@mark1russell7/kind 0.14.0 → 0.14.1

package/README.md

@@ -105,6 +105,12 @@ Each pod of a cluster shares the kernel of the Docker VM. Thus each stamp of the
 
 Before each run, the lab deletes the conntrack entries in SYN_SENT to the ClusterIP on each node (`forgetHandshakes`). A note of the run gives each count. Such an entry is a SYN with no answer, and it keeps its NAT for 120 s. A new SYN from the same port goes where the first one went, and it gets no answer either. The clients send requests between the runs too. Thus the restore of one run left such entries, and a client that took the port again in the next run timed out (T07, 2026-10-17).
 
+Before each run, the lab waits for a quiet VM (`quiet.ts`). It waits for no lab container of another agent, and for an idle share. The clients of the cell run at that time, and the agent of each node reads the conntrack table each second. Thus the idle share has the load of the cell in it, and a flat share voided a heavy cell with no other load (SYS-95). The gate reads the cell against itself:
+
+- **The baseline.** Before the first run of an environment, the lab waits until the cell is 120 s old, and it takes 3 samples. A baseline sample has no field `needed`. The baseline is the median of those samples, and the highest median of the environments holds, because a foreign load only lowers it.
+- **The share.** A run needs the baseline less the margin, between the floor and the flat share of 60%. Thus a cell at rest at 60% or more keeps its gate. A warm-up with no baseline needs only the floor. Each sample of the gate keeps its share in the field `needed`.
+- **The test of the gate.** A cell with `plannedLoad` starts a process in the loader after the baseline, and the process keeps that count of CPUs busy. The gate must refuse that run, and thus the run is void.
+
 ## The stacks
 
 From 0.2.0, a cell names its stack (`stack`): its server and its clients. A cell without a stack has the service.

package/build/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as factsOf, $n as DATAPLANES, $t as transitionOf, A as KindCellResult, An as KubeletProbe, At as failuresOf, B as upgradeCell, Bn as ReconnectsPrediction, Bt as restartOf, C as BandV1, Cn as Band, Ct as ZtunnelPodLine, D as FORMAT_V1, Dn as Flap, Dt as deletionOf, E as FORMAT, En as EdgeProtocol, Et as byNode, F as RunCheckV1, Fn as NonePrediction, Ft as periodOf, G as LAST_SLACK, Gn as Stack, Gt as signalsOf, H as KIND_NOISE, Hn as Reference, Ht as rulesOf, I as RunFactsV1, In as PermittedWindow, It as podsAt, J as RunCheck, Jn as TriggerKind, Jt as sliceReadyAt, K as Propagated, Kn as Template, Kt as sliceDropOf, L as TriggerV1, Ln as PodSettings, Lt as podsOf, M as KindVerdictV1, Mn as Mesh, Mt as isTunnelState, N as LoadSample, Nn as MeshFlavor, Nt as kernelCounts, O as KindCellRecord, On as KindCell, Ot as dropOf, P as PredictionV1, Pn as MeshMode, Pt as outcomesOf, Q as deletionsOf, Qn as Workload, Qt as stoppingOf, R as judge, Rn as Prediction, Rt as recordsOf, S as timeSpread, Sn as Backoff, St as TunnelLine, T as EnvironmentManifest, Tn as Declaration, Tt as byClients, U as KindDecision, Un as Replica, Ut as sessionsAt, V as Deleted, Vn as RedisDeclaration, Vt as restartsAt, W as KindVerdict, Wn as ResetReuse, Wt as signalOf, X as checkRun, Xn as VipSettings, Xt as slicesOf, Y as RunFacts, Yn as VipAnnouncerName, Yt as sliceReadyOf, Z as cyclesOf, Zn as WindowPrediction, Zt as socketsOf, _ as TimeSpread, _n as requestBand, _r as scenario, _t as RulesLine, a as judgeReconnects, an as LB_CLASS, ar as NODE_IMAGES, at as referenceOf, b as medianText, bn as showBand, bt as SocketLine, c as RELATIVE, cn as PORT, cr as ZONE_LABEL, ct as updatesOf, d as quantileOf, dn as VIP_ANNOTATION, dr as cidrRange, dt as Line, en as tunnelsOf, er as Dataplane, et as judgeKind, f as STAGES, fn as CountBand, fr as goDuration, ft as Period, g as Judged, gn as overshootBand, gr as nodeNames, gt as Request, h as readRecord, hn as drainBand, hr as kubeProxyPatch, ht as RecordLine, i as Try, in as HEALTH_PORT, ir as KubeProxyMode, it as propagationSource, j as KindCellV1, jn as MemberlistSettings, jt as intakeOf, k as KindCellRecordV1, kn as KindRun, kt as emptyOf, l as medianInterval, ln as REDIS, lr as ZONE_LOST, lt as Endpoint, m as kindCellRecordV1Schema, mn as bandOf, mr as kindConfig, mt as PropagationSource, n as Return, nn as ztunnelReplaced, nr as KindConfig, nt as observationEnd, o as latestReturn, on as LOG_LABEL, or as NodeImage, ot as reusesReset, p as kindCellRecordSchema, pn as backlogEnd, pr as isKubeProxyMode, pt as PodLine, q as ReconnectsFacts, qn as Trigger, qt as sliceEmptyOf, r as Schedule, rn as CLIENT, rr as KindScenario, rt as propagationOf, s as triesOf, sn as OUTSIDE, sr as ZONE_KEPT, st as unitOf, t as Reconnects, tn as ztunnelPodsOf, tr as KUBE_PROXY_MODES, tt as observationAfter, u as middle, un as SERVER, ur as cidrOverlap, ut as HBONE_PORT, v as calibrationOf, vn as seconds, vr as scenarioProblems, vt as Sessions, w as ClusterManifest, wn as Cycle, wt as backendsAt, x as predictionText, xn as BacklogTerm, xt as TCP_STATE, y as cellsTable, yn as secondsOf, yr as zoneOf, yt as SliceLine, z as upgrade, zn as PulsarSettings, zt as requestsOf } from "./judge-Cp3MzMk1.js";
