nx_clock_driver_gate_ar.nx source
↩ module page · 372 lines · 22000 B
1// Local-only V2 real-process scheduler harness. Positive closure uses production seams;
2// ownership selectors require the explicitly instrumented test-only scheduler closure.
3import "nx_syscalls.nx"
4import "nx_gate_verdict.nx"
5import "nx_clock_driver_toolrun_ar.nx"
6import "nx_build_canon_input_lib.nx"
7import "nx_rank_refresh_lib.nx"
8const MODE_0755: i64 = 493
9const RIG_PATH: i64 = 4096
10const RIG_PTR: i64 = 8
11const RIG_FILE_MODE: i64 = 384
12const RIG_DIR_MODE: i64 = 448
13const RIG_EINVAL: i64 = 0 - 22
14const RIG_SETUP: i64 = 90
15const RIG_GUARD: *u8 = "NISHI-CLOCK-RESERVE-FIXTURE\n"
16const CRG_EXCLUSIVE: i64 = 2
17const CRG_UNLOCK: i64 = 8
18const CRG_ROLES: i64 = 4
19const CRG_SLOW: i64 = 0
20const CRG_ESSENTIAL: i64 = 1
21const CRG_ORDINARY: i64 = 2
22const CRG_WINDOW: i64 = 3
23const CRG_START: i64 = 1
24const CRG_END: i64 = 0
25const CRG_MS_PER_SEC: i64 = 1000
26const CRG_MIN_COMPLETIONS: i64 = 2
27const CRG_FAULT_ROLE: i64 = 4
28const CRG_FAULT_POINT: i64 = 2
29const CRG_TEST_ECHILD: i64 = 0 - 10
30func rig_len(p: *u8) -> i64 { var n: i64 = 0; while p[n] != (0 as u8) { n = n + 1 } return n }
31func rig_eq(a: *u8, b: *u8) -> i64 {
32 var i: i64 = 0
33 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
34 if b[i] != (0 as u8) { return 0 }
35 return 1
36}
37func rig_num(p: *u8) -> i64 {
38 let n: i64 = rig_len(p)
39 if n == 0 { return 0 - 1 }
40 var i: i64 = 0; var v: i64 = 0
41 while i < n {
42 let c: i64 = p[i] as i64
43 if c < BCI_ZERO { return 0 - 1 }
44 if c > BCI_NINE { return 0 - 1 }
45 let d: i64 = c - BCI_ZERO
46 if v > (BCI_I64_MAX-d)/BCI_DECIMAL_BASE { return 0 - 1 }
47 v = v*BCI_DECIMAL_BASE+d; i = i + 1
48 }
49 return v
50}
51func rig_join(root: *u8, rel: *u8) -> *u8 {
52 if rig_len(root)+rig_len(rel)+2 > RIG_PATH { return 0 as *u8 }
53 let p: *u8 = sys_mmap(RIG_PATH)
54 var o: i64 = gv_cat(p, 0, root)
55 o = gv_cat(p, o, "/" as *u8); o = gv_cat(p, o, rel); p[o] = 0 as u8
56 return p
57}
58func rig_exists(path: *u8) -> i64 {
59 if (path as i64) == 0 { return 0 }
60 let f: i64 = sys_openat_rd(path)
61 if f < 0 { return 0 }
62 sys_close(f); return 1
63}
64// Reject symlinks in every supplied parent component. No descendant is reused.
