__sim_producer binds sim_idx and inputs_json inside the loop, and its
handler reads both. A worker that fails in the seeding above the loop,
or in the claim that opens it, reached the handler with neither name
assigned and died with UnboundLocalError instead of recording anything.

The parent learns a worker failed from error_event, which the handler
sets on its last line, so it was never reached either and the run
waited rather than stopping.

Both names are bound before the try now, and the message says worker
startup when no index was claimed rather than naming one that does not
exist. Binding only the name in the traceback is not enough: the
message then raises on the other one, which the tests cover.

Scoped to the parallel producer. The serial handler has the same
unbound inputs_json and is RocketPy-Team#1177's.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

__sim_producer binds sim_idx and inputs_json inside the loop, and its
handler reads both. A worker that fails in the seeding above the loop,
or in the claim that opens it, reached the handler with neither name
assigned and died with UnboundLocalError instead of recording anything.

The parent learns a worker failed from error_event, which the handler
sets on its last line, so it was never reached either and the run
waited rather than stopping.

Both names are bound before the try now, and the message says worker
startup when no index was claimed rather than naming one that does not
exist. Binding only the name in the traceback is not enough: the
message then raises on the other one, which the tests cover.

Scoped to the parallel producer. The serial handler has the same
unbound inputs_json and is RocketPy-Team#1177's.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

__sim_producer binds sim_idx and inputs_json inside the loop, and its
handler reads both. A worker that fails in the seeding above the loop,
or in the claim that opens it, reached the handler with neither name
assigned and died with UnboundLocalError instead of recording anything.

The parent learns a worker failed from error_event, which the handler
sets on its last line, so it was never reached either and the run
waited rather than stopping.

Both names are bound before the try now, and the message says worker
startup when no index was claimed rather than naming one that does not
exist. Binding only the name in the traceback is not enough: the
message then raises on the other one, which the tests cover.

Scoped to the parallel producer. The serial handler has the same
unbound inputs_json and is RocketPy-Team#1177's.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

__sim_producer binds sim_idx and inputs_json inside the loop, and its
handler reads both. A worker that fails in the seeding above the loop,
or in the claim that opens it, reached the handler with neither name
assigned and died with UnboundLocalError instead of recording anything.

The parent learns a worker failed from error_event, which the handler
sets on its last line, so it was never reached either and the run
waited rather than stopping.

Both names are bound before the try now, and the message says worker
startup when no index was claimed rather than naming one that does not
exist. Binding only the name in the traceback is not enough: the
message then raises on the other one, which the tests cover.

Scoped to the parallel producer. The serial handler has the same
unbound inputs_json and is RocketPy-Team#1177's.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Six ways a worker that failed got away without saying so. It died inside its
own handler on an unbound name, so the manager lock it was holding was never
given back and the run waited for good. A worker that was killed ran no
handler, set no event, and left only an exit code nobody read, so simulate()
returned normally with rows missing. Reporting a failure could itself block on
a lock a dead sibling still held.

Both names are bound before the try now, the handler reports through a bounded
lock and releases it from a finally, and the parent reads exit codes and the
failure event instead of joining unbounded. A run that is only slow is still
never cut short: how a worker ended decides that, not how long it took.

An exit code cannot show a worker that left between claiming an index and
recording it, so a run is checked against its own logs at the end. Both must
hold exactly the simulations asked for, none twice, none unreadable.

Scope is the parallel producer. __run_in_serial has the same unbound name and
belongs to RocketPy-Team#1177.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Six ways a worker that failed got away without saying so. It died inside its
own handler on an unbound name, so the manager lock it was holding was never
given back and the run waited for good. A worker that was killed ran no
handler, set no event, and left only an exit code nobody read, so simulate()
returned normally with rows missing. Reporting a failure could itself block on
a lock a dead sibling still held.

Both names are bound before the try now, the handler reports through a bounded
lock and releases it from a finally, and the parent reads exit codes and the
failure event instead of joining unbounded. A run that is only slow is still
never cut short: how a worker ended decides that, not how long it took.

An exit code cannot show a worker that left between claiming an index and
recording it, so a run is checked against its own logs at the end. Both must
hold exactly the simulations asked for, none twice, none unreadable.

Scope is the parallel producer. __run_in_serial has the same unbound name and
belongs to #1177.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

…ial loop

The rebase onto develop was clean in three files and left one add/add
conflict in __run_in_serial: both sides bind a name before the try so the
handlers cannot meet it unbound. RocketPy-Team#1177 binds inputs_json for the
KeyboardInterrupt handler, this branch binds sim_idx for the Exception one.
Both are kept; dropping either puts back the UnboundLocalError the other
side had just removed.

Keeping both then pushed the function to 27 statements, two over
max-statements, so the error-file append the two handlers had copies of
moved into __record_failed_inputs. The guard travels with it: the error
file is created in __setup_files, so appending "" to it was already a
no-op, and the unconditional copy and the guarded one did the same thing.

