rosotacom-dev 2.5.dev62__tar.gz → 2.5.dev65__tar.gz

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev62
+Version: 2.5.dev65
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause
@@ -367,7 +367,7 @@ Peer reachability is opt-in because some valid networks block ICMP and peers may
 be started in either order. `rosotacom start` accepts the same
 `--require-peer-reachable` policy when a deployment does require it.
 
-`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
+`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. The instance's `manifest.yaml` records what produced it: `rosotacom_version`, the effective config SHA, and `source_revision` — the commit, branch and tracked-dirtiness of the session source directory at creation time, so a recording stays attributable to a revision after the checkout has moved on (`null` when the source is not a git repository). Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
 
 What else a run leaves under `logs/<peer>/`, and which file to open first when a
 peer looked healthy but did nothing:

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/README.md

@@ -322,7 +322,7 @@ Peer reachability is opt-in because some valid networks block ICMP and peers may
 be started in either order. `rosotacom start` accepts the same
 `--require-peer-reachable` policy when a deployment does require it.
 
-`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
+`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. The instance's `manifest.yaml` records what produced it: `rosotacom_version`, the effective config SHA, and `source_revision` — the commit, branch and tracked-dirtiness of the session source directory at creation time, so a recording stays attributable to a revision after the checkout has moved on (`null` when the source is not a git repository). Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
 
 What else a run leaves under `logs/<peer>/`, and which file to open first when a
 peer looked healthy but did nothing:

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/docs/findings/README.md

@@ -31,6 +31,7 @@ living verification hook.
 - [Sender-side transit rows made a dead link report zero loss](sender-rows-make-a-dead-link-look-loss-free.md) - `delivered = rows - lost` counted the sender's own `sent` rows as deliveries, so a topic the receiver never saw summarised as `delivered == expected` at 0.0% loss, with the publisher's timer reported as arrival spacing.
 - [A bridge that learns types from the graph cannot use a transport that does not carry the graph](graph-derived-types-block-a-non-graph-transport.md) - over `zenoh_ros2dds` the payload topic never arrived in either run: the bridge routes a topic once a local reader exists and the reader waited for the bridge, leaving only `Pending=1` in a log.
 - [A Fast DDS datagram cap stops every message larger than it](fastdds-datagram-cap-drops-large-samples.md) - copying CycloneDDS's 1200 B fragment size into the Fast DDS OTA profile makes every sample above the cap never arrive, at 1200 B and at 8192 B, sync and async — while the 84 B heartbeat keeps flowing at 10 Hz.
+- [A fragment sized exactly like the datagram cap stops every fragmented sample](cyclone-fragment-equal-to-max-drops-fragmented-samples.md) - CycloneDDS 11.0.1 delivers nothing above one fragment when `FragmentSize` equals `MaxMessageSize`, where 0.10.5 delivers everything on the identical profile; a 40 B string still crosses, and discovery, endpoint announcement and proxy-writer matching all succeed while no sample arrives.
 - [A lost keyframe silences exactly the next gop_size−2 deltas](keyframe-loss-kills-the-next-deltas.md) - libavcodec emits nothing for them, the last delta decodes with artifacts, the next keyframe restores clean decode; a lost delta never blocks decode — so the display hole is gop_size × frame period, deterministically.
 - [Any transport element in a Fast DDS profile doubles every sample on the wire](a-transport-element-doubles-every-fastdds-sample.md) - 366 datagrams for 180 samples against 183 without it; `<builtinTransports>DEFAULT` is a no-op selection and doubles too, so the trigger is the element's presence — removing it takes the shipped OTA profile from 2.10x the payload to 1.04x at identical delivery.
 - [Lifespan is enforced by one DDS reader and not the other](lifespan-is-enforced-by-one-reader-and-not-the-other.md) - under the same 20% oversubscription both stacks queue alike (472 and 433 delivered at ~1.1-1.2 s); with `lifespan: 0.7` CycloneDDS is unchanged and delivers 9.1% inside the bound, while Fast DDS drops to 4 delivered and never exceeds 570 ms — the policy decides shown-vs-suppressed, not how long the wait is.

rosotacom_dev-2.5.dev65/docs/findings/cyclone-fragment-equal-to-max-drops-fragmented-samples.md

