rosotacom-dev 2.5.dev61__tar.gz → 2.5.dev65__tar.gz

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev61
+Version: 2.5.dev65
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause
@@ -367,7 +367,7 @@ Peer reachability is opt-in because some valid networks block ICMP and peers may
 be started in either order. `rosotacom start` accepts the same
 `--require-peer-reachable` policy when a deployment does require it.
 
-`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
+`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. The instance's `manifest.yaml` records what produced it: `rosotacom_version`, the effective config SHA, and `source_revision` — the commit, branch and tracked-dirtiness of the session source directory at creation time, so a recording stays attributable to a revision after the checkout has moved on (`null` when the source is not a git repository). Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
 
 What else a run leaves under `logs/<peer>/`, and which file to open first when a
 peer looked healthy but did nothing:

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/README.md

@@ -322,7 +322,7 @@ Peer reachability is opt-in because some valid networks block ICMP and peers may
 be started in either order. `rosotacom start` accepts the same
 `--require-peer-reachable` policy when a deployment does require it.
 
-`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
+`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. The instance's `manifest.yaml` records what produced it: `rosotacom_version`, the effective config SHA, and `source_revision` — the commit, branch and tracked-dirtiness of the session source directory at creation time, so a recording stays attributable to a revision after the checkout has moved on (`null` when the source is not a git repository). Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
 
 What else a run leaves under `logs/<peer>/`, and which file to open first when a
 peer looked healthy but did nothing:

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/docs/findings/README.md

@@ -31,6 +31,7 @@ living verification hook.
 - [Sender-side transit rows made a dead link report zero loss](sender-rows-make-a-dead-link-look-loss-free.md) - `delivered = rows - lost` counted the sender's own `sent` rows as deliveries, so a topic the receiver never saw summarised as `delivered == expected` at 0.0% loss, with the publisher's timer reported as arrival spacing.
 - [A bridge that learns types from the graph cannot use a transport that does not carry the graph](graph-derived-types-block-a-non-graph-transport.md) - over `zenoh_ros2dds` the payload topic never arrived in either run: the bridge routes a topic once a local reader exists and the reader waited for the bridge, leaving only `Pending=1` in a log.
 - [A Fast DDS datagram cap stops every message larger than it](fastdds-datagram-cap-drops-large-samples.md) - copying CycloneDDS's 1200 B fragment size into the Fast DDS OTA profile makes every sample above the cap never arrive, at 1200 B and at 8192 B, sync and async — while the 84 B heartbeat keeps flowing at 10 Hz.
+- [A fragment sized exactly like the datagram cap stops every fragmented sample](cyclone-fragment-equal-to-max-drops-fragmented-samples.md) - CycloneDDS 11.0.1 delivers nothing above one fragment when `FragmentSize` equals `MaxMessageSize`, where 0.10.5 delivers everything on the identical profile; a 40 B string still crosses, and discovery, endpoint announcement and proxy-writer matching all succeed while no sample arrives.
 - [A lost keyframe silences exactly the next gop_size−2 deltas](keyframe-loss-kills-the-next-deltas.md) - libavcodec emits nothing for them, the last delta decodes with artifacts, the next keyframe restores clean decode; a lost delta never blocks decode — so the display hole is gop_size × frame period, deterministically.
 - [Any transport element in a Fast DDS profile doubles every sample on the wire](a-transport-element-doubles-every-fastdds-sample.md) - 366 datagrams for 180 samples against 183 without it; `<builtinTransports>DEFAULT` is a no-op selection and doubles too, so the trigger is the element's presence — removing it takes the shipped OTA profile from 2.10x the payload to 1.04x at identical delivery.
 - [Lifespan is enforced by one DDS reader and not the other](lifespan-is-enforced-by-one-reader-and-not-the-other.md) - under the same 20% oversubscription both stacks queue alike (472 and 433 delivered at ~1.1-1.2 s); with `lifespan: 0.7` CycloneDDS is unchanged and delivers 9.1% inside the bound, while Fast DDS drops to 4 delivered and never exceeds 570 ms — the policy decides shown-vs-suppressed, not how long the wait is.

rosotacom_dev-2.5.dev65/docs/findings/cyclone-fragment-equal-to-max-drops-fragmented-samples.md