65func rig_parent(path: *u8) -> i64 {
66 let n: i64 = rig_len(path)
67 if n <= 1 { return 0 }
68 if n >= RIG_PATH { return 0 }
69 if path[0] != (BCI_SLASH as u8) { return 0 }
70 if bci_relative_path(path, 1, n-1, RIG_PATH-2) != 1 { return 0 }
71 let part: *u8 = sys_mmap(RIG_PATH)
72 let probe: *u8 = sys_mmap(RIG_PATH)
73 var i: i64 = 0
74 while i <= n {
75 var edge: i64 = 0
76 if i == n { edge = 1 } else { if i > 0 { if path[i] == (BCI_SLASH as u8) { edge = 1 } } }
77 if edge == 1 {
78 part[i] = 0 as u8
79 if sys_readlinkat(part, probe, RIG_PATH) != RIG_EINVAL { return 0 }
80 }
81 if i < n { part[i] = path[i] }
82 i = i + 1
83 }
84 return 1
85}
86func rig_write(path: *u8, buf: *u8, n: i64) -> i64 {
87 if (path as i64) == 0 { return 0 }
88 let fd: i64 = sys_openat_wr(path, RIG_FILE_MODE)
89 if fd < 0 { return 0 }
90 var w: i64 = 0
91 while w < n {
92 let got: i64 = sys_write(fd, (buf as i64+w) as *u8, n-w)
93 if got <= 0 { sys_close(fd); return 0 }
94 w = w + got
95 }
96 // Fixture visibility check only; persistence barriers belong to the subject under test.
97 let close: i64 = sys_close(fd)
98 if close != 0 { return 0 }
99 return rrf_file_equal(path, buf, n)
100}
101func rig_file(root: *u8, rel: *u8, val: *u8) -> i64 { return rig_write(rig_join(root,rel),val,rig_len(val)) }
102func rig_dir(root: *u8, rel: *u8) -> i64 {
103 let p: *u8 = rig_join(root, rel)
104 if (p as i64) == 0 { return 0 }
105 if sys_mkdir(p,RIG_DIR_MODE) != 0 { return 0 }
106 return 1
107}
108func rig_link(root: *u8, rel: *u8, target: *u8) -> i64 {
109 let p: *u8 = rig_join(root,rel)
110 if (p as i64) == 0 { return 0 }
111 if sys_symlinkat(target,p) != 0 { return 0 }
112 return 1
113}
114func rig_guard() -> i64 { return rrf_file_equal("fixture-root.guard" as *u8,RIG_GUARD,rig_len(RIG_GUARD)) }
115
116func crg_event(role: i64, phase: i64) -> i64 {
117 let lock: i64 = sys_openat_append("events.lock" as *u8,RIG_FILE_MODE)
118 if lock < 0 { return 0 }
119 if sys_flock(lock,CRG_EXCLUSIVE) != 0 { sys_close(lock); return 0 }
120 let b: *u8 = sys_mmap(RIG_PATH)
121 var o: i64 = gv_catn(b,0,role); o = gv_cat(b,o," " as *u8)
122 o = gv_catn(b,o,phase); o = gv_cat(b,o," " as *u8)
123 o = gv_catn(b,o,sys_now_ms()); o = gv_cat(b,o,"\n" as *u8)
124 let fd: i64 = sys_openat_append("events.tsv" as *u8,RIG_FILE_MODE)
125 var ok: i64 = 0
126 if fd >= 0 { if sys_write(fd,b,o) == o { ok = 1 }; if sys_close(fd) != 0 { ok = 0 } }
127 if sys_flock(lock,CRG_UNLOCK) != 0 { ok = 0 }; if sys_close(lock) != 0 { ok = 0 }
128 return ok
129}
130func crg_child(argc: i64, argv: *i64) -> i64 {
131 if argc != 4 { return RIG_SETUP }
132 if rig_guard() != 1 { return RIG_SETUP }
133 let role: i64 = rig_num(argv[2] as *u8); let duration: i64 = rig_num(argv[3] as *u8)
134 if role < 0 { return RIG_SETUP }; if role >= CRG_WINDOW { return RIG_SETUP }; if duration <= 0 { return RIG_SETUP }
135 if crg_event(role,CRG_START) != 1 { return RIG_SETUP }
136 let start: i64 = sys_now_ms()
137 var remaining: i64 = duration
