior Mercator acceptance gates remain in force, including recovery relative to its pre-disruption service and the attempted-wire overhead bound. The common 90% recovery measurement supplements that gate; it does not replace a failed criterion with an easier target. Candidate optimizations must pass focused mechanism and development checks before the executable, source and complete manifest are frozen. No full run starts merely because a candidate compiles.

Protocol-2 results and remaining boundaries

All 15,744 declared runs completed on seeds 9001 through 9064, with no missing cell or seed. Raw/configuration hashes and all cached summaries were checked against the frozen executable and source archive. All seven engines now have common deadline, worst-source, recovery, serialized-traffic and retained buffer/clearance measurements in the report and CSV exports.

Nominal adaptive deadline success is 96.4%, compared with 94.0% for the development-selected fixed policy. The paired seed-cluster difference is 2.3 percentage points, with a 95% interval of 2.0 to 2.6 points. Contact-gap success is 92.3% versus 89.9%. 768 of 768 original baseline-relative recovery windows pass; 8 of 8 prespecified nominal gates pass. These are finite-sample results within known topology/workload families.

A known development counterexample remains outside that independent seed sample. The frozen executable exactly reproduces two-cluster seed 5055’s saved ledger: message 116 is created at round 584, has deadline 616, and arrives at 617. Its second recovery criterion fails. The study’s known-boundary-audit.json binds the executable and raw ledger hashes. Fresh nominal passes do not establish uniform success for every seed in the nominal envelope.

Scatter’s zero worst-source success is measured terminal delivery, not missing instrumentation. Its positive default forwarding thresholds require an advantage in peer score, which uses storage allowance and relay headroom for non-recipient peers. Homogeneous resources give the distant sender no positive gradient; one shared transport also restricts dense-regime diversity. This exposes an assumption of that configured policy rather than a limit on every diffusion algorithm. The implementation and representative defaults, rather than an optimum over all engine parameters, define the comparison.

The lowest contrast in the resource grid is -8.3 percentage points in grid-n8-c256-s16384-d8. All 81 grid cells and all three additional workload families remain in the report. These exploratory contrasts do not establish simultaneous superiority across conditions. The report also binds the saved nominal recovery replay audit and distinguishes archived runtime source from later reporting changes. No runtime policy was tuned using the new reserve.