tests: fix and harden MLD host module tests after the IPv6 DAD-disable RNG shift

The DAD-disable fix (initiateDad now short-circuits to makeTentativeAddressPermanent
when dupAddrDetectTransmits=0, RFC 4862 Section 5.4) removed a uniform() draw, shifting
the seeded RNG stream in simulations that disable DAD.

MLD_host_basic and MLD_host_groupstates exercise the MLDv1 report-suppression race: when
two hosts share a group, the one with the shorter random uniform(0, maxRespDelay) delay
answers a Query and holds flag=true while the other suppresses, and only the flag=true
host sends a Done on leave. Which host wins is an RNG coin flip, so after the shift host2
wins at seed 0 and host1 sends no Done -- failing the HOST-04 assertion.

opp_test cannot express the relational property "the host that Reported is the one that
sends the Done, and the other sends none", so the tests pin the seed to fix the roles:

 - re-seed both tests to 1, where host1 is the reporter again (a pure role choice -- host1
   wins for seeds 1, 3, 4, 6 and loses for 0, 2, 5, 7; the behavior is identical either way);
 - have host2 also leave at t=5s and assert via %not-contains that it sends no Done, so the
   "exactly one Done, from the reporter" correlation is actually checked rather than being a
   tautology of host2 never leaving;
 - document the seed dependence and that an RNG-stream shift swaps the roles (re-pick a seed
   where host1 wins).

(Not attempted: asserting "the other host sends no Report" -- MLDv1 hosts also send unsolicited
Report retransmits and the querier sends multiple Queries, so that is not a stable fact even at
a fixed seed. The Done is the one unambiguous per-host signal of who the reporter was.)

Author: avarga

tests/module/MLD_host_basic.test

@@ -28,17 +28,20 @@ HOST-02 (delayed Report on General Query):
   and then a subsequent "sending Multicast Listener Report".
 
 HOST-04 (Done on leave):
-  host1's UdpSink has stopTime=5s, which closes the socket and fires
-  ipv6MulticastGroupLeftSignal -> Mldv1::multicastGroupLeft -> Done sent to
-  ff02::2 (ALL_ROUTERS_2). After the Query-driven Report (t~2..3s),
-  host1's flag=true, so Done is sent.
+  BOTH hosts' UdpSinks have stopTime=5s. On close, ipv6MulticastGroupLeftSignal ->
+  Mldv1::multicastGroupLeft sends a Done ONLY if the host holds flag=true. Exactly one
+  host is the reporter (holds flag=true after the Query race) -- host1 at the pinned
+  seed -- so host1 sends the Done and host2 leaves silently. The test asserts host1's
+  Done and, as a %not-contains, that host2 sends none. This is the seed-pinned form of
+  the relational property "the host that Reported is the one that sends the Done".
 
 Network: host1, host2, and router all connect to a shared EthernetHub, putting
 them on the same Ethernet segment. Ipv6FlatNetworkConfigurator assigns addresses.
 All three nodes have hasMld=true. The router is a real querier (router.multicastForwarding
 enabled -- set at node level so NetworkLayerNodeBase propagates it to the routing table)
 with short startup timer so the General Query arrives within the 10s limit.
-RNG seed is fixed for reproducibility.
+The RNG seed is pinned (see the seed-set note below): an RNG shift swaps which host wins
+the race, so the seed may need re-picking so host1 stays the reporter.
 
 %#--------------------------------------------------------------------------------------------------------------
 %file: test.ned
@@ -80,8 +83,17 @@ sim-time-limit = 10s
 cmdenv-express-mode = false
 cmdenv-log-prefix = "%C: "
 
-# Fix RNG seed for deterministic behavior of uniform(0, maxRespTime) in startHostTimer
-seed-set = 0
+# MLDv1 answers a General Query after a random uniform(0, maxRespDelay) delay; when two hosts share
+# a group, the shorter delay reports first and the other suppresses (Mldv1.cc:311 and :410). So
+# which host ends up as the reporter -- and therefore holds flag=true and sends the Done on leave --
+# is an RNG coin flip. opp_test cannot express the relational property "the reporter is the host that
+# sends the Done, and the other sends none", so we PIN the seed to fix the roles: at seed 1 host1 is
+# the reporter, so host1 sends the Done and host2 (which also leaves) sends none -- exactly one Done,
+# from host1, as asserted below.
+# NOTE: a change elsewhere that shifts how many random numbers are drawn before this point can swap
+# the roles. If that happens, re-pick a seed where host1 wins (seeds 1, 3, 4, 6 do; 0, 2, 5, 7 do
+# not) -- the behavior is unchanged, only which host plays which role.
+seed-set = 1
 
