@mark1russell7/kind 0.5.0 → 0.7.0

package/build/{judge-BS9pk96o.d.ts → judge-B1nSdbS0.d.ts}

@@ -96,6 +96,12 @@ type MeshMode = "sidecar" | "ambient";
 interface Mesh {
   readonly flavor: MeshFlavor;
   readonly mode: MeshMode;
+  /**
+   * These variables are the environment of the DaemonSet of ztunnel for the cell, in the flavor
+   * `ambient`. The lab sets them before the cell and removes them after it. Each change is a rollout
+   * of the DaemonSet. Without them, ztunnel has the environment of its chart.
+   */
+  readonly ztunnel?: Readonly<Record<string, string>> | undefined;
 }
 /**
  * A stack is the server and the clients of a cell:
@@ -118,16 +124,18 @@ type Stack = "service" | "grpc";
  * - `rollout` is a rolling update while Redis is down.
  * - `cpu-throttle` sets `cpu.max` in the cgroup of one replica.
  * - `authorization-policy` applies an AuthorizationPolicy of Istio that denies the clients, for the hold (T15).
+ * - `idle` stops the calls of each client with SIGUSR1, and starts them again with SIGUSR2 after the hold: a gap (T15).
+ * - `ztunnel-restart` deletes the ztunnel pod of each node with its grace. The DaemonSet makes a new pod on each node (T15).
  * - `none` injects nothing: a calibration measures the path itself.
  */
-type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle" | "authorization-policy";
+type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle" | "authorization-policy" | "idle" | "ztunnel-restart";
 /**
  * A trigger is its kind and the settings of its fault. The parameter `A` is the form of an amount:
  * a quantity in the format `/2`, a number in the format `/1`.
  */
 interface Trigger<A = Quantity> {
   readonly kind: TriggerKind;
-  /** This time is how long a fault holds before it ends: a stall, a pause of kube-proxy, a black hole on Redis. */
+  /** This time is how long a fault holds before it ends: a stall, a pause of kube-proxy, a black hole, or a gap. */
   readonly hold?: Quantity | undefined;
   /** This time is how long before the deletion a pause of kube-proxy starts (T07 `freeze-process`). */
   readonly lead?: Quantity | undefined;
@@ -219,8 +227,9 @@ interface Band<A = Quantity> {
  * - `fault`: the commit of the fault, as the injector or the agent stamps it.
  * - `resume`: the end of a pause of kube-proxy, as the agent stamps it.
  * - `heal`: the start of the first act that ends the fault, for example the delete of a policy.
+ * - `restart`: the first deletion timestamp of a ztunnel pod in the run, as the watcher receives it.
  */
-type Reference = "deletion" | "intake" | "fault" | "resume" | "heal";
+type Reference = "deletion" | "intake" | "fault" | "resume" | "heal" | "restart";
 /**
  * A reset reuse is how a reset fails a later connection on the same port. A reset from the server
  * leaves the conntrack entry of its flow in CLOSE, with the NAT to that server, for `life`. A SYN on
@@ -245,6 +254,9 @@ interface ResetReuse<A = Quantity> {
  * - `restarts`: each replica receives SIGTERM in the band, or no replica does.
  * - `stays`: no endpoint leaves the Service, and no request is refused.
  * - `stalls`: the rollout does not continue while Redis is down, and it ends after Redis is back.
+ * - `ends`: the socket of each client ends in the band after the reference `from`. With no band, no
+ *   socket of a client ends in the run. Then the first request of each client after the heal goes on
+ *   the socket of its last request before the fault. With `window`, the failed requests also start in that window.
  * - `measured`: no document bounds the outcome. The run keeps the measurement.
  */
 type Prediction<A = Quantity> = {
@@ -252,7 +264,42 @@ type Prediction<A = Quantity> = {
   /** These outcomes are the failures that the prediction excludes. Without them, it excludes each outcome but `ok`. */
   readonly outcomes?: readonly string[] | undefined;
   readonly why: string;
+} | WindowPrediction<A> | {
+  readonly kind: "removal";
+  readonly band: Band<A>;
+  readonly why: string;
+} | {
+  readonly kind: "leaves";
+  readonly band: Band<A>;
+  readonly why: string;
 } | {
+  readonly kind: "restarts";
+  readonly band: Band<A> | null;
+  readonly why: string;
+} | {
+  readonly kind: "stays";
+  readonly why: string;
+} | {
+  readonly kind: "stalls";
+  readonly why: string;
+} | {
+  readonly kind: "ends";
+  /** This reference is where the band of each close starts. */
+  readonly from: Reference;
+  /** This band is the close of the socket of each client after `from`, or null when no socket of a client ends. */
+  readonly band: Band<A> | null;
+  /** This window is where the failed requests start, or none when the prediction does not test them. */
+  readonly window?: WindowPrediction<A> | undefined;
+  readonly why: string;
+} | {
+  readonly kind: "measured";
+  readonly why: string;
+};
+/**
+ * A window prediction is the requests that fail in a window. The window starts at `start` and ends in
+ * `end`. With `certain`, at least one request fails.
