@mark1russell7/kind 0.4.1 → 0.6.0

package/build/index.js

@@ -1,4 +1,4 @@
-import { $ as slicesOf, A as medianInterval, B as intakeOf, C as propagationOf, D as unitOf, E as reusesReset, F as byNode, G as recordsOf, H as outcomesOf, I as deletionOf, J as rulesOf, K as requestsOf, L as dropOf, M as quantileOf, N as backendsAt, O as updatesOf, P as byClients, Q as sliceEmptyOf, R as emptyOf, S as observationEnd, T as referenceOf, U as podsAt, V as kernelCounts, W as podsOf, X as signalsOf, Y as signalOf, Z as sliceDropOf, _ as checkRun, a as calibrationOf, at as PORT, b as judgeKind, c as predictionText, ct as bandOf, d as FORMAT_V1, dt as showBand, et as stoppingOf, f as judge, g as LAST_SLACK, h as KIND_NOISE, i as readRecord, it as LOG_LABEL, j as middle, k as RELATIVE, l as timeSpread, lt as seconds, m as upgradeCell, n as kindCellRecordSchema, nt as CLIENT, o as cellsTable, ot as REDIS, p as upgrade, q as restartsAt, r as kindCellRecordV1Schema, rt as HEALTH_PORT, s as medianText, st as SERVER, t as STAGES, tt as transitionOf, u as FORMAT, ut as secondsOf, v as deletionsOf, w as propagationSource, x as observationAfter, y as factsOf, z as failuresOf } from "./judge-Bkbs7VVG.js";
+import { $ as slicesOf, A as medianInterval, B as intakeOf, C as propagationOf, D as unitOf, E as reusesReset, F as byNode, G as recordsOf, H as outcomesOf, I as deletionOf, J as rulesOf, K as requestsOf, L as dropOf, M as quantileOf, N as backendsAt, O as updatesOf, P as byClients, Q as sliceEmptyOf, R as emptyOf, S as observationEnd, T as referenceOf, U as podsAt, V as kernelCounts, W as podsOf, X as signalsOf, Y as signalOf, Z as sliceDropOf, _ as checkRun, a as calibrationOf, at as LOG_LABEL, b as judgeKind, c as predictionText, ct as SERVER, d as FORMAT_V1, dt as secondsOf, et as socketsOf, f as judge, ft as showBand, g as LAST_SLACK, h as KIND_NOISE, i as readRecord, it as HEALTH_PORT, j as middle, k as RELATIVE, l as timeSpread, lt as bandOf, m as upgradeCell, n as kindCellRecordSchema, nt as transitionOf, o as cellsTable, ot as PORT, p as upgrade, q as restartsAt, r as kindCellRecordV1Schema, rt as CLIENT, s as medianText, st as REDIS, t as STAGES, tt as stoppingOf, u as FORMAT, ut as seconds, v as deletionsOf, w as propagationSource, x as observationAfter, y as factsOf, z as failuresOf } from "./judge-DNCI5vvt.js";
 import { valueIn } from "@mark1russell7/quantity";
 import { execFile, execFileSync } from "node:child_process";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -295,6 +295,22 @@ const writeWhole = (path, bytes, executable) => {
 	if (executable) chmodSync(partial, 493);
 	renameSync(partial, path);
 };
+/** These are the waits in ms before the second and the third try of a download. A runner can fail to connect for a moment. */
+const DOWNLOAD_WAITS = [2e3, 8e3];
+/**
+* This function gives the bytes of a URL. It tries again after each wait when the connection fails or
+* the answer is a 5xx. It refuses each other answer that is not ok at once.