@@ -0,0 +1,89 @@
+# A Fragment Sized Exactly Like the Datagram Cap Stops Every Fragmented Sample
+
+## Claim
+
+Setting CycloneDDS's `FragmentSize` **equal to** `MaxMessageSize` makes every
+sample large enough to fragment **never arrive** on CycloneDDS 11.0.1, while the
+identical profile carries them on 0.10.5. Samples small enough to fit in one
+fragment keep flowing on the same link, which is what makes it dangerous: the
+endpoints match, neither side logs anything, and the reader simply never sees a
+sample.
+
+An RTPS message carries headers as well as the fragment, so a fragment of
+exactly `MaxMessageSize` cannot be put into a message of `MaxMessageSize`.
+0.10.5 evidently coped with that arithmetic; 11.0.1 does not, and drops
+silently.
+
+This is the CycloneDDS sibling of
+[the Fast DDS datagram cap](fastdds-datagram-cap-drops-large-samples.md), found
+from the opposite direction: there the cap was a value copied *from* this
+profile, here the profile's own two values were equal to each other.
+
+## Setup
+
+- Host pair / topology: two hosts joined by a point-to-point VPN (`/24`,
+  1.3 ms RTT, 0.0% loss measured with three probes each way), one container per
+  host from the packaged communication image, `--network host --ipc host`, one
+  ROS domain. Not the local smoke rig: on a single host nothing fragments far
+  enough to show it.
+- Session: none. A bare `ros2 topic pub -r 1` of a 64 kB
+  `std_msgs/msg/String` against a subscriber given the type explicitly — with
+  `EnableTopicDiscoveryEndpoints false` a bare `ros2 topic echo <topic>`
+  resolves no type and reports nothing, in both versions, which is a trap worth
+  naming because it looks exactly like the failure under test.
+- rosotacom SHA: measured on the packaged 2.5.dev61 images; re-runs record
+  theirs.
+- Profile: none — no impairment. The failure needs none, which is what makes it
+  attributable to the configuration rather than to the link.
+- Seed policy: deterministic (no netem, no random load), `n=1` per variant; the
+  effect is present/absent, not a distribution.
+- Stacks: `ros-kilted-cyclonedds` 0.10.5-2noble against
+  `ros-lyrical-cyclonedds` 11.0.1-4resolute.
+
+## Evidence
+
+| profile | 0.10.5 | 11.0.1 |
+|---|---|---|
+| `FragmentSize` 1200 B, `MaxMessageSize` 1200 B | arrives | **nothing** |
+| no size limits at all | — | arrives |
+| `FragmentSize` 1024 B, `MaxMessageSize` 1200 B | — | arrives |
+
+- A 40 B string crosses on 11.0.1 with the 1200/1200 profile, so the trigger is
+  fragmentation and not the link.
+- The discovery trace of a failing run rules out everything above the data path:
+  both participants discover each other across the hosts, both sides announce
+  their endpoints, the reading side builds proxy writers for the remote
+  participants, and neither side logs a QoS incompatibility or a rejection.
+
+Verification: automated:
+`pytest tests/unit/test_ota_link_configs.py::test_only_cyclone_caps_the_datagram_and_fast_dds_must_not`
+asserts the fragment stays strictly below the datagram cap, which is the
+invariant the two numbers exist for. Manual, for the effect itself: one
+container per host from the communication image on one ROS domain, the shipped
+OTA profile with only the three size elements varied, a 64 kB string at 1 Hz,
+and `ros2 topic echo <topic> std_msgs/msg/String --once` on the other side.
+
+## Status
+
+confirmed, 2026-08-20.
+
+Fixed by making `FragmentSize` strictly smaller than `MaxMessageSize` (1024 B
+against 1200 B) in `cyclonedds_tuned.xml.template`. The datagram stays inside
+the same MTU budget the 1200 B was chosen for — only the header room is added —
+and the value works on both versions, so it is one number rather than a branch
+on the distribution.
+
+## Publication notes
+
+A distribution bump silently changed what a profile *means*, and the profile
+text did not move. That is the reportable part: measurements taken under one ROS
+distribution cannot be presented as the other's on the strength of an identical
+configuration file, because identical configuration is not identical behaviour
+across a DDS major version. State the middleware version beside the profile
+wherever OTA numbers are reported.
+
+The second consequence is about what counts as evidence that a link works. A
+heartbeat crossing at 10 Hz with 0.0% loss certified nothing here — the small
+samples were exactly the ones that could not fail. A link check that does not
+include a sample past the fragment threshold does not test the transport the
+payload uses.

