encryptionIsCommutativeAcrossPeerInstances

The same law across the instance boundary a real deal actually has: a is applied by the scheme that minted it and b by the scheme that minted it, so nothing about the two layers passes through one object. encryptionIsCommutative one screen up is the degenerate case of this — and the only case the suite had before #2311.

Assertions, in the order they appear below, and the numbering the receipts use:

1. precondition, checked eagerly — the two schemes are distinct objects, so a fixture caching one instance reds here rather than re-running encryptionIsCommutative under a new name;

2. precondition, checked eagerly — their single-layer ciphertexts differ, so a fixture seeding two instances identically (distinct objects, identical keys, layers that cancel) reds too. This is distinctKeysProduceDistinctCiphertexts in its cross-peer form, and it is free: both ciphertexts are already needed as the second layer's input;

3. the law — E_bob(E_alice(m)) == E_alice(E_bob(m)) for every valid plaintext, over a validPlaintexts asserted non-empty. That knob's empty setting is the one that switches this property off wholesale: the law asserts nothing over an empty list and the rig below expects zero encryptions, so both would pass by arithmetic;

4. the rig fired — each peer performed exactly two encryptions per message, its own layer once as the outer and once as the inner. Rewriting the body to route both layers through one peer is precisely how this property decays back into its single-instance sibling, and a count is what notices; a passing assertEquals on the ciphertexts would not, since that mutation makes the law more true.

SchemePeer carries the other half: a peer owns its key privately and exposes only encrypt/strip, so applying one peer's key through another peer's scheme — a mis-crossing that would pass on any stateless scheme and hide a per-instance one — is not something this test body can express at all.

Mutation receipts, measured on this branch (JVM, --rerun-tasks), each applied alone and reverted, the verdict read out of the results XML:

The fifth row is the one worth reading twice: that mutation makes assertion 3 more likely to pass, so no ciphertext comparison can notice it, and assertion 4 is the whole of what stands between this property and its single-instance sibling.