chore(systests): force testnet allocation to the local DC for all sys…

…tem-tests (#10436)

# What

Force Farm testnet allocation to the same DC as the GitHub runner
executing the test (which is also the DC holding the just-built images)
— for **every** system-test. This generalizes the opt-in
`.allocate_testnet_to_local_dc()` mechanism introduced in #10122.

# Why

#10122 showed that cross-DC transfers of large images (e.g. 2.6G SetupOS
images from `dm1` to `zh1` or vice versa) cause download timeouts and
flaky tests. The same applies to all system-tests, so testnets should
always be allocated in the DC where the test runs and the images live.

# How

* Replace the `allocate_testnet_to_local_dc` bool on `SystemTestGroup`
(and its builder method) with the `ALLOCATE_TESTNET_TO_LOCAL_DC`
environment variable, read by the test driver in `create_group_setup`
(accepted values: `1`/`true`/`0`/`false`).
* Set `ALLOCATE_TESTNET_TO_LOCAL_DC=1` unconditionally from the
`system_test` macro in `rs/tests/system_tests.bzl`, covering both the
plain and the `_colocate` targets. This remains a no-op when the `DC`
volatile status variable is unknown (e.g. local runs without
`NODE_NAME`).
* Drop the now-redundant `.allocate_testnet_to_local_dc()` calls from
the 7 nested system-tests.
* Replace `dep_download_url` in `rs/tests/upload_systest_dep.sh` to no
longer go via the dc_http_proxy but point directly at the DC-local bazel
cache: `https://artifacts.$cluster.dfinity.network/cas/$dep_sha256`.
* Force the `release-system-tests` job in `release-testing.yml` and the
`system-tests-benchmarks-nightly` job to run in runner group `dm1` (the
`&dind-large-setup` anchor moved to `setup-guest-os-qualification`,
whose jobs keep their current runners).

# Notes for reviewers

* Pinning all tests to the runner's DC concentrates Farm load in `dm1`
where most runners live; watch for allocation failures after rollout.
Extra charts have been added to the [Farm
Dashboard](https://grafana.dm1-idx1.dfinity.network/d/uwEFG_yGk/farm-dashboard?from=now-3h&to=now&timezone=utc&refresh=10s)
for monitoring dm1 and zh1.
* Farm hosts/UVMs now fetch deps from
`artifacts.<cluster>.dfinity.network` over HTTPS (previously plain http
via proxy-global:8080); the redirect server already returns URLs of this
form.

test: make `FakeStateManager` return a valid height witness (#10364)

This PR makes `FakeStateManager` return a valid height witness in its
implementation of `list_state_hashes_to_certify`. This change is driven
by an upcoming new consensus integration test which depends on the
certified height increasing. Though as of today, nodes in the
integration test keeps
[invalidating](https://github.com/dfinity/ic/blob/8dc9fa9ad19c79f9d20d757fe95c306fc66389be/rs/consensus/certification/src/certifier.rs#L604)
certification shares (preventing the certified height to increase)
because the height witness is not valid.

To do so, the `FakeStateManager` now calls the [same
functions](https://github.com/dfinity/ic/blob/8dc9fa9ad19c79f9d20d757fe95c306fc66389be/rs/state_manager/src/lib.rs#L1914-L1927)
as `StateManagerImpl` (i.e. `replicated_state_as_lazy_tree`,
`hash_lazy_tree`, `compute_state_height_witness`) to compute the witness
instead of using a `::new_for_testing`.
The common part of the code was thus moved to the `ic_canonical_state`
crate.

fix: Also reduce read_ahead for dm-* devices (#10420)

Looks like it was actually dm-2 (store-crypt) and/or dm-4
(store-shared--data, more likely) suffering from read amplification, not
vda. They're probably all the same (virtual?) device underneath, which
is why reads appear to be spiking on all 3 at once. But it's likely the
shared data partition that is actually being pounded.

Reduce the read-ahead for all these devices similar to what was done for
vda, just to be safe.

feat: enable canister log memory store feature [DO NOT MERGE]

chore: Update Base Image Refs [2026-06-03-1831] (#10381)

Updating base container image references.

Run URL: https://github.com/dfinity/ic/actions/runs/26904782940

---------

Co-authored-by: Bownairo <7826872+Bownairo@users.noreply.github.com>
Co-authored-by: Eero Kelly <eero.kelly@dfinity.org>

feat: enable canister log memory store feature [DO NOT MERGE]

chore: Update Base Image Refs [2026-05-28-0908] (#10333)

Updating base container image references.

Run URL: https://github.com/dfinity/ic/actions/runs/26565442722

Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>

fix: IC-1967 Drop HTTP responses if context is no longer part of the …

…state (#10264)

The HTTP outcalls client dispatches HTTP request contexts from the
replicated state to the HTTP adapter. The adapter does the actual
request and returns the response asynchronously at a later point.

In the meantime, the request context may have already disappeared from
replicated state, i.e. because the request timed out or it already
received enough responses from other replicas.

Before this PR, the response returned from the adapter would be treated
as fully replicated by default. This causes the replica to sign and
gossip a share despite the missing context.

With this PR, the replica instead drops responses returned by the
adapter, for which no context exists anymore.

fix: specify VM allocation mode for system tests via environment vari…

…able (#10230)

Set the `vm_allocation_mode` for system-tests via an environment
variable instead of via Rust.

This is to fix the issue that colocated performance tests would not set
the required `performanceOptimizedAllocation` VM allocation mode because
the group is created in the wrapper driver which would not set the
`vm_allocation_mode`.

Now we specify the optional `vm_allocation_mode` via a parameter of the
`system_test` macro which when specified sets the `VM_ALLOCATION_MODE`
environment variable. This variable is then read and parsed when
creating the group which also works for colocated tests.

feat: Stop using blessed versions list for invariants in the registry (…

…#9772)

ReplicaVersionRecords and the blessed versions list are updated in sync,
as we no longer require an extra proposal to have each version
"blessed".

This moves the invariants in the registry to use the list of
ReplicaVersionRecords, instead of the blessed versions list, as a step
towards removing the redundant blessed versions list entirely.