+ */
+interface WindowPrediction<A = Quantity> {
   readonly kind: "window";
   readonly nodes: "all" | "paused";
   readonly start: {
@@ -284,28 +331,7 @@ type Prediction<A = Quantity> = {
   /** These outcomes are the only failures that the window permits. A failure with another outcome fails the run. Without them, each outcome but `ok` can fail. */
   readonly outcomes?: readonly string[] | undefined;
   readonly why: string;
-} | {
-  readonly kind: "removal";
-  readonly band: Band<A>;
-  readonly why: string;
-} | {
-  readonly kind: "leaves";
-  readonly band: Band<A>;
-  readonly why: string;
-} | {
-  readonly kind: "restarts";
-  readonly band: Band<A> | null;
-  readonly why: string;
-} | {
-  readonly kind: "stays";
-  readonly why: string;
-} | {
-  readonly kind: "stalls";
-  readonly why: string;
-} | {
-  readonly kind: "measured";
-  readonly why: string;
-};
+}
 /** A replica is one pod of the service at the start of a run. */
 interface Replica {
   readonly pod: string;
@@ -498,11 +524,25 @@ interface RecordLine {
   readonly on: string;
   readonly d: string | null;
 }
+/**
+ * A socket line is the connect or the close of a socket of the channel of a gRPC client
+ * (`client-lines.ts`). It gives the client (`p`) and its node (`n`), and the local port of the socket.
+ * A close also gives the code of an error of the socket (`err`), or null for a close with no error.
+ */
+interface SocketLine {
+  readonly t: number;
+  readonly what: "connect" | "close";
+  readonly p: string;
+  readonly n: string;
+  readonly lp: number | null;
+  readonly err?: string | null;
+}
 declare const requestsOf: (lines: readonly Line[]) => Request[];
 declare const podsOf: (lines: readonly Line[]) => PodLine[];
 declare const slicesOf: (lines: readonly Line[], svc: string) => SliceLine[];
 declare const rulesOf: (lines: readonly Line[], source?: PropagationSource) => RulesLine[];
 declare const recordsOf: (lines: readonly Line[]) => RecordLine[];
+declare const socketsOf: (lines: readonly Line[]) => SocketLine[];
 /** This function gives the requests that did not succeed, in sequence of their start. */
 declare const failuresOf: (lines: readonly Line[]) => Request[];
 /** This function counts the outcomes of the requests, by outcome. */
@@ -520,6 +560,29 @@ declare const byClients: <T extends {
 declare const byNode: (requests: readonly Request[]) => Map<string, Request[]>;
 /** This function gives the time that the watcher first received a deletion timestamp of one of the pods, after a time. */
 declare const deletionOf: (lines: readonly Line[], pods: readonly string[], after: number) => number | null;
+/**
+ * A ztunnel pod line is an event of a ztunnel pod in istio-system, from the watcher (`image/watch.mjs`).
+ * Its `type` is the type of the event of the API, and `cs` gives the readiness of each container (`r`).
+ */
+interface ZtunnelPodLine {
+  readonly t: number;
+  readonly type: string;
+  readonly name: string;
+  readonly node: string | null;
+  readonly del: boolean;
+  readonly cs: ReadonlyArray<{
+    readonly r: boolean;
+  }>;
+}
+declare const ztunnelPodsOf: (lines: readonly Line[]) => ZtunnelPodLine[];
+/** This function gives the time that the watcher first received a deletion timestamp of a ztunnel pod, after a time: the reference `restart`. */
+declare const restartOf: (lines: readonly Line[], after: number) => number | null;
+/**
+ * This function tells if a restart of ztunnel is over. Each ztunnel pod that got a deletion in the
+ * lines is gone. Each node has a ready ztunnel pod with no deletion. It is false when no ztunnel pod
+ * got a deletion.
+ */
+declare const ztunnelReplaced: (lines: readonly Line[], nodes: readonly string[]) => boolean;
 /** This function gives the stamp of a transition of the service in a pod: the first matching record of a machine, after a time. */
 declare const transitionOf: (lines: readonly Line[], pod: string, machine: string, match: (record: RecordLine) => boolean, after: number) => number | null;
 /**
@@ -610,6 +673,8 @@ interface RunFacts<A = Quantity> {
   readonly updates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
   /** These are the first LDS updates of the sidecar of each server pod after the heal, by pod. */
   readonly healUpdates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
+  /** These are the first close of the socket of each client after the reference (`ends`), by client, or null for none. */
+  readonly closes?: Readonly<Record<string, A | null>> | undefined;
 }
 /** A deleted replica is a replica of a run that got a deletion. It gives its pod, and the stamps of its intake (or null) and of its deletion. */
 interface Deleted {
@@ -648,9 +713,10 @@ interface KindVerdict<A = Quantity> {
 }
 /**
  * This function gives the unit of the main value of a cell, from its prediction:
- * - `s` for a time: the removal, the departure or the restart of a band, and the end of a stall.
+ * - `s` for a time: the removal, the departure or the restart of a band, the end of a stall, or a close.
  * - `{request}` for the failed requests: no failure, a window, a fleet that stays, and a measurement.
  * - `{replica}` for the replicas that received SIGTERM, when no replica must restart.
+ * - `{socket}` for the sockets of the clients that ended, when no socket must end.
