nx_ts_drain_gate.nx

nx_ts_drain_gate.nx -- TS2: THE PROCESS MUST KEEP SERVING AFTER TERM. /compare/trafficsafety rung TS2, accept rule taken VERBATIM from trafficsafety.plan and not re-invented here: "with a request in flight at the moment TERM lands, the client receives a complete response and not a 5xx or a reset, and a daemon that exits early FAILS the gate. Anti-vacuity tooth required -- a run in which no request was in flight when TERM landed must be reported as UNOBSERVED and must not score as a pass." THE MEASUREMENT IS WHAT THE CLIENT RECEIVED, NOT WHAT THE SERVER LOGGED. A drain that logs "draining" and still cuts the response is the defect, so nothing here reads the subject's output: a real client drives a real TCP connection and the verdict is whether the completion byte arrived. THE IN-FLIGHT WINDOW IS CONSTRUCTED, NOT HOPED FOR, and that is what makes this a gate rather than a race. The subject answers a request in TWO parts: it writes ACK (the response has begun and is therefore incomplete), then BLOCKS reading GO before writing DONE. The parent sends TERM and only THEN sends GO. So at the instant TERM lands the subject is provably mid-request, every time: - drain armed -> TERM is blocked, the blocking read is NOT interrupted, GO arrives, DONE is written. The client gets a complete response AFTER TERM. - neg-control -> TERM is delivered to a process blocked in read, default action TERMINATE, so the subject dies BEFORE GO is ever written and the client gets nothing. The ordering (TERM strictly before GO) is what removes the race; a sleep would have re-introduced it and would have been a magic number besides. TEST THE STATE, NOT THE MESSAGE. The neg-control's tooth asserts the subject died BY SIGNAL 15 -- read out of the wait status, not out of any text -- because "the client got nothing" has several possible causes and only one of them is the one this rung is about. IT ALSO VERIFIES THE SYSCALL NUMBER EMPIRICALLY. A subject that survives TERM can only have blocked it, so T04 is a live check that raw x86-64 14 (rt_sigprocmask) really passes through x86ctx_rv64_to_x86_64_syscall unchanged. Reasoning about that table is not the same as running it. SAFETY: loopback only; every port is FOUND by a bind that would have failed had it been occupied, because a probe port you did not verify free is not a control, it is a second instance. The listening socket is created by the PARENT and inherited across fork, so a child is never racing to bind and the client can connect the instant the subject exists. No serving daemon is touched. expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).