@mark1russell7/service 0.5.14 → 0.5.16

package/README.md

@@ -15,9 +15,14 @@ This release has the declaration, its export, the law, the health runtime, the l
 - **Keyed operations.** A keyed operation has the window that the server keeps its key for. `mayReissue` answers from the declaration of an operation. An operation without a declaration does not go again.
 - **The law.** `evaluate` and `verdictOf` decide one rule of the timer-ordering law on one binding. A rule is data: linear inequalities over `symbol@hop`, with a margin. A verdict is `holds`, `violated`, `unbounded` (it holds only because a timer is absent) or `depends` (nothing is bound).
 - **The linter.** `lint(description, scenario, rules)` applies the service rules (`SERVICE_RULES`) to a declaration. The declaration binds the symbols of the service: the polls of its checks, the windows of its policies, its drain. The scenario binds the symbols of the platform and of each dependency. A `depends` finding names the symbols that have no bound.
+- **The claims of a scenario.** A default is true only for a version: the keep-alive of Node is 5 s, but 65 s on main. Thus a value of the scenario can be a claim that names its epoch: `{ epoch: "node@22", value }`. Each finding then gives the epoch of each value that its rule reads (`epochs`).
+- **A measured value.** A claim can give a distribution by its statistics: `{ epoch, distribution: { p50, p99 } }`. The law binds the p99. A distribution without a p99 binds nothing, thus each rule that reads it depends.
+- **The four ways that a pod stops.** `STOPS` gives the steps of each way. A deletion and a liveness restart have the preStop hook and the drain. A crash and an OOM stop have neither. `lintStop(description, scenario, rules, way)` applies only the rules of the drain that guard that way: O04 for a deletion, O09 for a liveness restart. For a crash or an OOM stop, a finding of `STOP_RULE` depends on the time until the kubelet finds the exit.
 - **The scopes of a rule.** A rule about a client applies one time for each dependency. A rule about a consumer, for example O20, applies one time for each consumer and each worker.
 - **The loops of a progress check.** A check of the step `progress` can name the loops that mark it, with its stall time: `marks: { loops, stall }`. Each loop is a check or a worker of the service.
 - **The stall time.** `lint()` compares the stall time with the longest gap between two marks of the slowest loop (`PROGRESS_RULE`). A loop marks at the end of each turn, also a turn that fails. The gap of a check is `interval × (1 + jitter) + timeout`. The gap of a worker is its sleep or its longest backoff, the longer one, plus `unit_processing_time`. At 300 s ± 20 % and a timeout of 10 s, a poll gives 370 s.
+- **The marks of the timers.** A harness that runs a service k times faster scales its timers. Each timer has a mark: `scalable`, `fixed`, `stepped` (only multiples of a step) or `floored` (a peer sets a floor).
+- **The compression of a service.** `compressionOf(description, scenario, rules, k, marks)` gives each rule and scope whose verdict the compression changes. It also names the symbols that have no mark. `PLATFORM_MARKS` marks the timers of Kubernetes. For example, the propagation of the endpoints is `fixed`, thus a compression of the hold of O04 can break O04.
 - **A name that is not a loop.** A name that is not a check or a worker gets a `depends` finding. Without `marks`, a check gets no finding of this rule.
 - **Keyed limiters.** `svc.limiter(name, spec)` declares a rate limit for each key, as data. `keyedLimiter` makes its runtime on a store ([The keyed limiter](#the-keyed-limiter)).
 - **The hold.** The cap of the `fail readiness` phase binds `readiness_hold@process`, and a service without that phase holds for zero. The hold keeps the listener open after the signal, as a preStop sleep does. Thus O04 can compare the sum of the two with the propagation of the endpoints.

package/build/index.d.ts

@@ -84,6 +84,55 @@ export declare const evaluate: (rule: Rule, bind: Binding) => Evaluated[];
  * applies, the arithmetic cannot decide, and the verdict is "depends".
  */
 export declare const verdictOf: (rule: Rule, bind: Binding, evaluated: readonly Evaluated[]) => Verdict;
+/**
+ * A mark tells how a timer moves when a compression scales time by k (E10). A "scalable" timer
+ * becomes k times its value. A "fixed" timer keeps its value. A "stepped" timer takes only
+ * multiples of its step, thus it rounds up. A "floored" timer has a floor that a peer sets, for
+ * example the minimum retransmission timeout of the kernel. The step and the floor are in seconds.
+ */
+type TimerMark = {
+  readonly kind: "scalable";
+} | {
+  readonly kind: "fixed";
+} | {
+  readonly kind: "stepped";
+  readonly step: number;
+} | {
+  readonly kind: "floored";
+  readonly floor: number;
+  readonly by: string;
+};
+/** The marks map `symbol@hop` to a mark. A bare symbol marks the symbol at each hop. */
+type TimerMarks = Readonly<Record<string, TimerMark | undefined>>;
+/** A compressed binding, and the symbols that have no mark. */
+interface Compressed {
+  readonly bind: Binding;
+  /** These symbols have no mark. They keep their values, thus the compression proves nothing about them. */
+  readonly unmarked: readonly string[];
+}
+/** A change is a rule whose verdict a compression changes. */
+interface Change {
+  readonly rule: string;
+  readonly before: Verdict;
+  readonly after: Verdict;
+}
+/** The result of a compression: the rules whose verdict it changes, and the symbols of the rules that have no mark. */
+interface Compression {
+  readonly changed: readonly Change[];
+  readonly unmarked: readonly string[];
+}
+/**
+ * This function scales each timer of a binding by k, by its mark (E10). An absent timer ("inf" or
+ * "off") stays absent. A chain scales each value. The margins of the binding and the constants of
+ * the rules do not scale: they are tolerances, not timers. A symbol with no mark keeps its value.
