dnsruby 1.74.0 → 2.0.0

data/test/tc_review_cache.rb

@@ -0,0 +1,163 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'timeout'
+
+class ReviewCacheTest < Minitest::Test
+  def setup
+    @now = Time.utc(2026, 11, 14, 12)
+    @cache = Dnsruby::Cache.new
+  end
+
+  def test_wire_snapshot_is_independent_of_source_and_returned_messages
+    response = answer
+    response.header.aa = true
+    response.security_level = Dnsruby::Message::SecurityLevel.SECURE
+    Time.stub(:now, @now) do
+      @cache.add(response)
+      response.answer.first.address = '192.0.2.2'
+      found = @cache.find('cache.example.', 'A')
+      assert_equal('192.0.2.1', found.answer.first.address.to_s)
+      assert(found.cached)
+      refute(found.header.aa)
+      assert_equal(Dnsruby::Message::SecurityLevel.UNCHECKED, found.security_level)
+      found.answer.first.address = '192.0.2.3'
+      found.answer.first.ttl = 0
+      again = @cache.find('cache.example.', 'A')
+      assert_equal('192.0.2.1', again.answer.first.address.to_s)
+      assert_equal(300, again.answer.first.ttl)
+    end
+  end
+
+  def test_cache_reads_do_not_reencode_messages
+    response = answer
+    Time.stub(:now, @now) do
+      @cache.add(response)
+      # The stored form is already wire data. Only the returned copy is decoded.
+      encodings = 0
+      caller_thread = Thread.current
+      trace = TracePoint.new(:call) do |event|
+        encodings += 1 if Thread.current == caller_thread &&
+          event.defined_class == Dnsruby::Message && event.method_id == :encode
+      end
+      trace.enable do
+        assert_equal('192.0.2.1', @cache.find('cache.example.', 'A').answer.first.address.to_s)
+      end
+      assert_equal(0, encodings)
+    end
+  end
+
+  def test_decoding_does_not_hold_the_cache_mutex
+    @cache.add(answer)
+    data = @cache.cache.values.first
+    original = data.method(:message)
+    started, resume = Queue.new, Queue.new
+    data.define_singleton_method(:message) do
+      started << true
+      resume.pop
+      original.call
+    end
+    reader = Thread.new { @cache.find('cache.example.', 'A') }
+    Timeout.timeout(5) do
+      started.pop
+      @cache.add(answer('other.example.'))
+      refute_nil(@cache.find('other.example.', 'A'))
+    end
+  ensure
+    resume << true if resume
+    reader&.join(5)
+    reader&.kill if reader&.alive?
+  end
+
+  def test_authenticated_deadlines_survive_storage_delay_and_reinsertion
+    response = answer
+    record = response.answer.first
+    record.instance_variable_set(:@dnsruby_authenticated_expiration, @now.to_i + 7)
+    clean = Dnsruby::RR.create(record.to_s)
+    assert_equal(clean, record)
+    assert_equal(clean.hash, record.hash)
+    Time.stub(:now, @now + 3) { @cache.add(response) }
+    Time.stub(:now, @now + 5) do
+      found = @cache.find('cache.example.', 'A')
+      assert_equal(2, found.answer.first.ttl)
+      assert_equal(@now.to_i + 7,
+        found.answer.first.instance_variable_get(:@dnsruby_authenticated_expiration))
+      @cache.add(found)
+    end
+    Time.stub(:now, @now + 7) { assert_nil(@cache.find('cache.example.', 'A')) }
+  end
+
+  def test_expiry_during_decode_does_not_remove_a_newer_entry
+    clock = @now
+    Time.stub(:now, -> { clock }) do
+      @cache.add(answer)