What the merge could not show is that RocketPy-Team#1177's tests were written against
the loop this branch replaces:

- _InterruptingMonteCarlo stubs only what __run_in_serial touched, and the
  loop now also calls __seed_this_simulation, which reads models the double
  has none of. Stubbed, like the other name-mangled members; seeding is
  pinned by test_monte_carlo_seeding.py.
- Its rows carried no run_root, so the append test tripped the guard for
  studies written before that check existed instead of exercising the
  continuation. The double now writes the root the way the real row
  builders do, the inputs file whole and the outputs file by digest.
- _SimMonitor.keep_simulating is now claim_next_index, and one test
  monkeypatches it by name.
- Serial numbering now starts at zero, as the parallel path always did, so
  the three tests reading indices off disk expected 1, 2, 3 where a run
  writes 0, 1, 2.

tests/unit/simulation: 322 passed, 8 skipped. ruff clean, pylint 10.00.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ial loop

The rebase onto develop was clean in three files and left one add/add
conflict in __run_in_serial: both sides bind a name before the try so the
handlers cannot meet it unbound. RocketPy-Team#1177 binds inputs_json for the
KeyboardInterrupt handler, this branch binds sim_idx for the Exception one.
Both are kept; dropping either puts back the UnboundLocalError the other
side had just removed.

Keeping both then pushed the function to 27 statements, two over
max-statements, so the error-file append the two handlers had copies of
moved into __record_failed_inputs. The guard travels with it: the error
file is created in __setup_files, so appending "" to it was already a
no-op, and the unconditional copy and the guarded one did the same thing.

What the merge could not show is that RocketPy-Team#1177's tests were written against
the loop this branch replaces:

- _InterruptingMonteCarlo stubs only what __run_in_serial touched, and the
  loop now also calls __seed_this_simulation, which reads models the double
  has none of. Stubbed, like the other name-mangled members; seeding is
  pinned by test_monte_carlo_seeding.py.
- Its rows carried no run_root, so the append test tripped the guard for
  studies written before that check existed instead of exercising the
  continuation. The double now writes the root the way the real row
  builders do, the inputs file whole and the outputs file by digest.
- _SimMonitor.keep_simulating is now claim_next_index, and one test
  monkeypatches it by name.
- Serial numbering now starts at zero, as the parallel path always did, so
  the three tests reading indices off disk expected 1, 2, 3 where a run
  writes 0, 1, 2.

tests/unit/simulation: 322 passed, 8 skipped. ruff clean, pylint 10.00.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ial loop

The rebase onto develop was clean in three files and left one add/add
conflict in __run_in_serial: both sides bind a name before the try so the
handlers cannot meet it unbound. RocketPy-Team#1177 binds inputs_json for the
KeyboardInterrupt handler, this branch binds sim_idx for the Exception one.
Both are kept; dropping either puts back the UnboundLocalError the other
side had just removed.

Keeping both then pushed the function to 27 statements, two over
max-statements, so the error-file append the two handlers had copies of
moved into __record_failed_inputs. The guard travels with it: the error
file is created in __setup_files, so appending "" to it was already a
no-op, and the unconditional copy and the guarded one did the same thing.

What the merge could not show is that RocketPy-Team#1177's tests were written against
the loop this branch replaces:

- _InterruptingMonteCarlo stubs only what __run_in_serial touched, and the
  loop now also calls __seed_this_simulation, which reads models the double
  has none of. Stubbed, like the other name-mangled members; seeding is
  pinned by test_monte_carlo_seeding.py.
- Its rows carried no run_root, so the append test tripped the guard for
  studies written before that check existed instead of exercising the
  continuation. The double now writes the root the way the real row
  builders do, the inputs file whole and the outputs file by digest.
- _SimMonitor.keep_simulating is now claim_next_index, and one test
  monkeypatches it by name.
- Serial numbering now starts at zero, as the parallel path always did, so
  the three tests reading indices off disk expected 1, 2, 3 where a run
  writes 0, 1, 2.

tests/unit/simulation: 322 passed, 8 skipped. ruff clean, pylint 10.00.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ial loop

The rebase onto develop was clean in three files and left one add/add
conflict in __run_in_serial: both sides bind a name before the try so the
handlers cannot meet it unbound. RocketPy-Team#1177 binds inputs_json for the
KeyboardInterrupt handler, this branch binds sim_idx for the Exception one.
Both are kept; dropping either puts back the UnboundLocalError the other
side had just removed.

Keeping both then pushed the function to 27 statements, two over
max-statements, so the error-file append the two handlers had copies of
moved into __record_failed_inputs. The guard travels with it: the error
file is created in __setup_files, so appending "" to it was already a
no-op, and the unconditional copy and the guarded one did the same thing.

