mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-11 22:03:42 +00:00
Josh Creek
75f485667b
Closes Phase 4's outstanding action-sequence-correctness invariant, then fixes two server-side bugs an adversarial review of that work uncovered. Server simulation, bot observations, collision resources and tick rate are unchanged: the server_physics_parity trace is byte-for-byte identical to HEAD across 360 ticks including both ships' full observation vectors. 4.11 - prediction history filed under the ISSUING sequence _send_local_input filed each post-step predicted state under the timeline's estimate of the sequence the server would consume this tick, trailing issuance by input_lead. The body had integrated the intent issued under _input_seq, so predicted[S] held "state after the intent from now" while the server's authority for S is "state after action(S)". They agree only while the stick is still. Filing under _input_seq costs nothing: which action the ship uses is decided in LocalNetShipController.get_action() and is untouched. Every prior Phase 4 gate held its input steady, and a steady input cannot falsify a sequence label - the 60s runs honestly reported marker=0/3784. New --exercise-input-transitions role toggles thrust every 6 ticks; it is the only gate that can catch a label regression. Verified non-vacuous: the old label fails it at 50%. 4.12 - issued-but-unsimulated sequences, and the release path An attack (delta > 1) issues and sends several sequences for one local physics step. Those gap sequences had no recorded prediction, so a server ack of one reported missing_not_recorded - indistinguishable from ring loss, costing a teleport and resync suppression several times a minute. They are now recorded stateless via record_unsimulated() and answered with a new "skip" decision mode. Free-flight hard snaps: 25/8/4 -> 0/0/0. A release (delta == 0) re-recorded at the unchanged _input_seq, filing the current intent under a sequence that went out carrying a different action; LocalInputTimeline deliberately refuses to mutate an issued sequence, so the ring contradicted the wire. Recording is now skipped on release ticks. 4.13 - two Phase 3 bugs silently killing player input (a) InputJitterBuffer.consume() advanced last_applied_seq on every tick including a starve. Since ingest() discards seq <= last_applied_seq, one starve on a sequence the client had not sent yet stranded the stream one ahead of arrivals permanently - both sides advancing in lockstep, every honest packet discarded on arrival. The client's own input_lead release is enough to trigger it, so input died for ~30 ticks roughly every 6.5s on a clean LAN. Now only gives up on a sequence once strictly newer data proves it lost. Silent-client stall and ring-overflow resync are unchanged. (b) The seq-range guard bounded incoming seq against highest_ingested_seq, which only advances inside ingest(), which that guard gates. After a ~2s host hitch every packet was rejected forever with no diagnostic (600+ consecutive rejections reproduced via SIGSTOP). Third iteration of this guard; each previous version bounded against a value only the accepted path could advance. Adds an escape after 10 consecutive rejections, which grants an attacker nothing the rate limiter does not already bound. (c) The transitions gate reported PASS at 3.76% while input was completely dead, because suppression stops _record_metrics - a worse outage yields fewer samples and a LOWER rate. Now scales the required sample count with run length and asserts the wire's server_stalled bit. Reverting both fixes makes it fail at samples 292/600, server_stalled=true, input_lead=12. Fixing (a) also explained a residual the review had already traced: 151 of 151 action-marker mismatches were the server repeating a stale action on a starve, not a prediction defect. Marker is now 0.00% in all three conditions (was 1.7-2.5%), and free-flight p99 improved to 0.141/0.168/0.154m from 0.170/0.176/0.184m. Two pre-existing test defects fixed alongside: the ball gate asserted RTT-masking on a link with no RTT (flaked 2 in 5; now asserted only at rtt >= 20ms, 5/5 under latency), and the two-bot CI compared scores across a 3-5s window (now polls the scores the server actually held; note score_changed is emitted only on the client path). QA: 72 unit tests; 60s free-flight at LAN/80+-20ms/5% loss; transition gate in all three; 2.0s and 3.5s host-freeze recovery; ball contact x5; two-bot CI x3; all three abuse roles; net/match_net/clock/lobby smokes. Phase 4 sign-off still pending a human playtest at ~100ms RTT - the milestone asks how it feels, which no gate here answers.