  */
 declare const unitOf: (prediction: {
   readonly kind: Prediction["kind"];
@@ -697,7 +763,7 @@ declare const deletionsOf: (run: KindRun) => Deleted[];
  * This function gives how long a run observes after the end reference of its last window, or null
  * when its prediction sets no such time. The judge closes a window `end.band.hi` + δ after its end
  * reference. A request that starts by then ends at most the timeout of the workload later: the
- * client cancels it then. A prediction that is not a window, or a window with no end, sets none.
+ * client cancels it then. A prediction with no window, or a window with no end, sets none.
  */
 declare const observationAfter: (cell: Pick<KindCell, "prediction" | "workload">) => Quantity | null;
 /**
@@ -707,6 +773,8 @@ declare const observationAfter: (cell: Pick<KindCell, "prediction" | "workload">
  * it can miss its own failures. In a rolling update of gRPC, a call waits in the queue of its channel
  * for a stalled connect. It fails only at its timeout (kind run 40128267098). A reference that is not
  * in the lines yet does not count.
+ *
+ * The band of `ends` also sets an end: its reference, the end of the band and δ.
  */
 declare const observationEnd: (cell: KindCell, run: Pick<KindRun, "start" | "acts" | "target" | "replicas" | "lines">) => number | null;
 /** This function gives the facts of a run that each table reads: its failures by outcome and node, and the times of its target. */
@@ -818,7 +886,7 @@ interface TimeSpread {
 }
 /** This function gives the spread of a set of times, or null for none. The percentile is by nearest rank. */
 declare const timeSpread: (times: readonly Quantity[]) => TimeSpread | null;
-/** This function gives the prediction of a cell in a short form for a table. */
+/** This function gives the prediction of a cell in a short form for a table. A prediction `ends` gives its window after its band. */
 declare const predictionText: (prediction: Prediction) => string;
 /**
  * This function gives the main measurement of a cell in a short form: its median and what it
@@ -876,5 +944,5 @@ declare const quantileOf: (sorted: readonly number[], p: number) => number;
  */
 declare const medianInterval: (sorted: readonly number[]) => [number, number];
 //#endregion
-export { updatesOf as $, Replica as $t, TriggerV1 as A, transitionOf as At, RunCheck as B, showBand as Bt, KindCellResult as C, rulesOf as Ct, PredictionV1 as D, sliceEmptyOf as Dt, LoadSample as E, sliceDropOf as Et, KIND_NOISE as F, REDIS as Ft, judgeKind as G, KubeletProbe as Gt, checkRun as H, Declaration as Ht, KindDecision as I, SERVER as It, propagationOf as J, MeshMode as Jt, observationAfter as K, Mesh as Kt, KindVerdict as L, bandOf as Lt, upgrade as M, HEALTH_PORT as Mt, upgradeCell as N, LOG_LABEL as Nt, RunCheckV1 as O, slicesOf as Ot, Deleted as P, PORT as Pt, unitOf as Q, Reference as Qt, LAST_SLACK as R, seconds as Rt, KindCellRecordV1 as S, restartsAt as St, KindVerdictV1 as T, signalsOf as Tt, deletionsOf as U, KindCell as Ut, RunFacts as V, Band as Vt, factsOf as W, KindRun as Wt, referenceOf as X, Prediction as Xt, propagationSource as Y, PodSettings as Yt, reusesReset as Z, RedisDeclaration as Zt, ClusterManifest as _, nodeNames as _n, outcomesOf as _t, STAGES as a, Workload as an, Request as at, FORMAT_V1 as b, recordsOf as bt, readRecord as c, KindScenario as cn, backendsAt as ct, calibrationOf as d, NodeImage as dn, deletionOf as dt, ResetReuse as en, Endpoint as et, cellsTable as f, cidrOverlap as fn, dropOf as ft, BandV1 as g, kubeProxyPatch as gn, kernelCounts as gt, timeSpread as h, kindConfig as hn, intakeOf as ht, quantileOf as i, TriggerKind as in, RecordLine as it, judge as j, CLIENT as jt, RunFactsV1 as k, stoppingOf as kt, Judged as l, KubeProxyMode as ln, byClients as lt, predictionText as m, goDuration as mn, failuresOf as mt, medianInterval as n, Template as nn, PodLine as nt, kindCellRecordSchema as o, KUBE_PROXY_MODES as on, RulesLine as ot, medianText as p, cidrRange as pn, emptyOf as pt, observationEnd as q, MeshFlavor as qt, middle as r, Trigger as rn, PropagationSource as rt, kindCellRecordV1Schema as s, KindConfig as sn, SliceLine as st, RELATIVE as t, Stack as tn, Line as tt, TimeSpread as u, NODE_IMAGES as un, byNode as ut, EnvironmentManifest as v, scenario as vn, podsAt as vt, KindCellV1 as w, signalOf as wt, KindCellRecord as x, requestsOf as xt, FORMAT as y, scenarioProblems as yn, podsOf as yt, Propagated as z, secondsOf as zt };
-//# sourceMappingURL=judge-BS9pk96o.d.ts.map