138 while remaining > 0 { sys_sleep_ms(remaining); remaining = duration-(sys_now_ms()-start) }
139 if crg_event(role,CRG_END) != 1 { return RIG_SETUP }
140 return 0
141}
142func crg_command(dst: *u8, role: i64, duration: *u8) -> i64 {
143 var o: i64 = gv_cat(dst,0,"./child.elf child " as *u8)
144 o = gv_catn(dst,o,role); o = gv_cat(dst,o," " as *u8); o = gv_cat(dst,o,duration)
145 return o
146}
147func crg_setup(root: *u8, self: *u8) -> i64 {
148 if sys_mkdir(root,RIG_DIR_MODE) != 0 { return 0 }
149 if rig_dir(root,"knowledge" as *u8) != 1 { return 0 }
150 if rig_dir(root,"knowledge/status" as *u8) != 1 { return 0 }
151 if rig_dir(root,"sites" as *u8) != 1 { return 0 }
152 if rig_dir(root,"sites/nishifamily" as *u8) != 1 { return 0 }
153 if rig_dir(root,"logs" as *u8) != 1 { return 0 }
154 if rig_file(root,"fixture-root.guard" as *u8,RIG_GUARD) != 1 { return 0 }
155 if rig_file(root,"knowledge/status/actlog.jrnl" as *u8,"" as *u8) != 1 { return 0 }
156 if rig_file(root,"knowledge/status/clock_heavy.conf" as *u8,"" as *u8) != 1 { return 0 }
157 if rig_file(root,"events.lock" as *u8,"" as *u8) != 1 { return 0 }
158 if rig_file(root,"events.tsv" as *u8,"" as *u8) != 1 { return 0 }
159 let len: *i64 = sys_mmap(8) as *i64
160 let executable: *u8 = sys_read_file(self,len)
161 if (executable as i64) == 0 { return 0 }; if len[0] <= 0 { return 0 }
162 // A copy is required: scheduler chmod must never follow a symlink to the supplied binary.
163 let path: *u8 = rig_join(root,"child.elf" as *u8)
164 if rig_write(path,executable,len[0]) != 1 { return 0 }
165 if sys_fchmodat(path,MODE_0755) != 0 { return 0 }
166 return 1
167}
168func dfg_analyze(root: *u8, fatal: i64, ctr: *i64) -> i64 {
169 let size: *i64 = sys_mmap(8) as *i64; let buf: *u8 = sys_read_file(rig_join(root,"events.tsv" as *u8),size)
170 gv_check("negative event journal readable" as *u8,((buf as i64) != 0) as i64,ctr)
171 if (buf as i64) == 0 { return 0 }
172 let active: *i64 = sys_mmap(CRG_ROLES*8) as *i64
173 let ends: *i64 = sys_mmap(CRG_ROLES*8) as *i64
174 let val: *i64 = sys_mmap(3*8) as *i64
175 var p: i64 = 0; var valid: i64 = 1; var total: i64 = 0; var maximum: i64 = 0
176 var fault: i64 = 0; var after: i64 = 0; var duplicate: i64 = 0; var busy: i64 = 0; var previous: i64 = 0
177 while p < size[0] {
178 var f: i64 = 0
179 while f < 3 {
180 var v: i64 = 0; var digits: i64 = 0
181 while p < size[0] {
182 let c: i64 = buf[p] as i64
183 if c < BCI_ZERO { break }; if c > BCI_NINE { break }
184 if v > (BCI_I64_MAX-(c-BCI_ZERO))/BCI_DECIMAL_BASE { valid = 0; break }
185 v = v*BCI_DECIMAL_BASE+c-BCI_ZERO; p = p+1; digits = digits+1
186 }
187 val[f] = v
188 if digits == 0 { valid = 0 }
189 var separator: i64 = 32; if f == 2 { separator = 10 }
190 if p >= size[0] { valid = 0 } else { if buf[p] != (separator as u8) { valid = 0 } }
191 if valid == 0 { break }; p = p+1; f = f+1
192 }
193 if valid == 0 { break }
194 let role: i64 = val[0]; let phase: i64 = val[1]; let time: i64 = val[2]