+      data = @cache.cache.values.first
+      original = data.method(:message)
+      cache = @cache
+      replacement = answer
+      data.define_singleton_method(:message) do
+        result = original.call
+        clock += 300
+        cache.add(replacement)
+        result
+      end
+      assert_nil(@cache.find('cache.example.', 'A'))
+      assert_equal(300, @cache.find('cache.example.', 'A').answer.first.ttl)
+    end
+  end
+
+  def test_decoded_response_ttl_runs_from_receipt_even_when_storage_is_delayed
+    response = answer
+    response.answer.first.ttl = 10
+    decoded = Time.stub(:now, @now) { Dnsruby::Message.decode(response.encode) }
+    Time.stub(:now, @now + 4) { @cache.add(decoded) }
+    Time.stub(:now, @now + 7) do
+      assert_equal(3, @cache.find('cache.example.', 'A').answer.first.ttl)
+    end
+    Time.stub(:now, @now + 10) { assert_nil(@cache.find('cache.example.', 'A')) }
+  end
+
+  def test_message_and_record_clones_preserve_absolute_lifetime_bounds
+    response = Time.stub(:now, @now) { Dnsruby::Message.decode(answer.encode) }
+    response.answer.first.instance_variable_set(:@dnsruby_authenticated_expiration, @now.to_i + 7)
+    Time.stub(:now, @now + 3) do
+      [response.clone.answer.first, response.answer.first.clone].each do |record|
+        assert_equal(@now.to_i, record.instance_variable_get(:@dnsruby_received_at))
+        assert_equal(@now.to_i + 7, record.instance_variable_get(:@dnsruby_authenticated_expiration))
+      end
+      @cache.add(response.clone)
+    end
+    Time.stub(:now, @now + 7) { assert_nil(@cache.find('cache.example.', 'A')) }
+  end
+
+  def test_opt_flags_are_not_aged_as_a_ttl
+    response = answer
+    opt = Dnsruby::RR::OPT.new(1232, 32768)
+    opt.name = '.'
+    response.add_additional(opt)
+    Time.stub(:now, @now) { @cache.add(response) }
+    Time.stub(:now, @now + 5) do
+      found = @cache.find('cache.example.', 'A')
+      assert_equal(295, found.answer.first.ttl)
+      assert_equal(response.get_opt.ttl, found.get_opt.ttl)
+    end
+  end
+
+  def test_successful_message_decoding_does_not_generate_a_query_id
+    response = answer
+    response.header.id = 4321
+    wire = response.encode
+    SecureRandom.stub(:random_number, ->(*) { flunk('Decoding allocated a random query ID') }) do
+      decoded = Dnsruby::Message.decode(wire)
+      assert_equal(4321, decoded.header.id)
+      assert_equal('192.0.2.1', decoded.answer.first.address.to_s)
+    end
+  end
+
+  private
+
+  def answer(name = 'cache.example.')
+    Dnsruby::Message.new(name, 'A').tap do |message|
+      message.add_answer(Dnsruby::RR.create("#{name} 300 IN A 192.0.2.1"))
+    end
+  end
+end

data/test/tc_review_code_mapper.rb

@@ -0,0 +1,279 @@
+require_relative 'spec_helper'
+require 'timeout'
+
+class TestReviewCodeMapper < Minitest::Test
+  def setup
+    @mapper = Class.new(Dnsruby::CodeMapper)
+    @mapper.const_set(:ONE, 1)
+    @mapper.const_set(:TWO, 2)
+    @mapper.update
+  end
+
+  def teardown
+    Dnsruby::CodeMapper.class_variable_get(:@@arrays).delete(@mapper)
+  end
+
+  def maps
+    Dnsruby::CodeMapper.class_variable_get(:@@arrays).fetch(@mapper)
+  end
+
+  def test_new_numeric_mappings_do_not_rebuild_existing_reverse_index
+    # Count table traversals instead of depending on machine speed.