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/docs/findings/fastdds-datagram-cap-drops-large-samples.md

@@ -10,7 +10,7 @@ this dangerous: an 84 B heartbeat crossing at 10 Hz with 0.0% loss is a link
 that looks alive from every direction except the one that matters.
 
 The obvious reason to set it is symmetry with CycloneDDS, whose OTA profile
-carries this link at `FragmentSize`/`MaxMessageSize` 1200 B and works. The
+carries this link at a 1024 B fragment inside a 1200 B datagram and works. The
 symmetry does not transfer: on ROS 2 Kilted with Fast DDS 3.2.4 the cap is the
 single knob that breaks the link, at 1200 B and at 8192 B, with a synchronous
 writer and with an asynchronous one.

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/docs/forensics-report.md

@@ -37,7 +37,7 @@ gracefully when absent:
 |---|---|
 | `status.json` | declared topic types (FFMPEGPacket detection) |
 | `link_trace.jsonl` ([link trace recorder](link-trace.md)) | link state around each incident |
-| `manifest.yaml` | instance id + config SHA provenance |
+| `manifest.yaml` | instance id, config SHA, and `source_revision` — the commit of the session source at instance creation |
 | `--profile NAME --profiles-file FILE` | RFC 0004 environment context (static params or timeline steps) |
 | `state_transition` rows in `events.jsonl` | pipeline diagnoses around each incident |
 

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/docs/link-trace.md

@@ -30,6 +30,16 @@ rosotacom ota-smoke 13_link_latency --link-trace
 `--link-trace-interval` and `--link-trace-modem-command` also enable the
 recorder and force `shared.use_status_overview: true` for the generated instance.
 
+`interval_s` is the period between rows, and the status-overview node is ticked
+at the same period when the trace is enabled. Those two being equal is what
+makes the trace continuous: each row's `passive_counter_delta` covers one tick,
+so consecutive rows meet rather than leaving traffic between them. The recorder
+therefore schedules against an advancing deadline with a small tolerance instead
+of a stopwatch since the last row — without that, a tick landing a hair early is
+rejected and waits a whole further period, which halves the trace and leaves
+every second interval described by no row at all (measured on a 5 h drive:
+1.984 s between rows carrying 1.002 s windows).
+
 ## Row Schema
 
 Each line is one JSON object:

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/src/rosotacom/cli.py

@@ -275,6 +275,13 @@ class OtaSmokePeer:
     #: list. Naming the transport lets the narrow thing be substituted without
     #: this file having to know what narrow means.
     exec_command: str | None = None
+    #: CPUs this peer's session containers are confined to, e.g. "0-3".
+    #:
+    #: The reason it is per peer: a reservation is a property of one machine's
+    #: contention, not of the run. A bench pair is usually one busy workstation
+    #: shared with somebody else and one idle machine, and pinning the idle one
+    #: would only take capacity away from the measurement.
+    cpuset: str | None = None
 
 
 @dataclass(frozen=True)
@@ -875,6 +882,61 @@ def _append_log(path: Path, text: str) -> None:
             fp.write("\n")
 