What the merge could not show is that RocketPy-Team#1177's tests were written against
the loop this branch replaces:

- _InterruptingMonteCarlo stubs only what __run_in_serial touched, and the
  loop now also calls __seed_this_simulation, which reads models the double
  has none of. Stubbed, like the other name-mangled members; seeding is
  pinned by test_monte_carlo_seeding.py.
- Its rows carried no run_root, so the append test tripped the guard for
  studies written before that check existed instead of exercising the
  continuation. The double now writes the root the way the real row
  builders do, the inputs file whole and the outputs file by digest.
- _SimMonitor.keep_simulating is now claim_next_index, and one test
  monkeypatches it by name.
- Serial numbering now starts at zero, as the parallel path always did, so
  the three tests reading indices off disk expected 1, 2, 3 where a run
  writes 0, 1, 2.

tests/unit/simulation: 322 passed, 8 skipped. ruff clean, pylint 10.00.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ith (#1187)

* ENH: continue a Monte Carlo study from the root its rows were drawn with

A Monte Carlo run cannot be seeded on develop: simulate() takes no
random_seed. Seeding it per simulation index is not enough on its own,
because an append then derives a fresh root and writes it into the same
file, so a study resumed after a restart holds two lineages with nothing
afterwards to say which simulation came from which.

Both halves are here. A simulation takes its seed from its own index, so a
serial run and a run split over workers draw the same inputs for the same
index. Every input row records the root that drew it, and an append reads it
back rather than needing to be given it again. A seed that disagrees with the
rows is refused, as is a log whose rows disagree with each other, and one
whose rows carry no root at all, which is how a log written before this
looks. Output rows carry a digest of that root, so a log belonging to another
study is refused even when its indices line up with this one's.

The worker tests in #1182 drive the producer with a stand-in monitor, so
they move to the claim along with it. A reseed failure now names the index
it was seeding for rather than worker startup, because the seeding happens
after the claim rather than once above the loop.

The seeding half was #1054, closed in favour of this.

Addresses #1053 and #1075.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

* TST: carry #1177's interrupt tests onto the reseeded serial loop

The rebase onto develop was clean in three files and left one add/add
conflict in __run_in_serial: both sides bind a name before the try so the
handlers cannot meet it unbound. #1177 binds inputs_json for the
KeyboardInterrupt handler, this branch binds sim_idx for the Exception one.
Both are kept; dropping either puts back the UnboundLocalError the other
side had just removed.

Keeping both then pushed the function to 27 statements, two over
max-statements, so the error-file append the two handlers had copies of
moved into __record_failed_inputs. The guard travels with it: the error
file is created in __setup_files, so appending "" to it was already a
no-op, and the unconditional copy and the guarded one did the same thing.

What the merge could not show is that #1177's tests were written against
the loop this branch replaces:

- _InterruptingMonteCarlo stubs only what __run_in_serial touched, and the
  loop now also calls __seed_this_simulation, which reads models the double
  has none of. Stubbed, like the other name-mangled members; seeding is
  pinned by test_monte_carlo_seeding.py.
- Its rows carried no run_root, so the append test tripped the guard for
  studies written before that check existed instead of exercising the
  continuation. The double now writes the root the way the real row
  builders do, the inputs file whole and the outputs file by digest.
- _SimMonitor.keep_simulating is now claim_next_index, and one test
  monkeypatches it by name.
- Serial numbering now starts at zero, as the parallel path always did, so
  the three tests reading indices off disk expected 1, 2, 3 where a run
  writes 0, 1, 2.

tests/unit/simulation: 322 passed, 8 skipped. ruff clean, pylint 10.00.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* DOC: record the serial renumbering and the refused append as changes

The entry this branch added sits under Added, and both of these are
visible to someone whose code already reads a study off disk: a serial
run now numbers its simulations from zero, so the index field shifts by
one, and an append onto a study written before this release is refused
rather than continued.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* DOC: say how a run numbers its simulations

Reviewing the Changed entry @Gui-FernandesBR added turned up a gap on my
side: the serial renumbering is a break for anyone reading indices off
disk, and the only place it was written down was the changelog.

The guide's note leans on it without saying so. It claims simulation 7
draws the same inputs serially or split over workers, which is only one
claim if both paths agree on which simulation 7 is, so the note now says
a run of n numbers them 0 to n - 1.

The notebook says it where a reader meets simulate(). Its stored outputs
predate this and are left alone: nbsphinx never re-executes them, and a
seeding change moves every number in them, which is not a diff worth
reading.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

* TST: take the wall clock out of the shared-deadline test

This branch's CI went red on windows-latest 3.10 with

    assert min(offered) < 0.05
    E   assert 0.0500000000001819 < 0.05

The test lives on develop rather than in this branch, and #1182 is where I
added it. The stand-in workers return at once, so nothing makes the clock
move between _wait_for_the_workers setting its deadline and reading it back
for the last of them, and (t + 0.05) - t is not exactly 0.05 in binary.
Every other leg passed, and so did the same job on 3.14.

The clock is a counter now, so what each worker is offered is decided by
arithmetic rather than by how coarse the platform's timer is. The shape the
test is about is asserted as well: inside one stage the offers shrink along
the fleet, where one deadline each would hand every worker the whole grace.

Giving each worker its own grace turns both assertions red and leaves the
other twelve in the file green.

It sits here because it blocks this pull request's CI, and it is a test-only
change to a file this branch does not otherwise touch. Happy to move it to
its own pull request if you would rather keep the two apart.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

---------

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
Co-authored-by: Gui-FernandesBR <guilherme_fernandes@usp.br>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>