+*/
+const download = async (url, waits = DOWNLOAD_WAITS) => {
+	for (let attempt = 0;; attempt++) {
+		const response = await fetch(url, { redirect: "follow" }).catch((error) => error instanceof Error ? error : new Error(String(error)));
+		if (response instanceof Response && response.ok) return new Uint8Array(await response.arrayBuffer());
+		const failure = response instanceof Response ? /* @__PURE__ */ new Error(`the download of ${url} answered ${response.status}`) : response;
+		const wait = waits[attempt];
+		if (response instanceof Response && response.status < 500 || wait === void 0) throw failure;
+		await new Promise((resolve) => setTimeout(resolve, wait));
+	}
+};
 /**
 * This function gives the path of a tool, after a download when the cache does not have it. It
 * refuses bytes whose sha256 is not the pinned value, from the cache or from the download. For a
@@ -314,9 +330,7 @@ const ensureTool = async (tool, key = platformKey(), cache = cacheFolder()) => {
 		if (found !== asset.sha256) throw new Error(`${kept} has the sha256 ${found}, not the pinned ${asset.sha256}`);
 		if (tool.entry === void 0) return path;
 	} else {
-		const response = await fetch(asset.url, { redirect: "follow" });
-		if (!response.ok) throw new Error(`the download of ${asset.url} answered ${response.status}`);
-		bytes = new Uint8Array(await response.arrayBuffer());
+		bytes = await download(asset.url);
 		const found = sha256(bytes);
 		if (found !== asset.sha256) throw new Error(`${asset.url} has the sha256 ${found}, not the pinned ${asset.sha256}`);
 		writeWhole(kept, bytes, executable && tool.entry === void 0);
@@ -642,6 +656,12 @@ const policyObject = (account) => ({
 		rules: [{ from: [{ source: { principals: [`cluster.local/ns/{namespace}/sa/${account}`] } }] }]
 	}
 });
+/**
+* This function gives the target of a reset or a black hole of a cell. In T07 and T18 it is Redis,
+* with the replicas as peers. In T15 the fault is on the mesh leg between the client pods and the
+* replicas. It is a rule in each replica, with the client pods as peers.
+*/
+const linkOf = (cell) => cell.template === "T15" ? "servers" : "redis";
 /** This function gives the fault plan of a cell. */
 const planOf = (cell) => {
 	const ns = ["-n", "{namespace}"];
@@ -794,13 +814,13 @@ const planOf = (cell) => {
 		case "rst": return {
 			inject: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "rst"
 			}],
 			hold: needs(trigger.hold, "a hold"),
 			heal: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "clear-rst"
 			}],
 			restore: []
@@ -808,13 +828,13 @@ const planOf = (cell) => {
 		case "blackhole": return {
 			inject: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "blackhole"
 			}],
 			hold: needs(trigger.hold, "a hold"),
 			heal: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "clear"
 			}],
 			restore: []
@@ -930,6 +950,24 @@ const planOf = (cell) => {
 				]
 			}]
 		};
+		case "idle": return {
+			inject: [{
+				do: "signal",
+				target: "clients",
+				signal: "SIGUSR1"
+			}],
+			hold: needs(trigger.hold, "a hold, the time of the gap"),
+			heal: [{
+				do: "signal",
+				target: "clients",
+				signal: "SIGUSR2"
+			}],
+			restore: [{
+				do: "signal",
+				target: "clients",
+				signal: "SIGUSR2"
+			}]
+		};
 	}
 };
 /** This function tells if a trigger stops a pod of the service with its grace: a deletion, an eviction, a scale-in or a rollout. */
@@ -966,7 +1004,8 @@ const FILES = [
 	["conntrack.ts", "src/conntrack.ts"],
 	["drops.ts", "src/drops.ts"],
 	["eds.ts", "src/eds.ts"],
-	["lds.ts", "src/lds.ts"]
+	["lds.ts", "src/lds.ts"],
+	["client-lines.ts", "src/client-lines.ts"]
 ];
 const shell = process.platform === "win32";
 /** This function gives each file of a staged context, with its path in the context, in a stable sequence. */
@@ -1078,14 +1117,27 @@ const labImage = () => {
 /** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
 const ISTIO_VERSION = "1.31.3";
 /**
-* These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
-* (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
-* its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
-* from a registry.
+* These are the images of Istio, pinned by the digest of their index on Docker Hub (read on
+* 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by its digest,
+* tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls from a
+* registry. The flavor `sidecar` needs istiod and the proxy. The flavor `ambient` also needs
+* istio-cni and ztunnel (`MESH_IMAGES`).
