A 38 second nap after a two second wait
Planning a run with a hung replica found that the CPU throttle counted waiting as work. At a 5% share, a two second timeout earned 38 seconds of sleep.
The voter keeps its CPU share by sleeping after each tick: at 5%, nineteen units of sleep for each unit of work. The time spent waiting for a replica that never answers was inside the work. Run 2 schedules a hang at tick 60. The reply timeout is two seconds, so the tick that lost the replica would have been followed by a 38 second nap, in a segment with an 80 second cap. No flown run had a hung replica, so no flown run had the nap. The wait is now subtracted before the throttle, and scenario 28 checks that a one second timeout at 5% does not produce 19 seconds of sleep.
The same planning found the other side of the share. The orbit run measured 5.2% against a 5% cap. The difference was start-up: filling the 64 MB sensor block and spawning the replicas ran before the clock started. The fill now goes 1 MiB at a time with a throttle call after each, and the clock starts before the spawn, so a cap is the whole life of the process. It costs a few seconds of wall time per start.
The third change is a line. The bit flip at tick 60 of the first run was
outvoted the moment it happened and left nothing in the event log. It was
counted only in the detection line, faults=2 caught=2. ESA was told on 16
October that the line was missing. The voter now writes outvoted with the
replica’s number whenever a live replica dissents.
Nothing in v0.4.0 changes a decision. It changes what the voter counts, and what it says.