+ */
+export declare const compress: (bind: Binding, k: number, marks: TimerMarks) => Compressed;
+/**
+ * This function tells which rules a compression by k changes. A compression keeps each ordering
+ * when no verdict changes. A change in either direction counts: a violation that the compression
+ * hides is as wrong as one that it makes. The unmarked symbols are the symbols that the rules read.
+ */
+export declare const compression: (rules: readonly Rule[], bind: Binding, k: number, marks: TimerMarks) => Compression;
 //#endregion
 //#region src/lint.d.ts
 /**
@@ -96,10 +145,31 @@ export declare const verdictOf: (rule: Rule, bind: Binding, evaluated: readonly
  * A rule about a client applies one time for each dependency. A rule about a consumer applies one
  * time for each consumer and each worker. A rule about a limiter applies one time for each limiter.
  */
+/** A statistic of a measured distribution. The law binds p99 (`LAW_STATISTIC`). */
+type Statistic = "p50" | "p90" | "p99" | "p999" | "max";
+/** The law binds this statistic of a distribution. */
+export declare const LAW_STATISTIC: Statistic;
+/**
+ * A claim is a value of the scenario that names its epoch: the component and the version that give
+ * it, for example "node@22" (E2). A default is true only for a version: the keep-alive of Node is
+ * 5 s, but 65 s on main. A claim gives a set value, or a measured distribution by its statistics.
+ */
+type Claim = {
+  readonly epoch: string;
+  readonly value: Extent;
+} | {
+  readonly epoch: string;
+  readonly distribution: Readonly<Partial<Record<Statistic, Quantity>>>;
+};
+/**
+ * A value of the scenario is an amount, or a claim. An amount names no epoch, thus the finding of
+ * each rule that reads it gives null for its epoch.
+ */
+type ScenarioValue = Extent | Claim;
 /** A scenario gives the values of the platform and of each dependency, by the `symbol@hop` of the law. */
 interface Scenario {
   /** These are the values of the platform: prestop_sleep@pod, termination_grace@pod, probe_period@pod, propagation_bound@cluster. */
-  readonly platform: Readonly<Record<string, Extent>>;
+  readonly platform: Readonly<Record<string, ScenarioValue>>;
   /**
    * These are the probe windows of the kubelet, period × failure threshold. They add to the
    * windows of the declaration. A probe reads the cached verdict, thus detection is the latch,
@@ -110,16 +180,18 @@ interface Scenario {
     readonly liveness: Quantity;
   };
   /** These are the values of each dependency, by its name: failover_time@dependency, server_idle_close@server. */
-  readonly dependencies?: Readonly<Record<string, Readonly<Record<string, Extent>>>> | undefined;
+  readonly dependencies?: Readonly<Record<string, Readonly<Record<string, ScenarioValue>>>> | undefined;
   /** These are the values of the source of each consumer and worker, by its name and by the `symbol@hop` of the law: lease_duration@broker. */
-  readonly transports?: Readonly<Record<string, Readonly<Record<string, Extent>>>> | undefined;
+  readonly transports?: Readonly<Record<string, Readonly<Record<string, ScenarioValue>>>> | undefined;
   /**
    * These are the values of the callers of each limiter, by its name and by the `symbol@hop` of the
    * law: client_retry_window@caller, retry_delay@caller. A symbol without a hop binds at `caller`.
    */
-  readonly limiters?: Readonly<Record<string, Readonly<Record<string, Extent>>>> | undefined;
+  readonly limiters?: Readonly<Record<string, Readonly<Record<string, ScenarioValue>>>> | undefined;
 }
-/** A finding is the verdict of one rule for one scope: the service, or the client of a dependency. */
+/** The epochs of a scope map each symbol that the scenario binds to the epoch of its value, or null when the value names none. */
+type Epochs = Readonly<Record<string, string | null>>;
+/** A finding is the verdict of one rule for one scope: the service, or the client of a dependency. When a value of the scenario names an epoch, the finding gives the epoch of each value that the rule reads. */
 interface Finding {
   readonly rule: string;
   readonly scope: string;
@@ -129,6 +201,8 @@ interface Finding {
   readonly evaluated: readonly Evaluated[];
   /** These are the symbols that have no bound. A "depends" verdict waits for them. */
   readonly unbound: readonly string[];
+  /** These are the epochs of the symbols of the rule that the scenario binds (E2). Thus a finding is true for these versions. */
+  readonly epochs?: Epochs | undefined;
 }
 /** These are the identifiers of the rules that each declaration gets. */
 export declare const SERVICE_RULES: readonly string[];
@@ -150,11 +224,31 @@ export declare const LIMITER_RULES: readonly Rule[];
 export declare const serviceBindings: (svc: ServiceDescription, scenario: Scenario) => {
   readonly bind: Record<string, Bound>;
   readonly from: Record<string, string>;
+  readonly epochs: Epochs;
 };
 /** This identifier is the rule of the findings about a field that the declaration does not give. */
 export declare const DECLARATION_RULE = "declaration";
 /** This identifier is the rule of the findings about the stall time of a progress check (`Check.marks`). */
 export declare const PROGRESS_RULE = "progress";
+/**
+ * These are the marks of the timers of the platform (E10). Kubernetes takes the probe period, the
+ * preStop sleep and the termination grace in whole seconds, thus each is stepped by 1 s. The
+ * cluster sets the propagation of the endpoints, thus a compression of the service cannot scale it.