 
+#: A provenance read must never be what makes an instance fail to start.
+_SOURCE_REVISION_TIMEOUT_S = 5.0
+
+
+def _source_revision(path: Path | str) -> dict[str, Any] | None:
+    """The VCS revision of the directory this session was taken from.
+
+    `rosotacom_version` pins the tool. This pins its *input*: the session source
+    is normally a checkout of a deployment repository, and that checkout moves.
+    A consumer reading the manifest later cannot recover the revision by looking
+    at the machine, because looking at the machine answers a different question —
+    on one two-machine drive the vehicle had been synced by the time the
+    recording was consolidated the next morning, so the only commit anybody
+    could still read was not the commit that ran. The manifest is written once
+    at creation and never rewritten, which is exactly what such a fact needs.
+
+    `dirty` deliberately ignores untracked files: deployment checkouts routinely
+    carry recordings, logs and scratch files that are not the code, so counting
+    them would make every real deployment permanently dirty and the flag
+    meaningless. What it reports is tracked content differing from the commit.
+
+    Best effort throughout — not a directory, no git, not a repository, a git
+    that hangs: all yield None.
+    """
+    directory = Path(path)
+    if not directory.is_dir():
+        return None
+
+    def git(*args: str) -> str | None:
+        try:
+            result = subprocess.run(
+                ["git", "-C", str(directory), *args],
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=_SOURCE_REVISION_TIMEOUT_S,
+            )
+        except (OSError, subprocess.SubprocessError):
+            return None
+        return result.stdout.strip() if result.returncode == 0 else None
+
+    commit = git("rev-parse", "HEAD")
+    if not commit:
+        return None
+    branch = git("rev-parse", "--abbrev-ref", "HEAD")
+    tracked_changes = git("status", "--porcelain", "--untracked-files=no")
+    return {
+        "vcs": "git",
+        "commit": commit,
+        "branch": None if branch in (None, "HEAD") else branch,
+        "dirty": None if tracked_changes is None else bool(tracked_changes),
+        "root": git("rev-parse", "--show-toplevel"),
+    }
+
+
 def _effective_config_sha256(cfg: dict[str, Any]) -> str:
     text = yaml.safe_dump(cfg, sort_keys=True, default_flow_style=False, allow_unicode=True)
     return hashlib.sha256(text.encode("utf-8")).hexdigest()
@@ -901,6 +963,7 @@ def _write_instance_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(session.host_dir),
+            "source_revision": _source_revision(session.host_dir),
             "source_session_container_dir": session.container_dir,
             "source": session.source,
             "config_dir": str(instance.config_host_dir),
@@ -955,6 +1018,7 @@ def _write_scenario_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(session.host_dir),
+            "source_revision": _source_revision(session.host_dir),
             "source_session_container_dir": session.container_dir,
             "source": session.source,
             "config_dir": str(instance.config_host_dir),
@@ -1021,6 +1085,7 @@ def _write_interactive_smoke_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(target.session.host_dir),
+            "source_revision": _source_revision(target.session.host_dir),
             "source_session_container_dir": target.session.container_dir,
             "source": target.session.source,
             "config_dir": str(instance.config_host_dir),
@@ -1189,6 +1254,11 @@ def _parse_peer_exec_overrides(overrides: list[str] | None) -> dict[str, str]:
     return parse_assignments(overrides, option="--peer-exec")
 
 
+def _parse_peer_cpuset_overrides(overrides: list[str] | None) -> dict[str, str]:
+    parsed = parse_assignments(overrides, option="--peer-cpuset")
+    return {name: validate_cpuset(value) for name, value in parsed.items()}
+
+
 def _deployment_config(runtime: RuntimeConfig) -> DeploymentConfig | None:
     return load_deployment(runtime.deployment)
 
