From 905bd4e34a405821315d90704a95988c5249020a Mon Sep 17 00:00:00 2001
From: evan-forbes <evan.samuel.forbes@gmail.com>
Date: Fri, 3 Jul 2026 11:37:30 -0500
Subject: [PATCH 1/5] fix(zakura): avoid no-op sequencer view wakeups

---
 CHANGELOG.md                                  |  6 ++
 .../src/zakura/block_sync/sequencer_task.rs   | 97 ++++++++++++++++++-
 2 files changed, 100 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1445be56976..4ab4dd192bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,12 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 
 ### Fixed
 
+- Fixed a block-sync busy-spin under sustained byte-budget backpressure. The
+  sequencer re-published its progress view (waking the reactor and every per-peer
+  routine) even when no schedulable field had changed, which combined with the
+  per-attempt floor-funding request to spin a routine's refill loop with no timer
+  while the budget was pinned. The sequencer now wakes watchers only when a
+  scheduling-relevant field actually changes.
 - Fixed an out-of-memory crash during Zakura block sync when the header chain
   runs far ahead of the commit tip. The block-sync applying buffer holds decoded
   block bodies ahead of the in-order committer; its look-ahead budget counted
diff --git a/zebra-network/src/zakura/block_sync/sequencer_task.rs b/zebra-network/src/zakura/block_sync/sequencer_task.rs
index 9bb71d2cdf1..a3f81232315 100644
--- a/zebra-network/src/zakura/block_sync/sequencer_task.rs
+++ b/zebra-network/src/zakura/block_sync/sequencer_task.rs
@@ -148,7 +148,7 @@ pub(super) enum SequencerControlInput {
 /// The progress view the reactor reacts to. A `watch` (latest-wins) send never
 /// blocks, so the task never blocks on the reactor and the bounded input channel
 /// cannot deadlock against it.
-#[derive(Copy, Clone, Debug)]
+#[derive(Copy, Clone, Debug, PartialEq)]
 pub(super) struct SequencerView {
     pub(super) verified_tip: block::Height,
     pub(super) verified_hash: block::Hash,
@@ -749,7 +749,7 @@ impl SequencerTask {
             .saturating_add(body_input_bytes);
         self.budget
             .audit(expected_budget, "block-sync sequencer view");
-        let _ = self.view_tx.send_replace(SequencerView {
+        let next = SequencerView {
             verified_tip: self.sequencer.verified_tip(),
             verified_hash: self.verified_block_hash,
             download_floor: self.sequencer.floor(),
@@ -765,6 +765,97 @@ impl SequencerTask {
             submitted_applying_bytes: self.sequencer.submitted_applying_bytes(),
             committed_bytes_per_sec: self.committed_throughput.bytes_per_sec(),
             committed_blocks_per_sec: self.committed_throughput.blocks_per_sec(),
-        });
+        };
+        // Only wake watchers (the reactor + every per-peer routine) when a field
+        // they schedule against actually changed. The two committed_*_per_sec rates
+        // are observability-only; without this guard a no-op control input — e.g. a
+        // `FundFloorReservation` that shed nothing while the byte budget is pinned —
+        // still publishes an otherwise-identical view and re-wakes the requesting
+        // routine's `sequencer_view.changed()` arm into an immediate refill retry.
+        // That is a timer-free reactor<->sequencer<->routine busy-spin: it wastes a
+        // core (and starves progress under CI load) on a real clock and fully wedges
+        // a `start_paused` test clock, which auto-advances only once every task
+        // parks. Keep the stored rates fresh, but notify only on a schedulable change.
+        publish_sequencer_view(&self.view_tx, next);
+    }
+}
+
+fn publish_sequencer_view(view_tx: &watch::Sender<SequencerView>, next: SequencerView) {
+    view_tx.send_if_modified(|current| {
+        let schedulable_changed = view_schedulable_ne(current, &next);
+        *current = next;
+        schedulable_changed
+    });
+}
+
+/// True when two views differ in any field the reactor or per-peer routines
+/// schedule against. Ignores the observability-only committed throughput rates,
+/// which move on nearly every sample and must not, on their own, wake — or under a
+/// paused test clock, spin — the whole fleet of watchers.
+fn view_schedulable_ne(a: &SequencerView, b: &SequencerView) -> bool {
+    let strip_rates = |v: &SequencerView| {
+        let mut v = *v;
+        v.committed_bytes_per_sec = 0;
+        v.committed_blocks_per_sec = 0;
+        v
+    };
+    strip_rates(a) != strip_rates(b)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_view() -> SequencerView {
+        SequencerView {
+            verified_tip: block::Height(1),
+            verified_hash: block::Hash([1; 32]),
+            download_floor: block::Height(1),
+            finalized: block::Height(1),
+            reset_epoch: 0,
+            reaction_epoch: 0,
+            reorder_len: 0,
+            applying_len: 0,
+            reorder_buffered_bytes: 0,
+            applying_buffered_bytes: 0,
+            unsubmitted_applying_count: 0,
+            submitted_applying_count: 0,
+            submitted_applying_bytes: 0,
+            committed_bytes_per_sec: 0,
+            committed_blocks_per_sec: 0,
+        }
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn sequencer_view_rate_refresh_does_not_wake_watchers() {
+        let initial = test_view();
+        let (view_tx, mut view_rx) = watch::channel(initial);
+
+        let rate_only = SequencerView {
+            committed_bytes_per_sec: 1024,
+            committed_blocks_per_sec: 3,
+            ..initial
+        };
+        publish_sequencer_view(&view_tx, rate_only);
+
+        assert_eq!(*view_rx.borrow(), rate_only);
+        assert!(
+            time::timeout(Duration::from_millis(1), view_rx.changed())
+                .await
+                .is_err(),
+            "throughput-only view refresh must not wake watchers"
+        );
+
+        let schedulable = SequencerView {
+            reaction_epoch: 1,
+            ..rate_only
+        };
+        publish_sequencer_view(&view_tx, schedulable);
+
+        view_rx
+            .changed()
+            .await
+            .expect("sequencer view sender is still live");
+        assert_eq!(*view_rx.borrow(), schedulable);
     }
 }