195 if time < previous { valid = 0; break }; previous = time
196 if role == CRG_FAULT_ROLE {
197 if phase != CRG_FAULT_POINT { valid = 0; break }
198 fault = fault+1
199 } else {
200 if role >= CRG_ROLES { valid = 0; break }; if phase > 1 { valid = 0; break }
201 if role == CRG_WINDOW { if total != 0 { busy = busy+1 } }
202 if phase == CRG_START {
203 if active[role] != 0 { duplicate = duplicate+1 }; active[role] = active[role]+1
204 if role != CRG_WINDOW {
205 if fault > 0 { after = after+1 }
206 total = total+1; if total > maximum { maximum = total }
207 }
208 } else {
209 if active[role] <= 0 { valid = 0; break }; active[role] = active[role]-1; ends[role] = ends[role]+1
210 if role != CRG_WINDOW { total = total-1 }
211 }
212 }
213 }
214 gv_check("negative journal complete and monotonic" as *u8,(valid == 1) as i64,ctr)
215 gv_check("no start after ownership loss marker" as *u8,(after == 0) as i64,ctr)
216 gv_check("no duplicate role" as *u8,(duplicate == 0) as i64,ctr)
217 gv_check("observed at most two children" as *u8,(maximum <= 2) as i64,ctr)
218 gv_check("all fixture children ended" as *u8,(total == 0) as i64,ctr)
219 gv_check("window drained witnessed children" as *u8,(busy == 0) as i64,ctr)
220 gv_check("ordinary child matches actual driver progression" as *u8,(ends[CRG_ORDINARY] == 1-fatal) as i64,ctr)
221 gv_check("real foreground completed" as *u8,(ends[CRG_SLOW] == 1) as i64,ctr)
222 gv_check("fault marker count matches selector" as *u8,(fault==fatal) as i64,ctr)
223 if fatal==1 { gv_check("reserved child completed before park" as *u8,(ends[CRG_ESSENTIAL]>0) as i64,ctr) }
224 return valid
225}
226
227func dfg_size(p: *u8) -> i64 {
228 let n: *i64=sys_mmap(8) as *i64; let b: *u8=sys_read_file(p,n)
229 if (b as i64)==0 { return 0-1 }; return n[0]
230}
231func dfg_epoch(p: *u8,minimum: i64,maximum: i64) -> i64 {
232 let n: *i64=sys_mmap(8) as *i64; let b: *u8=sys_read_file(p,n)
233 if (b as i64)==0 { return 0 }; if n[0]<=0 { return 0 }
234 // Signed decimal representation has at most 19 digits; fixture tick writer emits no newline.
235 if n[0]>19 { return 0 }
236 var i: i64=0; var value: i64=0
237 while i<n[0] {
238 let c: i64=b[i] as i64
239 if c<BCI_ZERO { return 0 }; if c>BCI_NINE { return 0 }
240 let digit: i64=c-BCI_ZERO
241 if value>(BCI_I64_MAX-digit)/BCI_DECIMAL_BASE { return 0 }
242 value=value*BCI_DECIMAL_BASE+digit; i=i+1
243 }
244 if value<=0 { return 0 }; if value<minimum { return 0 }; if value>maximum { return 0 }
245 return 1
246}
247func dfg_contains(p: *u8,needle: *u8) -> i64 {
248 let n: *i64=sys_mmap(8) as *i64; let b: *u8=sys_read_file(p,n)
249 if (b as i64)==0 { return 0 }
250 let m: i64=rig_len(needle); var i: i64=0
251 while i+m<=n[0] { var j: i64=0; while j<m { if b[i+j]!=needle[j] { break }; j=j+1 }; if j==m { return 1 }; i=i+1 }
252 return 0
253}
254func dfg_row(buf: *u8,o: i64,name: *u8,period: i64,due: i64,role: i64,duration: *u8) -> i64 {