+export { updatesOf as $, MeshFlavor as $t, TriggerV1 as A, sliceEmptyOf as At, RunCheck as B, PORT as Bt, KindCellResult as C, kubeProxyPatch as Cn, requestsOf as Ct, PredictionV1 as D, signalOf as Dt, LoadSample as E, scenarioProblems as En, rulesOf as Et, KIND_NOISE as F, ztunnelPodsOf as Ft, judgeKind as G, secondsOf as Gt, checkRun as H, SERVER as Ht, KindDecision as I, ztunnelReplaced as It, propagationOf as J, Declaration as Jt, observationAfter as K, showBand as Kt, KindVerdict as L, CLIENT as Lt, upgrade as M, socketsOf as Mt, upgradeCell as N, stoppingOf as Nt, RunCheckV1 as O, signalsOf as Ot, Deleted as P, transitionOf as Pt, unitOf as Q, Mesh as Qt, LAST_SLACK as R, HEALTH_PORT as Rt, KindCellRecordV1 as S, kindConfig as Sn, recordsOf as St, KindVerdictV1 as T, scenario as Tn, restartsAt as Tt, deletionsOf as U, bandOf as Ut, RunFacts as V, REDIS as Vt, factsOf as W, seconds as Wt, referenceOf as X, KindRun as Xt, propagationSource as Y, KindCell as Yt, reusesReset as Z, KubeletProbe as Zt, ClusterManifest as _, NODE_IMAGES as _n, intakeOf as _t, STAGES as a, Replica as an, Request as at, FORMAT_V1 as b, cidrRange as bn, podsAt as bt, readRecord as c, Template as cn, SocketLine as ct, calibrationOf as d, WindowPrediction as dn, byClients as dt, MeshMode as en, Endpoint as et, cellsTable as f, Workload as fn, byNode as ft, BandV1 as g, KubeProxyMode as gn, failuresOf as gt, timeSpread as h, KindScenario as hn, emptyOf as ht, quantileOf as i, Reference as in, RecordLine as it, judge as j, slicesOf as jt, RunFactsV1 as k, sliceDropOf as kt, Judged as l, Trigger as ln, ZtunnelPodLine as lt, predictionText as m, KindConfig as mn, dropOf as mt, medianInterval as n, Prediction as nn, PodLine as nt, kindCellRecordSchema as o, ResetReuse as on, RulesLine as ot, medianText as p, KUBE_PROXY_MODES as pn, deletionOf as pt, observationEnd as q, Band as qt, middle as r, RedisDeclaration as rn, PropagationSource as rt, kindCellRecordV1Schema as s, Stack as sn, SliceLine as st, RELATIVE as t, PodSettings as tn, Line as tt, TimeSpread as u, TriggerKind as un, backendsAt as ut, EnvironmentManifest as v, NodeImage as vn, kernelCounts as vt, KindCellV1 as w, nodeNames as wn, restartOf as wt, KindCellRecord as x, goDuration as xn, podsOf as xt, FORMAT as y, cidrOverlap as yn, outcomesOf as yt, Propagated as z, LOG_LABEL as zt };
+//# sourceMappingURL=judge-B1nSdbS0.d.ts.map

package/build/{judge-Bkbs7VVG.js → judge-CmiF-Fcs.js}

@@ -42,6 +42,7 @@ const podsOf = (lines) => of(lines, "pod").sort((a, b) => a.t - b.t);
 const slicesOf = (lines, svc) => of(lines, "slice").filter((line) => line.svc === svc);
 const rulesOf = (lines, source = "rules") => of(lines, source).sort((a, b) => a.t - b.t);
 const recordsOf = (lines) => of(lines, "rec");
+const socketsOf = (lines) => of(lines, "sock").sort((a, b) => a.t - b.t);
 /** This function gives the requests that did not succeed, in sequence of their start. */
 const failuresOf = (lines) => requestsOf(lines).filter((request) => request.o !== "ok").sort((a, b) => a.t - b.t);
 /** This function counts the outcomes of the requests, by outcome. */
@@ -68,6 +69,22 @@ const byNode = (requests) => {
 };
 /** This function gives the time that the watcher first received a deletion timestamp of one of the pods, after a time. */
 const deletionOf = (lines, pods, after) => podsOf(lines).find((pod) => pods.includes(pod.name) && pod.del && pod.t >= after)?.t ?? null;
+const ztunnelPodsOf = (lines) => of(lines, "ztunnel-pod").sort((a, b) => a.t - b.t);
+/** This function gives the time that the watcher first received a deletion timestamp of a ztunnel pod, after a time: the reference `restart`. */
+const restartOf = (lines, after) => ztunnelPodsOf(lines).find((pod) => pod.del && pod.t >= after)?.t ?? null;
+/**
+* This function tells if a restart of ztunnel is over. Each ztunnel pod that got a deletion in the
+* lines is gone. Each node has a ready ztunnel pod with no deletion. It is false when no ztunnel pod
+* got a deletion.
+*/
+const ztunnelReplaced = (lines, nodes) => {
+	const last = /* @__PURE__ */ new Map();
+	for (const pod of ztunnelPodsOf(lines)) last.set(pod.name, pod);
+	const deleted = [...last.values()].filter((pod) => pod.del || pod.type === "DELETED");
+	if (deleted.length === 0 || deleted.some((pod) => pod.type !== "DELETED")) return false;
+	const ready = new Set([...last.values()].filter((pod) => !pod.del && pod.type !== "DELETED" && pod.cs.length > 0 && pod.cs.every((status) => status.r)).map((pod) => pod.node));
+	return nodes.every((node) => ready.has(node));
+};
 /** This function gives the stamp of a transition of the service in a pod: the first matching record of a machine, after a time. */
 const transitionOf = (lines, pod, machine, match, after) => recordsOf(lines).find((record) => record.p === pod && record.m === machine && record.at >= after && match(record))?.at ?? null;
 /**
@@ -192,9 +209,10 @@ const NOISE = valueIn(KIND_NOISE, "ms");
 const SLACK = valueIn(LAST_SLACK, "ms");
 /**
 * This function gives the unit of the main value of a cell, from its prediction:
-* - `s` for a time: the removal, the departure or the restart of a band, and the end of a stall.
