[wbnns]

The flaw. On one processor, when the manager's thread falls behind (a slow state-file write, a starved processor), the rate group's next tick waits in the manager's queue in front of the replies. Each cycle then closes before its answers are dispatched, and after three cycles every replica is retired as LOST and the run halts. CI hit it once in the restart test (PR #35, all three replicas retired). Under CPU starvation in a container (half a CPU, six busy loops, 20 ms cycles) it halted at cycle 4 on every try.

The rule (MRU-RM-023). A cycle closes late when other messages wait in the queue as it closes, or when every one of two or more expected answers is missing. In such a cycle a missing answer counts against no replica (no miss, no known-answer test or admission failed for a missing answer); a cycle with an answer missing is withheld (nothing delivered, no strike), counted in the new Late telemetry with a throttled CycleWithheld event. A reply that arrives after its cycle closed clears the replica's misses. One replica left: silence counts as before.

Evidence.

• 4 new unit tests (44 in all): answers queued behind the next tick, a known answer queued behind the tick, common silence, a replica that always answers late. With the rule disabled the manager suite fails.
• Parity test unchanged: 36 of 60 identical, wrong results identical in all 60.
• Load test (by hand): 15 starved runs, halted 9 times before and 0 after; replicas lost without cause 28 before, 14 after; 0 wrong in all. The losses left need one replica thread starved for three whole cycles (300 ms at the package's 100 ms cycle).
• Deployment check and the full run 3 package in ESA's image (local ARM build): 147 s, the same counts and events as v0.5.1, 0 withheld.

Also. RunRecorder reads Late; the summary reports late=; scripts/fprime-deployment.sh allows one count of slack per withheld cycle. Requirements D3, MRU-RM-002, 009, 010, 014 updated, MRU-RM-023 added. Version 0.6.0.