Merge dbsp/zset-edge into dbsp/sched

# Conflicts:
#	context/test-evidence/zset.md
#	crates/zset/src/edge.rs

context/test-evidence/zset.md

@@ -607,14 +607,14 @@ so the file never runs; the same file's other tests move a circuit for real.
 
 A circuit moved to a new thread for each of nine ticks equals one that never moved, over a
 pipeline with `integrate`, `distinct`, `aggregate`, `filter` and `delay`. It would fail if a
-node kept state outside the circuit's arena, which a thread-local would do.
+node kept state outside the circuit (a thread-local, say), which would not move with it.
 
 ### a_transaction_begun_on_one_thread_is_rolled_back_on_another
 
 `begin` and a step on one thread, `rollback` on another: the stream, the sink and `ticks` are
 as at `begin`. The undo log lives in the nodes, which move with the circuit.
 
-### a_handle_from_another_circuit_is_refused
+### every_call_that_takes_a_handle_refuses_a_foreign_one
 
 Ids index an arena, so a foreign handle used to be an out-of-range or mistyped slot. It is now
 refused by name ("handle from another circuit"); `should_panic(expected)` pins the message,
@@ -664,10 +664,71 @@ why that assertion is there.
 A new epoch holding `{1, 2}` plus one command `9`: the receiver applies only `{9}` and stamps
 `(2, 1)`. Rival R3 applies the whole target and fails.
 
-### a_late_frame_from_an_epoch_the_receiver_left_changes_nothing
+### a_late_reply_from_a_dead_incarnation_changes_nothing
 
-After epoch 2 is joined, a correction from epoch 1 with a larger `through` and a delta of epoch 1
-are ignored and ask for nothing. Rival R6 (no `left` check on corrections) fails it.
+The reviewer's case: epoch 100's reply to the first request is delayed, the sender restarts as
+1001, the receiver asks again and joins it, and then the late reply arrives. The first design
+(a `left` list) went back to epoch 100 and then dropped every 1001 frame. Now the late reply is
+not the answer to the latest request, so it only marks stale. Rival N2 (a foreign correction
+accepted) fails it.
+
+### an_unsolicited_correction_from_another_incarnation_only_marks_stale
+
+A correction with a token nobody asked for, from another epoch, leaves the stamp as it was and
+makes the receiver ask. Rival N2 fails it.
+
+### only_the_reply_to_the_latest_request_may_join_a_new_incarnation
+
+Two requests are out (a timeout between them); the reply to the first, from another epoch, does
+not join, and the reply to the second does. Rival N1 (any reply while asked is the answer) fails
+it.
+
+### an_answer_older_than_the_watermark_does_not_clear_stale
+
+An answer through 1 to a receiver at 3 neither moves it back nor says it is current. Rival N6
+(`<=` where `==` belongs) fails it.
+
+### an_answer_at_the_watermark_says_nothing_newer_and_clears_stale
+
+A repeat answer at the watermark clears `stale`; without the line the receiver asks for ever.
+
+### trouble_seen_after_a_request_keeps_its_answer_from_clearing_stale
+
+A gap seen after the request went out, then an answer through the old watermark: still stale.
+Rival N5 (no comparison of marks) fails it.
+
+### a_new_epoch_frame_re_asks_once_after_a_lost_request
+
+The sender read a request and restarted before answering. Five frames from the new epoch cause
+exactly one more request. Rival N3 (no re-ask) fails the first half and rival N4 (a re-ask for
+every foreign frame) the second.
+
+### a_poll_inside_a_transaction_is_refused
+
+A poll outside a transaction followed by a rolled-back consumer step loses nothing; a poll inside
+one panics. The reviewer's sequence stranded the receiver at `(1, 1)` holding nothing. Rival N8
+(the assertion removed) fails it.
+
+### a_zero_capacity_pipe_is_refused
+
+`channel_pipes(0)` made a rendezvous channel that `try_send` could never use. Rival N10 fails it.
+
+### a_committed_that_overflows_leaves_the_sink_as_it_was
+
+A weight overflow in `committed` no longer leaves a bumped `seq` or half an integral behind.
+Rival N9 (mutating first) fails it.
+
+### the_receiver_is_never_wrong_over_a_hostile_network
+
+The reviewer's generator as a permanent property: dropped, duplicated, garbled and reordered
+frames in both directions, restarts at any seq, timeouts and receiver restarts, capacity 1 to 4.
+After every action the receiver's applied state equals the sender's integral at the stamp it
+claims and its epoch never goes down; after the network is reliable it catches up. Run at 20,000
+cases three times, all green. Rivals N4 and N7 (a foreign delta moves the receiver) fail it.
+
+### the_reviewers_late_reply_case_is_a_history
+
+The late-reply sequence as a fixed history through the same World.
 
 ### an_unreadable_frame_asks_for_a_correction
 
@@ -694,3 +755,20 @@ the combined circuit's. Rival R1 fails it.
 
 Three corrections waiting, `poll(c, 2)` reads two and the next reads one, so a unit's turn is
 bounded by its budget. Rival: the bound removed from the loop fails the first assertion.
+
+Ids index an arena, so a foreign handle from a circuit of the same shape reads or wires the
+other circuit's slot. Ten cases (`current`, `take`, `push`, a unary operator, both operands of a
+binary one, `output`, `delay`, `integrate`, `distinct`) each need the panic text "handle from
+another circuit". The first draft pinned one site in nine. Rivals, each failing it: the check
+removed from `current`, `take`, `push`, `unary_with`, `binary_with` (each operand), `output`,
+`delay` or `integrate`.
+
+### a_circuit_is_not_sync
+
+The ambiguous-impl trick: the test does not build (E0283) if `Circuit` implements `Sync`.
+Rival: `unsafe impl Sync for Circuit {}` fails the build of `tests/threads.rs`.
+
+### a_sink_adds_its_input_with_one_clone_per_key
+
+A sink over `Counted` keys clones each key once (the insert into its sum). Rival: a sink that
+clones its input piece first, as the reviewer injected, makes `N` more.