+ */
+export declare const PLATFORM_MARKS: TimerMarks;
+/** A change of a compression of a service: a rule and a scope whose verdict the compression changes. */
+interface ScopedChange extends Change {
+  readonly scope: string;
+}
+/**
+ * This function tells which findings of `lint` a compression by k changes (E10). It scales the
+ * bindings of each scope by the marks. Thus a harness that runs the service k times faster learns
+ * the orderings that its run breaks. The unmarked symbols are the symbols of the rules with no mark.
+ */
+export declare const compressionOf: (svc: ServiceDescription, scenario: Scenario, rules: readonly Rule[], k: number, marks: TimerMarks) => {
+  readonly changed: readonly ScopedChange[];
+  readonly unmarked: readonly string[];
+};
 /**
  * This function applies each service rule to a declaration and a scenario. A rule applies one time
  * for the service, for each client, for each consumer and worker, or for each limiter. The function
@@ -163,6 +257,52 @@ export declare const PROGRESS_RULE = "progress";
  */
 export declare const lint: (svc: ServiceDescription, scenario: Scenario, rules: readonly Rule[]) => Finding[];
 //#endregion
+//#region src/stops.d.ts
+/**
+ * This module keeps apart the four ways that a pod stops (B11). Each way runs a different part of
+ * the shutdown, thus a different set of the rules of the drain guards it.
+ */
+/** A way that a pod stops: a deletion, a liveness restart, a crash, or a stop for lack of memory (OOM). */
+type StopWay = "deletion" | "liveness-restart" | "crash" | "oom";
+/** What a way of stopping runs, and the rules of the drain that guard it. */
+interface Stop {
+  readonly way: StopWay;
+  /** This is the signal that the process gets first, or null when the process exits by itself. */
+  readonly signal: "SIGTERM" | "SIGKILL" | null;
+  /** This flag tells if the kubelet runs the preStop hook. */
+  readonly preStop: boolean;
+  /** This flag tells if the process runs its shutdown phases. */
+  readonly drain: boolean;
+  /**
+   * This is how the pod leaves its endpoints: by its deletion, when its readiness fails, or when
+   * the kubelet finds that the container exited.
+   */
+  readonly leaves: "deletion" | "readiness" | "exit";
+  /** These are the identifiers of the rules of the drain that guard this way. */
+  readonly rules: readonly string[];
+}
+/** These are the rules of the drain. Each way of stopping applies only its own rules of this set. */
+export declare const DRAIN_RULE_IDS: readonly string[];
+/**
+ * These are the four ways that a pod stops.
+ * - A deletion runs the preStop hook, then SIGTERM. The endpoints drop the pod at its deletion,
+ *   thus the preStop sleep and the hold must cover the propagation (O04).
+ * - A liveness restart also runs the preStop hook and SIGTERM, with the grace. The pod stays in its
+ *   endpoints until its readiness fails, thus readiness must fail first (O09).
+ * - A crash and an OOM stop run no hook and no drain. The kubelet finds the exit at its relist, and
+ *   no rule bounds that time. A client that can reissue a request is the only guard.
+ */
+export declare const STOPS: Readonly<Record<StopWay, Stop>>;
+/** The identifier of the finding of a way of stopping that runs no drain. */
+export declare const STOP_RULE = "stop";
+/**
+ * This function applies the rules to a declaration for one way of stopping. A rule of the drain
+ * applies only when it guards that way. The other rules apply as `lint()` applies them. A way with
+ * no drain also gets a finding of `STOP_RULE` that depends. No rule bounds the time until the
+ * kubelet finds the exit, and the work in flight is lost.
+ */
+export declare const lintStop: (svc: ServiceDescription, scenario: Scenario, rules: readonly Rule[], way: StopWay) => Finding[];
+//#endregion
 //#region src/worker.d.ts
 /**
  * These are the knobs of a worker loop, by the names of the ordering law where the law has them.