109 lines
5.8 KiB
GDScript
109 lines
5.8 KiB
GDScript
extends "res://tests/test_case.gd"
|
|
|
|
const NetShipPredictor = preload("res://scripts/net_ship_predictor.gd")
|
|
const NetBodyState = preload("res://scripts/net_body_state.gd")
|
|
const LocalPredictionHistory = preload("res://scripts/local_prediction_history.gd")
|
|
|
|
|
|
func _authoritative() -> NetBodyState:
|
|
return NetBodyState.new()
|
|
|
|
|
|
func _matched(position_error: float = 0.0, rotation_error_degrees: float = 0.0) -> Dictionary:
|
|
return {
|
|
"status": "matched",
|
|
"authoritative_state": _authoritative(),
|
|
"position_error_magnitude": position_error,
|
|
"rotation_error_degrees": rotation_error_degrees,
|
|
}
|
|
|
|
|
|
func test_soft_correction_within_thresholds() -> void:
|
|
var decision := NetShipPredictor.decide(_matched(2.0, 60.0), false, false)
|
|
assert_eq(decision["mode"], "soft", "thresholds are strict greater-than, so exact boundary soft-corrects")
|
|
assert_eq(decision["reason"], "within_thresholds", "soft decision records why")
|
|
|
|
|
|
func test_hard_correction_for_missing_prediction_or_reset() -> void:
|
|
var missing := NetShipPredictor.decide({"status": "missing_evicted", "authoritative_state": _authoritative()}, false, false)
|
|
assert_eq(missing["mode"], "hard", "an unavailable same-sequence prediction must snap")
|
|
assert_eq(missing["reason"], "missing_evicted", "missing cause remains inspectable")
|
|
var reset := NetShipPredictor.decide(_matched(), false, true)
|
|
assert_eq(reset["mode"], "hard", "a new reset generation never blends across a teleport")
|
|
|
|
|
|
func test_hard_correction_for_flags_or_large_error() -> void:
|
|
var frozen_state := _matched()
|
|
(frozen_state["authoritative_state"] as NetBodyState).frozen = true
|
|
assert_eq(NetShipPredictor.decide(frozen_state, false, false)["reason"], "frozen_mismatch", "authority frozen flag wins over local simulation")
|
|
assert_eq(NetShipPredictor.decide(_matched(2.01), false, false)["reason"], "position_error", "position beyond 2m snaps")
|
|
assert_eq(NetShipPredictor.decide(_matched(0.0, 60.01), false, false)["reason"], "rotation_error", "rotation beyond 60 degrees snaps")
|
|
|
|
|
|
func test_soft_correction_applies_past_authority_as_a_delta_to_current_pose() -> void:
|
|
var predicted := _authoritative()
|
|
predicted.position = Vector3(10.0, 0.0, 0.0)
|
|
var authoritative := _authoritative()
|
|
authoritative.position = Vector3(10.5, 0.0, 0.0)
|
|
var comparison := {
|
|
"predicted_state": predicted,
|
|
"authoritative_state": authoritative,
|
|
}
|
|
var current := Transform3D(Basis.IDENTITY, Vector3(14.0, 2.0, -3.0))
|
|
var corrected := NetShipPredictor.soft_corrected_transform(current, comparison)
|
|
assert_almost_eq(corrected.origin.x, 14.5, 0.0001, "the correction moves current state by the same-sequence error")
|
|
assert_almost_eq(corrected.origin.y, 2.0, 0.0001, "unrelated current coordinates are preserved")
|
|
assert_almost_eq(corrected.origin.z, -3.0, 0.0001, "soft correction does not rewind to the old authoritative pose")
|
|
|
|
|
|
func test_missing_history_places_once_then_suppresses_old_acknowledgements() -> void:
|
|
var predictor := NetShipPredictor.new()
|
|
var ship := Ship.new()
|
|
var history := LocalPredictionHistory.new()
|
|
var missing := {"status": "missing_not_recorded", "seq": 4, "authoritative_state": _authoritative()}
|
|
assert_eq(predictor.reconcile(missing, ship, 0, 10, history)["mode"], "hard", "first unavailable acknowledgement performs one resync placement")
|
|
assert_eq(predictor.reconcile(missing, ship, 0, 11, history)["mode"], "suppressed", "older unavailable acknowledgements do not create a snap burst")
|
|
ship.free()
|
|
|
|
|
|
func test_reset_preempts_missing_history_suppression() -> void:
|
|
var predictor := NetShipPredictor.new()
|
|
var ship := Ship.new()
|
|
var history := LocalPredictionHistory.new()
|
|
var missing := {"status": "missing_not_recorded", "seq": 4, "authoritative_state": _authoritative()}
|
|
predictor.reconcile(missing, ship, 0, 10, history)
|
|
assert_eq(predictor.reconcile(missing, ship, 0, 11, history)["mode"], "suppressed", "old missing acknowledgement is suppressed during recovery")
|
|
var reset_authority := _authoritative()
|
|
reset_authority.position = Vector3(7.0, 2.0, -3.0)
|
|
var reset_missing := {"status": "missing_not_recorded", "seq": 5, "authoritative_state": reset_authority}
|
|
var reset := predictor.reconcile(reset_missing, ship, 1, 12, history)
|
|
assert_eq(reset["reason"], "reset_gen", "a changed reset generation preempts recovery suppression")
|
|
ship.free()
|
|
|
|
|
|
# An attack's skipped sequence is acknowledged by the server but was never
|
|
# locally simulated. It is a routine product of this client's own lead control
|
|
# — not history loss — so it must not be treated as a snap condition.
|
|
|
|
func test_unsimulated_gap_is_skipped_not_snapped() -> void:
|
|
var decision := NetShipPredictor.decide({"status": "unsimulated_gap", "seq": 5, "authoritative_state": _authoritative()}, false, false)
|
|
assert_eq(decision["mode"], "skip", "an unsimulated gap is neither soft nor hard")
|
|
assert_eq(decision["reason"], "unsimulated_gap", "the reason names the real cause")
|
|
|
|
|
|
func test_genuine_missing_history_is_still_a_hard_snap() -> void:
|
|
# The control for the test above: the two statuses must not have been
|
|
# collapsed together while making gaps benign.
|
|
for status in ["missing_not_recorded", "missing_evicted"]:
|
|
var decision := NetShipPredictor.decide({"status": status, "seq": 5, "authoritative_state": _authoritative()}, false, false)
|
|
assert_eq(decision["mode"], "hard", "%s must still hard-correct" % status)
|
|
|
|
|
|
func test_a_reset_still_wins_over_an_unsimulated_gap() -> void:
|
|
# Ordering guard: reset_gen is an epoch boundary and outranks everything,
|
|
# including the new skip path — otherwise a gap landing on the reset
|
|
# snapshot would silently discard the epoch change.
|
|
var decision := NetShipPredictor.decide({"status": "unsimulated_gap", "seq": 5, "authoritative_state": _authoritative()}, false, true)
|
|
assert_eq(decision["mode"], "hard", "reset still takes precedence")
|
|
assert_eq(decision["reason"], "reset_gen", "and is still attributed to the reset")
|