+* - `s` for a time: the removal, the departure or the restart of a band, the end of a stall, or a close.
 * - `{request}` for the failed requests: no failure, a window, a fleet that stays, and a measurement.
 * - `{replica}` for the replicas that received SIGTERM, when no replica must restart.
+* - `{socket}` for the sockets of the clients that ended, when no socket must end.
 */
 const unitOf = (prediction) => {
 	switch (prediction.kind) {
@@ -202,6 +220,7 @@ const unitOf = (prediction) => {
 		case "leaves":
 		case "stalls": return "s";
 		case "restarts": return prediction.band === null ? "{replica}" : "s";
+		case "ends": return prediction.band === null ? "{socket}" : "s";
 		default: return "{request}";
 	}
 };
@@ -227,6 +246,7 @@ const referenceOf = (run, from, pod = run.target?.pod) => {
 	if (from === "fault") return run.acts.fault;
 	if (from === "resume") return run.acts.resume;
 	if (from === "heal") return run.acts.heal;
+	if (from === "restart") return restartOf(lines, run.start);
 	if (pod === void 0) return null;
 	if (from === "deletion") return deletionOf(lines, [pod], run.start);
 	return intakeOf(lines, pod, run.start);
@@ -296,16 +316,18 @@ const deletionsOf = (run) => run.replicas.flatMap((replica) => {
 }).sort((a, b) => a.deletion - b.deletion);
 /** This function tells if a prediction is a window for each deleted replica. */
 const eachOf = (prediction) => prediction.kind === "window" && prediction.each === true;
+/** This function gives the window of the failed requests of a prediction: a window, the window of `ends`, or null. */
+const windowOf = (prediction) => prediction.kind === "window" ? prediction : prediction.kind === "ends" ? prediction.window ?? null : null;
 /**
 * This function gives how long a run observes after the end reference of its last window, or null
 * when its prediction sets no such time. The judge closes a window `end.band.hi` + δ after its end
 * reference. A request that starts by then ends at most the timeout of the workload later: the
-* client cancels it then. A prediction that is not a window, or a window with no end, sets none.
+* client cancels it then. A prediction with no window, or a window with no end, sets none.
 */
 const observationAfter = (cell) => {
-	const prediction = cell.prediction;
-	if (prediction.kind !== "window" || prediction.end === null) return null;
-	return seconds(sec(valueIn(prediction.end.band.hi, "ms") + valueIn(cell.workload.timeout, "ms") + NOISE));
+	const window = windowOf(cell.prediction);
+	if (window === null || window.end === null) return null;
+	return seconds(sec(valueIn(window.end.band.hi, "ms") + valueIn(cell.workload.timeout, "ms") + NOISE));
 };
 /**
 * This function gives the earliest end of the observation of a run, as a stamp, or null when its
@@ -314,17 +336,27 @@ const observationAfter = (cell) => {
 * it can miss its own failures. In a rolling update of gRPC, a call waits in the queue of its channel
 * for a stalled connect. It fails only at its timeout (kind run 40128267098). A reference that is not
 * in the lines yet does not count.
+*
+* The band of `ends` also sets an end: its reference, the end of the band and δ.
 */
 const observationEnd = (cell, run) => {
-	const after = observationAfter(cell);
+	const ends = [];
 	const prediction = cell.prediction;
-	if (after === null || prediction.kind !== "window" || prediction.end === null) return null;
-	const from = prediction.end.from;
-	const references = (prediction.each === true ? run.replicas.map((replica) => replica.pod) : [run.target?.pod]).flatMap((pod) => {
-		const at = referenceOf(run, from, pod);
-		return at === null ? [] : [at];
-	});
-	return references.length === 0 ? null : Math.max(...references) + valueIn(after, "ms");
+	if (prediction.kind === "ends" && prediction.band !== null) {
+		const at = referenceOf(run, prediction.from);
+		if (at !== null) ends.push(at + valueIn(prediction.band.hi, "ms") + NOISE);
+	}
+	const after = observationAfter(cell);
+	const window = windowOf(prediction);
+	if (after !== null && window !== null && window.end !== null) {
+		const from = window.end.from;
+		const references = (window.each === true ? run.replicas.map((replica) => replica.pod) : [run.target?.pod]).flatMap((pod) => {
+			const at = referenceOf(run, from, pod);
+			return at === null ? [] : [at];
+		});
+		if (references.length > 0) ends.push(Math.max(...references) + valueIn(after, "ms"));
+	}
+	return ends.length === 0 ? null : Math.max(...ends);
 };
 /** This function gives the facts of a run that each table reads: its failures by outcome and node, and the times of its target. */
 const factsOf = (cell, run) => {
@@ -599,9 +631,83 @@ const checkRun = (cell, run) => {
 			if (problems.length === 0) return done(true, `the rollout waited for Redis, and its first new pod was ready ${sec(firstReady.t - heal)} s after Redis came back`, sec(firstReady.t - heal));
 			return done(false, problems.join("; "), null);
 		}
+		case "ends": return checkEnds(cell, run, prediction, done);
 		case "measured": return done(true, "measured", facts.failures);
 	}
 };
+/**
+* This function judges a run against a prediction `ends`. Each client with an answer before the
+* reference is a client of the run. Its socket is the port of that answer (`lp`).