 */
 const ISTIO_IMAGES = {
 	pilot: "istio/pilot:1.31.3@sha256:6ad1e816c4d4767ba3f30a6286a96d121851ddb23d33e20736758acb5f3f4ea9",
-	proxy: "istio/proxyv2:1.31.3@sha256:eb74eacea98d3fb1e239ea84016085155478586a554158676b9b67d960151084"
+	proxy: "istio/proxyv2:1.31.3@sha256:eb74eacea98d3fb1e239ea84016085155478586a554158676b9b67d960151084",
+	cni: "istio/install-cni:1.31.3@sha256:e98782038634ef4fadaf78b53dd8fa4134fda3d65838ead5fc1edef245451c0f",
+	ztunnel: "istio/ztunnel:1.31.3@sha256:2c27371b3139ecbf4f5a017354bd540889482441712e88cd8e654ead5a3eb5b2"
+};
+/** These are the images that each flavor installs, by their names in `ISTIO_IMAGES`. */
+const MESH_IMAGES = {
+	sidecar: ["pilot", "proxy"],
+	ambient: [
+		"pilot",
+		"proxy",
+		"cni",
+		"ztunnel"
+	]
 };
 /**
 * This format is the JSON access log of each sidecar. Each field is a command of the formatter of
@@ -1119,10 +1171,15 @@ const ACCESS_LOG_FORMAT = {
 *   reports the whole runner, and no cell scales istiod.
 * - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
 *
-* The flavor `ambient` comes in a later step, thus it is refused.
+* The flavor `ambient` has the profile `ambient`: istiod, istio-cni and ztunnel, and no gateway
+* (manifests/profiles/ambient.yaml of Istio 1.31.3). Its two other images are full references too
+* (templates/daemonset.yaml of the chart of istio-cni, lines 93–96, and of ztunnel, lines 65–68).
+* The chart of istio-cni takes the pull policy of `global`. The template of ztunnel reads only its own
+* `imagePullPolicy`, thus the operator sets it there too.
 */
 const istioOperator = (flavor, images) => {
-	if (flavor !== "sidecar") throw new Error(`the lab installs the mesh flavor sidecar only, not ${flavor}`);
+	const ambient = flavor === "ambient";
+	if (ambient && (images.cni === void 0 || images.ztunnel === void 0)) throw new Error("the flavor ambient needs the images of istio-cni and ztunnel");
 	return {
 		apiVersion: "install.istio.io/v1alpha1",
 		kind: "IstioOperator",
@@ -1131,7 +1188,7 @@ const istioOperator = (flavor, images) => {
 			namespace: "istio-system"
 		},
 		spec: {
-			profile: "minimal",
+			profile: ambient ? "ambient" : "minimal",
 			hub: "docker.io/istio",
 			tag: ISTIO_VERSION,
 			meshConfig: {
@@ -1153,37 +1210,77 @@ const istioOperator = (flavor, images) => {
 						cpu: "500m",
 						memory: "256Mi"
 					} }
-				}
+				},
+				...ambient ? {
+					cni: { image: images.cni },
+					ztunnel: {
+						image: images.ztunnel,
+						imagePullPolicy: "Never"
+					}
+				} : {}
 			}
 		}
 	};
 };
+/** These are the workloads of each flavor in istio-system that the install waits for. */
+const MESH_WORKLOADS = {
+	sidecar: ["deployment/istiod"],
+	ambient: [
+		"deployment/istiod",
+		"daemonset/istio-cni-node",
+		"daemonset/ztunnel"
+	]
+};
 /**
 * This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
-* of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+* of the flavor. Then it waits for each workload of the flavor. The kubeconfig of the cluster goes to
+* istioctl. When the install fails, the error has the pods of istio-system and the last lines of the
+* log of istio-cni. Thus the log of the job shows the cause, for example a module that the kernel of
+* the runner does not have.