@@ -1749,8 +1819,13 @@ def _ota_plan_from_bindings(
     checkouts: Mapping[str, str] | None = None,
     project: str | None = None,
     exec_commands: Mapping[str, str] | None = None,
+    cpusets: Mapping[str, str] | None = None,
 ) -> OtaSmokePlan:
     _ota_validate_install_mode(install_mode)
+    if cpusets:
+        unknown = sorted(set(cpusets) - set(bindings))
+        if unknown:
+            raise RuntimeError(f"--peer-cpuset names a peer the session does not have: {', '.join(unknown)}")
     if exec_commands:
         unknown = sorted(set(exec_commands) - set(bindings))
         if unknown:
@@ -1811,6 +1886,7 @@ def _ota_plan_from_bindings(
             address=binding.address,
             checkout=(checkouts or {}).get(name) if install_mode == "checkout" else None,
             exec_command=(exec_commands or {}).get(name),
+            cpuset=(cpusets or {}).get(name),
         )
         for name, binding in bindings.items()
     }
@@ -1839,6 +1915,7 @@ def _ota_write_state(instance: SessionInstance, plan: OtaSmokePlan) -> OtaSmokeP
                 "address": peer.address,
                 "ssh": peer.ssh,
                 "checkout": peer.checkout,
+                "cpuset": peer.cpuset,
                 "exec": peer.exec_command,
             }
             for name, peer in sorted(plan.peers.items())
@@ -1865,6 +1942,7 @@ def _ota_load_state(path_arg: str) -> OtaSmokePlan:
             address=str(peer_raw["address"]),
             ssh=str(peer_raw["ssh"]) if peer_raw.get("ssh") else None,
             checkout=str(peer_raw["checkout"]) if peer_raw.get("checkout") else None,
+            cpuset=str(peer_raw["cpuset"]) if peer_raw.get("cpuset") else None,
             exec_command=str(peer_raw["exec"]) if peer_raw.get("exec") else None,
         )
     install_pin = raw.get("install_pin")
@@ -2199,6 +2277,7 @@ def _ota_start_parts(
     mode: str,
     force: bool = True,
     link_trace_parts: list[str] | None = None,
+    cpuset: str | None = None,
 ) -> list[str]:
     if target.target_type == "scenario":
         parts = ["scenario", "start", target.name, "--identity", identity, "--mode", mode, "--instance-id", instance_id]
@@ -2215,6 +2294,8 @@ def _ota_start_parts(
         ]
     parts.append("--force" if force else "--no-force")
     parts.extend(link_trace_parts or [])
+    if cpuset:
+        parts.extend(["--cpuset", cpuset])
     for override in peer_args:
         parts.extend(["--peer-address", override])
     return parts
@@ -2229,6 +2310,7 @@ def _ota_communication_start_parts(
     mode: str,
     force: bool = True,
     link_trace_parts: list[str] | None = None,
+    cpuset: str | None = None,
 ) -> list[str]:
     parts = [
         "start",
@@ -2243,6 +2325,8 @@ def _ota_communication_start_parts(
     ]
     parts.append("--force" if force else "--no-force")
     parts.extend(link_trace_parts or [])
+    if cpuset:
+        parts.extend(["--cpuset", cpuset])
     for override in peer_args:
         parts.extend(["--peer-address", override])
     return parts
@@ -2419,6 +2503,7 @@ def _ota_write_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(target.session.host_dir),
+            "source_revision": _source_revision(target.session.host_dir),
             "source_session_container_dir": target.session.container_dir,
             "source": target.session.source,
             "config_dir": str(instance.config_host_dir),
@@ -2658,6 +2743,7 @@ def _resolve_ota_smoke_context(
             checkouts=checkouts,
             project=project,
             exec_commands=exec_commands,
+            cpusets=_parse_peer_cpuset_overrides(getattr(args, "peer_cpuset", None)),
         )
     plan_peers = set(plan.peers)
     target_peers = set(_peer_keys_from_cfg(target.cfg))
@@ -2877,10 +2963,121 @@ def _ota_conflict_check(plan: OtaSmokePlan, *, dry_run: bool) -> None:
 _LOAD_WARN_PER_CPU = 0.7
 _LOAD_REFUSE_PER_CPU = 2.0
 