@@ -0,0 +1,89 @@
+# A Fragment Sized Exactly Like the Datagram Cap Stops Every Fragmented Sample
+
+## Claim
+
+Setting CycloneDDS's `FragmentSize` **equal to** `MaxMessageSize` makes every
+sample large enough to fragment **never arrive** on CycloneDDS 11.0.1, while the
+identical profile carries them on 0.10.5. Samples small enough to fit in one
+fragment keep flowing on the same link, which is what makes it dangerous: the
+endpoints match, neither side logs anything, and the reader simply never sees a
+sample.
+
+An RTPS message carries headers as well as the fragment, so a fragment of
+exactly `MaxMessageSize` cannot be put into a message of `MaxMessageSize`.
+0.10.5 evidently coped with that arithmetic; 11.0.1 does not, and drops
+silently.
+
+This is the CycloneDDS sibling of
+[the Fast DDS datagram cap](fastdds-datagram-cap-drops-large-samples.md), found
+from the opposite direction: there the cap was a value copied *from* this
+profile, here the profile's own two values were equal to each other.
+
+## Setup
+
+- Host pair / topology: two hosts joined by a point-to-point VPN (`/24`,
+  1.3 ms RTT, 0.0% loss measured with three probes each way), one container per
+  host from the packaged communication image, `--network host --ipc host`, one
+  ROS domain. Not the local smoke rig: on a single host nothing fragments far
+  enough to show it.
+- Session: none. A bare `ros2 topic pub -r 1` of a 64 kB
+  `std_msgs/msg/String` against a subscriber given the type explicitly — with
+  `EnableTopicDiscoveryEndpoints false` a bare `ros2 topic echo <topic>`
+  resolves no type and reports nothing, in both versions, which is a trap worth
+  naming because it looks exactly like the failure under test.
+- rosotacom SHA: measured on the packaged 2.5.dev61 images; re-runs record
+  theirs.
+- Profile: none — no impairment. The failure needs none, which is what makes it
+  attributable to the configuration rather than to the link.
+- Seed policy: deterministic (no netem, no random load), `n=1` per variant; the
+  effect is present/absent, not a distribution.
+- Stacks: `ros-kilted-cyclonedds` 0.10.5-2noble against
+  `ros-lyrical-cyclonedds` 11.0.1-4resolute.
+
+## Evidence
+
+| profile | 0.10.5 | 11.0.1 |
+|---|---|---|
+| `FragmentSize` 1200 B, `MaxMessageSize` 1200 B | arrives | **nothing** |
+| no size limits at all | — | arrives |
+| `FragmentSize` 1024 B, `MaxMessageSize` 1200 B | — | arrives |
+
+- A 40 B string crosses on 11.0.1 with the 1200/1200 profile, so the trigger is
+  fragmentation and not the link.
+- The discovery trace of a failing run rules out everything above the data path:
+  both participants discover each other across the hosts, both sides announce
+  their endpoints, the reading side builds proxy writers for the remote
+  participants, and neither side logs a QoS incompatibility or a rejection.
+
+Verification: automated:
+`pytest tests/unit/test_ota_link_configs.py::test_only_cyclone_caps_the_datagram_and_fast_dds_must_not`
+asserts the fragment stays strictly below the datagram cap, which is the
+invariant the two numbers exist for. Manual, for the effect itself: one
+container per host from the communication image on one ROS domain, the shipped
+OTA profile with only the three size elements varied, a 64 kB string at 1 Hz,
+and `ros2 topic echo <topic> std_msgs/msg/String --once` on the other side.
+
+## Status
+
+confirmed, 2026-08-20.
+
+Fixed by making `FragmentSize` strictly smaller than `MaxMessageSize` (1024 B
+against 1200 B) in `cyclonedds_tuned.xml.template`. The datagram stays inside
+the same MTU budget the 1200 B was chosen for — only the header room is added —
+and the value works on both versions, so it is one number rather than a branch
+on the distribution.
+
+## Publication notes
+
+A distribution bump silently changed what a profile *means*, and the profile
+text did not move. That is the reportable part: measurements taken under one ROS
+distribution cannot be presented as the other's on the strength of an identical
+configuration file, because identical configuration is not identical behaviour
+across a DDS major version. State the middleware version beside the profile
+wherever OTA numbers are reported.
+
+The second consequence is about what counts as evidence that a link works. A
+heartbeat crossing at 10 Hz with 0.0% loss certified nothing here — the small
+samples were exactly the ones that could not fail. A link check that does not
+include a sample past the fragment threshold does not test the transport the
+payload uses.