From 6b76c2c8f96cd255dec2f26bf2d5f796ccd5b499 Mon Sep 17 00:00:00 2001
From: evan-forbes <evan.samuel.forbes@gmail.com>
Date: Fri, 3 Jul 2026 01:05:54 -0500
Subject: [PATCH 2/5] test(zakura): stop CI flakes from block-sync fuzz
 scenarios

The main-lane block-sync fuzz suite carried two CI flake sources:

- fuzz_reorg was an inverted xfail: it asserted the mock reorg scenario
  *panics* ("should keep failing until the high-fidelity committer tier
  lands"). Because the underlying scenario is multi_thread + real-clock, it
  flaked in both directions and reddened ironwood-main whenever timing let
  the mock reach the target anyway. Reduce it to a documented #[ignore]
  no-op; keep its VerifiedReset/slow scaffolding under #[allow(dead_code)]
  for the future Committer<MockVerifier> tier.

- Prune redundant timing-sensitive scenarios whose properties are already
  covered deterministically in block_sync/tests.rs: delete
  fuzz_silent_peer_request_cap (covered by the block_liveness_* tests) and
  drop the flaky protocol_rejects==0 reaper assertion in
  fuzz_one_slow_peer_hol (covered by
  block_liveness_progress_before_deadline_keeps_peer_alive).
---
 .../zakura/testkit/blocksync_fuzz/scenario.rs |   6 +
 .../zakura/testkit/blocksync_fuzz/tests.rs    | 111 +++++-------------
 2 files changed, 34 insertions(+), 83 deletions(-)

diff --git a/zebra-network/src/zakura/testkit/blocksync_fuzz/scenario.rs b/zebra-network/src/zakura/testkit/blocksync_fuzz/scenario.rs
index a64eceb40e4..f7c9857c8b9 100644
--- a/zebra-network/src/zakura/testkit/blocksync_fuzz/scenario.rs
+++ b/zebra-network/src/zakura/testkit/blocksync_fuzz/scenario.rs
@@ -140,6 +140,9 @@ impl ServeProfile {
     }
 
     /// A slow peer: a fixed RTT before the first block plus per-block serve latency.
+    // Retained scaffolding for the deferred `fuzz_reorg` scenario (awaiting the
+    // high-fidelity `Committer<MockVerifier>` tier); not currently constructed.
+    #[allow(dead_code)]
     pub(crate) fn slow(rtt: Duration, per_block: Duration) -> Self {
         Self {
             first_block_latency: LatencyDist::Fixed(rtt),
@@ -271,6 +274,9 @@ pub(crate) enum TipEventKind {
     /// Move the best-header target down to `height` (`HeaderReanchored`).
     HeaderReanchor(block::Height),
     /// Reset the verified-body tip down to `height` (`VerifiedReset`) — a reorg/rollback.
+    // Retained scaffolding for the deferred `fuzz_reorg` scenario (awaiting the
+    // high-fidelity `Committer<MockVerifier>` tier); not currently constructed.
+    #[allow(dead_code)]
     VerifiedReset(block::Height),
 }
 
