queen: simulation.t27 - the gate simulates the merged actor runtime (turn stop, fenced store link, restarts inside the TTL, stale pids) #8305

Follow-up of #8279 (merged as #8292). Part of gHashTag/trios#1712 (item 5).

Problem

Lanes 2, 3, 4, 6 and 7 of gHashTag/trios#1712 merged into actors-next after #8292: turns that really stop (turn_stop.t27, behind a flag), node incarnations and the fenced store link (netlink.t27), keyed actors. The simulation card still described the world before them:

• every seed ran the runtime without turn stop, so the flagged runtime was never simulated;
• node restarts were kept past the lease TTL, because a restart inside it was the pid-reuse defect; with incarnations, a restart inside the TTL is the case to search;
• the store model was a known-defect check against the old link; the new link reads, handles, then acknowledges, and should be held to the invariants as a gate;
• a mutant whose pids drop the incarnation passed every invariant: nobody in the simulated world kept a pid after its DOWN, so a reused pid was never addressed;
• performance.now was a counter detached from the virtual clock, while the new link reads it for its lease age.

Spec

specs/queen/simulation.t27:

• seed_features / has_feature: every second gate seed runs with FEATURE_TURN_STOP;
• STORE_SEEDS_PER_RUN 2: those seeds also run on the store model of the link;
• NODE_RESTART_MIN_SECONDS 2: restarts span both sides of the TTL;
• stale_job / STALE_JOB_EVERY 4 / STALE_PIDS_KEPT 64: one job in four goes to a remembered pid;
• RARE_REVIEW_STOPPED: a review stopped by its turn's abort must be reached;
• the clock: performance.now reads the virtual clock plus the drawn work.

Acceptance

• t27c test-report: no FAIL, no vacuous test; a negative control for each new rule.
• The trios gate (queen(actors): seeded deterministic simulation of the actor runtime as a CI gate trios#1721) passes on actors-next with it, and fails on the re-created defects.

User Scenarios

• Given the simulation spec defines seed features and store seeds, When a gate run executes, Then every second seed runs with FEATURE_TURN_STOP and two seeds per run exercise the fenced store link model.
• Given the simulation spec configures node restart timing and stale pid injection, When a simulation run spans the lease TTL boundary, Then restarts occur both inside and outside the TTL and one in four jobs targets a remembered stale pid.
• Given the simulation spec binds performance.now to the virtual clock plus drawn work, When the store link reads the clock for lease age, Then the read value reflects simulated time not a detached counter.

Requirements

• FR-001: seed_features / has_feature MUST assign FEATURE_TURN_STOP to every second gate seed.
• FR-002: STORE_SEEDS_PER_RUN MUST be set to 2 so those seeds also run the fenced store link model.
• FR-003: NODE_RESTART_MIN_SECONDS MUST be set to 2 so restarts span both sides of the lease TTL.
• FR-004: stale_job / STALE_JOB_EVERY 4 / STALE_PIDS_KEPT 64 MUST inject one stale-pid job in four and retain 64 stale pids.
• FR-005: RARE_REVIEW_STOPPED MUST ensure a review stopped by its turn's abort is reached during simulation.
• FR-006: performance.now MUST read the virtual clock plus the drawn work for the store link's lease age calculation.

Success Criteria

• t27c test-report on specs/queen/simulation.t27 exits 0 with no FAIL and no vacuous tests.
• Negative control tests for each new rule (turn-stop flag, store seeds, restart TTL span, stale pids, stopped review, virtual clock) are present and pass.
• The trios gate (queen(actors): seeded deterministic simulation of the actor runtime as a CI gate trios#1721) passes on actors-next with the updated simulation and fails when each defect is re-created individually.

Boundary

• specs/queen/simulation.t27