+import { $ as factsOf, $n as DATAPLANES, $t as transitionOf, A as KindCellResult, An as KubeletProbe, At as failuresOf, B as upgradeCell, Bn as ReconnectsPrediction, Bt as restartOf, C as BandV1, Cn as Band, Ct as ZtunnelPodLine, D as FORMAT_V1, Dn as Flap, Dt as deletionOf, E as FORMAT, En as EdgeProtocol, Et as byNode, F as RunCheckV1, Fn as NonePrediction, Ft as periodOf, G as LAST_SLACK, Gn as Stack, Gt as signalsOf, H as KIND_NOISE, Hn as Reference, Ht as rulesOf, I as RunFactsV1, In as PermittedWindow, It as podsAt, J as RunCheck, Jn as TriggerKind, Jt as sliceReadyAt, K as Propagated, Kn as Template, Kt as sliceDropOf, L as TriggerV1, Ln as PodSettings, Lt as podsOf, M as KindVerdictV1, Mn as Mesh, Mt as isTunnelState, N as LoadSample, Nn as MeshFlavor, Nt as kernelCounts, O as KindCellRecord, On as KindCell, Ot as dropOf, P as PredictionV1, Pn as MeshMode, Pt as outcomesOf, Q as deletionsOf, Qn as Workload, Qt as stoppingOf, R as judge, Rn as Prediction, Rt as recordsOf, S as timeSpread, Sn as Backoff, St as TunnelLine, T as EnvironmentManifest, Tn as Declaration, Tt as byClients, U as KindDecision, Un as Replica, Ut as sessionsAt, V as Deleted, Vn as RedisDeclaration, Vt as restartsAt, W as KindVerdict, Wn as ResetReuse, Wt as signalOf, X as checkRun, Xn as VipSettings, Xt as slicesOf, Y as RunFacts, Yn as VipAnnouncerName, Yt as sliceReadyOf, Z as cyclesOf, Zn as WindowPrediction, Zt as socketsOf, _ as TimeSpread, _n as requestBand, _r as scenario, _t as RulesLine, a as judgeReconnects, an as LB_CLASS, ar as NODE_IMAGES, at as referenceOf, b as medianText, bn as showBand, bt as SocketLine, c as RELATIVE, cn as PORT, cr as ZONE_LABEL, ct as updatesOf, d as quantileOf, dn as VIP_ANNOTATION, dr as cidrRange, dt as Line, en as tunnelsOf, er as Dataplane, et as judgeKind, f as STAGES, fn as CountBand, fr as goDuration, ft as Period, g as Judged, gn as overshootBand, gr as nodeNames, gt as Request, h as readRecord, hn as drainBand, hr as kubeProxyPatch, ht as RecordLine, i as Try, in as HEALTH_PORT, ir as KubeProxyMode, it as propagationSource, j as KindCellV1, jn as MemberlistSettings, jt as intakeOf, k as KindCellRecordV1, kn as KindRun, kt as emptyOf, l as medianInterval, ln as REDIS, lr as ZONE_LOST, lt as Endpoint, m as kindCellRecordV1Schema, mn as bandOf, mr as kindConfig, mt as PropagationSource, n as Return, nn as ztunnelReplaced, nr as KindConfig, nt as observationEnd, o as latestReturn, on as LOG_LABEL, or as NodeImage, ot as reusesReset, p as kindCellRecordSchema, pn as backlogEnd, pr as isKubeProxyMode, pt as PodLine, q as ReconnectsFacts, qn as Trigger, qt as sliceEmptyOf, r as Schedule, rn as CLIENT, rr as KindScenario, rt as propagationOf, s as triesOf, sn as OUTSIDE, sr as ZONE_KEPT, st as unitOf, t as Reconnects, tn as ztunnelPodsOf, tr as KUBE_PROXY_MODES, tt as observationAfter, u as middle, un as SERVER, ur as cidrOverlap, ut as HBONE_PORT, v as calibrationOf, vn as seconds, vr as scenarioProblems, vt as Sessions, w as ClusterManifest, wn as Cycle, wt as backendsAt, x as predictionText, xn as BacklogTerm, xt as TCP_STATE, y as cellsTable, yn as secondsOf, yr as zoneOf, yt as SliceLine, z as upgrade, zn as PulsarSettings, zt as requestsOf } from "./judge-DLn2PLxb.js";
 import { Quantity } from "@mark1russell7/quantity";
 import { CheckFn, Coupling, Finding, HealthServer, Poll, Scenario, ServiceBuilder, ServiceDescription, Stage, StopWay, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { BuildImage } from "@mark1russell7/harness";
@@ -88,8 +88,12 @@ interface PinnedChart {
   readonly url: string;
   readonly sha256: string;
 }
-/** This function gives the path of a chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
-export declare const ensurePinnedChart: (chart: PinnedChart, cache?: string) => Promise<string>;
+/**
+ * This function gives the path of a chart in the cache, after a download when the cache does not have it.