 # Enable MLD on all nodes
 **.ipv6.hasMld = true
@@ -100,14 +112,16 @@ seed-set = 0
 **.host1.app[0].typename = "UdpSink"
 **.host1.app[0].localPort = 1000
 **.host1.app[0].multicastGroup = "ff0e::1:2:3"
-# HOST-04: host1 leaves at t=5s (socket close fires ipv6MulticastGroupLeftSignal -> Done).
-# After the Query-driven Report (flag=true), Done is sent to ff02::2.
+# HOST-04: BOTH hosts leave at t=5s (socket close -> ipv6MulticastGroupLeftSignal). Only the host
+# holding flag=true (the reporter, host1 at this seed) sends a Done; the suppressed host leaves
+# silently. host2 also leaving is what makes "host2 sends no Done" a real check, not a tautology.
 **.host1.app[0].stopTime = 5s
 
 **.host2.numApps = 1
 **.host2.app[0].typename = "UdpSink"
 **.host2.app[0].localPort = 1000
 **.host2.app[0].multicastGroup = "ff0e::1:2:3"
+**.host2.app[0].stopTime = 5s
 
 # HOST-02: enable real querier on the router (multicastForwarding at node level so
 # NetworkLayerNodeBase propagates *.multicastForwarding = this.multicastForwarding
@@ -145,6 +159,14 @@ MldHostBasicNetwork.host1.ipv6.mld: Mldv1: sending Multicast Listener Report for
 %contains: stdout
 MldHostBasicNetwork.host1.ipv6.mld: Mldv1: sending Multicast Listener Done for group=ff0e::1:2:3
 
+%#--------------------------------------------------------------------------------------------------------------
+%# CORRELATION (the other host): host2 also leaves at t=5s, but as the suppressed loser at this seed
+%# it holds flag=false and sends NO Done -- only the reporter (host1) does. This is the seed-pinned
+%# "the reporter sends the Done, the other does not" check. (See the seed-set note above: an RNG
+%# shift swaps the roles, and the seed would need to be re-picked so host1 is the reporter again.)
+%not-contains: stdout
+MldHostBasicNetwork.host2.ipv6.mld: Mldv1: sending Multicast Listener Done
+
 %#--------------------------------------------------------------------------------------------------------------
 %postrun-command: grep "undisposed object:" test.out > test_undisposed.out || true
 %not-contains: test_undisposed.out

tests/module/MLD_host_groupstates.test

@@ -39,13 +39,16 @@ TRAJ-3  ff0e::1  Query-driven  (host1 receives General Query after becoming Idle
   HOST-02: The "received General Listener Query" line proves Idle --> DELAYING_LISTENER.
   The subsequent "sending Multicast Listener Report" line proves the delayed Report was sent.
 
-TRAJ-4  ff0e::1  Done on leave  (host1 leaves at t=5s via UdpSink stopTime)
-  host1's UdpSink has stopTime=5s. Socket close fires ipv6MulticastGroupLeftSignal ->
-  Mldv1::multicastGroupLeft -> Done sent to ff02::2.  After the Query-driven Report
-  (flag=true), Done is sent to ff02::2 (ALL_ROUTERS_2).
+TRAJ-4  ff0e::1  Done on leave  (BOTH hosts leave at t=5s via UdpSink stopTime)
+  Both hosts' UdpSinks have stopTime=5s. Socket close fires ipv6MulticastGroupLeftSignal ->
+  Mldv1::multicastGroupLeft, which sends a Done to ff02::2 ONLY if the host holds flag=true.
+  Exactly one host is the reporter (won the Query race) -- host1 at the pinned seed -- so host1
+  sends the Done and host2 leaves silently.
 
-  HOST-04: The "sending Multicast Listener Done" line proves
-  IDLE_LISTENER --> NON_LISTENER (leave with Done, flag=true).
+  HOST-04: The "sending Multicast Listener Done" line from host1 proves
+  IDLE_LISTENER --> NON_LISTENER (leave with Done, flag=true); a %not-contains proves host2,
+  the suppressed loser, sends none. This is the seed-pinned form of "the host that Reported is
+  the one that sends the Done".
 