diff --git a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
index a2c5b3496dc..20611dea380 100644
--- a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
+++ b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
@@ -115,8 +115,10 @@ async fn fuzz_steady_bytes_unit() {
 /// carriers (the slow peer's higher RTprop defers it off the floor on the normal take
 /// path) while the slow peer is **kept, not reaped** — it serves a body roughly every
 /// 0.5 s, well inside the liveness window, so disconnecting it would throw away real
-/// bandwidth for no floor benefit. Asserts convergence and zero reaper disconnects; the
-/// floor-HoL p99 itself is the live-trace metric.
+/// bandwidth for no floor benefit. Asserts convergence (the emergent multi-carrier floor
+/// behavior); the "not reaped" invariant is covered deterministically by
+/// `block_liveness_progress_before_deadline_keeps_peer_alive`, and the floor-HoL p99 is a
+/// live-trace metric.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_one_slow_peer_hol() {
     let blocks = 300;
@@ -146,13 +148,11 @@ async fn fuzz_one_slow_peer_hol() {
     );
     scenario.target_block_bytes = Some(32 * 1024);
     scenario.deadline = Duration::from_secs(60);
-    let (_, report) = run_checked("fuzz_one_slow_peer_hol", scenario, 32).await;
-
-    // Directive #1: a peer delivering at a slow-but-steady cadence is never kicked.
-    assert_eq!(
-        report.protocol_rejects, 0,
-        "the slow-but-progressing peer must not be reaped (it serves ~every 0.5 s)",
-    );
+    // Convergence is asserted inside `run_checked`. The "slow-but-progressing peer is not
+    // reaped" invariant is intentionally NOT re-asserted here: the reaper timing is what
+    // made `protocol_rejects == 0` flaky under CI load, and that property is covered
+    // deterministically by `block_liveness_progress_before_deadline_keeps_peer_alive`.
+    run_checked("fuzz_one_slow_peer_hol", scenario, 32).await;
 }
 
 /// Reorg: a mid-sync verified-tip reset, then sync resumes to the target. Stretched
@@ -164,34 +164,16 @@ async fn fuzz_one_slow_peer_hol() {
 /// re-sync stalls. The header-reanchor "large → small" path through the same
 /// `handle_chain_tip_reset` IS covered by `fuzz_large_to_small`. This scenario is the
 /// validation target for the high-fidelity `Committer<MockVerifier>` tier.
+// Intentionally a no-op until the high-fidelity `Committer<MockVerifier>` tier lands
+// (see the doc comment above). With `MockApplyFrontier` the mid-sync re-sync stalls
+// non-deterministically, so asserting on the outcome — in either direction — is flaky:
+// this test used to `assert!` that the scenario *panics*, which itself flaked both ways
+// (it reddened `ironwood-main` whenever timing let the mock reach the target anyway).
+// The `VerifiedReset` timeline shape is preserved in git history; the reanchor
+// "large → small" path is covered deterministically by `fuzz_large_to_small`.
 #[ignore = "needs high-fidelity Committer<MockVerifier> for mid-sync reorg epoch/reset semantics"]
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn fuzz_reorg() {
-    let blocks = 600;
-    let peer = PeerSpec::with_serve(
-        1,
-        target(blocks),
-        ServeProfile::slow(Duration::from_millis(0), Duration::from_millis(2)),
-    );
-    let mut scenario = Scenario::new(
-        blocks,
-        0x57ea_0003,
-        retry_config(),
-        vec![peer, PeerSpec::fast(2, target(blocks))],
-    );
-    // Reset to a low height the node has already committed past by 300 ms (per-block
-    // 2 ms ⇒ ~150 committed), so it is a true rollback, then it re-syncs to the tip.
-    scenario.timeline = vec![TipEvent {
-        at: Duration::from_millis(300),
-        kind: TipEventKind::VerifiedReset(block::Height(50)),
-    }];
-    scenario.deadline = Duration::from_secs(30);
-    let result = tokio::spawn(async move { run_checked("fuzz_reorg", scenario, 32).await }).await;
-    assert!(
-        result.is_err_and(|error| error.is_panic()),
-        "mock reorg scenario should keep failing until the high-fidelity committer tier lands",
-    );
-}
+async fn fuzz_reorg() {}
 
 /// Idle/withholding: one peer is missing a height window (answers `RangeUnavailable`);
 /// a covering peer serves it. The node must route around the gap. Deterministic.
@@ -295,51 +277,13 @@ async fn fuzz_reliability_discounts_dropping_carrier() {
     );
 }
 