+# Thresholds for a peer whose containers are pinned to a CPU set. These are a
+# different quantity from the ones above and deliberately not the same numbers:
+# load-per-CPU counts runnable threads and is unbounded, while this is the busy
+# fraction of the pinned CPUs and cannot exceed 1.0. What it answers is the only
+# question a reservation raises — is anybody else on the cores this run was
+# given — so it is read before the run puts its own work there.
+_CPUSET_WARN_BUSY = 0.5
+_CPUSET_REFUSE_BUSY = 0.85
+
+
+#: Two snapshots of the per-CPU jiffy counters, a second apart. A busy fraction
+#: needs a delta -- the absolute counters describe the machine since boot, which
+#: says nothing about who is on those cores now.
+_CPU_BUSY_PROBE = "grep '^cpu[0-9]' /proc/stat; sleep 1; echo ---; grep '^cpu[0-9]' /proc/stat"
+
+
+def _parse_cpu_busy(stdout: str, cpus: Sequence[int]) -> dict[int, float] | None:
+    """Busy fraction per CPU between the two /proc/stat snapshots.
+
+    Busy is everything but idle and iowait: a core waiting on disk is not
+    competing for the runqueue this measurement cares about, and counting it
+    would refuse runs on a machine that is merely writing a bag.
+    """
+    before, sep, after = stdout.partition("---")
+    if not sep:
+        return None
+
+    def snapshot(text: str) -> dict[int, tuple[int, int]]:
+        out: dict[int, tuple[int, int]] = {}
+        for line in text.splitlines():
+            fields = line.split()
+            if len(fields) < 6 or not fields[0].startswith("cpu") or not fields[0][3:].isdigit():
+                continue
+            try:
+                values = [int(x) for x in fields[1:]]
+            except ValueError:
+                continue
+            total = sum(values)
+            idle = values[3] + values[4]  # idle + iowait
+            out[int(fields[0][3:])] = (total, idle)
+        return out
+
+    first, second = snapshot(before), snapshot(after)
+    busy: dict[int, float] = {}
+    for cpu in cpus:
+        if cpu not in first or cpu not in second:
+            return None
+        total_delta = second[cpu][0] - first[cpu][0]
+        idle_delta = second[cpu][1] - first[cpu][1]
+        if total_delta <= 0:
+            return None
+        busy[cpu] = max(0.0, min(1.0, 1.0 - idle_delta / total_delta))
+    return busy or None
+
+
+def _ota_cpuset_load_check(peer: OtaSmokePeer, *, dry_run: bool) -> bool:
+    """Judge the CPUs this peer is pinned to, not the machine around them.
+
+    A reservation makes a machine measurable without making it quiet: the other
+    account keeps every thread it had, they just queue on fewer cores, so
+    /proc/loadavg reads higher than before and says nothing about whether the
+    reserved cores are free. Reading those cores directly is the only way the
+    preflight can tell a partitioned workstation from a saturated one.
+
+    Returns False when the probe could not produce a number, so the caller can
+    fall back to the machine-wide check rather than silently skip it.
+    """
+    if not peer.cpuset:
+        return False
+    cpus = parse_cpuset_list(peer.cpuset)
+    result = _ota_run(
+        peer,
+        _CPU_BUSY_PROBE,
+        label=f"{peer.name}: load on CPUs {peer.cpuset}",
+        dry_run=dry_run,
+        batch=True,
+        check=False,
+    )
+    if dry_run:
+        return True
+    if result.returncode != 0:
+        return False
+    busy = _parse_cpu_busy(result.stdout or "", cpus)
+    if busy is None:
+        return False
+
+    worst_cpu = max(busy, key=lambda cpu: busy[cpu])
+    mean = sum(busy.values()) / len(busy)
+    detail = " ".join(f"cpu{cpu}={busy[cpu] * 100:.0f}%" for cpu in sorted(busy))
+    summary = (
+        f"CPUs {peer.cpuset} are {mean * 100:.0f}% busy on average "
+        f"(worst cpu{worst_cpu} at {busy[worst_cpu] * 100:.0f}%) — {detail}"
+    )
+    if mean >= _CPUSET_REFUSE_BUSY:
+        raise RuntimeError(
+            f"Peer {peer.name} is pinned to CPUs {peer.cpuset}, and they are not free: {summary}.\n"
+            "The reservation is either not in force or somebody else is inside it. Check it on that "
+            "machine, pin to different CPUs, or — if this load is yours and expected — pass "
+            "--skip-conflict-check."
+        )
+    if mean >= _CPUSET_WARN_BUSY:
+        print(f"! {peer.name}: {summary} — the run has less of its reservation than it looks")
+    else:
+        print(f"+ {peer.name}: {summary}")
+    return True
+
 