+ * It refuses a download whose sha256 is not the pinned value. A file in the cache with a different
+ * sha256 (a torn write) is downloaded again, and each write replaces the file in one step.
+ */
+export declare const ensurePinnedChart: (chart: PinnedChart, cache?: string, get?: (url: string) => Promise<Uint8Array>) => Promise<string>;
 /**
  * This function installs a pinned chart in a cluster with the values `values`. It writes the values
  * to a file in the folder of the cluster. Helm waits for each workload of the chart, for up to 10 min.
@@ -381,7 +385,8 @@ export declare const DNS_PORT = 53;
 export declare const dnsCommands: (on: boolean) => string[][];
 /**
  * This function gives the commands of the injector that put a stateful middlebox in its network
- * namespace, with each peer, on the local port `port`. With `idle` null, they remove it.
+ * namespace, with each peer, on the local port `port`. With `idle` null, they remove the parts of these
+ * peers. A run removes what the table of the namespace holds (`middleboxRemoval`).
  *
  * The middlebox forgets a flow of the port after `idle` with no segment. Then it drops each later
  * segment of it: the silent-drop form of the router of the harness. Conntrack stays as it is. The
@@ -404,6 +409,16 @@ export declare const dnsCommands: (on: boolean) => string[][];
  * old flow of the peer. A cell of the middlebox opens no new flow in its gap.
  */
 export declare const middleboxCommands: (peers: readonly string[], idle: Quantity | null, port: number) => string[][];
+/**
+ * This function gives the commands that remove a middlebox from a network namespace, from the filter
+ * table that `iptables-save -c` gives for it. An empty list means that the namespace has no part of it.
+ *
+ * The commands remove each part that the table holds, and only those. The lab stops at the first
+ * command that fails. Thus a removal from a list of the peers stops at a jump that is not there, and
+ * its chains stay. For example, a set that failed half way added no jumps, or a client pod has a new
+ * address. Then the next set of the namespace fails at its `-N`.
+ */
+export declare const middleboxRemoval: (saved: string) => string[][];
 /**
  * This function gives the placement of the sessions of the clients: the backend of each slot of each
  * client, by client. The clients come in the sequence of their names. The sessions on the target go
@@ -1031,7 +1046,11 @@ export declare const metallbRecord: (cluster: Pick<Cluster, "kubectl">, namespac
  */
 /** This version is the release of Pulsar of the lab. */
 export declare const PULSAR_VERSION = "5.0.0";
-/** This chart is the Helm chart 4.8.0 of Pulsar. The sha256 is of the file of the release. */
+/**
+ * This chart is the Helm chart 4.8.0 of Pulsar. The sha256 is of the file of the release. The URL is
+ * on the archive of Apache, which keeps each release. The mirror downloads.apache.org keeps only the
+ * latest releases.
+ */
 export declare const PULSAR_CHART: PinnedChart;
 /**
  * This image is Pulsar 5.0.0 for linux/amd64, pinned by the digest of the manifest of the platform.
@@ -1371,6 +1390,60 @@ interface LearnWindow {
  */
 export declare const learnWindow: (declaration: Declaration, readiness: KubeletProbe, propagation: Propagation, workload: Workload) => LearnWindow;
 //#endregion
+//#region src/quiet.d.ts
+/**
+ * The quiet gate asks for an idle share of the VM before a run. The clients of the cell run at that
+ * time, and the agent of each node reads the whole conntrack table each second. Thus the idle share
+ * has the load of the cell in it. A flat share can void a heavy cell with no other load (SYS-95).
+ * The gate reads the cell against itself. The baseline is the idle share of the settled cell, and
+ * a foreign load shows as a fall from the baseline.
+ */
+/** These numbers are the terms of the gate. Each share is a share of all the CPUs of the VM. */
+interface QuietGate {
+  /** This share is enough for each cell, as it was before SYS-95. */
+  readonly flat: number;
+  /** This share is the most fall from the baseline that the gate lets through. */
+  readonly margin: number;
+  /** This share is the least that the gate lets through, with any baseline. */
+  readonly floor: number;
+  /** This time in milliseconds is the age of a cell at its first baseline sample. */
+  readonly settle: number;
+  /** This count is the samples of a baseline. */
+  readonly samples: number;
+}
+/**
+ * These are the terms of the lab. The flat share is the share of SYS-42. The other terms come from the
+ * calibration of SYS-95, over the 9 records of SYS-57, with no foreign container in them:
+ *
+ * - The margin is the 99th percentile of the fall from the settled median of an environment: 4.88
+ *   points of 93 samples, rounded up.
+ * - The floor is the lowest settled median of an environment, 48 %, minus the margin.
+ * - The time to settle holds the slowest environment. Its conntrack table was at its plateau at 105 s.
+ */
+export declare const QUIET_GATE: QuietGate;
+/**
+ * This function gives the idle share that a run needs. With no baseline, it is the floor: a warm-up
+ * counts for nothing, and its table is not full yet. A cell that is at rest at the flat share or more
+ * keeps the flat share.