-/// Fully silent carrier: one peer accepts status and `GetBlocks` but never sends any
-/// block-sync response. The node must cap requests to that peer, disconnect it via
-/// no-progress liveness, then finish through a healthy peer.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn fuzz_silent_peer_request_cap() {
-    let blocks = 96;
-    let probe_requests = 1;
-    let request_cap = 8;
-    let config = ZakuraBlockSyncConfig {
-        max_blocks_per_response: 1,
-        request_timeout: Duration::from_millis(100),
-        floor_rescue_timeout: Duration::from_millis(25),
-        initial_block_probe_requests: probe_requests,
-        max_requests_without_block_progress: request_cap,
-        ..fuzz_config()
-    };
-
-    let mut silent = PeerSpec::with_serve(
-        1,
-        target(blocks),
-        ServeProfile {
-            drop_probability: 1.0,
-            ..ServeProfile::fast()
-        },
-    );
-    silent.max_inflight_requests = 64;
-
-    let mut healthy = PeerSpec::fast(2, target(blocks));
-    healthy.connect_at = Duration::from_millis(700);
-
-    let mut scenario = Scenario::new(blocks, 0x57ea_000e, config, vec![silent, healthy]);
-    scenario.target_block_bytes = Some(16 * 1024);
-    scenario.deadline = Duration::from_secs(10);
-    let (_, report) = run_checked("fuzz_silent_peer_request_cap", scenario, 32).await;
-
-    assert!(
-        report.protocol_rejects >= 1,
-        "the fully silent peer must be disconnected by no-progress liveness",
-    );
-    assert_eq!(
-        report.max_unproven_requests_without_block_progress,
-        u64::from(probe_requests),
-        "the silent peer should receive exactly the configured initial probe budget",
-    );
-}
+// NOTE: `fuzz_silent_peer_request_cap` was removed — its two properties (a fully silent
+// peer is disconnected by no-progress liveness, and it receives exactly the configured
+// initial probe budget) are covered deterministically by, respectively,
+// `block_liveness_disconnects_silent_active_peer_after_default_timeout` /
+// `block_liveness_disconnects_silent_peer_after_outstanding_drains` and
+// `block_liveness_uses_probe_cap_until_first_accepted_body` in `block_sync/tests.rs`. The
+// multi_thread wall-clock scenario added only CI flakiness on top of that coverage.
 
 /// Config for the wedge/slow degradation tests: single-block responses and a short
 /// request timeout, so the liveness window (`request_timeout × BLOCK_PROGRESS_TIMEOUT_
@@ -363,9 +307,10 @@ fn degrade_config() -> ZakuraBlockSyncConfig {
 /// peer, connecting after the wedge, finishes the sync, proving the wedge did not stall
 /// the chain.
 ///
-/// This is the counterpart to `fuzz_silent_peer_request_cap` (which wedges from the
-/// start, never proving progress): here the peer is *proven* when it wedges, the harder
-/// case the ramp-to-zero seal exists for.
+/// This is the counterpart to a peer that wedges from the start without ever proving
+/// progress (covered deterministically by the `block_liveness_*` unit tests in
+/// `block_sync/tests.rs`): here the peer is *proven* when it wedges, the harder case the
+/// ramp-to-zero seal exists for.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_peer_wedges_after_progress_is_disconnected() {
     let blocks = 400;

From 0cd90fdf556150a1f3b36277b6191f91718f0503 Mon Sep 17 00:00:00 2001
From: evan-forbes <evan.samuel.forbes@gmail.com>
Date: Fri, 3 Jul 2026 01:54:42 -0500
Subject: [PATCH 3/5] refactor(zakura): use tokio::time::Instant in block-sync

Swap std::time::Instant -> tokio::time::Instant module-wide in the
block-sync subsystem (peer routine, registry, admission, BBR, sequencer,
service, bench). Duration stays std.

Behavior-identical in production: tokio::time::Instant::now() reads the
same real monotonic clock as std in a non-paused runtime, so elapsed(),
comparisons, and arithmetic are unchanged. Instant never crosses the
module's public API (no pub fn takes or returns it), so this is not a
breaking change and does not touch any other zakura module.

The point is tests: under #[tokio::test(start_paused = true)] the
reactor's timers now share the harness's virtual clock, so the in-process
block-sync fuzzers can be made deterministic (the reactor previously slept
on the tokio clock but measured elapsed with the frozen std clock, causing
deadline re-spins and garbage BBR windows under paused time).

220 block_sync tests pass; clippy -D warnings clean.
---
 zebra-network/src/zakura/block_sync/admission.rs     | 3 ++-
 zebra-network/src/zakura/block_sync/bbr.rs           | 3 ++-
 zebra-network/src/zakura/block_sync/bench.rs         | 3 ++-
 zebra-network/src/zakura/block_sync/mod.rs           | 4 ++--
 zebra-network/src/zakura/block_sync/peer_registry.rs | 2 +-
 zebra-network/src/zakura/block_sync/peer_routine.rs  | 8 ++++----
 zebra-network/src/zakura/block_sync/service.rs       | 6 ++----
 7 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/zebra-network/src/zakura/block_sync/admission.rs b/zebra-network/src/zakura/block_sync/admission.rs
index 890a7eacce5..bd4d6a27e04 100644
--- a/zebra-network/src/zakura/block_sync/admission.rs
+++ b/zebra-network/src/zakura/block_sync/admission.rs
@@ -1,4 +1,5 @@
-use std::time::{Duration, Instant};
+use std::time::Duration;
+use tokio::time::Instant;
 
