Item 4. Three consecutive rounds of the Android on-device suite (18 tests each)
and three of the iOS sign-in suite (7 each), all green, against a real relay.
`Scripts/rounds.sh N` runs every layer that can run on a given machine and
prints one line per layer per round -- because "three clean rounds" should be a
command, not a ritual somebody performs from memory and reports on.
⚠️ **A skipped layer prints SKIP, never a pass.** A round that silently did
nothing looks exactly like a round that worked; that is how a suite stops
meaning anything.
The shared-account rounds needed rethinking rather than retrying. The account
service allows **three registrations per address per hour**, deliberately --
forty sign-in attempts is a person with a password manager and a bad afternoon,
forty accounts is a flood. Three sign-UPS per shape consumes an hour's budget
for one shape and fails the next, so a test written that way measures the rate
limiter rather than the product.
So sign-up is proven once per shape and the repeatable part is what a person
actually repeats: sign in, register a device, be reachable -- three rounds,
asserting every round lands on the SAME relay account. The relay keys on the
product-scoped pseudonym rather than the handle, and if it keyed on the handle
each round would quietly make a new account and nobody would notice until
messages stopped arriving.
Fresh-registration rounds stay on the local shape, which has no such limit
because a self-hosted relay is not a shared service.
⚠️ The backoff no longer pretends it can outwait an hour. It fails with the
actual constraint spelled out, because a correct defence dressed up as a flaky
test is worse than either.
Paul Hitt
ec03f469c7