255 var k: i64=gv_cat(buf,o,name); k=gv_cat(buf,k,"\t" as *u8)
256 k=gv_catn(buf,k,period); k=gv_cat(buf,k,"\t" as *u8)
257 k=gv_catn(buf,k,due); k=gv_cat(buf,k,"\t./child.elf child " as *u8)
258 k=gv_catn(buf,k,role); k=gv_cat(buf,k," " as *u8); k=gv_cat(buf,k,duration)
259 k=gv_cat(buf,k,"\n" as *u8); buf[k]=0 as u8; return k
260}
261func main(argc: i64,argv: *i64) -> i64 {
262 if argc>1 { if rig_eq(argv[1] as *u8,"child" as *u8)==1 { return crg_child(argc,argv) } }
263 if argc!=12 { gv_puts("usage: SELF DRIVER PARENT positive|fatal-foreground|fatal-essential SLOW_MS ESSENTIAL_MS PERIOD_SEC OBSERVATION_MS CAPTURE_BYTES HANDSHAKE_MS HANDSHAKE_POLL_MS\n" as *u8); return RIG_SETUP }
264 let self: *u8=argv[1] as *u8; let driver: *u8=argv[2] as *u8; let parent: *u8=argv[3] as *u8; let mode: *u8=argv[4] as *u8
265 if rig_parent(self)!=1 { return RIG_SETUP }; if rig_parent(driver)!=1 { return RIG_SETUP }; if rig_parent(parent)!=1 { return RIG_SETUP }
266 var fatal: i64=1
267 let denied: i64=rig_eq(mode,"watchdog-refused" as *u8)
268 if denied==1 { fatal=0 } else { if rig_eq(mode,"positive" as *u8)==1 { fatal=0 } else {
269 if rig_eq(mode,"fatal-foreground" as *u8)!=1 { if rig_eq(mode,"fatal-essential" as *u8)!=1 { return RIG_SETUP } }
270 } }
271 let slow: i64=rig_num(argv[5] as *u8); let essential: i64=rig_num(argv[6] as *u8); let period: i64=rig_num(argv[7] as *u8)
272 let observation: i64=rig_num(argv[8] as *u8); let cap: i64=rig_num(argv[9] as *u8)
273 if slow<=0 { return RIG_SETUP }; if essential<=0 { return RIG_SETUP }; if period<=0 { return RIG_SETUP }
274 if period>BCI_I64_MAX/CRG_MS_PER_SEC { return RIG_SETUP }
275 if slow<=period*CRG_MS_PER_SEC { return RIG_SETUP }
276 if slow>BCI_I64_MAX-essential { return RIG_SETUP }
277 if slow+essential>BCI_I64_MAX-CRG_MIN_COMPLETIONS*CRG_MS_PER_SEC { return RIG_SETUP }
278 // Caller must leave room after children finish for at least two real parked sleeps.
279 if observation<=slow+essential+CRG_MIN_COMPLETIONS*CRG_MS_PER_SEC { return RIG_SETUP }
280 if cap<=RIG_PATH { return RIG_SETUP }
281 let handshake: i64=rig_num(argv[10] as *u8); let poll: i64=rig_num(argv[11] as *u8)
282 if handshake<=0 { return RIG_SETUP }; if handshake>=observation { return RIG_SETUP }
283 if poll<=0 { return RIG_SETUP }; if poll>handshake { return RIG_SETUP }
284 let leaf: *u8=sys_mmap(RIG_PATH); var k: i64=gv_cat(leaf,0,"clock-driver-" as *u8)
285 k=gv_catn(leaf,k,sys_now_ms()); leaf[k]=0 as u8
286 let root: *u8=rig_join(parent,leaf)
287 if crg_setup(root,self)!=1 { return RIG_SETUP }
288 if rig_dir(root,"knowledge/store" as *u8)!=1 { return RIG_SETUP }
289 let lp: *i64=sys_mmap(8) as *i64; let binary: *u8=sys_read_file(driver,lp)
290 if (binary as i64)==0 { return RIG_SETUP }; if lp[0]<=0 { return RIG_SETUP }
291 let subject: *u8=rig_join(root,"driver.elf" as *u8)
292 if rig_write(subject,binary,lp[0])!=1 { return RIG_SETUP }
293 if sys_fchmodat(subject,MODE_0755)!=0 { return RIG_SETUP }
294 if rig_file(root,"fixture.desired.tsv" as *u8,"" as *u8)!=1 { return RIG_SETUP }