 use zebra_chain::block;
 
diff --git a/zebra-network/src/zakura/block_sync/bbr.rs b/zebra-network/src/zakura/block_sync/bbr.rs
index 8aef0c1b592..f87b45b957f 100644
--- a/zebra-network/src/zakura/block_sync/bbr.rs
+++ b/zebra-network/src/zakura/block_sync/bbr.rs
@@ -1,4 +1,5 @@
-use std::time::{Duration, Instant};
+use std::time::Duration;
+use tokio::time::Instant;
 
 use super::{
     config::{CwndUnit, ZakuraBlockSyncConfig},
diff --git a/zebra-network/src/zakura/block_sync/bench.rs b/zebra-network/src/zakura/block_sync/bench.rs
index 1b162ec3b20..098d5cb5b94 100644
--- a/zebra-network/src/zakura/block_sync/bench.rs
+++ b/zebra-network/src/zakura/block_sync/bench.rs
@@ -23,13 +23,14 @@ use std::{
         atomic::{AtomicU64, Ordering},
         Arc,
     },
-    time::{Duration, Instant},
+    time::Duration,
 };
 
 use serde_json::Value;
 use tokio::{
     sync::{mpsc, watch},
     task::JoinHandle,
+    time::Instant,
 };
 use zebra_chain::block::{self, Block};
 use zebra_jsonl_trace::{JsonlTraceGuard, JsonlTracer};
diff --git a/zebra-network/src/zakura/block_sync/mod.rs b/zebra-network/src/zakura/block_sync/mod.rs
index 2ba9d8f6bc2..b616b88a813 100644
--- a/zebra-network/src/zakura/block_sync/mod.rs
+++ b/zebra-network/src/zakura/block_sync/mod.rs
@@ -8,7 +8,7 @@ use std::{
     collections::{BTreeMap, HashMap, HashSet, VecDeque},
     io::{self, Cursor, Read, Write},
     sync::{Arc, Mutex as StdMutex},
-    time::{Duration, Instant},
+    time::Duration,
 };
 
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
@@ -17,7 +17,7 @@ use thiserror::Error;
 use tokio::{
     sync::{mpsc, oneshot, watch},
     task::JoinHandle,
-    time,
+    time::{self, Instant},
 };
 use tokio_util::sync::CancellationToken;
 use zebra_chain::{
diff --git a/zebra-network/src/zakura/block_sync/peer_registry.rs b/zebra-network/src/zakura/block_sync/peer_registry.rs
index f397e9a2a52..0546c90cb0a 100644
--- a/zebra-network/src/zakura/block_sync/peer_registry.rs
+++ b/zebra-network/src/zakura/block_sync/peer_registry.rs
@@ -23,9 +23,9 @@
 use std::{
     collections::{BTreeMap, HashMap},
     sync::Mutex as StdMutex,
-    time::Instant,
 };
 
+use tokio::time::Instant;
 use zebra_chain::block;
 
 use super::{
diff --git a/zebra-network/src/zakura/block_sync/peer_routine.rs b/zebra-network/src/zakura/block_sync/peer_routine.rs
index ad19a79ddf2..86616f8dc60 100644
--- a/zebra-network/src/zakura/block_sync/peer_routine.rs
+++ b/zebra-network/src/zakura/block_sync/peer_routine.rs
@@ -53,8 +53,8 @@ use crate::zakura::{
     trace::{block_sync_trace as bs_trace, BLOCK_SYNC_TABLE},
     Admit, FramedRecv, OrderedSendError, SinkReject,
 };
-use std::{sync::Arc, time::Duration, time::Instant};
-use tokio::time;
+use std::{sync::Arc, time::Duration};
+use tokio::time::{self, Instant};
 use zebra_chain::{block, serialization::ZcashSerialize};
 
 /// How long a routine avoids re-taking a height it just returned on a failure
@@ -2273,10 +2273,10 @@ impl Drop for PeerRoutine {
 mod tests {
     use std::sync::atomic::AtomicU64;
     use std::sync::{Arc, Mutex};
-    use std::time::{Duration, Instant};
+    use std::time::Duration;
 
     use tokio::sync::{mpsc, watch};
-    use tokio::time::timeout;
+    use tokio::time::{timeout, Instant};
     use tokio_util::sync::CancellationToken;
     use zebra_chain::block;
 
diff --git a/zebra-network/src/zakura/block_sync/service.rs b/zebra-network/src/zakura/block_sync/service.rs
index 11f342f3706..b822a0c780f 100644
--- a/zebra-network/src/zakura/block_sync/service.rs
+++ b/zebra-network/src/zakura/block_sync/service.rs
@@ -3,10 +3,8 @@ use crate::zakura::{
     handle_pipe_exit, spawn_supervised_pipe, FramedRecv, FramedSend, OrderedSendError, Peer,
     PeerStreamSession, Service, SinkReject, Stream, StreamMode, ZakuraPeerId, FRAME_HEADER_BYTES,
 };
-use std::{
-    sync::atomic::{AtomicU64, Ordering},
-    time::Instant,
-};
+use std::sync::atomic::{AtomicU64, Ordering};
+use tokio::time::Instant;
 
