From 1e3b2c319e0270afcadfb731b762615f7d350c96 Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Sun, 26 Apr 2026 19:14:32 +0000
Subject: [PATCH] testing: rekey settle past drain window + stale tooling
 references

- testing/static/scripts/rekey-test.sh: bump REKEY_SETTLE from 5s to
  12s so post-rekey ping_all samples are taken after the 10s old-
  session drain window has closed (DRAIN_WINDOW_SECS in
  handlers/rekey.rs). The 5s sample window straddled the drain,
  occasionally catching old-session decrypts mid-cutover and producing
  spurious ping failures.

- testing/lib/log_analysis.py: discovery-succeeded match string is
  "proof verified, route cached" (the wording in handlers/discovery.rs);
  the regex looked for the older "caching route" wording, so the chaos
  analysis summary always reported `Succeeded: 0` regardless of how
  many successes the raw node logs actually showed.

- testing/scripts/build.sh: drop the second cargo invocation that
  passed `--features gateway --bin fips-gateway`. PR #79 removed the
  `gateway` cargo feature in favor of platform cfg gates, so this
  invocation now fails with `the package 'fips' does not contain this
  feature: gateway`. The first cargo build already produces
  fips-gateway as a workspace binary on every supported target.
---
 testing/lib/log_analysis.py          | 2 +-
 testing/scripts/build.sh             | 2 --
 testing/static/scripts/rekey-test.sh | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/testing/lib/log_analysis.py b/testing/lib/log_analysis.py
index 549d63c..ffa33bb 100644
--- a/testing/lib/log_analysis.py
+++ b/testing/lib/log_analysis.py
@@ -176,7 +176,7 @@ def _analyze_lines(result: AnalysisResult, source: str, log_text: str):
         # Discovery
         if "Initiating LookupRequest" in line or "Discovery lookup initiated" in line:
             result.discovery_initiated.append((source, line))
-        if "proof verified, caching route" in line:
+        if "proof verified, route cached" in line:
             result.discovery_succeeded.append((source, line))
         if "target not in any peer bloom filter" in line:
             result.discovery_bloom_miss.append((source, line))
diff --git a/testing/scripts/build.sh b/testing/scripts/build.sh
index c122546..9a1e3b5 100755
--- a/testing/scripts/build.sh
+++ b/testing/scripts/build.sh
@@ -46,13 +46,11 @@ if [ "$UNAME_S" = "Darwin" ]; then
 
     echo "Building FIPS for Linux (release) using cargo-zigbuild..."
     cargo zigbuild --release --target "$CARGO_TARGET" --manifest-path="$PROJECT_ROOT/Cargo.toml"
-    cargo zigbuild --release --target "$CARGO_TARGET" --manifest-path="$PROJECT_ROOT/Cargo.toml" --features gateway --bin fips-gateway
 
     TARGET_DIR="$PROJECT_ROOT/target/$CARGO_TARGET/release"
 else
     echo "Building FIPS (release)..."
     cargo build --release --manifest-path="$PROJECT_ROOT/Cargo.toml"
-    cargo build --release --manifest-path="$PROJECT_ROOT/Cargo.toml" --features gateway --bin fips-gateway
 
     TARGET_DIR="$PROJECT_ROOT/target/release"
 fi
diff --git a/testing/static/scripts/rekey-test.sh b/testing/static/scripts/rekey-test.sh
index 1c91842..b225da3 100755
--- a/testing/static/scripts/rekey-test.sh
+++ b/testing/static/scripts/rekey-test.sh
@@ -60,7 +60,7 @@ trap 'echo ""; echo "Test interrupted"; exit 130' INT
 
 # Wait times derived from rekey timer
 BASELINE_CONVERGENCE_TIMEOUT=36
-REKEY_SETTLE=5         # settle time after rekey for cutover to complete
+REKEY_SETTLE=12        # > DRAIN_WINDOW_SECS (10) so post-rekey samples are off the old session
 # First FMP rekey should follow shortly after the 35s interval once the mesh is
 # fully converged. Keep this bounded to preserve a meaningful scheduling check
 # while still allowing for log visibility at the timeout edge.