@@ -292,5 +432,5 @@ export declare const drainMachine: (description: ServiceDescription) => Machine;
 /** These are the static machines of the runtime, by the name that their events carry. */
 export declare const MACHINES: Readonly<Record<Exclude<MachineName, "drain" | "client">, Machine>>;
 //#endregion
-export { type Allowed, type Backoff, type Binding, type Bound, type Cancel, type Check, type CheckFn, type CheckMetrics, type CheckVerdict, type Clock, type Controller, type ControllerBuilder, type CooperativeFloor, type Coupling, DURATION_FRACTIONS, type Decision, type DelayBand, type Dependency, type DependencyHandle, type DurationHistogram, EPISODES_KEPT, EXIT_SIGNALS, type EmbeddedProcess, type Episode, type Evaluated, type ExitCodes, type ExitSignal, type ExitTrigger, FORMAT, type FailsBy, type Finding, type Gate, type Health, type HealthMetrics, type HealthServer, type HealthVerdict, type Heartbeat, type HeartbeatOptions, type HostStream, type Idempotency, type Inequality, type IterationContext, type Jitter, type JobAction, type JobContext, type JobFailure, type JobSettle, type JobSource, type KeyState, type KeyedLimiter, type Lifecycle, type LifecycleEvent, type LifecycleState, type LimitPolicy, type LimitRule, type Limiter, type LimiterEviction, type LimiterSpec, type LimiterState, type LimiterStore, type LimiterStoreSpec, type MachineName, type MemoryStore, type MessageShape, type MessageTrigger, type Operation, type OperationOf, type Outcome, PROCESS_TRIGGERS, type Phase, type PhaseContext, type PhaseWork, type PlatformClockOptions, type PodTiming, type Poll, type ProbeAnswer, type ProbeKind, type ProcessHost, type ProcessPort, type ProcessTrigger, type Profile, type ProgressMarks, type QueueDrain, type QueueDrainOptions, type QueueKnobs, type Recorder, type RedeliveryPolicy, type RefusalCause, type Refused, type RepeatSignal, type RequestEnd, type RequestEvent, type RequestFn, type RequestOptions, type RequestStream, type RequestWork, type RequeueCause, type Result, type RoutePattern, type RouteRequest, type Rule, type RunOptions, SLIDING_WINDOW_MACHINE, STAGES, type Scenario, type ServiceBuilder, type ServiceDescription, type ShutdownOptions, type Side, type SlidingWindow, type Span, type Stage, type StartOptions, type Step, type StoreFailure, TOKEN_BUCKET_MACHINE, type TakeRequest, type TakeStep, type Term, type Timing, type TokenBucket, type Transport, type TransportImpl, type UnitRequest, type Verdict, type Watchdog, type WatchdogSpec, type WorkerKnobs, type WorkerLoop, type WorkerLoopOptions, asDebounce, asWindow, backoffBand, backoffDelay, backoffProblems, cooperativeAbortAt, daemon, decide, detectionTime, embeddedProcess, ephemeral, failSpan, freeAt, heartbeat, heartbeatDetection, idleSpan, isExitCode, isExitSignal, isMessageShape, keyedLimiter, kubernetes, limitRule, limiterMachine, limiterProblems, limiterStateOf, localDev, longestRetryAfter, matchesMessage, mayReissue, memoryStore, nodeProcess, platformClock, processPortOf, queueDrain, realClock, recoverSpan, redact, redeliverOnce, replay, retryAfterSeconds, service, stageRank, watchdog };
+export { type Allowed, type Backoff, type Binding, type Bound, type Cancel, type Change, type Check, type CheckFn, type CheckMetrics, type CheckVerdict, type Claim, type Clock, type Compressed, type Compression, type Controller, type ControllerBuilder, type CooperativeFloor, type Coupling, DURATION_FRACTIONS, type Decision, type DelayBand, type Dependency, type DependencyHandle, type DurationHistogram, EPISODES_KEPT, EXIT_SIGNALS, type EmbeddedProcess, type Episode, type Epochs, type Evaluated, type ExitCodes, type ExitSignal, type ExitTrigger, FORMAT, type FailsBy, type Finding, type Gate, type Health, type HealthMetrics, type HealthServer, type HealthVerdict, type Heartbeat, type HeartbeatOptions, type HostStream, type Idempotency, type Inequality, type IterationContext, type Jitter, type JobAction, type JobContext, type JobFailure, type JobSettle, type JobSource, type KeyState, type KeyedLimiter, type Lifecycle, type LifecycleEvent, type LifecycleState, type LimitPolicy, type LimitRule, type Limiter, type LimiterEviction, type LimiterSpec, type LimiterState, type LimiterStore, type LimiterStoreSpec, type MachineName, type MemoryStore, type MessageShape, type MessageTrigger, type Operation, type OperationOf, type Outcome, PROCESS_TRIGGERS, type Phase, type PhaseContext, type PhaseWork, type PlatformClockOptions, type PodTiming, type Poll, type ProbeAnswer, type ProbeKind, type ProcessHost, type ProcessPort, type ProcessTrigger, type Profile, type ProgressMarks, type QueueDrain, type QueueDrainOptions, type QueueKnobs, type Recorder, type RedeliveryPolicy, type RefusalCause, type Refused, type RepeatSignal, type RequestEnd, type RequestEvent, type RequestFn, type RequestOptions, type