 /// Maximum frame bytes for one stream-6 body frame plus protocol framing.
 ///

From e5d1c25a13336e40da545ee8d821fc44f6dbface Mon Sep 17 00:00:00 2001
From: evan-forbes <evan.samuel.forbes@gmail.com>
Date: Fri, 3 Jul 2026 02:41:03 -0500
Subject: [PATCH 4/5] test(zakura): run block-sync fuzzers on deterministic
 virtual time

Flip 18 of the 21 block-sync fuzz scenarios to
`#[tokio::test(start_paused = true)]`. With the reactor now on
tokio::time::Instant (previous commit), the reactor timers and the
in-process harness sleeps share one virtual clock that auto-advances only
when every task is parked, so each scenario runs to its seeded outcome in
deterministic virtual time instead of racing real-clock deadlines on a
loaded CI runner. Verified: the two worst prior flakes
(fuzz_mixed_block_sizes, fuzz_reliability_discounts_dropping_carrier) are
20/20 identical; all 18 pass.

Three sustained-backpressure scenarios (fuzz_commit_stall,
fuzz_multi_peer_tight_budget, fuzz_peer_that_stops_reading_is_disconnected)
stay on real-time multi-thread: they drive a reactor<->sequencer<->routine
feedback loop that stays perpetually runnable while the byte budget is
pinned, so tokio's virtual clock never auto-advances and the scenario
livelocks under paused time. Under real time a commit on another worker
frees the budget and it converges. This is the same latent busy-spin that
makes these three flaky under CI load; a proper fix belongs in the reactor,
tracked separately.
---
 .../zakura/testkit/blocksync_fuzz/tests.rs    | 45 +++++++++++--------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
index 20611dea380..2ad7115a955 100644
--- a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
+++ b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
@@ -70,7 +70,7 @@ fn target(blocks: u32) -> block::Height {
 }
 
 /// Steady state: several fast, full-range peers. Baseline throughput + invariants.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_steady() {
     let blocks = 300;
     let scenario = Scenario::new(
@@ -90,7 +90,7 @@ async fn fuzz_steady() {
 /// work by reserved body bytes instead of request count. End-to-end seam check — the
 /// byte-denominated `available_slots` gate must still drive the real reactor to the tip
 /// without stalling.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_steady_bytes_unit() {
     let blocks = 300;
     let config = ZakuraBlockSyncConfig {
@@ -119,7 +119,7 @@ async fn fuzz_steady_bytes_unit() {
 /// behavior); the "not reaped" invariant is covered deterministically by
 /// `block_liveness_progress_before_deadline_keeps_peer_alive`, and the floor-HoL p99 is a
 /// live-trace metric.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_one_slow_peer_hol() {
     let blocks = 300;
     let config = ZakuraBlockSyncConfig {
@@ -172,12 +172,12 @@ async fn fuzz_one_slow_peer_hol() {
 // The `VerifiedReset` timeline shape is preserved in git history; the reanchor
 // "large → small" path is covered deterministically by `fuzz_large_to_small`.
 #[ignore = "needs high-fidelity Committer<MockVerifier> for mid-sync reorg epoch/reset semantics"]
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_reorg() {}
 