295 if rig_file(root,"clock_jobs.tsv" as *u8,"" as *u8)!=1 { return RIG_SETUP }
296 if rig_file(root,"driver.windows" as *u8,"2" as *u8)!=1 { return RIG_SETUP }
297 if rig_file(root,"driver.handshake-ms" as *u8,argv[10] as *u8)!=1 { return RIG_SETUP }
298 if rig_file(root,"driver.handshake-poll-ms" as *u8,argv[11] as *u8)!=1 { return RIG_SETUP }
299 if denied==1 { if rig_file(root,"fixture.watchdog-denied" as *u8,"x" as *u8)!=1 { return RIG_SETUP } }
300 if rig_file(root,"clock_tick.txt" as *u8,"UNTOUCHED\n" as *u8)!=1 { return RIG_SETUP }
301 if rig_file(root,"sites/nishifamily/clock_dispatch.txt" as *u8,"UNTOUCHED\n" as *u8)!=1 { return RIG_SETUP }
302 if rig_file(root,"knowledge/status/clock_maxdispatch.conf" as *u8,"1\n" as *u8)!=1 { return RIG_SETUP }
303 let conf: *u8=sys_mmap(RIG_PATH); var co: i64=gv_cat(conf,0,"essential\t./child.elf child 1 " as *u8)
304 co=gv_cat(conf,co,argv[6] as *u8); co=gv_cat(conf,co,"\n" as *u8); conf[co]=0 as u8
305 if rig_file(root,"knowledge/status/clock_reserved.conf" as *u8,conf)!=1 { return RIG_SETUP }
306 if fatal==1 { var fault: *u8="F" as *u8; if rig_eq(mode,"fatal-essential" as *u8)==1 { fault="E" as *u8 }; if rig_file(root,"fault.mode" as *u8,fault)!=1 { return RIG_SETUP } }
307 let rows: *u8=sys_mmap(RIG_PATH)
308 let now: i64=sys_now_realtime_sec()
309 // Ordinary stays due across the first real persisted window; no test reset between windows.
310 let interval: i64=observation/CRG_MS_PER_SEC+period
311 var o: i64=dfg_row(rows,0,"slow" as *u8,interval,now-1,CRG_SLOW,argv[5] as *u8)
312 o=dfg_row(rows,o,"essential" as *u8,period,now+period,CRG_ESSENTIAL,argv[6] as *u8)
313 o=dfg_row(rows,o,"ordinary" as *u8,interval,now-1,CRG_ORDINARY,argv[6] as *u8)
314 if rig_file(root,"fixture.schedule.tsv" as *u8,rows)!=1 { return RIG_SETUP }
315 if sys_chdir(root)!=0 { return RIG_SETUP }
316 gv_puts("fixture_root=" as *u8); gv_puts(root); gv_puts("\n" as *u8)
317 let ctr: *i64=gv_ctr()
318 gv_check("tick reader rejects missing file" as *u8,(dfg_epoch("tick.missing" as *u8,1,BCI_I64_MAX)==0) as i64,ctr)
319 if rig_file(root,"tick.empty" as *u8,"" as *u8)!=1 { return RIG_SETUP }
320 if rig_file(root,"tick.malformed" as *u8,"123bad" as *u8)!=1 { return RIG_SETUP }
321 gv_check("tick reader rejects empty file" as *u8,(dfg_epoch("tick.empty" as *u8,1,BCI_I64_MAX)==0) as i64,ctr)
322 gv_check("tick reader rejects malformed file" as *u8,(dfg_epoch("tick.malformed" as *u8,1,BCI_I64_MAX)==0) as i64,ctr)
323 let av: *i64=sys_mmap(5*RIG_PTR) as *i64
324 av[0]=subject as i64; av[1]="clock_jobs.tsv" as i64; av[2]="clock_tick.txt" as i64; av[3]="isolated-driver" as i64; av[4]=0
325 let output: *u8=sys_mmap(cap); let olen: *i64=sys_mmap(8) as *i64
326 let start: i64=sys_now_ms()
327 let rc: i64=tr_run_capture_cwd(subject,av,output,cap,olen,observation,root)
328 gv_puts("driver_rc=" as *u8); gv_num(rc); gv_puts(" elapsed_ms=" as *u8); gv_num(sys_now_ms()-start); gv_puts("\n" as *u8)
