[heifner]

sysio.epoch::advance sent sysio.opreg::recorddel and termcheck for every (outpost, member) pair of the expiring batch-operator group, so each duty epoch wrote one delivery row per active outpost. termcheck's thresholds and the min_terminate_window_ms bound count duty epochs, so the extra rows scaled the miss ladder by the outpost count:

• Full outage. With the two launch outposts, the consecutive-miss rail tripped after three duty epochs instead of six.
• Partial outage. An operator that kept missing one outpost logged a hit alongside every miss, so the consecutive rail never fired; with enough outposts its miss rate also stays under the percent rail.

advance now records one result per member per duty epoch, delivered only if the member reached every active outpost, followed by one termcheck. Non-canonical slashes are still collected per outpost and sent first. An epoch with no active outpost records nothing, as before.

Notes

• CertiK WNS-54 / WIRE-404.
• Only sysio.epoch.wasm is rebuilt; ABIs are unchanged. The sysio.opreg and README changes are docs only.
• Which rail fires first. At the production defaults (5% over 24 h, 18-minute duty interval), the percent rail trips around the fifth missed duty epoch, before the consecutive rail. An operator with 16 or fewer records in the window is terminated at its first miss.
• Tests: a two-outpost termination ladder (ACTIVE after five fully missed duty epochs, TERMINATED at the sixth); a partial delivery counts as a miss; one delivery row per member per duty epoch; noncanonical_delivery_slashes_before_termination updated for one row per duty epoch; an advance with no active outpost sends no recorddel or termcheck.
• Merge order. Current with master, including Emissions: size T5 accruals on the headroom net of pending emission #658. [WNS-56] OPP: bound the operator roster to the schedule window and cap queueout #692 rewrites the MAX_OPERATORS_PER_EPOCH doc this PR edits and also rebuilds sysio.epoch.wasm; whichever lands later fixes that doc and rebuilds the wasm from the merged sources.

[huangminghuang]

Reviewed at head 3b78bc7. Fresh-state pre-launch behavior and focused tests look correct. Approval assumes deployments carrying legacy per-outpost dellog state will be reset before launch.

[huangminghuang]

Re-reviewed current head 1cf719f against base 70e499f. No actionable findings. The zero-active-outpost regression addresses the prior low-priority finding. Fresh contract and test builds passed; sysio_msgch_chain_tests passed 31/31 (2,200 assertions), the focused operator-registry cadence test passed, and the rebuilt epoch WASM matches the committed artifact. The deployment is prelaunch, so no legacy delivery-log migration is required. Remote build-matrix jobs were still pending at review time.