+    inversions = 0
+    maps.strings.define_singleton_method(:invert) do
+      inversions += 1
+      super()
+    end
+    100.times { |i| @mapper.add_pair("TYPE#{i + 1000}", i + 1000) }
+    assert_equal(0, inversions)
+    assert_equal('TYPE1099', @mapper.new(1099).to_s)
+  end
+
+  def test_unknown_enum_code_is_registered_only_in_its_own_mapping
+    original_class_name = Dnsruby::Classes.to_string(254)
+    value = @mapper.new(254)
+    assert_equal(254, value.code)
+    assert_equal('254', value.to_s)
+    assert_equal('254', @mapper.new(254).to_s)
+    assert_equal(original_class_name, Dnsruby::Classes.to_string(254))
+    assert_equal('NONE', Dnsruby::Classes.new(Dnsruby::Classes::NONE).to_s)
+  end
+
+  def test_aliases_reassignment_case_and_setters_preserve_hash_invert_semantics
+    strings = maps.strings.dup
+    stringsdown = maps.stringsdown.dup
+    size = maps.maxcode
+    [['new', 3], ['alias', 3], ['new', 4], ['alias', 5], ['ONE', 5],
+     ['ONE', 5], ['ALIAS', 6], ['Mixed-Name', 7]].each do |name, code|
+      strings[name] = code
+      stringsdown[name.downcase] = code
+      assert_equal(size += 1, @mapper.add_pair(name, code))
+      assert_equal(strings, maps.strings)
+      assert_equal(strings.invert, maps.values)
+      assert_equal(stringsdown, maps.stringsdown)
+    end
+    value = @mapper.new('mixed_name')
+    assert_equal(7, value.code)
+    value.set_string('oNe')
+    assert_equal([5, 'alias'], [value.code, value.string])
+    value.set_code(6)
+    assert_equal([6, 'ALIAS'], [value.code, value.string])
+    assert_equal(6, @mapper.to_code('alias'))
+    assert_equal('literal', @mapper.to_string('literal'))
+  end
+
+  def test_mutable_name_is_copied_and_frozen_name_keeps_identity
+    name = +'mutable'
+    @mapper.add_pair(name, 10)
+    name.replace('changed')
+    assert_equal('mutable', @mapper.to_string(10))
+    assert_predicate(@mapper.to_string(10), :frozen?)
+    assert_equal(10, @mapper.to_code('mutable'))
+    assert_nil(@mapper.to_code('changed'))
+    frozen = 'frozen'.freeze
+    @mapper.add_pair(frozen, 11)
+    assert_same(frozen, @mapper.to_string(11))
+  end
+
+  def test_custom_string_subclass_keeps_native_hash_behavior
+    name_class = Class.new(String) do
+      def dup
+        raise 'Hash does not call user-defined dup'
+      end
+    end
+    name = name_class.new('custom')
+    expected = {name => 12}.invert
+    @mapper.add_pair(name, 12)
+    name.replace('changed')
+    assert_equal(expected[12], @mapper.to_string(12))
+    assert_equal(expected[12].frozen?, @mapper.to_string(12).frozen?)
+  end
+
+  def test_mutable_custom_code_is_rehashed_on_subsequent_insert
+    # add_pair accepts values other than integers. Mutable keys must be
+    # rehashed on insertion, matching Hash#invert.
+    code = ['before']
+    @mapper.add_pair('custom', code)
+    code.replace(['after'])
+    @mapper.add_pair('numeric', 13)
+    assert_equal('custom', maps.values[['after']])
+    assert_equal(maps.strings.invert, maps.values)
+  end
+
+  def test_update_discards_dynamic_pairs_and_rebuilds_constants
+    @mapper.add_pair('extra', 3)
+    @mapper.const_set(:THREE, 3)