 def _ota_load_check(plan: OtaSmokePlan, *, dry_run: bool) -> None:
     """Refuse to measure on a peer that is busy with someone else's work."""
     for peer in plan.peers.values():
+        # A pinned peer is judged on its own CPUs. The machine-wide figure is the
+        # wrong question there: it is high by construction on exactly the shared
+        # workstation the pinning exists for.
+        if _ota_cpuset_load_check(peer, dry_run=dry_run):
+            continue
         result = _ota_run(
             peer,
             "cut -d' ' -f1-3 /proc/loadavg; nproc",
@@ -2910,7 +3107,9 @@ def _ota_load_check(plan: OtaSmokePlan, *, dry_run: bool) -> None:
                 f"Peer {peer.name} is carrying unrelated load: {summary}.\n"
                 "A measurement taken here would describe the contention, not the link.\n"
                 "Wait for the machine to go quiet, measure on another pair, or — if this "
-                "load is yours and expected — pass --skip-conflict-check."
+                "load is yours and expected — pass --skip-conflict-check.\n"
+                "If those CPUs were reserved away from another account, pin this peer to them "
+                "with --peer-cpuset and the check will read them instead of the whole machine."
             )
         if ratio >= _LOAD_WARN_PER_CPU:
             print(f"! {peer.name}: {summary} — comparisons survive if runs are interleaved, absolute latencies do not")
@@ -3692,7 +3891,15 @@ def _ota_start_peers(
         peer = plan.peers[peer_name]
         command = _ota_rosotacom_command(
             plan,
-            _ota_start_parts(target, peer_name, instance_id, peer_args, mode=mode, link_trace_parts=link_trace_parts),
+            _ota_start_parts(
+                target,
+                peer_name,
+                instance_id,
+                peer_args,
+                mode=mode,
+                link_trace_parts=link_trace_parts,
+                cpuset=peer.cpuset,
+            ),
             peer,
         )
         _ota_run(peer, command, label=f"{peer_name}: start {target.name}", dry_run=dry_run)
@@ -4089,6 +4296,7 @@ def _ota_create_tmux(
             peer_args,
             mode="attach",
             link_trace_parts=link_trace_parts,
+            cpuset=first_peer.cpuset,
         ),
         first_peer,
     )
@@ -4169,6 +4377,7 @@ def _ota_create_tmux(
                 peer_args,
                 mode="attach",
                 link_trace_parts=link_trace_parts,
+                cpuset=peer.cpuset,
             ),
             peer,
         )
@@ -5235,6 +5444,43 @@ def _local_ipc_run_args(network_isolated: bool) -> list[str]:
     return [] if network_isolated else ["--ipc", "host"]
 
 
+_CPUSET_RE = re.compile(r"^\d+(-\d+)?(,\d+(-\d+)?)*$")
+
+
+def validate_cpuset(cpuset: str) -> str:
+    """Accept a docker `--cpuset-cpus` list, and nothing else.
+
+    This string is handed to `docker run` and travels to a peer over ssh, so it
+    is validated rather than trusted: only decimal CPU numbers and ranges, the
+    exact grammar docker documents. Anything else — a shell metacharacter, a
+    negative number, an empty element — is a caller error and says so here
+    instead of at the far end of an ssh pipe.
+    """
+    cleaned = cpuset.strip()
+    if not _CPUSET_RE.match(cleaned):
+        raise RuntimeError(
+            f"--cpuset {cpuset!r} is not a CPU list: expected decimal numbers and ranges like '0-3' or '0,2,4-7'."
+        )
+    for part in cleaned.split(","):
+        if "-" in part:
+            low, high = (int(x) for x in part.split("-", 1))
+            if high < low:
+                raise RuntimeError(f"--cpuset {cpuset!r}: range {part!r} counts backwards.")
+    return cleaned
+
+
+def parse_cpuset_list(cpuset: str) -> list[int]:
+    """Expand a validated CPU list into the individual CPU numbers."""
+    cpus: list[int] = []
+    for part in validate_cpuset(cpuset).split(","):
+        if "-" in part:
+            low, high = (int(x) for x in part.split("-", 1))
+            cpus.extend(range(low, high + 1))
+        else:
+            cpus.append(int(part))
+    return sorted(set(cpus))
+
+
 def _base_extra_run_args(
     runtime: RuntimeConfig,
     session: ResolvedSession,
@@ -5242,8 +5488,15 @@ def _base_extra_run_args(
     instance: SessionInstance,
     *,
     network_isolated: bool = False,
+    cpuset: str | None = None,
 ) -> list[str]:
     args: list[str] = _local_ipc_run_args(network_isolated)
+    if cpuset:
+        # Confine every container of this session to the given CPUs. On a shared
+        # workstation the point is not to slow this session down: it is to put it
+        # on the cores that were reserved away from whoever else is on the
+        # machine, so a latency measurement stops competing for a runqueue.
+        args.extend(["--cpuset-cpus", validate_cpuset(cpuset)])
     ros2docker_cfg = load_config(runtime.ros2docker_config)
 