 */
 const installMesh = async (cluster, flavor, images) => {
 	const istioctl = await ensureTool(ISTIOCTL);
 	const file = join(cluster.dir, `istio-${flavor}.json`);
 	writeFileSync(file, `${JSON.stringify(istioOperator(flavor, images), null, 2)}\n`);
-	await command(istioctl, [
-		"install",
-		"--kubeconfig",
-		cluster.kubeconfig,
-		"-y",
-		"-f",
-		file,
-		"--readiness-timeout",
-		"10m0s"
-	], { timeout: 9e5 });
-	await cluster.kubectl([
-		"-n",
-		"istio-system",
-		"rollout",
-		"status",
-		"deployment/istiod",
-		"--timeout=300s"
-	]);
+	try {
+		await command(istioctl, [
+			"install",
+			"--kubeconfig",
+			cluster.kubeconfig,
+			"-y",
+			"-f",
+			file,
+			"--readiness-timeout",
+			"10m0s"
+		], { timeout: 9e5 });
+		for (const workload of MESH_WORKLOADS[flavor]) await cluster.kubectl([
+			"-n",
+			"istio-system",
+			"rollout",
+			"status",
+			workload,
+			"--timeout=300s"
+		]);
+	} catch (error) {
+		const state = async (args) => (await cluster.kubectl([
+			"-n",
+			"istio-system",
+			...args
+		]).catch((why) => String(why))).slice(-4e3);
+		const pods = await state([
+			"get",
+			"pods",
+			"-o",
+			"wide"
+		]);
+		const cni = flavor === "ambient" ? `\nthe log of istio-cni:\n${await state([
+			"logs",
+			"daemonset/istio-cni-node",
+			"--tail=60",
+			"--all-containers"
+		])}` : "";
+		throw new Error(`the install of Istio ${flavor} failed: ${String(error)}\nthe pods of istio-system:\n${pods}${cni}`);
+	}
 };
 /** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
 const meshKey = (cell) => cell.mesh?.flavor ?? "none";
@@ -1199,6 +1296,8 @@ const LDS_EVERY = {
 	value: 50,
 	unit: "ms"
 };
+/** This function tells if the watcher follows the log of each ztunnel for a cell: a cell in ambient mode. */
+const followsZtunnel = (cell) => cell.mesh?.mode === "ambient";
 /** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
 const pollsListeners = (cell) => cell.mesh?.mode === "sidecar" && cell.trigger.kind === "authorization-policy";
 //#endregion
@@ -1386,12 +1485,13 @@ const openKindLab = async (cluster, image) => {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
 		},
-		async watch(namespaces) {
+		async watch(namespaces, options) {
 			if (watcher !== null) await watcher.stop({ timeout: 0 }).catch(() => void 0);
 			const kube = await cluster.credentials();
 			watcher = await new GenericContainer(image).withNetworkMode(cluster.network).withEnvironment({
 				KUBE: JSON.stringify(kube),
-				NAMESPACES: namespaces.join(",")
+				NAMESPACES: namespaces.join(","),
+				ZTUNNEL: options?.ztunnel === true ? "1" : "0"
 			}).withCommand(["node", "watch.mjs"]).withLogConsumer(consume((line) => push(line))).start();
 		},
 		async probe(netns) {
@@ -1514,6 +1614,28 @@ const openKindLab = async (cluster, image) => {
 			});
 			return stamp;
 		},
+		async tables(node, pid, table) {
+			const t = await lab.now();
+			const text = await output(sidecarOf(node).injector, [
+				"nsenter",
+				"-t",
+				String(pid),
+				"-n",
+				"iptables-save",
+				"-c",
+				"-t",
+				table
+			]);
+			push({
+				ev: "tables",
+				t,
+				node,
+				pid,
+				table,
+				text: text.slice(0, 8e3)
+			});
+			return text;
+		},
 		async now() {
 			return (await lab.act(firstNode, { op: "now" })).t0;
 		},
@@ -1600,16 +1722,23 @@ const whole = (amount, what) => {
 };
 /** This function gives the namespace of a cell: `lab-` and 10 digits of the sha256 of its name. */
 const namespaceOf = (cell) => `lab-${createHash("sha256").update(cell.name).digest("hex").slice(0, 10)}`;
+/** These are the labels of the namespace of each mode of a mesh. */
+const MESH_LABELS = {
+	sidecar: { "istio-injection": "enabled" },
+	ambient: { "istio.io/dataplane-mode": "ambient" }
+};
 /**
 * This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
 * `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+* In the ambient mode, the label `istio.io/dataplane-mode=ambient` makes istio-cni redirect the
+* traffic of each pod to ztunnel. The listeners of ztunnel are in the network namespace of the pod.