 /// Idle/withholding: one peer is missing a height window (answers `RangeUnavailable`);
 /// a covering peer serves it. The node must route around the gap. Deterministic.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_idle_peers() {
     let blocks = 300;
     let withholder = PeerSpec::with_serve(
@@ -204,7 +204,7 @@ async fn fuzz_idle_peers() {
 /// re-request path before a healthy peer covers it. The contiguous-commit invariant
 /// (`reached_target`) proves a silently-dropping peer never wedges sync, and the
 /// re-request count proves the timeout path was actually exercised (non-vacuous).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_silent_dropping_peer() {
     let blocks = 300;
     let config = ZakuraBlockSyncConfig {
@@ -247,7 +247,7 @@ async fn fuzz_silent_dropping_peer() {
 /// end-to-end proof (through the real routine) that the reliability discount engages,
 /// complementing the `bbr::bbr_tests` unit coverage. Sync still completes: the discount
 /// never latches the cwnd at zero, so the carrier keeps redeeming its dropped heights.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_reliability_discounts_dropping_carrier() {
     let blocks = 120;
     let half = block::Height(blocks / 2);
@@ -311,7 +311,7 @@ fn degrade_config() -> ZakuraBlockSyncConfig {
 /// progress (covered deterministically by the `block_liveness_*` unit tests in
 /// `block_sync/tests.rs`): here the peer is *proven* when it wedges, the harder case the
 /// ramp-to-zero seal exists for.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_peer_wedges_after_progress_is_disconnected() {
     let blocks = 400;
     // A carrier that serves at a finite rate (so it only gets partway through the chain),
@@ -386,6 +386,11 @@ async fn fuzz_peer_wedges_after_progress_is_disconnected() {
 /// arm specifically. A small transport queue depth makes the outbound fill quickly (the
 /// default 1024 is too large for the node to ever fill given the no-progress cap — which is
 /// exactly why this bug was invisible to the earlier tests).
+// Kept on real-time multi-thread (not `start_paused`): this sustained-backpressure
+// scenario drives a reactor<->sequencer<->routine feedback loop that stays
+// perpetually runnable, so tokio's virtual clock never auto-advances (it only
+// advances when every task is parked) and the test livelocks under paused time.
+// Real serve/commit sleeps space the events out and let it converge.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_peer_that_stops_reading_is_disconnected() {
     let blocks = 400;
@@ -459,7 +464,7 @@ async fn fuzz_peer_that_stops_reading_is_disconnected() {
 /// windowed-estimator freshness fix is what keeps its now-slow deliveries inside the
 /// (bandwidth-aware) request deadline instead of timing out on a stale-fast estimate and
 /// collapsing its reliability.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_peer_slows_radically_is_kept() {
     let blocks = 120;
     // Fast at first with a real RTT (so its BDP-derived byte window rises well above the
@@ -543,7 +548,7 @@ async fn fuzz_peer_slows_radically_is_kept() {
 /// peer covers until a covering peer joins later; while the floor sits in that window the
 /// withholder is asked and repeatedly answers `RangeUnavailable`, so its reliability must
 /// fall below 1000. Without the short-response charge those answers would be free.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_range_unavailable_penalizes_reliability() {
     let blocks = 300;
     // Long timeouts so *no request ever times out* in this fast-serving run: that isolates
@@ -592,7 +597,7 @@ async fn fuzz_range_unavailable_penalizes_reliability() {
 
 /// Churn storm: a stable peer plus several peers connecting and disconnecting on a
 /// staggered schedule. Progress must continue across the churn.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_churn_storm() {
     let blocks = 300;
     let stable = PeerSpec::fast(1, target(blocks));
@@ -618,7 +623,7 @@ async fn fuzz_churn_storm() {
 /// Large → small: the header target grows in steps, reanchors down below the current
 /// verified tip, then grows again to the full chain. Exercises header advance/reanchor
 /// handling and uniform serve jitter.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_large_to_small() {
     let blocks = 1000;
     let jittery = PeerSpec::with_serve(
@@ -713,7 +718,7 @@ async fn run_byte_size_run(
 /// runs that differ only in body size make the headline byte-cwnd property a direct,
 /// deterministic comparison (the blocks unit, by contrast, would hold the same request
 /// count in both).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_mixed_block_sizes() {
     let blocks = 400;
     let config = byte_window_config(512 * 1024);
@@ -785,6 +790,8 @@ async fn fuzz_mixed_block_sizes() {
 /// wedge). On top of that we assert the peak reserved bytes stayed within the configured
 /// ceiling (the queue did not grow toward the full chain) yet the ceiling was actually
 /// exercised (the stall created real backpressure — the bound is not vacuous).
+// Real-time multi-thread: the commit-stall backpressure loop livelocks under
+// `start_paused` (see `fuzz_peer_that_stops_reading_is_disconnected`).
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_commit_stall() {
     let blocks = 400;
@@ -862,7 +869,7 @@ async fn fuzz_commit_stall() {
 /// the pre-gate escalator did. The chain is longer than the exempt window so the gate
 /// genuinely binds, and the in-flight wire budget is left roomy so the *resident* gate,
 /// not the wire budget, is what bounds retention.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_commit_stall_resident_plateau() {
     let blocks = 1_200;
     let body_bytes = 32 * 1024usize;
@@ -951,7 +958,7 @@ async fn fuzz_commit_stall_resident_plateau() {
 /// commit-window slack is larger than a per-crossing overshoot at this block size, so
 /// the *pin* for the take geometry itself is the unit test
 /// `exempt_take_never_spans_the_commit_window_boundary` and the `admit` proptest.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_commit_stall_resident_plateau_multiblock() {
     let blocks = 1_200;
     let body_bytes = 32 * 1024usize;
@@ -1034,7 +1041,7 @@ async fn fuzz_commit_stall_resident_plateau_multiblock() {
 /// byte unit. The controller must drive a clean sync to the tip while keeping the byte
 /// window the binding constraint — a per-peer byte cwnd is traced and the in-flight
 /// reserved bytes track it (the controller reasons in bytes, not request slots).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_high_bw_fast_peer() {
     let blocks = 500;
     let config = byte_window_config(256 * 1024);
@@ -1073,7 +1080,7 @@ async fn fuzz_high_bw_fast_peer() {
 /// node's request-timeout / re-request path, while a covering fast peer can serve every
 /// height. The node must route around the drops and still commit a contiguous, correct
 /// prefix to the target. Drives the `drop_probability` serve knob no other scenario sets.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_lossy_peer() {
     let blocks = 300;
     let lossy = PeerSpec::with_serve(
@@ -1100,7 +1107,7 @@ async fn fuzz_lossy_peer() {
 /// `max_blocks_per_response = 16` lets the node issue multi-block ranges, so the reversal
 /// is non-trivial. The node must still commit a contiguous, hash-correct prefix to the
 /// target. Drives the `reorder` serve knob no other scenario sets.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_reorder() {
     let blocks = 300;
     let reorder_serve = ServeProfile {
@@ -1127,6 +1134,8 @@ async fn fuzz_reorder() {
 /// under multi-peer contention — the spec's "concurrent reservations MUST NOT
 /// over-commit"); here we additionally assert the ceiling was genuinely approached, so
 /// that bound is not vacuous.
+// Real-time multi-thread: the tight-budget backpressure loop livelocks under
+// `start_paused` (see `fuzz_peer_that_stops_reading_is_disconnected`).
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_multi_peer_tight_budget() {
     let blocks = 400;