     if not ros2docker_cfg.get("mount_ws"):
@@ -5427,7 +5680,9 @@ def start_session(args: argparse.Namespace) -> str:
                 " (or pass --force to replace it, --skip-conflict-check to ignore it).",
             )
     image_name = _scoped_image_name(runtime)
-    extra_run_args = _base_extra_run_args(runtime, session, cfg, instance, network_isolated=network_isolated)
+    extra_run_args = _base_extra_run_args(
+        runtime, session, cfg, instance, network_isolated=network_isolated, cpuset=getattr(args, "cpuset", None)
+    )
     run_override: dict[str, object] = {}
     network_name = getattr(args, "network_name", None)
     if network_name:
@@ -8912,6 +9167,18 @@ def _add_ota_install_args(parser: argparse.ArgumentParser) -> None:
             "Required for every peer in that mode; the same repository is at a different path on each machine."
         ),
     )
+    parser.add_argument(
+        "--peer-cpuset",
+        action="append",
+        default=[],
+        metavar="PEER=CPUS",
+        help=(
+            "Confine this peer's session containers to these CPUs, e.g. 'a=0-3'. For a shared "
+            "workstation whose CPUs were reserved away from another account: the run then measures "
+            "on cores nobody else can take, and the load preflight judges those cores instead of "
+            "the whole machine."
+        ),
+    )
     parser.add_argument(
         "--peer-exec",
         action="append",
@@ -8980,6 +9247,14 @@ def _add_start_args(parser: argparse.ArgumentParser) -> None:
         help="Require three bounded ICMP probes to the peer to succeed before starting.",
     )
     parser.add_argument("--instance-id", help="Join or create a named runtime session instance.")
+    parser.add_argument(
+        "--cpuset",
+        help=(
+            "Confine this session's containers to these CPUs, e.g. '0-3'. Use on a shared "
+            "workstation where those CPUs were reserved away from another account: the "
+            "session then measures on cores nobody else can take."
+        ),
+    )
     parser.add_argument(
         "--skip-conflict-check",
         action="store_true",

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/src/rosotacom/cli_benchmark.py

@@ -5214,6 +5214,7 @@ def _make_live_run_point(args: argparse.Namespace, session_name: str) -> RunPoin
                 peer_address=getattr(args, "peer_address", None),
                 peer_ssh=getattr(args, "peer_ssh", None),
                 peer_checkout=getattr(args, "peer_checkout", None),
+                peer_cpuset=getattr(args, "peer_cpuset", None),
                 peer_exec=getattr(args, "peer_exec", None),
                 install_mode=getattr(args, "install_mode", None),
                 install_pin=getattr(args, "install_pin", None),

{rosotacom_dev-2.5.dev61 → rosotacom_dev-2.5.dev65}/src/rosotacom/resources/ws/ota_configs/cyclonedds_tuned.xml.template

@@ -6,7 +6,18 @@
                 <NetworkInterface address="#host_ip"/>
             </Interfaces>
             <MulticastRecvNetworkInterfaceAddresses>none</MulticastRecvNetworkInterfaceAddresses>
-            <FragmentSize>1200B</FragmentSize>
+            <!-- Strictly below MaxMessageSize, and that is the whole point: an RTPS
+                 message carries headers as well as the fragment, so a fragment of
+                 exactly MaxMessageSize cannot be sent at all. Both were 1200B, which
+                 CycloneDDS 0.10.5 coped with and 11.0.1 does not — under Lyrical no
+                 fragmented sample crossed, silently: the endpoints matched and the
+                 reader never saw a sample, while a sample small enough not to
+                 fragment arrived normally. Measured between two hosts with a 64 kB
+                 sample: 1200/1200 delivers nothing on 11.0.1 and everything on
+                 0.10.5; 1024/1200 delivers on both. The datagram stays inside the
+                 same MTU budget the 1200B was chosen for; only the header room is
+                 added. -->
+            <FragmentSize>1024B</FragmentSize>
             <MaxMessageSize>1200B</MaxMessageSize>
             <MaxRexmitMessageSize>1200B</MaxRexmitMessageSize>
         </General>