 */
 const namespaceObject = (cell, namespace) => ({
 	apiVersion: "v1",
 	kind: "Namespace",
 	metadata: {
 		name: namespace,
-		...cell.mesh?.mode === "sidecar" ? { labels: { "istio-injection": "enabled" } } : {}
+		...cell.mesh === void 0 ? {} : { labels: { ...MESH_LABELS[cell.mesh.mode] } }
 	}
 });
 /**
@@ -2296,7 +2425,7 @@ const quiet = async (ctx, ours) => {
 */
 const deploy = async (lab, cluster, cell, namespace, images) => {
 	await cluster.apply([namespaceObject(cell, namespace)]);
-	await lab.watch([namespace]);
+	await lab.watch([namespace], { ztunnel: followsZtunnel(cell) });
 	if (hasRedis(cell)) {
 		await cluster.apply(redisObjects(namespace, images.redis));
 		await cluster.kubectl([
@@ -2432,12 +2561,95 @@ const replicasOf = (ctx) => {
 	}));
 	return stackOf(ctx.cell) === "grpc" ? byClients(replicas, ctx.tracker.answers) : replicas;
 };
+/**
+* This time is how long before the commit of its rules the lab starts the injector in each replica.
+* It is more than the execs of one node before its commit: a read of its tables and the injector.
+*/
+const INJECT_LEAD_MS = 700;
+/**
+* This function puts the rules of an action in the network namespace of each replica, with each
+* client pod as a peer: the target `servers`. The rules of all replicas commit at one instant on
+* CLOCK_MONOTONIC (`--at`). Thus no client meets one replica with the rule and one without it. The
+* replicas of one node go one after the other, and the nodes at the same time.
+*
+* The fault finds the PID of each replica, and the clear uses it again: thus the heal comes soon
+* after its hold. Before the commit of a clear, the lab reads the filter table of each replica. Its
+* counters show if the rule matched the clients beside the rules of istio-cni. After the commit of a
+* fault, the lab reads the nat table, with the redirect of istio-cni. The stamp is the first commit
+* and the last end.
+*/
+const injectServers = async (ctx, action, replicas) => {
+	const clients = [...ctx.tracker.pods.values()].filter((pod) => pod.labels["app"] === "client" && !pod.del && pod.ip !== null).map((pod) => pod.ip).sort();
+	if (clients.length === 0 || replicas.length === 0) throw new Error(`the injector needs clients and replicas: ${clients.length} clients, ${replicas.length} replicas`);
+	const clear = action.startsWith("clear");
+	const byNode = /* @__PURE__ */ new Map();
+	for (const replica of replicas) {
+		const pid = (clear ? ctx.pids.get(replica.pod) : void 0) ?? await ctx.lab.pidOf(replica.node, ctx.namespace, replica.pod, "app");
+		ctx.pids.set(replica.pod, pid);
+		byNode.set(replica.node, [...byNode.get(replica.node) ?? [], pid]);
+	}
+	const at = await ctx.lab.now() + INJECT_LEAD_MS;
+	const args = [
+		action,
+		clients.join(","),
+		"--at",
+		String(Math.round(at * 1e6))
+	];
+	const stamps = await Promise.all([...byNode].map(async ([node, pids]) => {
+		const out = [];
+		for (const pid of pids) {
+			if (clear) await ctx.lab.tables(node, pid, "filter");
+			out.push(await ctx.lab.inject(node, pid, args));
+		}
+		return out;
+	}));
+	if (!clear) for (const [node, pids] of byNode) for (const pid of pids) await ctx.lab.tables(node, pid, "nat");
+	const all = stamps.flat();
+	return {
+		t0: Math.min(...all.map((stamp) => stamp.t0)),
+		t1: Math.max(...all.map((stamp) => stamp.t1))
+	};
+};
+/**
+* This function sends a signal to the process of each client pod: the target `clients`. The nodes go
+* at the same time. SIGUSR1 finds the PID of each client, and SIGUSR2 uses it again, thus the heal of
+* a gap comes soon after its hold. When that PID fails, the client started again, and the lab finds
+* its PID. The stamp is the first act and the last end.