+    returned = @mapper.update
+    assert_equal(maps.strings.keys, returned)
+    assert_nil(@mapper.to_code('extra'))
+    assert_equal(3, @mapper.to_code('three'))
+    assert_equal('THREE', @mapper.to_string(3))
+    assert_equal(3, maps.maxcode)
+  end
+
+  def test_update_retains_registrations_from_constant_lookup_callbacks
+    @mapper.define_singleton_method(:const_get) do |name|
+      add_pair('FROM_CALLBACK', 20)
+      super(name)
+    end
+    @mapper.update
+    assert_equal(20, @mapper.to_code('FROM_CALLBACK'))
+    assert_equal('FROM_CALLBACK', @mapper.to_string(20))
+    assert_equal(1, @mapper.to_code('ONE'))
+    assert_equal(maps.strings.invert, maps.values)
+  end
+
+  def test_reentrant_custom_downcase_can_register_another_pair
+    mapper = @mapper
+    name = +'outer'
+    name.define_singleton_method(:downcase) do
+      mapper.add_pair('inner', 15)
+      super()
+    end
+    Timeout.timeout(2) { @mapper.add_pair(name, 14) }
+    assert_equal(14, @mapper.to_code('outer'))
+    assert_equal(15, @mapper.to_code('inner'))
+    assert_equal(maps.strings.invert, maps.values)
+    assert_equal(4, maps.maxcode)
+  end
+
+  def test_custom_downcase_can_wait_for_another_writer_thread
+    mapper = @mapper
+    name = +'outer'
+    name.define_singleton_method(:downcase) do
+      Thread.new { mapper.add_pair('inner', 15) }.value
+      super()
+    end
+    Timeout.timeout(2) { @mapper.add_pair(name, 14) }
+    assert_equal(14, @mapper.to_code('outer'))
+    assert_equal(15, @mapper.to_code('inner'))
+    assert_equal(maps.strings.invert, maps.values)
+  end
+
+  def test_overridden_frozen_query_does_not_change_string_key_copying
+    name = +'mutable'
+    name.define_singleton_method(:frozen?) { true }
+    @mapper.add_pair(name, 16)
+    name.replace('changed')
+    assert_equal('mutable', @mapper.to_string(16))
+    assert_predicate(@mapper.to_string(16), :frozen?)
+  end
+
+  def test_concurrent_aliases_keep_reverse_mapping_consistent
+    threads = 6.times.map do |worker|
+      Thread.new do
+        80.times { |i| @mapper.add_pair("NAME#{worker}-#{i}", 1000 + i) }
+      end
+    end
+    Timeout.timeout(5) { threads.each(&:value) }
+    assert_equal(maps.strings.invert, maps.values)
+    assert_equal(482, maps.maxcode)
+    6.times { |worker| assert_equal(1079, @mapper.to_code("NAME#{worker}-79")) }
+  ensure
+    threads&.each { |thread| thread.kill if thread.alive? }
+  end
+
+  def test_dns_type_and_class_construction_rejects_out_of_range_without_interning
+    [[Dnsruby::Types, 'TYPE'], [Dnsruby::Classes, 'CLASS']].each do |mapper, prefix|
+      table = Dnsruby::CodeMapper.class_variable_get(:@@arrays).fetch(mapper)
+      before = [table.strings.dup, table.stringsdown.dup, table.values.dup, table.maxcode]
+      [-1, 65_536, 65_538, 2**128].each do |code|
+        assert_raises(ArgumentError) { mapper.new(code) }
+        assert_raises(ArgumentError) { mapper.new("#{prefix}#{code}") }
+      end
+      100.times { |i| assert_raises(ArgumentError) { mapper.new("#{prefix}#{65_536 + i}") } }
+      ['', 'suffix', '.0', "\nignored"].each do |suffix|
+        # An empty suffix tests the bare TYPE or CLASS prefix.