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/docs/findings/fastdds-datagram-cap-drops-large-samples.md

@@ -10,7 +10,7 @@ this dangerous: an 84 B heartbeat crossing at 10 Hz with 0.0% loss is a link
 that looks alive from every direction except the one that matters.
 
 The obvious reason to set it is symmetry with CycloneDDS, whose OTA profile
-carries this link at `FragmentSize`/`MaxMessageSize` 1200 B and works. The
+carries this link at a 1024 B fragment inside a 1200 B datagram and works. The
 symmetry does not transfer: on ROS 2 Kilted with Fast DDS 3.2.4 the cap is the
 single knob that breaks the link, at 1200 B and at 8192 B, with a synchronous
 writer and with an asynchronous one.

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/docs/forensics-report.md

@@ -37,7 +37,7 @@ gracefully when absent:
 |---|---|
 | `status.json` | declared topic types (FFMPEGPacket detection) |
 | `link_trace.jsonl` ([link trace recorder](link-trace.md)) | link state around each incident |
-| `manifest.yaml` | instance id + config SHA provenance |
+| `manifest.yaml` | instance id, config SHA, and `source_revision` — the commit of the session source at instance creation |
 | `--profile NAME --profiles-file FILE` | RFC 0004 environment context (static params or timeline steps) |
 | `state_transition` rows in `events.jsonl` | pipeline diagnoses around each incident |
 

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/docs/link-trace.md

@@ -30,6 +30,16 @@ rosotacom ota-smoke 13_link_latency --link-trace
 `--link-trace-interval` and `--link-trace-modem-command` also enable the
 recorder and force `shared.use_status_overview: true` for the generated instance.
 
+`interval_s` is the period between rows, and the status-overview node is ticked
+at the same period when the trace is enabled. Those two being equal is what
+makes the trace continuous: each row's `passive_counter_delta` covers one tick,
+so consecutive rows meet rather than leaving traffic between them. The recorder
+therefore schedules against an advancing deadline with a small tolerance instead
+of a stopwatch since the last row — without that, a tick landing a hair early is
+rejected and waits a whole further period, which halves the trace and leaves
+every second interval described by no row at all (measured on a 5 h drive:
+1.984 s between rows carrying 1.002 s windows).
+
 ## Row Schema
 
 Each line is one JSON object:

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom/cli.py

@@ -882,6 +882,61 @@ def _append_log(path: Path, text: str) -> None:
             fp.write("\n")
 
 
+#: A provenance read must never be what makes an instance fail to start.
+_SOURCE_REVISION_TIMEOUT_S = 5.0
+
+
+def _source_revision(path: Path | str) -> dict[str, Any] | None:
+    """The VCS revision of the directory this session was taken from.
+
+    `rosotacom_version` pins the tool. This pins its *input*: the session source
+    is normally a checkout of a deployment repository, and that checkout moves.
+    A consumer reading the manifest later cannot recover the revision by looking
+    at the machine, because looking at the machine answers a different question —
+    on one two-machine drive the vehicle had been synced by the time the
+    recording was consolidated the next morning, so the only commit anybody
+    could still read was not the commit that ran. The manifest is written once
+    at creation and never rewritten, which is exactly what such a fact needs.
+
+    `dirty` deliberately ignores untracked files: deployment checkouts routinely
+    carry recordings, logs and scratch files that are not the code, so counting
+    them would make every real deployment permanently dirty and the flag
+    meaningless. What it reports is tracked content differing from the commit.
+
+    Best effort throughout — not a directory, no git, not a repository, a git
+    that hangs: all yield None.
+    """
+    directory = Path(path)
+    if not directory.is_dir():
+        return None
+
+    def git(*args: str) -> str | None:
+        try:
+            result = subprocess.run(
+                ["git", "-C", str(directory), *args],
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=_SOURCE_REVISION_TIMEOUT_S,
+            )
+        except (OSError, subprocess.SubprocessError):
+            return None
+        return result.stdout.strip() if result.returncode == 0 else None
+
+    commit = git("rev-parse", "HEAD")
+    if not commit:
+        return None
+    branch = git("rev-parse", "--abbrev-ref", "HEAD")
+    tracked_changes = git("status", "--porcelain", "--untracked-files=no")
+    return {
+        "vcs": "git",
+        "commit": commit,
+        "branch": None if branch in (None, "HEAD") else branch,
+        "dirty": None if tracked_changes is None else bool(tracked_changes),
+        "root": git("rev-parse", "--show-toplevel"),
+    }
+
+
 def _effective_config_sha256(cfg: dict[str, Any]) -> str:
     text = yaml.safe_dump(cfg, sort_keys=True, default_flow_style=False, allow_unicode=True)
     return hashlib.sha256(text.encode("utf-8")).hexdigest()
@@ -908,6 +963,7 @@ def _write_instance_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(session.host_dir),
+            "source_revision": _source_revision(session.host_dir),
             "source_session_container_dir": session.container_dir,
             "source": session.source,
             "config_dir": str(instance.config_host_dir),
@@ -962,6 +1018,7 @@ def _write_scenario_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(session.host_dir),
+            "source_revision": _source_revision(session.host_dir),
             "source_session_container_dir": session.container_dir,
             "source": session.source,
             "config_dir": str(instance.config_host_dir),
@@ -1028,6 +1085,7 @@ def _write_interactive_smoke_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(target.session.host_dir),
+            "source_revision": _source_revision(target.session.host_dir),
             "source_session_container_dir": target.session.container_dir,
             "source": target.session.source,
             "config_dir": str(instance.config_host_dir),
@@ -2445,6 +2503,7 @@ def _ota_write_manifest(
             "instance_id": instance.instance_id,
             "rosotacom_version": __version__,
             "source_session_host_dir": str(target.session.host_dir),
+            "source_revision": _source_revision(target.session.host_dir),
             "source_session_container_dir": target.session.container_dir,
             "source": target.session.source,
             "config_dir": str(instance.config_host_dir),