RequestStream, type RequestWork, type RequeueCause, type Result, type RoutePattern, type RouteRequest, type Rule, type RunOptions, SLIDING_WINDOW_MACHINE, STAGES, type Scenario, type ScenarioValue, type ScopedChange, type ServiceBuilder, type ServiceDescription, type ShutdownOptions, type Side, type SlidingWindow, type Span, type Stage, type StartOptions, type Statistic, type Step, type Stop, type StopWay, type StoreFailure, TOKEN_BUCKET_MACHINE, type TakeRequest, type TakeStep, type Term, type TimerMark, type TimerMarks, type Timing, type TokenBucket, type Transport, type TransportImpl, type UnitRequest, type Verdict, type Watchdog, type WatchdogSpec, type WorkerKnobs, type WorkerLoop, type WorkerLoopOptions, asDebounce, asWindow, backoffBand, backoffDelay, backoffProblems, cooperativeAbortAt, daemon, decide, detectionTime, embeddedProcess, ephemeral, failSpan, freeAt, heartbeat, heartbeatDetection, idleSpan, isExitCode, isExitSignal, isMessageShape, keyedLimiter, kubernetes, limitRule, limiterMachine, limiterProblems, limiterStateOf, localDev, longestRetryAfter, matchesMessage, mayReissue, memoryStore, nodeProcess, platformClock, processPortOf, queueDrain, realClock, recoverSpan, redact, redeliverOnce, replay, retryAfterSeconds, service, stageRank, watchdog };
 //# sourceMappingURL=index.d.ts.map

package/build/index.js

@@ -2318,8 +2318,74 @@ const verdictOf = (rule, bind, evaluated) => {
 	const all = inequalities(rule);
 	return applicable.some((index) => readsAbsent(all[index], bind)) ? "unbounded" : "holds";
 };
+/** This function gives the mark of a symbol: its mark at its hop, else the mark of the bare symbol. */
+const markOf = (marks, key) => marks[key] ?? marks[key.split("@")[0] ?? key];
+const STEP_EPSILON = 1e-9;
+const scaled = (seconds, k, mark) => {
+	switch (mark.kind) {
+		case "scalable": return seconds * k;
+		case "fixed": return seconds;
+		case "stepped": return Math.max(Math.ceil(seconds * k / mark.step - STEP_EPSILON), 0) * mark.step;
+		case "floored": return Math.max(seconds * k, mark.floor);
+	}
+};
+/**
+* This function scales each timer of a binding by k, by its mark (E10). An absent timer ("inf" or
+* "off") stays absent. A chain scales each value. The margins of the binding and the constants of
+* the rules do not scale: they are tolerances, not timers. A symbol with no mark keeps its value.
+*/
+const compress = (bind, k, marks) => {
+	if (!Number.isFinite(k) || k <= 0) throw new RangeError(`a compression scales time by a finite factor above 0, not ${k}`);
+	const out = {};
+	const unmarked = [];
+	for (const [key, bound] of Object.entries(bind)) {
+		if (key === "margin" || key === "margins") continue;
+		const mark = markOf(marks, key);
+		if (mark === void 0) {
+			if (bound !== void 0) unmarked.push(key);
+			out[key] = bound;
+		} else if (typeof bound === "number") out[key] = scaled(bound, k, mark);
+		else if (Array.isArray(bound)) out[key] = bound.map((seconds) => scaled(seconds, k, mark));
+		else out[key] = bound;
+	}
+	const margins = {
+		...bind.margin !== void 0 ? { margin: bind.margin } : {},
+		...bind.margins !== void 0 ? { margins: bind.margins } : {}
+	};
+	return {
+		bind: {
+			...out,
+			...margins
+		},
+		unmarked
+	};
+};
+/**
+* This function tells which rules a compression by k changes. A compression keeps each ordering
+* when no verdict changes. A change in either direction counts: a violation that the compression
+* hides is as wrong as one that it makes. The unmarked symbols are the symbols that the rules read.
+*/
+const compression = (rules, bind, k, marks) => {
+	const compressed = compress(bind, k, marks);
+	const changed = rules.flatMap((rule) => {
+		const before = verdictOf(rule, bind, evaluate(rule, bind));
+		const after = verdictOf(rule, compressed.bind, evaluate(rule, compressed.bind));
+		return before === after ? [] : [{
+			rule: rule.id,
+			before,
+			after
+		}];
+	});
+	const read = new Set(rules.flatMap(symbolsOf));
+	return {
+		changed,
+		unmarked: compressed.unmarked.filter((symbol) => read.has(symbol))
+	};
+};
 //#endregion
 //#region src/lint.ts
+/** The law binds this statistic of a distribution. */
+const LAW_STATISTIC = "p99";
 /** These are the identifiers of the rules that each declaration gets. */
 const SERVICE_RULES = [
 	"O04",
@@ -2410,6 +2476,35 @@ const LIMITER_RULES = [{
 const secondsOf = (amount) => rationals.toNumber(convertExact(rationals.fromNumber(amount.value), amount.unit, "s"));
 /** This function gives an amount, or no bound, as the law binds it. */
 const boundOf = (amount) => amount.value === "infinite" ? "inf" : secondsOf(amount);
+/**
+* This function gives a value of the scenario as the law binds it, with its epoch. A distribution
+* binds its p99. A distribution without a p99 binds nothing, thus each rule that reads it depends.