+*/
+const signalClients = async (ctx, signal) => {
+	const clients = [...ctx.tracker.pods.values()].filter((pod) => pod.labels["app"] === "client" && !pod.del && pod.node !== null);
+	if (clients.length === 0) throw new Error(`the signal ${signal} needs clients`);
+	const stamps = await Promise.all(clients.map(async (pod) => {
+		const node = pod.node;
+		const known = signal === "SIGUSR2" ? ctx.pids.get(pod.name) : void 0;
+		if (known !== void 0) try {
+			return await ctx.lab.act(node, {
+				op: "signal",
+				pid: known,
+				signal
+			});
+		} catch {}
+		const pid = await ctx.lab.pidOf(node, ctx.namespace, pod.name, CLIENT);
+		ctx.pids.set(pod.name, pid);
+		return ctx.lab.act(node, {
+			op: "signal",
+			pid,
+			signal
+		});
+	}));
+	return {
+		t0: Math.min(...stamps.map((stamp) => stamp.t0)),
+		t1: Math.max(...stamps.map((stamp) => stamp.t1))
+	};
+};
 /** This function does one step of a fault plan. It gives the stamp of its act, or null for an act without a stamp. */
 const doStep = async (ctx, step, replicas, background) => {
 	const { lab, cluster, namespace } = ctx;
 	const target = replicas[0];
 	const fill = (args) => args.map((arg) => arg.replaceAll("{namespace}", namespace).replaceAll(POD, target.pod).replaceAll(NODE, target.node).replaceAll(VERSION, String(ctx.version)));
 	const where = async (which) => {
+		if (which === "servers") throw new Error("the target servers is a target of the injector only");
+		if (which === "clients") throw new Error("the target clients is a target of a signal only");
 		if (which === "server") return {
 			node: target.node,
 			pid: await lab.pidOf(target.node, namespace, target.pod, "app"),
@@ -2489,6 +2701,7 @@ const doStep = async (ctx, step, replicas, background) => {
 			};
 		}
 		case "signal": {
+			if (step.target === "clients") return signalClients(ctx, step.signal);
 			const at = await where(step.target);
 			return lab.act(at.node, {
 				op: "signal",
@@ -2511,6 +2724,7 @@ const doStep = async (ctx, step, replicas, background) => {
 			};
 		}
 		case "inject": {
+			if (step.target === "servers") return injectServers(ctx, step.action, replicas);
 			const at = await where(step.target);
 			let first = null;
 			for (const replica of replicas) {
@@ -2777,14 +2991,19 @@ const runKindCells = async (cells, options) => {
 		kind: "shipped",
 		name: "grpc-go"
 	}) : void 0;
+	const flavors = new Set(cells.flatMap((cell) => cell.mesh === void 0 ? [] : [cell.mesh.flavor]));
+	const pinned = /* @__PURE__ */ new Map();
+	for (const name of new Set([...flavors].flatMap((flavor) => MESH_IMAGES[flavor]))) pinned.set(name, await localPin(ISTIO_IMAGES[name]));
 	const images = {
 		lab: image,
 		redis: redisImage,
 		grpc: grpcImage,
-		mesh: cells.some((cell) => cell.mesh !== void 0) ? {
-			pilot: await localPin(ISTIO_IMAGES.pilot),
-			proxy: await localPin(ISTIO_IMAGES.proxy)
-		} : void 0
+		mesh: flavors.size === 0 ? void 0 : {
+			pilot: pinned.get("pilot"),
+			proxy: pinned.get("proxy"),
+			cni: pinned.get("cni"),
+			ztunnel: pinned.get("ztunnel")
+		}
 	};
 	const groups = /* @__PURE__ */ new Map();
 	for (const cell of cells) groups.set(clusterKey(cell), [...groups.get(clusterKey(cell)) ?? [], cell]);
@@ -2805,7 +3024,11 @@ const runKindCells = async (cells, options) => {
 				if (grpcImage !== void 0 && group.some((cell) => stackOf(cell) === "grpc")) await cluster.load(grpcImage);
 				if (mesh !== void 0) {
 					if (images.mesh === void 0) throw new Error(`${group[0].name}: the run has no images of Istio`);
-					for (const each of [images.mesh.pilot, images.mesh.proxy]) await cluster.load(each);