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom/resources/ws/ota_configs/cyclonedds_tuned.xml.template

@@ -6,7 +6,18 @@
                 <NetworkInterface address="#host_ip"/>
             </Interfaces>
             <MulticastRecvNetworkInterfaceAddresses>none</MulticastRecvNetworkInterfaceAddresses>
-            <FragmentSize>1200B</FragmentSize>
+            <!-- Strictly below MaxMessageSize, and that is the whole point: an RTPS
+                 message carries headers as well as the fragment, so a fragment of
+                 exactly MaxMessageSize cannot be sent at all. Both were 1200B, which
+                 CycloneDDS 0.10.5 coped with and 11.0.1 does not — under Lyrical no
+                 fragmented sample crossed, silently: the endpoints matched and the
+                 reader never saw a sample, while a sample small enough not to
+                 fragment arrived normally. Measured between two hosts with a 64 kB
+                 sample: 1200/1200 delivers nothing on 11.0.1 and everything on
+                 0.10.5; 1024/1200 delivers on both. The datagram stays inside the
+                 same MTU budget the 1200B was chosen for; only the header room is
+                 added. -->
+            <FragmentSize>1024B</FragmentSize>
             <MaxMessageSize>1200B</MaxMessageSize>
             <MaxRexmitMessageSize>1200B</MaxRexmitMessageSize>
         </General>

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom/resources/ws/ros2src/com_py/com_py/link_trace.py

@@ -152,6 +152,12 @@ def build_link_trace_sample(
 class LinkTraceRecorder:
     """Write link trace rows as append-only JSONL."""
 
+    #: How early a tick may be and still count as on time. The caller ticks at
+    #: the same nominal period, so its jitter is the whole question; a tenth of
+    #: the interval absorbs that without ever letting rows run at half the
+    #: configured period.
+    _TOLERANCE_FRACTION = 0.1
+
     def __init__(
         self,
         path: str,
@@ -166,13 +172,37 @@ class LinkTraceRecorder:
         self.modem_metrics_command = modem_metrics_command
         self.modem_metrics_timeout_s = modem_metrics_timeout_s
         self._clock = clock
-        self._last_write: Optional[float] = None
+        self._due_at: Optional[float] = None
 