+        text = suffix.empty? ? prefix : "#{prefix}123#{suffix}"
+        assert_raises(ArgumentError) { mapper.new(text) }
+      end
+      assert_equal(before, [table.strings, table.stringsdown, table.values, table.maxcode])
+    end
+  end
+
+  def test_dns_numeric_spelling_variants_do_not_grow_mapping_tables
+    [[Dnsruby::Types, 'TYPE'], [Dnsruby::Classes, 'CLASS']].each do |mapper, prefix|
+      code = 65_050
+      assert_equal(code, mapper.new(code).code)
+      table = Dnsruby::CodeMapper.class_variable_get(:@@arrays).fetch(mapper)
+      before = [table.strings.dup, table.stringsdown.dup, table.values.dup, table.maxcode]
+      100.times do |zeroes|
+        text = "#{prefix.downcase}#{'0' * zeroes}#{code}"
+        mapped = mapper.new(text)
+        expected = zeroes.zero? ? "#{prefix}#{code}" : text
+        assert_equal(code, mapped.code)
+        assert_equal(expected, mapped.to_s)
+        assert_equal(expected, mapper.new(mapped).to_s)
+      end
+      assert_equal(before, [table.strings, table.stringsdown, table.values, table.maxcode])
+      [0, 65_535].each { |boundary| assert_equal(boundary, mapper.new(boundary).code) }
+    end
+    assert_equal('TYPE0001', Dnsruby::Types.new('TYPE0001').to_s)
+    assert_equal('CLASS0001', Dnsruby::Classes.new('CLASS0001').to_s)
+    assert_equal('A', Dnsruby::Types.new(1).to_s)
+    assert_equal('IN', Dnsruby::Classes.new(1).to_s)
+  end
+
+  def test_dns_code_helpers_validate_range_and_numeric_strings
+    [[Dnsruby::Types, 'TYPE', :typesbyname, :typesbyval],
+     [Dnsruby::Classes, 'CLASS', :classesbyname, :classesbyval]].each do |mapper, prefix, byname, byval|
+      assert_equal(1, mapper.public_send(byname, "#{prefix}0001"))
+      assert_equal(mapper.to_string(1), mapper.public_send(byval, ' 0001 '))
+      [-1, 65_536, 2**128].each do |code|
+        assert_raises(ArgumentError) { mapper.public_send(byval, code) }
+        assert_raises(ArgumentError) { mapper.public_send(byval, code.to_s) }
+        assert_raises(ArgumentError) { mapper.public_send(byname, "#{prefix}#{code}") }
+      end
+    end
+    error = assert_raises(ArgumentError) { Dnsruby::RR.create('x. IN TYPE65536 \\# 0') }
+    assert_match(/0\.\.65535/, error.message)
+    error = assert_raises(ArgumentError) { Dnsruby::RR.create('x. CLASS65536 TYPE65000 \\# 0') }
+    assert_match(/0\.\.65535/, error.message)
+  end
+
+  def test_copying_a_mutated_dns_mapper_still_validates_the_wire_range
+    [Dnsruby::Types, Dnsruby::Classes].each do |mapper|
+      value = mapper.new(1)
+      value.code = 65_536
+      assert_raises(ArgumentError) { mapper.new(value) }
+    end
+    # Custom CodeMapper subclasses can accept values outside the DNS
+    # type/class range.
+    @mapper.add_pair('LARGE', 2**32)
+    @mapper.add_pair('NEGATIVE', -1)
+    assert_equal(2**32, @mapper.new('LARGE').code)
+    assert_equal(-1, @mapper.new('NEGATIVE').code)
+  end
+
+  def test_dns_mappers_preserve_explicit_application_aliases
+    arrays = Dnsruby::CodeMapper.class_variable_get(:@@arrays)
+    [[Dnsruby::Types, 'TYPE'], [Dnsruby::Classes, 'CLASS']].each do |mapper, prefix|
+      original = arrays.fetch(mapper)
+      replacement = Dnsruby::CodeMapper::Arrays.new
+      %i[strings stringsdown values].each do |field|
+        replacement.public_send("#{field}=", original.public_send(field).dup)
+      end
+      replacement.maxcode = original.maxcode
+      replacement.incremental = original.incremental
+      arrays[mapper] = replacement
+      begin
+        existing = mapper.new(1)
+        mapper.add_pair('PREFERRED-ONE-ALIAS', 1)
+        assert_equal('PREFERRED-ONE-ALIAS', mapper.new(existing).to_s)
+        numeric_spelling = mapper.new("#{prefix}0001")
+        assert_equal("#{prefix}0001", mapper.new(numeric_spelling).to_s)
+        mapper.add_pair("#{prefix}0001", 1)
+        mapper.add_pair('LATEST-ONE-ALIAS', 1)
+        assert_equal('LATEST-ONE-ALIAS', mapper.new(numeric_spelling).to_s)
+        mapper.add_pair('APPLICATION-ALIAS', 65_052)