+					for (const name of MESH_IMAGES[mesh.flavor]) {
+						const each = images.mesh[name];
+						if (each === void 0) throw new Error(`${group[0].name}: the run has no image ${name} of Istio`);
+						await cluster.load(each);
+					}
 					const began = Date.now();
 					await installMesh(cluster, mesh.flavor, images.mesh);
 					options.log(`  Istio ${mesh.flavor} installed in ${Math.round((Date.now() - began) / 100) / 10} s`);
@@ -2844,7 +3067,8 @@ const runKindCells = async (cells, options) => {
 							version: 1,
 							probed: "",
 							listened: "",
-							expected: cell.pod.replicas
+							expected: cell.pod.replicas,
+							pids: /* @__PURE__ */ new Map()
 						};
 						const share = Math.ceil(cell.runs / environments) - (env < cell.runs % environments || cell.runs % environments === 0 ? 0 : 1);
 						const runs = [await runOnce(ctx, env, -1, true, ours)];
@@ -2863,10 +3087,7 @@ const runKindCells = async (cells, options) => {
 								lab: image,
 								redis: redisImage,
 								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {},
-								...cell.mesh === void 0 ? {} : {
-									"istio-pilot": ISTIO_IMAGES.pilot,
-									"istio-proxy": ISTIO_IMAGES.proxy
-								}
+								...cell.mesh === void 0 ? {} : Object.fromEntries(MESH_IMAGES[cell.mesh.flavor].map((name) => [`istio-${name}`, ISTIO_IMAGES[name]]))
 							}
 						});
 						entry.loads.push(...loads);
@@ -2927,11 +3148,13 @@ const estimate = (cell, environments = 2) => {
 		"app-stall": hold + 40,
 		"cpu-throttle": hold + 40,
 		rollout: hold + 50,
-		"authorization-policy": hold + 20
+		"authorization-policy": hold + 20,
+		idle: hold + 5
 	};
 	const after = observationAfter(cell);
 	const observed = after === null ? 0 : hold + valueIn(after, "s");
-	const each = 25 + Math.max(observed, trigger[cell.trigger.kind] ?? (cell.template === "T18" ? hold + 35 : 15 + valueIn(cell.pod.preStop, "s")));
+	const closes = cell.prediction.kind === "ends" && cell.prediction.band !== null ? valueIn(cell.prediction.band.hi, "s") + 3 : 0;
+	const each = 25 + Math.max(observed, closes, trigger[cell.trigger.kind] ?? (cell.template === "T18" ? hold + 35 : 15 + valueIn(cell.pod.preStop, "s")));
 	return (cell.mesh === void 0 ? 60 : 180) * environments + (cell.runs + environments) * each;
 };
 /**
@@ -2963,6 +3186,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { ACCESS_LOG_FORMAT, CLIENT, CLIENT_ACCOUNT, CONTROLLER, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, NODE_IMAGES, O04, O09, O10, O16, POLICY, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, clusterFilter, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, goDuration, hostsOf, installMesh, intakeAfter, intakeOf, istioOperator, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, namespaceObject, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, tarEntry, timeSpread, toolPath, transitionOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult };
+export { ACCESS_LOG_FORMAT, CLIENT, CLIENT_ACCOUNT, CONTROLLER, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, MESH_IMAGES, MESH_WORKLOADS, NODE_IMAGES, O04, O09, O10, O16, POLICY, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, clusterFilter, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, followsZtunnel, goDuration, hostsOf, installMesh, intakeAfter, intakeOf, istioOperator, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, namespaceObject, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, socketsOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, tarEntry, timeSpread, toolPath, transitionOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult };
 
 //# sourceMappingURL=index.js.map