     def maybe_write(self, snapshot: Dict[str, Any], link_sample: Optional[Dict[str, Any]]) -> bool:
+        """Write one row if this tick is the one the schedule was waiting for.
+
+        The schedule is a *deadline that advances*, not a stopwatch since the
+        last row, and the tolerance is not cosmetic. The caller is deliberately
+        ticking at the same period as this one — `generate_session_files` sets
+        `status_write_interval_s` to the trace interval — so a plain
+        "never faster than interval_s" gate rejects every tick that lands a hair
+        early and, with no catch-up, makes it wait a whole further period.
+
+        That halves the trace, and it does not merely halve its resolution: the
+        passive counter delta in a row covers the caller's own tick, so with
+        rows twice as far apart every second of traffic is described by no row
+        at all. Measured on the 2026-08-19 drive before this fix: rows 1.984 s
+        apart carrying 1.002 s windows.
+        """
         now = self._clock()
-        if self._last_write is not None and now - self._last_write < self.interval_s:
+        if self._due_at is None:
+            self._due_at = now
+        if now < self._due_at - self._TOLERANCE_FRACTION * self.interval_s:
             return False
-        self._last_write = now
+        # Advance the deadline rather than restarting it from now, so the rows
+        # stay on one cadence instead of drifting by the jitter of every tick.
+        # After a stall long enough that the next deadline is already behind us,
+        # start a fresh interval from the present rather than bursting through
+        # the deadlines that were missed: the rows describe the link now, and a
+        # burst of them would describe nothing.
+        next_due = self._due_at + self.interval_s
+        self._due_at = next_due if next_due > now else now + self.interval_s
         modem = run_modem_metrics_hook(
             self.modem_metrics_command,
             timeout_s=self.modem_metrics_timeout_s,

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom_dev.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev62
+Version: 2.5.dev65
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause
@@ -367,7 +367,7 @@ Peer reachability is opt-in because some valid networks block ICMP and peers may
 be started in either order. `rosotacom start` accepts the same
 `--require-peer-reachable` policy when a deployment does require it.
 
-`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
+`rosotacom` reads the static session input and creates generated files under `session-instances/<date>/<session>_<timestamp>_<id>/config/`, including per-peer plugin/session specs, topic lists, optional QoS, and optional `domain_bridge.yaml`. The instance's `manifest.yaml` records what produced it: `rosotacom_version`, the effective config SHA, and `source_revision` — the commit, branch and tracked-dirtiness of the session source directory at creation time, so a recording stays attributable to a revision after the checkout has moved on (`null` when the source is not a git repository). Catmux pane output is logged under the same instance in `logs/<peer>/catmux/`.
 
 What else a run leaves under `logs/<peer>/`, and which file to open first when a
 peer looked healthy but did nothing:

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom_dev.egg-info/SOURCES.txt

@@ -62,6 +62,7 @@ docs/testing.md
 docs/work-items.md
 docs/findings/README.md
 docs/findings/a-transport-element-doubles-every-fastdds-sample.md
+docs/findings/cyclone-fragment-equal-to-max-drops-fragmented-samples.md
 docs/findings/cyclone-spdp-discovery-bursts.md
 docs/findings/delay-alone-no-loss.md
 docs/findings/fastdds-datagram-cap-drops-large-samples.md

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom_dev.egg-info/scm_file_list.json

@@ -47,6 +47,7 @@
     "docs/ffmpeg-keyframes.md",
     "docs/findings/README.md",
     "docs/findings/a-transport-element-doubles-every-fastdds-sample.md",
+    "docs/findings/cyclone-fragment-equal-to-max-drops-fragmented-samples.md",
     "docs/findings/cyclone-spdp-discovery-bursts.md",
     "docs/findings/delay-alone-no-loss.md",
     "docs/findings/fastdds-datagram-cap-drops-large-samples.md",

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/src/rosotacom_dev.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
   "tag": "2.4",
-  "distance": 62,
-  "node": "gfec674ece7749d5ecb7bf4b65d12faa17e8f965e",
+  "distance": 65,
+  "node": "g10a4e383f32456a7740c259e780111c21ea071de",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-20"

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/tests/unit/test_cli.py

@@ -3721,3 +3721,81 @@ def test_ota_cleanup_refuses_to_act_on_a_guessed_plan(capsys: pytest.CaptureFixt
 
