Step 1: an invariant that holds of any raised scenario

The address collision was found by eye. This is the mechanical form of it: no
two machines hold one address on one segment.

Pure over already-collected facts, so the logic is tested without a hypervisor
— including the cases that would make it useless if got wrong: the same address
on DIFFERENT segments is normal and must not be reported, and one machine
holding an address twice is not two machines.

Asserted against whatever the integration suite has standing, read from the
hypervisor rather than from the declaration. The declaration is what was
accepted, and it was accepted.

src/lifecycle/invariants.ts

@@ -0,0 +1,67 @@
+/**
+ * Properties that must hold of ANY raised scenario, whatever it declares.
+ *
+ * Distinct from validation, which reads a file and can only catch what the file says. These
+ * read what actually came up. The first one exists because two routers were raised holding
+ * one address on one segment: the declaration was accepted, the raise reported success, and
+ * the address resolved to whichever container answered ARP last — so a published port
+ * worked or did not, run to run, with nothing reporting a fault.
+ *
+ * Pure over already-collected facts, so the logic is testable without a hypervisor and the
+ * reading of the hypervisor stays in one place.
+ */
+
+/** One address, held by one machine, on one segment. */
+export interface Held {
+  machine: string;
+  segment: string;
+  address: string;
+}
+
+export interface Conflict {
+  segment: string;
+  address: string;
+  machines: string[];
+}
+
+/** Strip a prefix length: what is held is an address, the mask is a property of the link. */
+function bare(address: string): string {
+  const slash = address.lastIndexOf("/");
+  return slash === -1 ? address : address.slice(0, slash);
+}
+
+/**
+ * Two machines holding one address on one segment.
+ *
+ * The same address on DIFFERENT segments is not a conflict — `192.168.1.1` on one private
+ * network and on another are two different machines' idea of "the gateway", which is the
+ * normal case and must not be reported.
+ */
+export function duplicateAddresses(held: Held[]): Conflict[] {
+  const byPlace = new Map<string, Set<string>>();
+  for (const entry of held) {
+    const key = `${entry.segment} ${bare(entry.address)}`;
+    const machines = byPlace.get(key) ?? new Set<string>();
+    machines.add(entry.machine);
+    byPlace.set(key, machines);
+  }
+
+  const conflicts: Conflict[] = [];
+  for (const [key, machines] of byPlace) {
+    if (machines.size < 2) continue;
+    const [segment, address] = key.split(" ");
+    conflicts.push({
+      segment: segment as string,
+      address: address as string,
+      machines: [...machines].sort(),
+    });
+  }
+  return conflicts.sort((a, b) => a.address.localeCompare(b.address));
+}
+
+/** Render conflicts as something a failing test can print without further work. */
+export function describeConflicts(conflicts: Conflict[]): string {
+  return conflicts
+    .map((c) => `${c.address} is held by ${c.machines.join(" and ")} on '${c.segment}'`)
+    .join("; ");
+}