nx_ts_handoff_gate.nx

nx_ts_handoff_gate.nx -- TS1: KEEP THE SOCKET, REPLACE THE PROCESS. /compare/trafficsafety rung TS1, accept rule taken VERBATIM from trafficsafety.plan and not re-invented here: "a swap under a synthetic request stream drops ZERO connections, measured by a client that counts refusals and resets, not by the daemon's own log. The neg-control is mandatory -- the same harness against the CURRENT ordinary-listener path must show a non-zero drop, or the test proves nothing." THE MEASUREMENT IS DROPPED CONNECTIONS, NOT BINDERS. nx_hotlisten_gate proves two processes can co-bind a port, which is the NECESSARY condition and never the sufficient one -- LWN documents SO_REUSEPORT as itself dropping connections during the three-way handshake when the listening set changes. So nothing here counts binders. A client process drives real TCP connections, and every connect that is refused and every exchange that does not complete is counted as a DROP. THE DECISIVE TOOTH IS THE ARRIVAL DURING THE GAP. Both arms run the same script: generation one serves a stream, generation one EXITS AND IS REAPED so that zero servers exist, a client connects at that exact instant, and only then is generation two started. With an owner outside the service holding the listener the arrival completes its handshake into the kernel's accept queue and is served microseconds later; with the current bind-per-process path there is nothing bound and the arrival is refused. That difference is deterministic, which is why it can be a gate. SCOPE DECLARED UP FRONT RATHER THAN IMPLIED. This proves the STRUCTURAL property -- an arrival during the swap is not refused. It is NOT a failure-RATE measurement: HAProxy's published figure for the un-fixed race is 155 failures per million connections, and no run of this size could see a rate like that. Measuring that would need a load generator and is a different instrument; the ceiling is stated here rather than left for a reader to assume it was covered. SAFETY: loopback only, and every port is FOUND by a bind that would have failed if the port were occupied -- a probe port you did not verify free is not a control, it is a second instance. No serving daemon is touched. expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).