+*/
+const claimOf = (value) => {
+	if (!("epoch" in value)) return {
+		bound: boundOf(value),
+		epoch: null
+	};
+	if ("value" in value) return {
+		bound: boundOf(value.value),
+		epoch: value.epoch
+	};
+	const statistic = value.distribution["p99"];
+	return {
+		bound: statistic === void 0 ? void 0 : secondsOf(statistic),
+		epoch: value.epoch
+	};
+};
+/** This function binds each value of a part of the scenario, at the symbol that `at` gives, and records its epoch. */
+const bindScenario = (values, at, bind, epochs) => {
+	for (const [symbol, value] of Object.entries(values)) {
+		const claim = claimOf(value);
+		const key = at(symbol);
+		epochs[key] = claim.epoch;
+		if (claim.bound !== void 0) bind[key] = claim.bound;
+		else delete bind[key];
+	}
+};
 /** This function tells if a unit is a time. A unit that the package does not know is not a time. */
 const isTime = (unit) => {
 	try {
@@ -2424,6 +2519,7 @@ const most = (values) => values.length === 0 ? void 0 : Math.max(...values);
 const serviceBindings = (svc, scenario) => {
 	const bind = {};
 	const from = {};
+	const epochs = {};
 	const set = (symbol, bound, said) => {
 		if (bound === void 0) return;
 		bind[symbol] = bound;
@@ -2446,18 +2542,25 @@ const serviceBindings = (svc, scenario) => {
 	set("cooperative_window@process", boundOf(svc.shutdown.cooperativeWindow), "the declared cooperative window");
 	const hold = svc.shutdown.phases.find((phase) => phase.name === "fail readiness");
 	set("readiness_hold@process", hold === void 0 ? 0 : secondsOf(hold.cap), hold === void 0 ? "no fail readiness phase: the intake stops at once after the signal" : "the cap of the fail readiness phase, which holds while the endpoints update");
-	for (const [symbol, amount] of Object.entries(scenario.platform)) set(symbol, boundOf(amount), "the scenario");
+	bindScenario(scenario.platform, (symbol) => symbol, bind, epochs);
+	for (const [symbol, epoch] of Object.entries(epochs)) if (bind[symbol] === void 0) delete from[symbol];
+	else from[symbol] = epoch === null ? "the scenario" : `the scenario, for ${epoch}`;
 	return {
 		bind,
-		from
+		from,
+		epochs
 	};
 };
 /** This function gives the client knobs of a dependency at @client, and the values of the scenario at its own hops. */
 const dependencyBindings = (dependency, scenario) => {
 	const bind = {};
+	const epochs = {};
 	for (const [knob, amount] of Object.entries(dependency.knobs)) bind[`${knob}@client`] = boundOf(amount);
-	for (const [symbol, amount] of Object.entries(scenario.dependencies?.[dependency.name] ?? {})) bind[symbol.includes("@") ? symbol : `${symbol}@dependency`] = boundOf(amount);
-	return bind;
+	bindScenario(scenario.dependencies?.[dependency.name] ?? {}, (symbol) => symbol.includes("@") ? symbol : `${symbol}@dependency`, bind, epochs);
+	return {
+		bind,
+		epochs
+	};
 };
 /**
 * These are the hops of the law at which the knobs of a transport bind, by its kind. A worker does
@@ -2474,12 +2577,16 @@ const TRANSPORT_HOPS = {
 */
 const transportBindings = (transport, hop, scenario) => {
 	const bind = {};
+	const epochs = {};
 	for (const [knob, amount] of Object.entries(transport.knobs)) {
 		if (!isTime(amount.unit)) continue;
 		bind[knob.includes("@") ? knob : `${knob}@${hop}`] = boundOf(amount);
 	}
-	for (const [symbol, amount] of Object.entries(scenario.transports?.[transport.name] ?? {})) bind[symbol] = boundOf(amount);
-	return bind;
+	bindScenario(scenario.transports?.[transport.name] ?? {}, (symbol) => symbol, bind, epochs);
+	return {
+		bind,
+		epochs
+	};
 };
 /**
 * This function gives the symbols of a limiter, and the values of the scenario for its callers.
@@ -2493,8 +2600,12 @@ const limiterBindings = (limiter, scenario) => {
 		"retry_after@limiter": retryAfterSeconds(longestRetryAfter(limiter.policy)),
 		"retry_after_at_cap@limiter": retryAfterSeconds(idleSpan(limiter.policy))
 	};
-	for (const [symbol, amount] of Object.entries(scenario.limiters?.[limiter.name] ?? {})) bind[symbol.includes("@") ? symbol : `${symbol}@caller`] = boundOf(amount);
-	return bind;
+	const epochs = {};
+	bindScenario(scenario.limiters?.[limiter.name] ?? {}, (symbol) => symbol.includes("@") ? symbol : `${symbol}@caller`, bind, epochs);
+	return {
+		bind,
+		epochs
+	};
 };
 const SCOPED = /@(client|dependency|server)$/;
 const TRANSPORT_SCOPED = /@consumer$/;
@@ -2644,6 +2755,79 @@ const progressFindings = (svc) => {
 	}
 	return findings;
 };
+/** This function gives the scopes of a rule that reads these symbols: the service, each client, each consumer and worker, or each limiter. */
+const scopesOf = (svc, scenario, service, symbols) => {
+	const within = (name, scoped) => {
+		const bind = {
+			...service.bind,
+			...scoped.bind
+		};
+		for (const symbol of Object.keys(scoped.epochs)) if (!(symbol in scoped.bind)) delete bind[symbol];
+		return [
+			name,
+			bind,
+			{
+				...service.epochs,
+				...scoped.epochs
+			}
+		];
+	};
+	return symbols.some((symbol) => LIMITER_SCOPED.test(symbol)) ? (svc.limiters ?? []).map((limiter) => within(limiter.name, limiterBindings(limiter, scenario))) : symbols.some((symbol) => TRANSPORT_SCOPED.test(symbol)) ? svc.transports.flatMap((transport) => {
+		const hop = TRANSPORT_HOPS[transport.kind];
+		return hop === null ? [] : [within(transport.name, transportBindings(transport, hop, scenario))];
+	}) : symbols.some((symbol) => SCOPED.test(symbol)) ? svc.dependencies.map((dependency) => within(dependency.name, dependencyBindings(dependency, scenario))) : [[
+		svc.name,
+		service.bind,
+		service.epochs
+	]];
+};
+/** This function gives the epochs of the symbols of a rule that the scenario binds. */
+const epochsOf = (symbols, epochs) => Object.fromEntries(symbols.flatMap((symbol) => symbol in epochs ? [[symbol, epochs[symbol] ?? null]] : []));
+/**
+* These are the marks of the timers of the platform (E10). Kubernetes takes the probe period, the
+* preStop sleep and the termination grace in whole seconds, thus each is stepped by 1 s. The
+* cluster sets the propagation of the endpoints, thus a compression of the service cannot scale it.
