test(zset): the edge over a hostile network, and the cases the review found

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

context/test-evidence/zset.md

@@ -664,10 +664,71 @@ why that assertion is there.
 A new epoch holding `{1, 2}` plus one command `9`: the receiver applies only `{9}` and stamps
 `(2, 1)`. Rival R3 applies the whole target and fails.
 
-### a_late_frame_from_an_epoch_the_receiver_left_changes_nothing
+### a_late_reply_from_a_dead_incarnation_changes_nothing
 
-After epoch 2 is joined, a correction from epoch 1 with a larger `through` and a delta of epoch 1
-are ignored and ask for nothing. Rival R6 (no `left` check on corrections) fails it.
+The reviewer's case: epoch 100's reply to the first request is delayed, the sender restarts as
+1001, the receiver asks again and joins it, and then the late reply arrives. The first design
+(a `left` list) went back to epoch 100 and then dropped every 1001 frame. Now the late reply is
+not the answer to the latest request, so it only marks stale. Rival N2 (a foreign correction
+accepted) fails it.
+
+### an_unsolicited_correction_from_another_incarnation_only_marks_stale
+
+A correction with a token nobody asked for, from another epoch, leaves the stamp as it was and
+makes the receiver ask. Rival N2 fails it.
+
+### only_the_reply_to_the_latest_request_may_join_a_new_incarnation
+
+Two requests are out (a timeout between them); the reply to the first, from another epoch, does
+not join, and the reply to the second does. Rival N1 (any reply while asked is the answer) fails
+it.
+
+### an_answer_older_than_the_watermark_does_not_clear_stale
+
+An answer through 1 to a receiver at 3 neither moves it back nor says it is current. Rival N6
+(`<=` where `==` belongs) fails it.
+
+### an_answer_at_the_watermark_says_nothing_newer_and_clears_stale
+
+A repeat answer at the watermark clears `stale`; without the line the receiver asks for ever.
+
+### trouble_seen_after_a_request_keeps_its_answer_from_clearing_stale
+
+A gap seen after the request went out, then an answer through the old watermark: still stale.
+Rival N5 (no comparison of marks) fails it.
+
+### a_new_epoch_frame_re_asks_once_after_a_lost_request
+
+The sender read a request and restarted before answering. Five frames from the new epoch cause
+exactly one more request. Rival N3 (no re-ask) fails the first half and rival N4 (a re-ask for
+every foreign frame) the second.
+
+### a_poll_inside_a_transaction_is_refused
+
+A poll outside a transaction followed by a rolled-back consumer step loses nothing; a poll inside
+one panics. The reviewer's sequence stranded the receiver at `(1, 1)` holding nothing. Rival N8
+(the assertion removed) fails it.
+
+### a_zero_capacity_pipe_is_refused
+
+`channel_pipes(0)` made a rendezvous channel that `try_send` could never use. Rival N10 fails it.
+
+### a_committed_that_overflows_leaves_the_sink_as_it_was
+
+A weight overflow in `committed` no longer leaves a bumped `seq` or half an integral behind.
+Rival N9 (mutating first) fails it.
+
+### the_receiver_is_never_wrong_over_a_hostile_network
+
+The reviewer's generator as a permanent property: dropped, duplicated, garbled and reordered
+frames in both directions, restarts at any seq, timeouts and receiver restarts, capacity 1 to 4.
+After every action the receiver's applied state equals the sender's integral at the stamp it
+claims and its epoch never goes down; after the network is reliable it catches up. Run at 20,000
+cases three times, all green. Rivals N4 and N7 (a foreign delta moves the receiver) fail it.
+
+### the_reviewers_late_reply_case_is_a_history
+
+The late-reply sequence as a fixed history through the same World.
 
 ### an_unreadable_frame_asks_for_a_correction