+* - With a band, the first close of a socket of each client after the reference must be in the band
+*   ± δ. It must be the close of that socket. The main value is the middle of these times.
+* - With no band, no socket of a client can close after the reference. The first request of each client
+*   after the heal must be `ok` on that socket. The main value is the count of the closes.
+*
+* With a window, the failed requests of the run must also agree with that window (`checkRun`).
+*/
+const checkEnds = (cell, run, prediction, done) => {
+	const from = referenceOf(run, prediction.from);
+	if (from === null) return done(false, `the run has no ${prediction.from} reference`, null);
+	const lines = run.lines;
+	const calls = requestsOf(lines).filter((request) => request.t >= run.start && request.t <= run.end).sort((a, b) => a.t - b.t);
+	const last = /* @__PURE__ */ new Map();
+	for (const request of calls) if (request.t < from && request.o === "ok") last.set(request.p, request);
+	if (last.size === 0) return done(false, `no client had an answer before the ${prediction.from}`, null);
+	const clients = [...last.keys()].sort();
+	const shut = socketsOf(lines).filter((line) => line.what === "close" && line.t >= from && line.t <= run.end);
+	const closes = {};
+	const times = [];
+	const problems = [];
+	for (const client of clients) {
+		const close = shut.find((line) => line.p === client);
+		closes[client] = close === void 0 ? null : seconds(sec(close.t - from));
+		if (close !== void 0) times.push(sec(close.t - from));
+	}
+	let agrees;
+	let value;
+	if (prediction.band !== null) {
+		const band = secondsOf(prediction.band);
+		for (const client of clients) {
+			const close = shut.find((line) => line.p === client);
+			const port = last.get(client).lp ?? null;
+			if (close === void 0) problems.push(`the socket of ${client} did not end`);
+			else if (port !== null && close.lp !== null && close.lp !== port) problems.push(`the first socket of ${client} to end had the port ${close.lp}, not the port ${port} of its last answer`);
+			else if (!inBand(sec(close.t - from), band)) problems.push(`the socket of ${client} ended at ${sec(close.t - from)} s`);
+		}
+		const sorted = [...times].sort((a, b) => a - b);
+		value = sorted.length === 0 ? null : middle(sorted);
+		agrees = `the socket of each of ${clients.length} clients ended, at ${sorted.join(", ")} s`;
+	} else {
+		for (const client of clients) {
+			const close = shut.find((line) => line.p === client);
+			if (close !== void 0) problems.push(`the socket of ${client} ended ${sec(close.t - from)} s after the ${prediction.from}`);
+		}
+		const resumed = run.acts.heal ?? from;
+		for (const client of clients) {
+			const port = last.get(client).lp ?? null;
+			const next = calls.find((request) => request.p === client && request.t >= resumed);
+			if (next === void 0) problems.push(`${client} sent no call after the heal`);
+			else if (next.o !== "ok") problems.push(`the first call of ${client} after the heal ended ${next.o}`);
+			else if ((next.lp ?? null) !== port) problems.push(`the first call of ${client} after the heal went on the port ${next.lp ?? "none"}, not ${port ?? "none"}`);
+		}
+		value = times.length;
+		agrees = `no socket of ${clients.length} clients ended, and the first call of each one after the heal went on its socket`;
+	}
+	const inner = prediction.window === void 0 ? null : checkRun({
+		...cell,
+		prediction: prediction.window
+	}, run);
+	if (inner !== null && !inner.ok) problems.push(inner.why);
+	const why = problems.length > 0 ? problems.join("; ") : inner === null ? agrees : `${agrees}; ${inner.why}`;
+	const checked = done(problems.length === 0, why, value, {
+		...inner === null ? {} : inner.facts,
+		closes
+	});
+	return inner?.tail === void 0 ? checked : {
+		...checked,
+		tail: inner.tail
+	};
+};
 /** This function judges a cell on its runs: each counted run must agree, and a median in a band must be equivalent to it. */
 const judgeKind = (cell, runs) => {
 	const counted = runs.filter((run) => !run.warmup && run.void === null);
@@ -641,7 +747,7 @@ const judgeKind = (cell, runs) => {
 		checks
 	};
 	const prediction = cell.prediction;
-	const band = prediction.kind === "removal" || prediction.kind === "leaves" || prediction.kind === "restarts" ? prediction.band : null;
+	const band = prediction.kind === "removal" || prediction.kind === "leaves" || prediction.kind === "restarts" || prediction.kind === "ends" ? prediction.band : null;