+ */
+export declare const neededIdle: (gate: QuietGate, baseline: number | null) => number;
+/** This function gives the reason of a sample that the gate refuses. The site reads it back with `NOT_QUIET`. */
+export declare const quietWhy: (idle: number, needed: number, foreign: readonly string[]) => string;
+/**
+ * This form reads the void of a run that the gate refuses. Its groups are the wait in seconds, the idle share, the share
+ * of the gate and the other lab containers. A record from before SYS-95 has no share of the gate.
+ */
+export declare const NOT_QUIET: RegExp;
+/**
+ * This function gives the next baseline of a cell from the samples of one environment. Samples with
+ * a foreign container do not count. The highest median holds, because a foreign load only lowers
+ * the idle share. Thus a load in one environment does not move the gate of the other one.
+ */
+export declare const baselineOf: (previous: number | null, samples: ReadonlyArray<{
+  readonly idle: number;
+  readonly foreign: readonly string[];
+}>) => number | null;
+//#endregion
 //#region src/rules.d.ts
 /**
  * This function gives the scenario of a cell for `lint()`: the preStop sleep, the grace, the probe
@@ -1500,5 +1573,5 @@ export declare const toolPath: (tool: Tool, key?: string, cache?: string) => str
  */
 export declare const ensureTool: (tool: Tool, key?: string, cache?: string) => Promise<string>;
 //#endregion
-export { type Announcement, type BacklogTerm, type Backoff, type Band, type BandV1, type Broker, CLIENT, type CiliumImages, type Cluster, type ClusterHosts, type ClusterManifest, type CountBand, type Credentials, type Cycle, DATAPLANES, DRAIN_RULES, type Dataplane, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeVipPod, type KubeletProbe, LAST_SLACK, LB_CLASS, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type MemberlistSettings, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, type MetallbImages, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, OUTSIDE, type OutsideSpec, PORT, type Parts, Period, type PermittedWindow, type PinnedChart, PodLine, type PodSettings, type Prediction, type PredictionV1, type ProducerState, type Propagated, type Propagation, PropagationSource, type PulsarSettings, REDIS, RELATIVE, type Reconnects, type ReconnectsFacts, type ReconnectsPrediction, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, type Return, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type Schedule, type ServiceRule, Sessions, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, type Try, TunnelLine, VIP_ANNOTATION, type Verdicts, type VipAnnouncer, type VipAnnouncerName, type VipLease, type VipNetwork, type VipService, type VipSettings, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, backlogEnd, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, drainBand, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isKubeProxyMode, isTunnelState, judge, judgeKind, judgeReconnects, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, latestReturn, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, overshootBand, periodOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestBand, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, sessionsAt, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, triesOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
+export { type Announcement, type BacklogTerm, type Backoff, type Band, type BandV1, type Broker, CLIENT, type CiliumImages, type Cluster, type ClusterHosts, type ClusterManifest, type CountBand, type Credentials, type Cycle, DATAPLANES, DRAIN_RULES, type Dataplane, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeVipPod, type KubeletProbe, LAST_SLACK, LB_CLASS, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type MemberlistSettings, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, type MetallbImages, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, OUTSIDE, type OutsideSpec, PORT, type Parts, Period, type PermittedWindow, type PinnedChart, PodLine, type PodSettings, type Prediction, type PredictionV1, type ProducerState, type Propagated, type Propagation, PropagationSource, type PulsarSettings, type QuietGate, REDIS, RELATIVE, type Reconnects, type ReconnectsFacts, type ReconnectsPrediction, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, type Return, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type Schedule, type ServiceRule, Sessions, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, type Try, TunnelLine, VIP_ANNOTATION, type Verdicts, type VipAnnouncer, type VipAnnouncerName, type VipLease, type VipNetwork, type VipService, type VipSettings, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, backlogEnd, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, drainBand, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isKubeProxyMode, isTunnelState, judge, judgeKind, judgeReconnects, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, latestReturn, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, overshootBand, periodOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestBand, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, sessionsAt, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, triesOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
 //# sourceMappingURL=index.d.ts.map

package/build/index.js

@@ -1,5 +1,6 @@
