nx_survey_handoff_gate.nx

nx_survey_handoff_gate.nx -- TS1 ADOPTION: THE REAL DAEMON, RESTARTED FOR REAL, ZERO DROPS. /compare/trafficsafety rung TS1. nx_ts_handoff_gate already proved the MECHANISM on a synthetic server. This gate proves the ADOPTION, which is the half that was open: it fork+execs the ACTUAL nx_survey_daemon binary, restarts it for real, and measures what a client saw. Nothing here checks that the source references a symbol -- a reference is not an adoption, and the estate has a long record of capabilities that were referenced and never reached. ACCEPT RULE, taken VERBATIM from trafficsafety.plan and not re-invented here: "a swap under a synthetic request stream drops ZERO connections, measured by a client that counts refusals and resets, not by the daemon's own log. The neg-control is mandatory -- the same harness against the CURRENT ordinary-listener path must show a non-zero drop, or the test proves nothing." THE TWO ARMS DIFFER IN EXACTLY ONE THING: whether an owner outside the daemon is publishing the listening socket. Same binary, same argv shape, same client, same request count. In the ARMED arm an owner holds the listener and hands it to each generation, so ts_handoff_nodrop INHERITS it; in the NEG-CONTROL there is no owner, so the very same call falls back to binding -- which is today's behaviour for every other daemon in the estate, and is the disease state. THE DECISIVE MOMENT IS THE ARRIVAL DURING THE GAP. Generation one is killed AND REAPED, so at that instant ZERO daemon processes exist. A client connects right then. With an owner the handshake completes into the kernel's accept queue and generation two serves it; without one there is nothing bound and the arrival is refused with ECONNREFUSED. That difference is deterministic, which is what makes this a gate and not a flaky benchmark. IT ALSO EXERCISES ENVOY'S ORDERING RULE, WHICH IS WHY THE PUBLISH IS THE READINESS SIGNAL. ts_handoff_publish blocks until a generation asks for the socket, and the adopted daemon asks only AFTER it has finished every expensive step (its three arenas and the seg-store warm). So a publish that returns is positive evidence that initialisation completed BEFORE the handoff -- the exact ordering whose absence caused this estate's 8-minute blackout. SAFETY: loopback only; every port is FOUND by a bind that would have failed had it been occupied, because a probe port you did not verify free is not a control, it is a second instance. The live :8031 survey daemon is NEVER touched -- the subject is given its own port on argv precisely so this gate can drive a real restart without becoming a second instance of a running service. The subject runs with CWD inside the gate's own /tmp fixture, so its store self-heal cannot write into a production tree. expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).