+        assert_equal(65_052, mapper.new('application_alias').code)
+        assert_equal("#{prefix}065052", mapper.new("#{prefix}065052").to_s)
+        assert_equal(65_052, mapper.to_code('APPLICATION-ALIAS'))
+        assert_equal('APPLICATION-ALIAS', mapper.new(65_052).to_s)
+        assert_nil(mapper.to_code("#{prefix}065052"), 'automatic spelling must not replace the explicit alias')
+      ensure
+        arrays[mapper] = original
+      end
+    end
+  end
+end

data/test/tc_review_control_deadlines.rb

@@ -0,0 +1,169 @@
+require_relative 'tc_pipeline_send'
+
+class ReviewControlDeadlinesTest < Minitest::Test
+  def test_validation_budget_interrupts_initial_connect_write_and_pipeline_wait
+    [:connect, :write, :pipeline].each do |stage|
+      [:deadline, :cancel].each do |reason|
+        isolated("stage = #{stage.inspect}; reason = #{reason.inspect}\n" + <<~'RUBY')
+          SELECTOR.singleton_class.remove_method(:notify_queue_observers)
+          resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false,
+            use_tcp: true, tcp_pipelining: stage == :pipeline, packet_timeout: 1,
+            query_timeout: 2, retry_times: 1, do_caching: false)
+          writer = resolver.single_resolvers.first
+          waiting, finished = Queue.new, Queue.new
+          sockets = []
+          Socket.define_singleton_method(:new) do |*|
+            socket = FrameSocket.new
+            sockets << socket
+            socket.define_singleton_method(:bind) { |*| 0 }
+            socket.define_singleton_method(:connect_nonblock) do |*, **|
+              waiting << true if stage == :connect
+              stage == :connect ? :wait_writable : 0
+            end
+            socket.define_singleton_method(:write_nonblock) do |*|
+              waiting << true
+              raise IO::EAGAINWaitWritable
+            end
+            socket
+          end
+          IO.define_singleton_method(:select) do |_, _, _, duration|
+            raise 'unbounded I/O wait' unless duration > 0 && duration <= 0.05
+            sleep(duration)
+            nil
+          end
+          pipeline_mutex = Mutex.new
+          if stage == :pipeline
+            pipeline_mutex.lock
+            writer.instance_variable_set(:@pipeline_mutex, pipeline_mutex)
+            original = writer.method(:send_dnsruby)
+            writer.define_singleton_method(:send_dnsruby) do |*args|
+              waiting << true
+              original.call(*args)
+            end
+          end
+          budget = Dnsruby::ValidationBudget.new(limits:
+            Dnsruby::Dnssec.validation_limits.merge(timeout: reason == :deadline ? 0.04 : 2))
+          started = Dnsruby::TransportClock.now
+          worker = Thread.new do
+            begin
+              Dnsruby::ValidationBudget.with(budget) do
+                resolver.query_no_validation_or_recursion('lookup.example.', 'A')
+              end
+              finished << :unexpected_success
+            rescue Dnsruby::ValidationLimitError => error
+              finished << error
+            end
+          end
+          Timeout.timeout(2) { waiting.pop }
+          budget.cancel if reason == :cancel
+          result = Timeout.timeout(0.5) { finished.pop }
+          worker.join
+          expected = reason == :cancel ? Dnsruby::ValidationCancelled : Dnsruby::ValidationLimitError
+          raise "wrong result: #{result.inspect}" unless result.instance_of?(expected)
+          elapsed = Dnsruby::TransportClock.now - started
+          raise "initial send ignored control: #{elapsed}" unless elapsed < 0.3
+          raise 'unconnected or blocked socket leaked' unless sockets.all?(&:closed?)
+          engine = resolver.instance_variable_get(:@resolver_ruby)
+          raise 'logical query leaked' unless engine.instance_variable_get(:@query_list).empty?
+          raise 'logical deadline leaked' unless engine.next_tick_at.nil?
+          raise 'packet attempt leaked' unless K.class_variable_get(:@@query_hash).empty?
+          raise 'observer leaked' unless K.class_variable_get(:@@observers).empty?