-import { $ as rulesOf, A as judgeReconnects, At as overshootBand, B as emptyOf, C as observationEnd, Ct as PORT, D as reusesReset, Dt as backlogEnd, E as referenceOf, Et as VIP_ANNOTATION, F as backendsAt, G as outcomesOf, H as intakeOf, I as byClients, J as podsOf, K as periodOf, L as byNode, M as triesOf, Mt as seconds, N as HBONE_PORT, Nt as secondsOf, O as unitOf, Ot as bandOf, P as TCP_STATE, Pt as showBand, Q as restartsAt, R as deletionOf, S as observationAfter, St as OUTSIDE, T as propagationSource, Tt as SERVER, U as isTunnelState, V as failuresOf, W as kernelCounts, X as requestsOf, Y as recordsOf, Z as restartOf, _ as checkRun, _t as quantileOf, a as calibrationOf, at as sliceReadyAt, b as factsOf, bt as LB_CLASS, c as predictionText, ct as socketsOf, d as FORMAT_V1, dt as tunnelsOf, et as sessionsAt, f as judge, ft as ztunnelPodsOf, g as LAST_SLACK, gt as middle, h as KIND_NOISE, ht as medianInterval, i as readRecord, it as sliceEmptyOf, j as latestReturn, jt as requestBand, k as updatesOf, kt as drainBand, l as timeSpread, lt as stoppingOf, m as upgradeCell, mt as RELATIVE, n as kindCellRecordSchema, nt as signalsOf, o as cellsTable, ot as sliceReadyOf, p as upgrade, pt as ztunnelReplaced, q as podsAt, r as kindCellRecordV1Schema, rt as sliceDropOf, s as medianText, st as slicesOf, t as STAGES, tt as signalOf, u as FORMAT, ut as transitionOf, v as cyclesOf, vt as CLIENT, w as propagationOf, wt as REDIS, x as judgeKind, xt as LOG_LABEL, y as deletionsOf, yt as HEALTH_PORT, z as dropOf } from "./judge-C6XgY2Pk.js";
+import { $ as rulesOf, A as judgeReconnects, At as overshootBand, B as emptyOf, C as observationEnd, Ct as PORT, D as reusesReset, Dt as backlogEnd, E as referenceOf, Et as VIP_ANNOTATION, F as backendsAt, G as outcomesOf, H as intakeOf, I as byClients, J as podsOf, K as periodOf, L as byNode, M as triesOf, Mt as seconds, N as HBONE_PORT, Nt as secondsOf, O as unitOf, Ot as bandOf, P as TCP_STATE, Pt as showBand, Q as restartsAt, R as deletionOf, S as observationAfter, St as OUTSIDE, T as propagationSource, Tt as SERVER, U as isTunnelState, V as failuresOf, W as kernelCounts, X as requestsOf, Y as recordsOf, Z as restartOf, _ as checkRun, _t as quantileOf, a as calibrationOf, at as sliceReadyAt, b as factsOf, bt as LB_CLASS, c as predictionText, ct as socketsOf, d as FORMAT_V1, dt as tunnelsOf, et as sessionsAt, f as judge, ft as ztunnelPodsOf, g as LAST_SLACK, gt as middle, h as KIND_NOISE, ht as medianInterval, i as readRecord, it as sliceEmptyOf, j as latestReturn, jt as requestBand, k as updatesOf, kt as drainBand, l as timeSpread, lt as stoppingOf, m as upgradeCell, mt as RELATIVE, n as kindCellRecordSchema, nt as signalsOf, o as cellsTable, ot as sliceReadyOf, p as upgrade, pt as ztunnelReplaced, q as podsAt, r as kindCellRecordV1Schema, rt as sliceDropOf, s as medianText, st as slicesOf, t as STAGES, tt as signalOf, u as FORMAT, ut as transitionOf, v as cyclesOf, vt as CLIENT, w as propagationOf, wt as REDIS, x as judgeKind, xt as LOG_LABEL, y as deletionsOf, yt as HEALTH_PORT, z as dropOf } from "./judge-DjtNaAVO.js";
 import { valueIn } from "@mark1russell7/quantity";
+import { median } from "@mark1russell7/rigor-statistics";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -643,16 +644,18 @@ const createCluster = async (scenario, dir) => {
 };
 //#endregion
 //#region src/helm.ts
-/** This function gives the path of a chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
-const ensurePinnedChart = async (chart, cache = cacheFolder()) => {
+/**
+* This function gives the path of a chart in the cache, after a download when the cache does not have it.
+* It refuses a download whose sha256 is not the pinned value. A file in the cache with a different
+* sha256 (a torn write) is downloaded again, and each write replaces the file in one step.
+*/
+const ensurePinnedChart = async (chart, cache = cacheFolder(), get = download) => {
 	const path = join(cache, "charts", `${chart.name}-${chart.version}.tgz`);
-	const bytes = existsSync(path) ? readFileSync(path) : await download(chart.url);
+	if (existsSync(path) && sha256(readFileSync(path)) === chart.sha256) return path;
+	const bytes = await get(chart.url);
 	const found = sha256(bytes);
 	if (found !== chart.sha256) throw new Error(`the chart ${chart.name} ${chart.version} has the sha256 ${found}, not the pinned ${chart.sha256}`);
-	if (!existsSync(path)) {
-		mkdirSync(join(cache, "charts"), { recursive: true });
-		writeFileSync(path, bytes);
-	}
+	writeWhole(path, bytes, false);
 	return path;
 };
 /**
@@ -1069,7 +1072,8 @@ const dnsCommands = (on) => {
 };
 /**
 * This function gives the commands of the injector that put a stateful middlebox in its network
-* namespace, with each peer, on the local port `port`. With `idle` null, they remove it.
+* namespace, with each peer, on the local port `port`. With `idle` null, they remove the parts of these
+* peers. A run removes what the table of the namespace holds (`middleboxRemoval`).
 *
 * The middlebox forgets a flow of the port after `idle` with no segment. Then it drops each later
 * segment of it: the silent-drop form of the router of the harness. Conntrack stays as it is. The
@@ -1201,6 +1205,38 @@ const middleboxCommands = (peers, idle, port) => {
 	];
 };
 /**
+* This function gives the commands that remove a middlebox from a network namespace, from the filter
+* table that `iptables-save -c` gives for it. An empty list means that the namespace has no part of it.
+*
+* The commands remove each part that the table holds, and only those. The lab stops at the first
+* command that fails. Thus a removal from a list of the peers stops at a jump that is not there, and
+* its chains stay. For example, a set that failed half way added no jumps, or a client pod has a new
+* address. Then the next set of the namespace fails at its `-N`.