     assert calls == []
     assert "no deployment state" in capsys.readouterr().out
+
+
+def _git_repo(path: Path) -> None:
+    path.mkdir(parents=True, exist_ok=True)
+    env = {
+        **os.environ,
+        "GIT_AUTHOR_NAME": "t",
+        "GIT_AUTHOR_EMAIL": "t@example.invalid",
+        "GIT_COMMITTER_NAME": "t",
+        "GIT_COMMITTER_EMAIL": "t@example.invalid",
+    }
+    for args in (
+        ["init", "--initial-branch", "main"],
+        ["config", "commit.gpgsign", "false"],
+    ):
+        subprocess.run(["git", "-C", str(path), *args], check=True, capture_output=True, env=env)
+    (path / "session-definition.yaml").write_text("shared: {}\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(path), "add", "-A"], check=True, capture_output=True, env=env)
+    subprocess.run(["git", "-C", str(path), "commit", "-m", "seed"], check=True, capture_output=True, env=env)
+
+
+def test_the_manifest_records_the_revision_of_the_session_it_was_built_from(
+    tmp_path: Path,
+) -> None:
+    """rosotacom_version pins the tool; this pins its input.
+
+    Without it the only recoverable commit is whatever the machine holds when
+    somebody looks, which is a different fact — and a wrong one as soon as the
+    machine has been synced in between.
+    """
+    session = tmp_path / "sessions" / "demo"
+    _git_repo(session)
+
+    revision = rosotacom._source_revision(session)
+
+    assert revision is not None
+    assert revision["vcs"] == "git"
+    assert re.fullmatch(r"[0-9a-f]{40}", revision["commit"])
+    assert revision["branch"] == "main"
+    assert revision["dirty"] is False
+    assert Path(revision["root"]).resolve() == session.resolve()
+
+
+def test_a_session_source_that_differs_from_its_commit_says_so(tmp_path: Path) -> None:
+    session = tmp_path / "sessions" / "demo"
+    _git_repo(session)
+    (session / "session-definition.yaml").write_text("shared: {changed: true}\n", encoding="utf-8")
+
+    assert rosotacom._source_revision(session)["dirty"] is True
+
+
+def test_untracked_files_beside_a_session_do_not_make_it_dirty(tmp_path: Path) -> None:
+    """A deployment checkout carries recordings, logs and scratch files.
+
+    Counting those would leave every real deployment permanently dirty, which is
+    the same as reporting nothing.
+    """
+    session = tmp_path / "sessions" / "demo"
+    _git_repo(session)
+    (session / "rosbag2_2026_01_01-00_00_00").mkdir()
+    (session / "rosbag2_2026_01_01-00_00_00" / "metadata.yaml").write_text("x\n", encoding="utf-8")
+
+    assert rosotacom._source_revision(session)["dirty"] is False
+
+
+@pytest.mark.parametrize("case", ["not_a_repository", "not_a_directory", "missing"])
+def test_a_source_without_a_revision_is_null_and_not_an_error(tmp_path: Path, case: str) -> None:
+    """An instance must never fail to start over a provenance read."""
+    if case == "not_a_repository":
+        target = tmp_path / "plain"
+        target.mkdir()
+    elif case == "not_a_directory":
+        target = tmp_path / "file"
+        target.write_text("x\n", encoding="utf-8")
+    else:
+        target = tmp_path / "gone"
+
+    assert rosotacom._source_revision(target) is None

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/tests/unit/test_link_trace.py

@@ -129,3 +129,75 @@ def test_link_trace_recorder_appends_jsonl_on_interval(tmp_path: Path) -> None:
 