 	if (failed > 0) {
 		const first = checks.find((check) => !check.ok);
 		return {
@@ -731,25 +837,34 @@ const upgradeTrigger = (trigger) => {
 		}
 	};
 };
+const upgradeWindow = (window) => {
+	const { afterReset, propagation, ...rest } = window;
+	return {
+		...rest,
+		start: {
+			from: window.start.from,
+			band: band(window.start.band)
+		},
+		end: window.end === null ? null : {
+			from: window.end.from,
+			band: band(window.end.band)
+		},
+		...afterReset === void 0 ? {} : { afterReset: {
+			life: seconds(afterReset.life),
+			outcome: afterReset.outcome
+		} },
+		...propagation === void 0 ? {} : { propagation: band(propagation) }
+	};
+};
 const upgradePrediction = (prediction) => {
 	switch (prediction.kind) {
-		case "window": {
-			const { afterReset, propagation, ...rest } = prediction;
+		case "window": return upgradeWindow(prediction);
+		case "ends": {
+			const { window, ...rest } = prediction;
 			return {
 				...rest,
-				start: {
-					from: prediction.start.from,
-					band: band(prediction.start.band)
-				},
-				end: prediction.end === null ? null : {
-					from: prediction.end.from,
-					band: band(prediction.end.band)
-				},
-				...afterReset === void 0 ? {} : { afterReset: {
-					life: seconds(afterReset.life),
-					outcome: afterReset.outcome
-				} },
-				...propagation === void 0 ? {} : { propagation: band(propagation) }
+				band: prediction.band === null ? null : band(prediction.band),
+				...window === void 0 ? {} : { window: upgradeWindow(window) }
 			};
 		}
 		case "removal":
@@ -776,7 +891,7 @@ const upgradeFacts = (facts) => {
 		by: seconds(old.by)
 	};
 	const byKey = (record) => Object.fromEntries(Object.entries(record).map(([key, old]) => [key, propagated(old)]));
-	const { sliceEmpty, rules, left, signals, updates, healUpdates, ...rest } = facts;
+	const { sliceEmpty, rules, left, signals, updates, healUpdates, closes, ...rest } = facts;
 	return {
 		...rest,
 		intakeAfterDeletion: time$1(facts.intakeAfterDeletion),
@@ -787,7 +902,8 @@ const upgradeFacts = (facts) => {
 		...sliceEmpty === void 0 ? {} : { sliceEmpty: seconds(sliceEmpty) },
 		...rules === void 0 ? {} : { rules: Object.fromEntries(Object.entries(rules).map(([node, old]) => [node, time$1(old)])) },
 		...left === void 0 ? {} : { left: seconds(left) },
-		...signals === void 0 ? {} : { signals: signals.map((old) => time$1(old)) }
+		...signals === void 0 ? {} : { signals: signals.map((old) => time$1(old)) },
+		...closes === void 0 ? {} : { closes: Object.fromEntries(Object.entries(closes).map(([client, old]) => [client, time$1(old)])) }
 	};
 };
 /**
@@ -853,7 +969,7 @@ const atBand = (from, band) => {
 	const { lo, hi } = secondsOf(band);
 	return lo === 0 && hi === 0 ? `the ${from}` : `the ${from} + ${showBand(band)}`;
 };
-/** This function gives the prediction of a cell in a short form for a table. */
+/** This function gives the prediction of a cell in a short form for a table. A prediction `ends` gives its window after its band. */
 const predictionText = (prediction) => {
 	switch (prediction.kind) {
 		case "none": return prediction.outcomes === void 0 ? "no failure" : `no ${prediction.outcomes.join(", ")}`;
@@ -863,6 +979,10 @@ const predictionText = (prediction) => {
 		case "restarts": return prediction.band === null ? "no restart" : `each replica SIGTERM in ${showBand(prediction.band)}`;
 		case "stays": return "stays ready, no refusal";
 		case "stalls": return "the rollout waits for Redis";
+		case "ends": {
+			const closes = prediction.band === null ? "no socket of a client ends, and each one calls again on its socket" : `the socket of each client ends in ${atBand(prediction.from, prediction.band)}`;
+			return prediction.window === void 0 ? closes : `${closes}; ${predictionText(prediction.window)}`;
+		}
 		case "measured": return "measured";
 	}
 };
@@ -964,7 +1084,9 @@ const TRIGGERS = [
 	"app-stall",
 	"rollout",
 	"cpu-throttle",
-	"authorization-policy"
+	"authorization-policy",
+	"idle",
+	"ztunnel-restart"
 ];
 const MODES = [
 	"iptables",
@@ -980,7 +1102,8 @@ const reference = z.enum([
 	"intake",
 	"fault",
 	"resume",
-	"heal"
+	"heal",
+	"restart"
 ]);
 const probe = z.object({
 	period: time,
@@ -1114,33 +1237,34 @@ const recordOf = (a, main) => {
 		lo: a,
 		hi: a
 	});
+	const window = z.object({
+		kind: z.literal("window"),
+		nodes: z.enum(["all", "paused"]),
+		start: z.object({
+			from: reference,
+			band
+		}),
+		end: z.object({
+			from: reference,