+*/
+const middleboxRemoval = (saved) => {
+	const chains = [MIDDLEBOX.input, MIDDLEBOX.output];
+	const lines = saved.split("\n").map((line) => line.trim().replace(/^\[\d+:\d+\]\s+/, ""));
+	const present = chains.filter((chain) => lines.some((line) => line.startsWith(`:${chain} `)));
+	const jumps = lines.map((line) => line.split(/\s+/)).filter((words) => words[0] === "-A" && (words[1] === "INPUT" || words[1] === "OUTPUT") && chains.some((chain) => words.at(-1) === chain && words.at(-2) === "-j")).map((words) => [
+		"iptables",
+		"-D",
+		...words.slice(1)
+	]);
+	return [
+		...present.map((chain) => [
+			"iptables",
+			"-F",
+			chain
+		]),
+		...jumps,
+		...present.map((chain) => [
+			"iptables",
+			"-X",
+			chain
+		])
+	];
+};
+/**
 * This function gives the target of a reset or a black hole of a cell. In T07 and T18 it is Redis,
 * with the replicas as peers. In T15 the fault is on the mesh leg between the client pods and the
 * replicas. It is a rule in each replica, with the client pods as peers. A partition (`partition`)
@@ -3184,11 +3220,15 @@ const macsAt = (found, mac, count) => {
 */
 /** This version is the release of Pulsar of the lab. */
 const PULSAR_VERSION = "5.0.0";
-/** This chart is the Helm chart 4.8.0 of Pulsar. The sha256 is of the file of the release. */
+/**
+* This chart is the Helm chart 4.8.0 of Pulsar. The sha256 is of the file of the release. The URL is
+* on the archive of Apache, which keeps each release. The mirror downloads.apache.org keeps only the
+* latest releases.
+*/
 const PULSAR_CHART = {
 	name: "pulsar",
 	version: "4.8.0",
-	url: "https://downloads.apache.org/pulsar/helm-chart/4.8.0/pulsar-4.8.0.tgz",
+	url: "https://archive.apache.org/dist/pulsar/helm-chart/4.8.0/pulsar-4.8.0.tgz",
 	sha256: "464f4a268463d187c9bc83b365b31de0b4a460533d948a04f846ba9b026068f5"
 };
 /**
@@ -4655,6 +4695,48 @@ const learnWindow = (declaration, readiness, propagation, workload) => {
 	};
 };
 //#endregion
+//#region src/quiet.ts
+/**
+* These are the terms of the lab. The flat share is the share of SYS-42. The other terms come from the
+* calibration of SYS-95, over the 9 records of SYS-57, with no foreign container in them:
+*
+* - The margin is the 99th percentile of the fall from the settled median of an environment: 4.88
+*   points of 93 samples, rounded up.
+* - The floor is the lowest settled median of an environment, 48 %, minus the margin.
+* - The time to settle holds the slowest environment. Its conntrack table was at its plateau at 105 s.
+*/
+const QUIET_GATE = {
+	flat: .6,
+	margin: .05,
+	floor: .43,
+	settle: 12e4,
+	samples: 3
+};
+/**
+* This function gives the idle share that a run needs. With no baseline, it is the floor: a warm-up
+* counts for nothing, and its table is not full yet. A cell that is at rest at the flat share or more
+* keeps the flat share.
+*/
+const neededIdle = (gate, baseline) => baseline === null ? gate.floor : Math.min(gate.flat, Math.max(gate.floor, baseline - gate.margin));
+/** This function gives the reason of a sample that the gate refuses. The site reads it back with `NOT_QUIET`. */
+const quietWhy = (idle, needed, foreign) => `${Math.round(idle * 100)}% idle, the gate needs ${Math.round(needed * 100)}%, other lab containers: ${foreign.join("; ") || "none"}`;
+/**
+* This form reads the void of a run that the gate refuses. Its groups are the wait in seconds, the idle share, the share
+* of the gate and the other lab containers. A record from before SYS-95 has no share of the gate.
+*/
+const NOT_QUIET = /^the VM was not quiet in (\d+) s: (\d+)% idle(?:, the gate needs (\d+)%)?, other lab containers: (.*)$/;
+/**
+* This function gives the next baseline of a cell from the samples of one environment. Samples with
+* a foreign container do not count. The highest median holds, because a foreign load only lowers
+* the idle share. Thus a load in one environment does not move the gate of the other one.
+*/
+const baselineOf = (previous, samples) => {
+	const clean = samples.filter((sample) => sample.foreign.length === 0).map((sample) => sample.idle);
+	if (clean.length === 0) return previous;
+	const middle = median(clean);
+	return previous === null ? middle : Math.max(previous, middle);
+};
+//#endregion
 //#region src/rules.ts
 const seconds$1 = (amount) => valueIn(amount, "s");
 const s = (value) => ({
@@ -4923,21 +5005,57 @@ const sample = async (ctx, ours) => {
 * This is below the share of 60%. That wait had no bound, and it took approximately 30 min.
 */
 const QUIET_WITHIN = 3e5;
+/** This function gives the names of this lab at a sample: the prober and the watcher start again with new names. */
+const oursAt = (ctx, ours) => /* @__PURE__ */ new Set([
+	...ours,
+	...ctx.lab.own(),
+	ctx.loader.getName().replace(/^\//, "")
+]);
+/**
+* This function takes the baseline of the cell in this environment, once. The first run after the
+* warm-up calls it. It waits until the cell has its age. The conntrack table fills for the life of
+* its entries, and the read of the table costs more until then.
