[coconutbird]

This branch pins groupnet to 30407c0bb057a7f12bf1520397f7398b38f97103 and imports the unfinished managed-link work from the local clone: explicit UDP neighbors, every ordinal listed in the chart, and the coherence, sync tests and strong_rw modules split into child files. It then ports s3cache to the API.

Pre-write fence for strong writes

strong_rw::workload::a_crashed_pod_restarts_on_its_warm_tier failed intermittently on main and on this branch (unacked). A writer crashed after the origin applied its PUT and before it published the outcome. The peer kept its lease for up to D and served the old value.

A strong write is now fenced before its origin call:

• The writer publishes IndexOp::Pending for each key. It waits on the same ack-or-lapse round as the outcome. Only then does it call the origin.
• A peer that applied the announcement answers the key from the origin. A LIST whose prefix covers the key is also forwarded. The peer stops when the outcome event names the announcement (settles). Every event also carries the writer's oldest open announcement (floor), so a gap that drops the outcome cannot strand the fence.
• If the writer's life ends with announcements open (a gap into a new epoch, a renewal or a seal), the peer marks each key as uncertain. One origin HEAD then resolves the key.
• If the fence does not complete in time, the write is answered 503 and is not sent to the origin. If the origin refuses the write, the writer publishes IndexOp::Abandoned.
• A donor offers no index image while it holds a peer's open announcement. An install carries the follower's open announcements.
• strong-acks and bounded do not fence. The wire magic moves to 0xFD.

Cost: every strong write publishes two feed events and pays the ack round twice. strong_rw reports the latency of acknowledged writes (debug build, local MinIO):

scenario	before: median / p99	after: median / p99
steady, origin jitter 0–40 ms (3 runs each)	89.8–91.9 ms / 120–135 ms	90.7–94.6 ms / 153–183 ms
150 ms gossip delay, 30% loss (2 runs each)	389–390 ms / 553–603 ms	718–723 ms / 982–1007 ms

Verification (local)

• The crash test passed 20 of 20 runs in a row on c35e1b4, with 0 violations in each run. Later commits change only tests and documentation.
• I ran the full cargo test --locked --workspace --all-features --test it three times on 56a1a7c. Runs 1 and 3 passed: 95 passed and 10 ignored. Run 2 had 94 passed and 1 failed: fleet_bootstrap::peer_bootstrap_transfers_a_production_scale_index. In that run the joiner stopped waiting for the 116 MB donor image (DonorUnavailable) and listed the origin. That test does no writes, and it passed 3 of 3 runs alone.
• The unit tests passed: 191 passed and 1 ignored. They include new tests for the three crash points, a stalled fence (503 with no origin connection), a lapse of a partitioned peer, and the settle and floor rules.
• cargo fmt --check, clippy (all targets, all features) and cargo doc -D warnings are clean.

Old and new pods cannot exchange gossip: groupnet reset every wire version to 1, moved to the routed network, and keys the default feed entry as ~writes/d. The feed event changed again here.