     rows = [json.loads(line) for line in trace_path.read_text(encoding="utf-8").splitlines()]
     assert [row["kind"] for row in rows] == ["link_trace", "link_trace"]
+
+
+def _recorder(tmp_path: Path, ticks: list[float], interval_s: float = 1.0) -> tuple[LinkTraceRecorder, list[float]]:
+    remaining = iter(ticks)
+    path = tmp_path / "status" / "link_trace.jsonl"
+    return LinkTraceRecorder(str(path), interval_s=interval_s, clock=lambda: next(remaining)), ticks
+
+
+SNAPSHOT = {"generated_at": "2026-08-19T13:52:11.000", "peer": "a", "remote": "b", "topics": []}
+
+
+def test_a_caller_ticking_at_the_configured_period_gets_a_row_per_tick(tmp_path: Path) -> None:
+    """The caller ticks at exactly this period, so its jitter is the whole question.
+
+    `generate_session_files` sets `status_write_interval_s` to the trace
+    interval, so every tick lands one period after the last — sometimes a
+    millisecond early. A gate that rejects those outright makes each of them
+    wait a further full period, which is how the 2026-08-19 drive ended up with
+    rows 1.984 s apart at `interval_s: 1.0`.
+    """
+    ticks = [100.0, 100.999, 101.998, 102.997, 103.996]
+    recorder, _ = _recorder(tmp_path, ticks)
+
+    written = [recorder.maybe_write(SNAPSHOT, None) for _ in ticks]
+
+    assert written == [True] * len(ticks)
+
+
+def test_half_the_traffic_is_not_left_between_two_rows(tmp_path: Path) -> None:
+    """Why the tick above matters more than resolution.
+
+    A row's passive counter delta covers the caller's own tick. With rows twice
+    as far apart as the ticks, every second interval is described by no row at
+    all — so the trace undercounts the bytes it exists to account for.
+    """
+    ticks = [0.0, 0.999, 1.998, 2.997]
+    recorder, _ = _recorder(tmp_path, ticks)
+    for _ in ticks:
+        recorder.maybe_write(SNAPSHOT, {"passive_counter_delta": {"window_s": 1.0}})
+
+    rows = [
+        json.loads(line) for line in (tmp_path / "status" / "link_trace.jsonl").read_text(encoding="utf-8").splitlines()
+    ]
+    stamps = [row["monotonic_s"] for row in rows]
+    gaps = [b - a for a, b in zip(stamps, stamps[1:], strict=False)]
+    assert gaps, "more than one row"
+    assert max(gaps) < 1.5, "no second of the drive falls between two rows"
+
+
+def test_a_much_faster_caller_is_still_held_to_the_interval(tmp_path: Path) -> None:
+    """The tolerance must not turn the interval into a suggestion."""
+    ticks = [0.0, 0.2, 0.4, 0.6, 0.8, 1.0, 1.2]
+    recorder, _ = _recorder(tmp_path, ticks)
+
+    written = [recorder.maybe_write(SNAPSHOT, None) for _ in ticks]
+
+    assert written == [True, False, False, False, False, True, False]
+
+
+def test_a_stall_resynchronises_instead_of_bursting(tmp_path: Path) -> None:
+    """After a gap, the rows describe the link now.
+
+    Emitting the deadlines that were missed would produce a burst of rows that
+    describe nothing, and would make the trace's own timestamps disagree with
+    the counters in it.
+    """
+    ticks = [0.0, 30.0, 30.2, 31.0]
+    recorder, _ = _recorder(tmp_path, ticks)
+
+    written = [recorder.maybe_write(SNAPSHOT, None) for _ in ticks]
+
+    assert written == [True, True, False, True]

{rosotacom_dev-2.5.dev62 → rosotacom_dev-2.5.dev65}/tests/unit/test_ota_link_configs.py

@@ -28,7 +28,9 @@ PLUGIN_BASE = (
     REPO_ROOT / "src" / "rosotacom" / "resources" / "ws" / "session" / "content" / "base" / "session_plugin_base.yaml"
 )
 
-OTA_FRAGMENT_BYTES = 1200
+OTA_FRAGMENT_BYTES = 1024
+#: The datagram cap the fragment has to fit inside, headers included.
+OTA_DATAGRAM_BYTES = 1200
 
 
 def _load(path: Path, name: str) -> ModuleType:
@@ -73,7 +75,15 @@ def test_only_cyclone_caps_the_datagram_and_fast_dds_must_not() -> None:
     cyclone = _resolved("cyclonedds_tuned.xml")
 
     assert f"<FragmentSize>{OTA_FRAGMENT_BYTES}B</FragmentSize>" in cyclone
-    assert f"<MaxMessageSize>{OTA_FRAGMENT_BYTES}B</MaxMessageSize>" in cyclone
+    assert f"<MaxMessageSize>{OTA_DATAGRAM_BYTES}B</MaxMessageSize>" in cyclone
+
+    # Strictly smaller, not equal, and this is the assertion the numbers exist
+    # for: an RTPS message carries headers as well as the fragment, so a
+    # fragment of exactly MaxMessageSize cannot be sent. Both were 1200 B, which
+    # CycloneDDS 0.10.5 coped with and 11.0.1 does not — no fragmented sample
+    # arrived at all, silently, while a 40 B one kept crossing
+    # (docs/findings/cyclone-fragment-equal-to-max-drops-fragmented-samples.md).
+    assert OTA_FRAGMENT_BYTES < OTA_DATAGRAM_BYTES
 
     for config in ("fastdds_tuned.xml", "fastdds_easy_mode.xml"):
         resolved = _without_comments(_resolved(config))