fix(kernel): EvidenceEmitter stores a step's events in call order (N123)

[LamaSu]

Row: N123 (steward #6352). EvidenceEmitter.addEvent stored events in the order their SHA-256 digests finished, not the order it was called.

The bug

addEvent awaited hashEvent (an async crypto.subtle.digest) before stepEv.events.push. So when calls overlap on one step, a slow digest puts an event after later ones. Master's runPrintJob makes such calls (printer-job.ts:196), and so do the IPP binding tests: they flaked in #474, #456 and #6307.

Reproduced at this branch's base. All five failures are in n123-before-fix.log:

• refvertical's test (#6343);
• three new gated tests;
• the new production-path case: runPrintJob with a plain emitter, where execution_started's digest takes 3 s, gave [progress, started, progress, completed].

What it does and does not reach:

• hashBundle hashes the sorted event hashes (spec canonical.ts:107-111). So the bundle hash, the kernel signature and verifyBundleHash do not depend on order.
• The gateway's evidence envelope re-sorts events by id (evidence-envelope.ts:61, :85).
• What the race does change is the order of a bundle's events array as returned and archived. Two public verifiers read that order and report timestamp_ordering_violation: evaluateEvidence (verifier oracle/evidence-evaluator.ts:123-128) and VerifierNode (network/verifier-node.ts:298-304).

The fix (packages/kernel/src/evidence-emitter.ts)

Each step keeps a chain, StepEvidence.stored.

• An event is still hashed at its call, from the event as called. It is stored only after the step's earlier events have been stored or have failed.
• The digests still run concurrently.
• An event the step refuses (the LO-EV-9 binding checks) still rejects at once and takes no place.
• A failed digest rejects only its own call, in its turn, and is never an unhandled rejection in the meantime.
• Steps never wait on each other.

Every caller now gets call order: master's runPrintJob, JobRunner (already ordered at the caller since #502), the printer line (#521, likewise), scripts, and third-party kernels using the exported API.

Tests

• evidence-emitter-order.test.ts (new):
  • refvertical's reproduction, as they wrote it;
  • four cases that hold chosen digests behind a gate, so nothing depends on timing:
    • nothing is stored ahead of a held earlier event, and every digest is requested at its call;
    • a failed digest takes no place and lets no later event jump ahead;
    • a refused event rejects at once;
    • steps are independent.
• ipp-adapter-job-binding.test.ts:
  • It carries test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571 (merged in unchanged) and then drops test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571's ordered emitter. Its tests use a plain EvidenceEmitter again, so the production path is what is tested.
  • It gains a production-path case: runPrintJob with execution_started's digest held 3 s keeps the printer's order, in the signed bundle too.
• Mutation check: 7 of 7 mutants killed:
  • the original unordered code;
  • hashing awaited before the event's turn;
  • no unhandled-rejection guard;
  • one chain for the whole emitter instead of per step;
  • hashing deferred to the event's turn;
  • a chain tail that does not absorb failures;
  • no initial chain.
• Suites:
  • kernel: 1133 of 1133 pass;
  • merged with the printer line's head fix(kernel): a print's timeouts are timer delays, refused before anything is held otherwise #541 (d2fe143): 1215 of 1215;
  • gateway kernel-service-safety, adapter-pylabrobot barrier-attestation and spec emitter-manifest pass against the rebuilt kernel;
  • tsc --noEmit is clean.

Merging

• Merges CLEAN with master, test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571, every printer-line head (fix(kernel): a print's evidence is bound to its own print (N106) #521, fix(kernel): the print path's catch blocks turn any failure into text without throwing (failureText part B; steward #5547) #530, fix(kernel): the print's setup, latch label and recovery log never reject (astra 210 follow-ups, #530) #532, fix(kernel): runPrintJob is total, and a print's releases are each attempted, the lease last #539, fix(kernel): a print's timeouts are timer delays, refused before anything is held otherwise #541), feat(gateway): the production D1 (operator) EIP-712 verifier for the FinalMilestonePackageV2 mint guard (stacked on #358) #555, and the parked N116 branch.
• It can merge before or after test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571: it carries test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571's commit, so if it merges first GitHub marks test(kernel): IPP job-binding tests record in emission order, no flake on hash timing (steward #6307) #571 merged.

🤖 Generated with Claude Code