+*/
+const PLATFORM_MARKS = {
+	"probe_period@pod": {
+		kind: "stepped",
+		step: 1
+	},
+	"prestop_sleep@pod": {
+		kind: "stepped",
+		step: 1
+	},
+	"termination_grace@pod": {
+		kind: "stepped",
+		step: 1
+	},
+	"propagation_bound@cluster": { kind: "fixed" }
+};
+/**
+* This function tells which findings of `lint` a compression by k changes (E10). It scales the
+* bindings of each scope by the marks. Thus a harness that runs the service k times faster learns
+* the orderings that its run breaks. The unmarked symbols are the symbols of the rules with no mark.
+*/
+const compressionOf = (svc, scenario, rules, k, marks) => {
+	const service = serviceBindings(svc, scenario);
+	const changed = [];
+	const unmarked = /* @__PURE__ */ new Set();
+	for (const rule of rules) {
+		if (!SERVICE_RULES.includes(rule.id)) continue;
+		for (const [scope, bind] of scopesOf(svc, scenario, service, symbolsOf(rule))) {
+			const result = compression([rule], bind, k, marks);
+			for (const change of result.changed) changed.push({
+				...change,
+				scope
+			});
+			for (const symbol of result.unmarked) unmarked.add(symbol);
+		}
+	}
+	return {
+		changed,
+		unmarked: [...unmarked]
+	};
+};
 /**
 * This function applies each service rule to a declaration and a scenario. A rule applies one time
 * for the service, for each client, for each consumer and worker, or for each limiter. The function
@@ -2651,26 +2835,14 @@ const progressFindings = (svc) => {
 * Each progress check that names its loops also gets its findings (`PROGRESS_RULE`).
 */
 const lint = (svc, scenario, rules) => {
-	const service = serviceBindings(svc, scenario).bind;
+	const service = serviceBindings(svc, scenario);
 	const findings = [...declarationFindings(svc), ...progressFindings(svc)];
 	for (const rule of rules) {
 		if (!SERVICE_RULES.includes(rule.id)) continue;
 		const symbols = symbolsOf(rule);
-		const scopes = symbols.some((symbol) => LIMITER_SCOPED.test(symbol)) ? (svc.limiters ?? []).map((limiter) => [limiter.name, {
-			...service,
-			...limiterBindings(limiter, scenario)
-		}]) : symbols.some((symbol) => TRANSPORT_SCOPED.test(symbol)) ? svc.transports.flatMap((transport) => {
-			const hop = TRANSPORT_HOPS[transport.kind];
-			return hop === null ? [] : [[transport.name, {
-				...service,
-				...transportBindings(transport, hop, scenario)
-			}]];
-		}) : symbols.some((symbol) => SCOPED.test(symbol)) ? svc.dependencies.map((dependency) => [dependency.name, {
-			...service,
-			...dependencyBindings(dependency, scenario)
-		}]) : [[svc.name, service]];
-		for (const [scope, bind] of scopes) {
+		for (const [scope, bind, all] of scopesOf(svc, scenario, service, symbols)) {
 			const evaluated = evaluate(rule, bind);
+			const epochs = epochsOf(symbols, all);
 			findings.push({
 				rule: rule.id,
 				scope,
@@ -2678,13 +2850,97 @@ const lint = (svc, scenario, rules) => {
 				statement: rule.rule,
 				...rule.window !== void 0 ? { window: rule.window } : {},
 				evaluated,
-				unbound: symbols.filter((symbol) => bind[symbol] === void 0)
+				unbound: symbols.filter((symbol) => bind[symbol] === void 0),
+				...Object.values(epochs).some((epoch) => epoch !== null) ? { epochs } : {}
 			});
 		}
 	}
 	return findings;
 };
 //#endregion
+//#region src/stops.ts
+/** These are the rules of the drain. Each way of stopping applies only its own rules of this set. */
+const DRAIN_RULE_IDS = [
+	"O04",
+	"O09",
+	"O10",
+	"O16"
+];
+/**
+* These are the four ways that a pod stops.
+* - A deletion runs the preStop hook, then SIGTERM. The endpoints drop the pod at its deletion,
+*   thus the preStop sleep and the hold must cover the propagation (O04).
+* - A liveness restart also runs the preStop hook and SIGTERM, with the grace. The pod stays in its
+*   endpoints until its readiness fails, thus readiness must fail first (O09).