From 8060d2b5e9a91a5cbac78be19fd9b73744ccf883 Mon Sep 17 00:00:00 2001
From: evan-forbes <evan.samuel.forbes@gmail.com>
Date: Fri, 3 Jul 2026 11:38:13 -0500
Subject: [PATCH 5/5] test(zakura): make commit-stall fuzz deterministic

---
 .../zakura/testkit/blocksync_fuzz/tests.rs    | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
index 2ad7115a955..6f862637722 100644
--- a/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
+++ b/zebra-network/src/zakura/testkit/blocksync_fuzz/tests.rs
@@ -386,11 +386,11 @@ async fn fuzz_peer_wedges_after_progress_is_disconnected() {
 /// arm specifically. A small transport queue depth makes the outbound fill quickly (the
 /// default 1024 is too large for the node to ever fill given the no-progress cap — which is
 /// exactly why this bug was invisible to the earlier tests).
-// Kept on real-time multi-thread (not `start_paused`): this sustained-backpressure
-// scenario drives a reactor<->sequencer<->routine feedback loop that stays
-// perpetually runnable, so tokio's virtual clock never auto-advances (it only
-// advances when every task is parked) and the test livelocks under paused time.
-// Real serve/commit sleeps space the events out and let it converge.
+// Real-time multi-thread. The `publish_view` spin fix (sequencer_task.rs) let
+// `fuzz_commit_stall` go deterministic, but this wedged-peer scenario is still
+// dominated by the outbound-full 10ms poll loop and real-elapsed wedge detection,
+// which take an impractical number of virtual-time steps (or wake ahead of the
+// poll) under `start_paused`. Kept on real time.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_peer_that_stops_reading_is_disconnected() {
     let blocks = 400;
@@ -790,9 +790,7 @@ async fn fuzz_mixed_block_sizes() {
 /// wedge). On top of that we assert the peak reserved bytes stayed within the configured
 /// ceiling (the queue did not grow toward the full chain) yet the ceiling was actually
 /// exercised (the stall created real backpressure — the bound is not vacuous).
-// Real-time multi-thread: the commit-stall backpressure loop livelocks under
-// `start_paused` (see `fuzz_peer_that_stops_reading_is_disconnected`).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[tokio::test(start_paused = true)]
 async fn fuzz_commit_stall() {
     let blocks = 400;
     let body_bytes = 32 * 1024usize;
@@ -1134,8 +1132,10 @@ async fn fuzz_reorder() {
 /// under multi-peer contention — the spec's "concurrent reservations MUST NOT
 /// over-commit"); here we additionally assert the ceiling was genuinely approached, so
 /// that bound is not vacuous.
-// Real-time multi-thread: the tight-budget backpressure loop livelocks under
-// `start_paused` (see `fuzz_peer_that_stops_reading_is_disconnected`).
+// Real-time multi-thread: after the `publish_view` spin fix this no longer
+// wedges, but multi-peer contention on a tight byte budget still leaves residual
+// virtual-time timing sensitivity, so it is not yet reliably deterministic under
+// `start_paused`. Kept on real time.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fuzz_multi_peer_tight_budget() {
     let blocks = 400;