+*/
+const takeBaseline = async (ctx, ours) => {
+	if (ctx.settled) return;
+	await sleep(Math.max(0, ctx.deployed + ctx.gate.settle - Date.now()));
+	const samples = [];
+	for (let index = 0; index < ctx.gate.samples; index += 1) samples.push(await sample(ctx, oursAt(ctx, ours)));
+	ctx.loads.push(...samples);
+	const baseline = baselineOf(ctx.baselines.get(ctx.cell.name) ?? null, samples);
+	if (baseline !== null) ctx.baselines.set(ctx.cell.name, baseline);
+	ctx.settled = true;
+	ctx.log(`  baseline: ${samples.map((each) => `${Math.round(each.idle * 100)}%`).join(", ")} idle, the gate needs ${Math.round(neededIdle(ctx.gate, baseline) * 100)}%`);
+};
+/** This function starts the planned load of a cell for the longest wait of the gate. The load runs in the loader, out of the cluster. */
+const startPlannedLoad = async (ctx) => {
+	const cores = ctx.cell.plannedLoad;
+	if (cores === void 0) return;
+	const spec = JSON.stringify({
+		cores,
+		ms: 32e4
+	});
+	await ctx.loader.exec([
+		"sh",
+		"-c",
+		`nohup node agent.mjs burn '${spec}' >/dev/null 2>&1 &`
+	]);
+};
 /**
 * This function waits until the VM is quiet: no lab container of another agent, and an idle share of
-* the CPUs. It gives null, or the reason when the VM is not quiet in `within` ms.
+* the CPUs (`neededIdle`). It gives null, or the reason when the VM is not quiet in `within` ms.
 */
 const quiet = async (ctx, ours, within = QUIET_WITHIN) => {
 	const end = Date.now() + within;
+	const needed = neededIdle(ctx.gate, ctx.baselines.get(ctx.cell.name) ?? null);
 	for (;;) {
-		const load = await sample(ctx, /* @__PURE__ */ new Set([
-			...ours,
-			...ctx.lab.own(),
-			ctx.loader.getName().replace(/^\//, "")
-		]));
-		ctx.loads.push(load);
-		if (load.foreign.length === 0 && load.idle >= ctx.idle) return null;
-		const why = `${Math.round(load.idle * 100)}% idle, other lab containers: ${load.foreign.join("; ") || "none"}`;
+		const load = await sample(ctx, oursAt(ctx, ours));
+		ctx.loads.push({
+			...load,
+			needed
+		});
+		if (load.foreign.length === 0 && load.idle >= needed) return null;
+		const why = quietWhy(load.idle, needed, load.foreign);
 		if (Date.now() >= end) return `the VM was not quiet in ${within / 1e3} s: ${why}`;
 		ctx.log(`  waiting: ${why}`);
 		await sleep(3e4);
@@ -5245,13 +5363,19 @@ const namespacesOf = async (ctx, target, replicas) => {
 */
 const middleboxServers = async (ctx, idle, port, replicas) => {
 	const peers = [...ctx.tracker.pods.values()].filter((pod) => pod.labels["app"] === "client" && !pod.del && pod.ip !== null).map((pod) => pod.ip).sort();
-	const commands = middleboxCommands(peers, idle, port);
+	const commands = idle === null ? null : middleboxCommands(peers, idle, port);
 	const t0 = await ctx.lab.now();
 	const each = await namespacesOf(ctx, "servers", replicas);
 	await Promise.all(each.map(async ({ node, pid }) => {
-		if (idle === null) await ctx.lab.tables(node, pid, "filter");
-		await ctx.lab.netns(node, pid, commands);
-		if (idle !== null) await ctx.lab.tables(node, pid, "filter");
+		if (commands !== null) {
+			await ctx.lab.netns(node, pid, commands);
+			await ctx.lab.tables(node, pid, "filter");
+			return;
+		}
+		const removal = middleboxRemoval(await ctx.lab.tables(node, pid, "filter"));
+		if (removal.length > 0) await ctx.lab.netns(node, pid, removal);
+		const left = middleboxRemoval(await ctx.lab.tables(node, pid, "filter"));
+		if (left.length > 0) throw new Error(`the middlebox on ${node} (PID ${pid}) has ${left.length} parts after its removal`);
 	}));
 	return {
 		t0,
@@ -5574,6 +5698,10 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 	if (atRest !== null) return empty(`the cell was not at rest: ${atRest}`, await lab.now());
 	await probeThePods(ctx);
 	await pollListeners(ctx);
+	if (!warmup) {
+		await takeBaseline(ctx, ours);
+		await startPlannedLoad(ctx);
+	}
 	const loud = await quiet(ctx, ours);
 	if (loud !== null) {
 		ctx.log(`  ${loud}`);
@@ -5857,6 +5985,7 @@ const runKindCells = async (cells, options) => {
 	const groups = /* @__PURE__ */ new Map();
 	for (const cell of cells) groups.set(clusterKey(cell), [...groups.get(clusterKey(cell)) ?? [], cell]);
 	const results = [];
+	const baselines = /* @__PURE__ */ new Map();
 	for (const group of groups.values()) {
 		const partial = /* @__PURE__ */ new Map();
 		for (let env = 0; env < environments; env += 1) {
@@ -5943,7 +6072,13 @@ const runKindCells = async (cells, options) => {
 							vip: cell.vip === void 0 ? null : vip,
 							loads,
 							loader,
-							idle: options.idle ?? .6,
+							gate: {
+								...QUIET_GATE,
+								flat: options.idle ?? QUIET_GATE.flat
+							},
+							baselines,
+							deployed: Date.now(),
+							settled: false,
 							log: options.log,
 							version: 1,
 							probed: "",