 Note on intermediate IDLE_LISTENER observability: timer expiry is only EV_DEBUG in Mldv1
 (not EV_INFO), so the IDLE_LISTENER state after unsolicited-Report-timer expiry is inferred
@@ -57,7 +60,8 @@ Network: host1, host2, and router all connect to a shared EthernetHub.
 Ipv6FlatNetworkConfigurator assigns /64 link-local and global addresses.
 hasMld=true on all nodes; dupAddrDetectTransmits=0 eliminates DAD delay.
 Router is a real querier (multicastForwarding=true at node level) with short timers.
-seed-set=0 pins uniform(0, maxRespDelay) for deterministic timer behavior.
+The RNG seed is pinned (see the seed-set note below): it fixes which host wins the query-response
+race, and thus which one holds flag=true and sends the Done. An RNG shift swaps the roles.
 
 %#--------------------------------------------------------------------------------------------------------------
 %file: test.ned
@@ -99,8 +103,16 @@ sim-time-limit = 30s
 cmdenv-express-mode = false
 cmdenv-log-prefix = "%C: "
 
-# Fix RNG seed for deterministic behavior of uniform(0, maxRespTime) in startHostTimer
-seed-set = 0
+# MLDv1 answers a General Query after a random uniform(0, maxRespDelay) delay; when two hosts share
+# a group, the shorter delay reports first and the other suppresses (Mldv1.cc:311 and :410), so which
+# host ends up as the reporter -- and therefore holds flag=true and sends the Done on leave -- is an
+# RNG coin flip. opp_test cannot express the relational "the reporter is the host that Dones, and the
+# other does not", so we PIN the seed: at seed 1 host1 is the reporter, so host1 sends the Done and
+# host2 (which also leaves) sends none -- exactly one Done, from host1, as asserted below.
+# NOTE: a change elsewhere that shifts how many random numbers are drawn before this point can swap
+# the roles. If that happens, re-pick a seed where host1 wins (seeds 1, 3, 4, 6 do; 0, 2, 5, 7 do
+# not) -- the behavior is unchanged, only which host plays which role.
+seed-set = 1
 
 # Enable MLD on all nodes
 **.ipv6.hasMld = true
@@ -120,13 +132,16 @@ seed-set = 0
 **.host1.app[0].typename = "UdpSink"
 **.host1.app[0].localPort = 1000
 **.host1.app[0].multicastGroup = "ff0e::1"
-# TRAJ-4: host1 leaves at t=5s via socket close (fires ipv6MulticastGroupLeftSignal -> Done).
+# TRAJ-4: BOTH hosts leave at t=5s via socket close (fires ipv6MulticastGroupLeftSignal). Only the
+# host holding flag=true (the reporter, host1 at this seed) sends a Done; the suppressed host leaves
+# silently. host2 also leaving is what makes "host2 sends no Done" a real check, not a tautology.
 **.host1.app[0].stopTime = 5s
 
 **.host2.numApps = 1
 **.host2.app[0].typename = "UdpSink"
 **.host2.app[0].localPort = 1000
 **.host2.app[0].multicastGroup = "ff0e::1"
+**.host2.app[0].stopTime = 5s
 
 # TRAJ-3: real querier on the router drives the Idle -> Delaying -> Report path.
 # multicastForwarding MUST be set at node level: NetworkLayerNodeBase propagates
@@ -181,6 +196,14 @@ MldHostGroupstatesNetwork.host1.ipv6.mld: Mldv1: received General Listener Query
 %contains: stdout
 MldHostGroupstatesNetwork.host1.ipv6.mld: Mldv1: sending Multicast Listener Done for group=ff0e::1 on iface=eth0
 
+%#--------------------------------------------------------------------------------------------------------------
+%# CORRELATION (the other host): host2 also leaves at t=5s, but as the suppressed loser at this seed
+%# it holds flag=false and sends NO Done -- only the reporter (host1) does. This is the seed-pinned
+%# "the reporter sends the Done, the other does not" check (see the seed-set note: an RNG shift swaps
+%# the roles, and the seed would need re-picking so host1 stays the reporter).
+%not-contains: stdout
+MldHostGroupstatesNetwork.host2.ipv6.mld: Mldv1: sending Multicast Listener Done
+
 %#--------------------------------------------------------------------------------------------------------------
 %postrun-command: grep "undisposed object:" test.out > test_undisposed.out || true
 %not-contains: test_undisposed.out