developer
16c8ad27b9
It asserted that a reader had to observe both of the swapped-in upstream addresses, which is a demand about *which* list a reader happens to see. A reader that finished its sampling before the rebind loop got there satisfied every real property and still failed, so this failed roughly 2 runs in 10 and would have turned CI red on nothing. What the test should pin is the copy-on-write invariant itself: a reader must only ever see a whole, published list. Each reader now compares every observed snapshot against the three lists this test publishes, and fails immediately on a half-applied one. That is checked on every iteration rather than inferred afterwards, and it makes no demand about which list was seen, so it cannot flake. 15 consecutive -race runs, no failure.