[futurepaul]

Flake: simplex::run::tests::no_unsettled_cancel_is_let_go (images/bridge/src/simplex/run.rs:2744), "every cancel kept, none settled": 43 of 64 cancels left Cancelling. Seen on #779's images check (run 41161367564, job 124419427605), from master's code.

Cause (test): the test's clock (t) starts before its forwards and allows them 1 s (t += FILE_WAIT_MS + 1_000). But forward stamps each file with the real clock (Instant::now()) and writes the link's file each time. On a slow runner, a batch of 32 forwards took longer than that second:

• the batch's later files weren't overdue at files_overdue(t), and stayed in files;
• FILES_MAX (32) then turned away as many files of the next batch, which were never received and so never given up on;
• so fewer than 64 cancels were kept: 64 − 21 = 43.

The product is right: a file is overdue a full FILE_WAIT_MS after its forward. Its twin, a_receive_asked_before_a_restart_keeps_its_place, relies on the same second, as do three single-file overdue steps.

Fix: the tests take an instant past the wait for every file forwarded so far, all_overdue(after) = after.max(Instant::now()) + FILE_WAIT_MS, wherever they relied on that second. It's no earlier than the clock they kept, so their retries and order are unchanged. Nothing waits longer: it's a computed instant, not a sleep.

Proof:

• With each link-file write slowed by 40 ms (a proof-only edit, not committed; a batch takes about 1.3 s), the old tests fail: 57 of 64 cancels kept in this one, and its twin receives /freceive 66 it shouldn't. With the fix, both pass.
• simplex::run::tests: 200 of 200 runs pass, plus 200 more as 8 at once (25 rounds), all passing. Clippy is clean with -D warnings.

🤖 Generated with Claude Code

[alexlwn123]

Pass at 4decfbd391a18fbee2b89a8c13e03131772ce04b.

The test-only helper removes the one-second assumption about forward/write duration: its deadline is at least FILE_WAIT_MS after every completed forward and advances the existing simulated clock. I traced the five changed call sites through file expiry, cancellation retries, and retained receive reservations; the assertions remain meaningful. One shared helper is proportionate to the fix, and I found no blocking regression.

Validation: CI is still running. Attempted cargo test -p fragment-bridge simplex::run::tests from images/, but this macOS host cannot compile the existing Linux-only libc::prctl/PR_SET_PDEATHSIG call (also present in the parent commit), so no local tests ran. The referenced external engineering-style file was unavailable on this machine.