+			band
+		}).nullable(),
+		certain: z.boolean(),
+		afterReset: z.object({
+			life: a,
+			outcome: z.string()
+		}).optional(),
+		each: z.boolean().optional(),
+		propagation: band.optional(),
+		outcomes: z.array(z.string()).optional(),
+		why: z.string()
+	});
 	const prediction = z.discriminatedUnion("kind", [
 		z.object({
 			kind: z.literal("none"),
 			outcomes: z.array(z.string()).optional(),
 			why: z.string()
 		}),
-		z.object({
-			kind: z.literal("window"),
-			nodes: z.enum(["all", "paused"]),
-			start: z.object({
-				from: reference,
-				band
-			}),
-			end: z.object({
-				from: reference,
-				band
-			}).nullable(),
-			certain: z.boolean(),
-			afterReset: z.object({
-				life: a,
-				outcome: z.string()
-			}).optional(),
-			each: z.boolean().optional(),
-			propagation: band.optional(),
-			outcomes: z.array(z.string()).optional(),
-			why: z.string()
-		}),
+		window,
 		z.object({
 			kind: z.literal("removal"),
 			band,
@@ -1164,6 +1288,13 @@ const recordOf = (a, main) => {
 			kind: z.literal("stalls"),
 			why: z.string()
 		}),
+		z.object({
+			kind: z.literal("ends"),
+			from: reference,
+			band: band.nullable(),
+			window: window.optional(),
+			why: z.string()
+		}),
 		z.object({
 			kind: z.literal("measured"),
 			why: z.string()
@@ -1180,7 +1311,8 @@ const recordOf = (a, main) => {
 		stack: z.enum(["service", "grpc"]).optional(),
 		mesh: z.object({
 			flavor: z.enum(["sidecar", "ambient"]),
-			mode: z.enum(["sidecar", "ambient"])
+			mode: z.enum(["sidecar", "ambient"]),
+			ztunnel: z.record(z.string(), z.string()).optional()
 		}).optional(),
 		substitutes: z.string().nullable(),
 		mode: z.enum(MODES),
@@ -1241,7 +1373,8 @@ const recordOf = (a, main) => {
 		healUpdates: z.record(z.string(), z.object({
 			after: a.nullable(),
 			by: a
-		}).nullable()).optional()
+		}).nullable()).optional(),
+		closes: z.record(z.string(), a.nullable()).optional()
 	});
 	return {
 		cell,
@@ -1303,6 +1436,6 @@ const readRecord = (data) => {
 	throw new Error(`a kind cell record has the format ${FORMAT} or ${FORMAT_V1}, not ${String(format)}`);
 };
 //#endregion
-export { slicesOf as $, medianInterval as A, intakeOf as B, propagationOf as C, unitOf as D, reusesReset as E, byNode as F, recordsOf as G, outcomesOf as H, deletionOf as I, rulesOf as J, requestsOf as K, dropOf as L, quantileOf as M, backendsAt as N, updatesOf as O, byClients as P, sliceEmptyOf as Q, emptyOf as R, observationEnd as S, referenceOf as T, podsAt as U, kernelCounts as V, podsOf as W, signalsOf as X, signalOf as Y, sliceDropOf as Z, checkRun as _, calibrationOf as a, PORT as at, judgeKind as b, predictionText as c, bandOf as ct, FORMAT_V1 as d, showBand as dt, stoppingOf as et, judge as f, LAST_SLACK as g, KIND_NOISE as h, readRecord as i, LOG_LABEL as it, middle as j, RELATIVE as k, timeSpread as l, seconds as lt, upgradeCell as m, kindCellRecordSchema as n, CLIENT as nt, cellsTable as o, REDIS as ot, upgrade as p, restartsAt as q, kindCellRecordV1Schema as r, HEALTH_PORT as rt, medianText as s, SERVER as st, STAGES as t, transitionOf as tt, FORMAT as u, secondsOf as ut, deletionsOf as v, propagationSource as w, observationAfter as x, factsOf as y, failuresOf as z };
+export { sliceEmptyOf as $, medianInterval as A, intakeOf as B, propagationOf as C, unitOf as D, reusesReset as E, byNode as F, recordsOf as G, outcomesOf as H, deletionOf as I, restartsAt as J, requestsOf as K, dropOf as L, quantileOf as M, backendsAt as N, updatesOf as O, byClients as P, sliceDropOf as Q, emptyOf as R, observationEnd as S, referenceOf as T, podsAt as U, kernelCounts as V, podsOf as W, signalOf as X, rulesOf as Y, signalsOf as Z, checkRun as _, calibrationOf as a, ztunnelReplaced as at, judgeKind as b, predictionText as c, LOG_LABEL as ct, FORMAT_V1 as d, SERVER as dt, slicesOf as et, judge as f, bandOf as ft, LAST_SLACK as g, KIND_NOISE as h, showBand as ht, readRecord as i, ztunnelPodsOf as it, middle as j, RELATIVE as k, timeSpread as l, PORT as lt, upgradeCell as m, secondsOf as mt, kindCellRecordSchema as n, stoppingOf as nt, cellsTable as o, CLIENT as ot, upgrade as p, seconds as pt, restartOf as q, kindCellRecordV1Schema as r, transitionOf as rt, medianText as s, HEALTH_PORT as st, STAGES as t, socketsOf as tt, FORMAT as u, REDIS as ut, deletionsOf as v, propagationSource as w, observationAfter as x, factsOf as y, failuresOf as z };
 
-//# sourceMappingURL=judge-Bkbs7VVG.js.map
+//# sourceMappingURL=judge-CmiF-Fcs.js.map