@@ -6082,6 +6217,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { ACCESS_LOG_FORMAT, ANNOUNCE_ANNOTATION, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, KUBE_VIP, KUBE_VIP_ANNOUNCER, KUBE_VIP_ARP_RATE, KUBE_VIP_ELECTION, KUBE_VIP_IMAGE, KUBE_VIP_LEASE, KUBE_VIP_VERSION, LAST_SLACK, LB_CLASS, LDS_EVERY, LDS_FILTER, LOG_LABEL, MEMBERLIST, MEMBERLIST_FILE, MESH_IMAGES, MESH_WORKLOADS, METALLB_ANNOTATION, METALLB_ANNOUNCER, METALLB_CHART, METALLB_IMAGES, METALLB_NAMESPACE, METALLB_POOL, METALLB_SPAM, METALLB_VERSION, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, O04, O09, O10, O16, OUTSIDE, PING, POD_LINK, POLICY, PORT, PRODUCER, PRODUCER_BACKOFF, PRODUCER_SCRIPT, PULSAR_CHART, PULSAR_IMAGE, PULSAR_LOOKUP, PULSAR_NAMESPACE, PULSAR_SERVICE, PULSAR_TOPIC, PULSAR_VERSION, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SESSION, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, TICK, VIP_ANNOTATION, VIP_LABEL, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, announcementsOf, announcerOf, arpMacOf, backendsAt, backendsOf, backlogEnd, bandOf, brokerOfHost, brokersOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, clusterNameOf, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensurePinnedChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, helmInstall, holdMetallb, holdPulsar, holdVip, hostsOf, installCilium, installKubeVip, installMesh, installMetallb, installPulsar, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, judgeReconnects, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeVipObjects, kubeVipPods, kubeVipReady, kubeletBand, labImage, labSource, latchBand, latestReturn, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, macsAt, medianInterval, medianText, memberlistFileOf, memberlistTermsOf, meshKey, metallbObjects, metallbRecord, metallbValues, metallbVipOf, middle, middleboxCommands, namesService, namespaceObject, namespaceOf, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, ownerAtRest, ownerOrder, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, pulsarObjects, pulsarRecord, pulsarValues, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, speakersReady, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, suspicionOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, triesOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, vipLeaseOf, vipNetworkOf, vipOf, vipServed, vipService, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
+export { ACCESS_LOG_FORMAT, ANNOUNCE_ANNOTATION, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, KUBE_VIP, KUBE_VIP_ANNOUNCER, KUBE_VIP_ARP_RATE, KUBE_VIP_ELECTION, KUBE_VIP_IMAGE, KUBE_VIP_LEASE, KUBE_VIP_VERSION, LAST_SLACK, LB_CLASS, LDS_EVERY, LDS_FILTER, LOG_LABEL, MEMBERLIST, MEMBERLIST_FILE, MESH_IMAGES, MESH_WORKLOADS, METALLB_ANNOTATION, METALLB_ANNOUNCER, METALLB_CHART, METALLB_IMAGES, METALLB_NAMESPACE, METALLB_POOL, METALLB_SPAM, METALLB_VERSION, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, NOT_QUIET, O04, O09, O10, O16, OUTSIDE, PING, POD_LINK, POLICY, PORT, PRODUCER, PRODUCER_BACKOFF, PRODUCER_SCRIPT, PULSAR_CHART, PULSAR_IMAGE, PULSAR_LOOKUP, PULSAR_NAMESPACE, PULSAR_SERVICE, PULSAR_TOPIC, PULSAR_VERSION, QUIET_GATE, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SESSION, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, TICK, VIP_ANNOTATION, VIP_LABEL, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, announcementsOf, announcerOf, arpMacOf, backendsAt, backendsOf, backlogEnd, bandOf, baselineOf, brokerOfHost, brokersOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, clusterNameOf, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensurePinnedChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, helmInstall, holdMetallb, holdPulsar, holdVip, hostsOf, installCilium, installKubeVip, installMesh, installMetallb, installPulsar, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, judgeReconnects, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeVipObjects, kubeVipPods, kubeVipReady, kubeletBand, labImage, labSource, latchBand, latestReturn, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, macsAt, medianInterval, medianText, memberlistFileOf, memberlistTermsOf, meshKey, metallbObjects, metallbRecord, metallbValues, metallbVipOf, middle, middleboxCommands, middleboxRemoval, namesService, namespaceObject, namespaceOf, neededIdle, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, ownerAtRest, ownerOrder, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, pulsarObjects, pulsarRecord, pulsarValues, quantileOf, quietWhy, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, speakersReady, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, suspicionOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, triesOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, vipLeaseOf, vipNetworkOf, vipOf, vipServed, vipService, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
 
 //# sourceMappingURL=index.js.map