+          pipeline_mutex.unlock if stage == :pipeline
+          resolver.close
+        RUBY
+      end
+    end
+  end
+
+  def test_scheduled_and_protocol_retries_keep_the_original_control
+    isolated(<<~'RUBY')
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false,
+        packet_timeout: 10, query_timeout: 20, retry_times: 2)
+      writer = resolver.single_resolvers.first
+      sent = []
+      writer.define_singleton_method(:send_async) { |*| sent << Thread.current[:dnsruby_response_query] }
+      control = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + 1)
+      queue = Queue.new
+      Dnsruby::QueryControl.with(control) { resolver.send_async(query, queue, :controlled) }
+      engine = resolver.instance_variable_get(:@resolver_ruby)
+      plan = engine.instance_variable_get(:@timeouts)[:controlled][1]
+      attempt = plan.values.first
+      plan.clear
+      plan[Dnsruby::TransportClock.now - 1] = attempt
+      engine.send(:update_tick_deadline, :controlled)
+      engine.tick
+      raise 'scheduled retry lost its controlling lookup' unless sent.length == 2 &&
+        sent.all? { |settings| settings.send_token.control.equal?(control) && settings.endtime <= control.deadline }
+      previous = sent.last
+      previous.query_bytes = query.encode
+      writer.define_singleton_method(:send_dnsruby_with_socket) { |*| }
+      Thread.current[:dnsruby_response_query] = previous
+      writer.send_dnsruby(query.encode, query, previous.client_query_id, previous.client_queue, true)
+      Thread.current[:dnsruby_response_query] = nil
+      replacement = SELECTOR.query_settings_for_id(previous.client_query_id)
+      raise 'protocol retry extended the controlling deadline' unless replacement.endtime <= control.deadline
+      raise 'protocol retry lost cancellation' unless replacement.send_token.equal?(previous.send_token)
+      control.cancel
+      raise 'retry ignored parent cancellation' unless replacement.send_token.cancelled?
+      resolver.close
+    RUBY
+  end
+
+  def test_deadline_heap_matches_live_deadlines_without_retaining_removed_entries
+    deadlines = Dnsruby::DeadlineQueue.new
+    expected = {}
+    random = Random.new(73)
+    5_000.times do
+      key = random.rand(100)
+      if random.rand(3).zero?
+        assert(expected.delete(key) == deadlines.delete(key), "removed deadline for #{key}")
+      else
+        deadlines[key] = expected[key] = random.rand(1000)
+      end
+      assert(expected.values.min == deadlines.first_deadline, 'minimum live deadline')
+      assert_equal(expected.length, deadlines.instance_variable_get(:@heap).length)
+    end
+    expected.keys.each { |key| deadlines.delete(key) }
+    assert_nil(deadlines.first)
+    assert_empty(deadlines.instance_variable_get(:@positions))
+  end
+
+  def test_logical_deadline_index_tracks_retries_validation_cancellation_and_reset
+    isolated(<<~'RUBY')
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false,
+        retry_times: 3, retry_delay: 0.02, query_timeout: 0.5)
+      resolver.single_resolvers.each { |sender| sender.define_singleton_method(:send_async) { |*| } }
+      queues = [Queue.new, Queue.new]
+      queues.each_with_index { |queue, id| resolver.send_async(query, queue, id) }
+      engine = resolver.instance_variable_get(:@resolver_ruby)
+      check_minimum = -> do
+        all = engine.instance_variable_get(:@timeouts).values.flat_map { |deadline, retries, _| [deadline, *retries.keys] }
+        raise 'deadline index differs from live plans' unless engine.next_tick_at == all.min
+      end
+      check_minimum.call
+      sleep 0.025
+      engine.tick
+      check_minimum.call
+      resolver.single_res_mutex.synchronize do
+        current = engine.instance_variable_get(:@query_list)[0]
+        engine.begin_validation(0, current[3].first, current[2])
+      end
+      check_minimum.call
+      engine.cancel_query(1, queues[1])
+      check_minimum.call
+      resolver.close
+      check_minimum.call
+      engine.reset_attributes
+      check_minimum.call
+    RUBY
+  end
+
+  private
+
+  def isolated(code)
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, '-I', File.expand_path('../lib', __dir__),
+      '-e', TestPipelineSend::FIXTURE + code)
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end