+* - A crash and an OOM stop run no hook and no drain. The kubelet finds the exit at its relist, and
+*   no rule bounds that time. A client that can reissue a request is the only guard.
+*/
+const STOPS = {
+	deletion: {
+		way: "deletion",
+		signal: "SIGTERM",
+		preStop: true,
+		drain: true,
+		leaves: "deletion",
+		rules: [
+			"O04",
+			"O10",
+			"O16"
+		]
+	},
+	"liveness-restart": {
+		way: "liveness-restart",
+		signal: "SIGTERM",
+		preStop: true,
+		drain: true,
+		leaves: "readiness",
+		rules: [
+			"O09",
+			"O10",
+			"O16"
+		]
+	},
+	crash: {
+		way: "crash",
+		signal: null,
+		preStop: false,
+		drain: false,
+		leaves: "exit",
+		rules: []
+	},
+	oom: {
+		way: "oom",
+		signal: "SIGKILL",
+		preStop: false,
+		drain: false,
+		leaves: "exit",
+		rules: []
+	}
+};
+/** The identifier of the finding of a way of stopping that runs no drain. */
+const STOP_RULE = "stop";
+/**
+* This function applies the rules to a declaration for one way of stopping. A rule of the drain
+* applies only when it guards that way. The other rules apply as `lint()` applies them. A way with
+* no drain also gets a finding of `STOP_RULE` that depends. No rule bounds the time until the
+* kubelet finds the exit, and the work in flight is lost.
+*/
+const lintStop = (svc, scenario, rules, way) => {
+	const stop = STOPS[way];
+	const applies = rules.filter((rule) => !DRAIN_RULE_IDS.includes(rule.id) || stop.rules.includes(rule.id));
+	const findings = lint(svc, scenario, applies);
+	if (stop.drain) return findings;
+	return [...findings, {
+		rule: STOP_RULE,
+		scope: svc.name,
+		verdict: "depends",
+		statement: `a ${way} runs no preStop hook and no drain, and no rule bounds the time until the kubelet finds the exit`,
+		window: "the work in flight is lost, and the endpoints keep the pod until the kubelet finds the exit",
+		evaluated: [],
+		unbound: ["exit_detection@pod"]
+	}];
+};
+//#endregion
 //#region src/profiles.ts
 const s = (value) => ({
 	value,
@@ -3671,6 +3927,6 @@ const MACHINES = {
 	watchdog: WATCHDOG_MACHINE
 };
 //#endregion
-export { DECLARATION_RULE, DURATION_FRACTIONS, EPISODES_KEPT, EXIT_MACHINE, EXIT_SIGNALS, FORMAT, GATE_MACHINE, LATCH_MACHINE, LIMITER_RULES, MACHINES, POLLER_MACHINE, PROCESS_TRIGGERS, PROGRESS_RULE, SERVICE_RULES, SLIDING_WINDOW_MACHINE, STAGES, TOKEN_BUCKET_MACHINE, WATCHDOG_MACHINE, WINDOW_MACHINE, asDebounce, asWindow, backoffBand, backoffDelay, backoffProblems, capKnob, cooperativeAbortAt, daemon, decide, detectionTime, drainMachine, embeddedProcess, ephemeral, evaluate, failSpan, freeAt, heartbeat, heartbeatDetection, idleSpan, inequalities, isExitCode, isExitSignal, isMessageShape, keyedLimiter, kubernetes, limitRule, limiterMachine, limiterProblems, limiterStateOf, lint, localDev, longestRetryAfter, matchesMessage, mayReissue, memoryStore, nodeProcess, platformClock, processPortOf, queueDrain, realClock, recoverSpan, redact, redeliverOnce, replay, retryAfterSeconds, service, serviceBindings, stageRank, symbolsOf, verdictOf, watchdog, workerLoop };
+export { DECLARATION_RULE, DRAIN_RULE_IDS, DURATION_FRACTIONS, EPISODES_KEPT, EXIT_MACHINE, EXIT_SIGNALS, FORMAT, GATE_MACHINE, LATCH_MACHINE, LAW_STATISTIC, LIMITER_RULES, MACHINES, PLATFORM_MARKS, POLLER_MACHINE, PROCESS_TRIGGERS, PROGRESS_RULE, SERVICE_RULES, SLIDING_WINDOW_MACHINE, STAGES, STOPS, STOP_RULE, TOKEN_BUCKET_MACHINE, WATCHDOG_MACHINE, WINDOW_MACHINE, asDebounce, asWindow, backoffBand, backoffDelay, backoffProblems, capKnob, compress, compression, compressionOf, cooperativeAbortAt, daemon, decide, detectionTime, drainMachine, embeddedProcess, ephemeral, evaluate, failSpan, freeAt, heartbeat, heartbeatDetection, idleSpan, inequalities, isExitCode, isExitSignal, isMessageShape, keyedLimiter, kubernetes, limitRule, limiterMachine, limiterProblems, limiterStateOf, lint, lintStop, localDev, longestRetryAfter, matchesMessage, mayReissue, memoryStore, nodeProcess, platformClock, processPortOf, queueDrain, realClock, recoverSpan, redact, redeliverOnce, replay, retryAfterSeconds, service, serviceBindings, stageRank, symbolsOf, verdictOf, watchdog, workerLoop };
 
 //# sourceMappingURL=index.js.map