feat(roundtrip): pin the swarm step to the multi network mode where a role takes it

The swarm step drew the node network from the run's rotation, so a role could pass on a clearnet-only or tor-only round and never prove dual-stack in swarm. swarm-zombie accepts network= and appends it to the whitelist entry, and the roundtrip pins multi whenever the validator accepts that row for the role; single-mode and narrowed roles keep the rotation.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Makefile

@@ -783,11 +783,12 @@ SWARM_DISTROS = $(or $(distros),$${INFINITO_DISTRO:?})
 # Param variant: optional matrix variant index to deploy (default 0); a multi-variant app runs one cluster per swarm-zombie, so pick the round to validate.
 # Param disable: optional comma-separated provider keys removed from the test inventory (e.g. matomo,dashboard,prometheus,email,css).
 # Param name: optional cluster-id prefix for the container + network names; release with the same name=.
+# Param network: optional node network mode pinned on the row (clearnet | tor | multi); empty keeps the run's rotation.
 # Param step_timeout: optional minute budget for the matrix-deploy step (default 690).
 # Note: Use `make swarm-exec` / `make swarm-shell` to inspect, `make swarm-down` to release.
 swarm-zombie: install-act
-	@test -n '$(app)' || { echo 'usage: make swarm-zombie app=<application_id> [distros=<distro>] [variant=<idx>] [name=<cluster-id>] [disable=<keys>]'; exit 2; }
-	@"$${PYTHON}" -m cli.meta.ci.validate --modes swarm --whitelist '$(app)#$(or $(variant),0)@swarm'
+	@test -n '$(app)' || { echo 'usage: make swarm-zombie app=<application_id> [distros=<distro>] [variant=<idx>] [name=<cluster-id>] [disable=<keys>] [network=<mode>]'; exit 2; }
+	@"$${PYTHON}" -m cli.meta.ci.validate --modes swarm --whitelist '$(app)#$(or $(variant),0)@swarm$(if $(network),+$(network))'
 	@SWARM_NAME='$(or $(name),$(app))' INFINITO_KEEP_SWARM_NODES=false bash scripts/tests/deploy/swarm/utils/clean/teardown.sh
 	@bash scripts/tests/deploy/swarm/utils/clean/lab_subnet.sh
 	@bash scripts/tests/deploy/act/down_act_outer.sh
@@ -803,7 +804,7 @@ swarm-zombie: install-act
 	 ACT_WORKFLOW=.github/workflows/call-test-deploy.yml \
 	 ACT_JOB=deploy \
 	 ACT_MATRIX="apps:$(app);variant:$(or $(variant),0);mode:swarm" \
-	 ACT_INPUTS="whitelist=$(app)#$(or $(variant),0)@swarm distros=$(SWARM_DISTROS) index=0 sweep=0 modes=swarm disable=$(disable)" \
+	 ACT_INPUTS="whitelist=$(app)#$(or $(variant),0)@swarm$(if $(network),+$(network)) distros=$(SWARM_DISTROS) index=0 sweep=0 modes=swarm disable=$(disable)" \
 	 bash scripts/tests/deploy/act/workflow.sh
 
 .PHONY: system-purge

docs/agents/action/iteration/roundtrip.md

@@ -14,7 +14,7 @@ For debugging the compose deploy of one role, see [Compose Loop](compose.md); fo
 - With no `apps=`, the loop defaults to **every application, most-complex first** (the `complexity` CLI: `infinito meta roles applications complexity --sort "desc weight" --format string`). That is a large run (one compose plus one swarm deploy per app), so narrow it with `apps=` while iterating.
 - The mode sequence defaults to `compose swarm` and is overridable with `modes="compose swarm"`. The order is always compose first, so the cheaper mode fails fast before the expensive swarm rebuild. Append `k8s` here once that mode exists.
 - Per step the output is streamed to `${TMPDIR:-/tmp}/roundtrip-<app>-<mode>.log`. Tell the operator the exact `tail -f` path for the running step.
-- The compose step runs `compose-deploy mode=reinstall apps=<app> full_cycle=true variant=0`; the swarm step runs `swarm-zombie app=<app>`, pinned to `variant:0` so a multi-variant app validates one cluster (parity with the compose step, not the full per-variant CI matrix that runs one isolated runner per variant). The cluster is named `<app>-swarm-mgr-01` etc. via the mandatory `SWARM_NAME` (the app id is the default cluster id). Each validated swarm cluster is released afterwards unless you pass `keep=true`.
+- The compose step runs `compose-deploy mode=reinstall apps=<app> full_cycle=true variant=0`; the swarm step runs `swarm-zombie app=<app>`, pinned to `variant:0` and, whenever the role can take it, to the `multi` network mode, so a multi-variant app validates one cluster (parity with the compose step, not the full per-variant CI matrix that runs one isolated runner per variant). The cluster is named `<app>-swarm-mgr-01` etc. via the mandatory `SWARM_NAME` (the app id is the default cluster id). Each validated swarm cluster is released afterwards unless you pass `keep=true`.
 - `make autoformat` and `make test` MUST be green before a roundtrip; the loop does not re-run them per app.
 - **A blocked mode is NEVER a reason to silently switch to another.** If a mode cannot run (the swarm NFS wedge below, a wedged daemon, a missing host capability), STOP the whole sweep, report the blocker together with the exact recovery command, and wait for it to be cleared. You MUST NOT fall back to a `modes=compose`-only (or any reduced) sweep to look productive: it hides the unmet swarm parity and never satisfies the compose-AND-swarm gate. Resume the full sweep only once the blocker is gone.
 

scripts/tests/deploy/roundtrip.sh

@@ -44,8 +44,13 @@ for app in "${_apps[@]}"; do
 				disable="${disable:-}" 2>&1 | tee "$log"
 			;;
 		swarm)
+			network=""
+			if "${PYTHON}" -m cli.meta.ci.validate --modes swarm --whitelist "${app}#0@swarm+multi" >/dev/null 2>&1; then
+				network="multi"
+			fi
+			echo "==> roundtrip: ${app} [swarm] network=${network:-rotation}"
 			ACT_PLATFORM_IMAGE=local/act-runner-fixed:latest \
-				make -C "$_repo_root" swarm-zombie app="$app" \
+				make -C "$_repo_root" swarm-zombie app="$app" network="$network" \
 				disable="${disable:-}" 2>&1 | tee "$log"
 			marker="==> swarm drill complete: app=${app}"
 			grep -qF "${marker}" "$log" || {