329 gv_check("capture complete" as *u8,(olen[0]<cap-1) as i64,ctr)
330 gv_check("actual driver output retained" as *u8,rig_write("driver.out" as *u8,output,olen[0]),ctr)
331 if denied==1 {
332 gv_check("driver preflight refuses missing watchdog" as *u8,(rc==DFI_REFUSED) as i64,ctr)
333 gv_check("watchdog refusal fixture executed" as *u8,(dfg_size("witness.watchdog-refused" as *u8)==1) as i64,ctr)
334 gv_check("no false watchdog readiness" as *u8,(rig_exists("witness.watchdog-ready" as *u8)==0) as i64,ctr)
335 gv_check("preflight timeout diagnostic" as *u8,dfg_contains("driver.out" as *u8,"no confirmed watchdog; scheduler never entered" as *u8),ctr)
336 gv_check("no scheduler state load" as *u8,(rig_exists("witness.schedule-load" as *u8)==0) as i64,ctr)
337 gv_check("no desired registry load" as *u8,(rig_exists("witness.desired-load" as *u8)==0) as i64,ctr)
338 gv_check("no fixture child dispatched" as *u8,(dfg_size("events.tsv" as *u8)==0) as i64,ctr)
339 gv_check("no state save" as *u8,(rig_exists("witness.schedule-seed" as *u8)==0) as i64,ctr)
340 gv_check("tick unchanged" as *u8,rrf_file_equal("clock_tick.txt" as *u8,"UNTOUCHED\n" as *u8,10),ctr)
341 gv_check("success report unchanged" as *u8,rrf_file_equal("sites/nishifamily/clock_dispatch.txt" as *u8,"UNTOUCHED\n" as *u8,10),ctr)
342 return gv_verdict("CLOCK-DRIVER-WATCHDOG-REFUSAL",ctr,"controlled fork-return injection; no scheduler entry" as *u8)
343 }
344 gv_check("watchdog fork confirmed before scheduler start" as *u8,(dfg_size("witness.watchdog-ready" as *u8)==1) as i64,ctr)
345 gv_check("no watchdog fork refusal" as *u8,(rig_exists("witness.watchdog-refused" as *u8)==0) as i64,ctr)
346 dfg_analyze(root,fatal,ctr)
347 if fatal==0 {
348 gv_check("positive driver exits at actual life boundary" as *u8,(rc==0) as i64,ctr)
349 gv_check("both actual windows load schedule including save merge" as *u8,(dfg_size("witness.schedule-load" as *u8)==4) as i64,ctr)
350 gv_check("both actual windows load desired registry" as *u8,(dfg_size("witness.desired-load" as *u8)==2) as i64,ctr)
351 gv_check("both actual windows call plane save" as *u8,(dfg_size("witness.schedule-seed" as *u8)==2) as i64,ctr)
352 gv_check("both fixture save writes complete" as *u8,(dfg_size("witness.schedule-committed" as *u8)==2) as i64,ctr)
353 gv_check("actual tick persistence is a complete epoch within this run" as *u8,dfg_epoch("clock_tick.txt" as *u8,now,sys_now_realtime_sec()),ctr)
354 gv_check("actual success report exercised" as *u8,dfg_contains("sites/nishifamily/clock_dispatch.txt" as *u8,"window-end" as *u8),ctr)
355 gv_check("actual life recycle branch exercised" as *u8,dfg_contains("sites/nishifamily/clock_heartbeat.txt" as *u8,"life-recycle" as *u8),ctr)
356 gv_check("no fatal park diagnostic" as *u8,(dfg_contains("driver.out" as *u8,"FATAL ownership uncertain" as *u8)==0) as i64,ctr)
357 } else {
358 gv_check("watchdog ended deliberately parked driver" as *u8,(rc==(0-5)) as i64,ctr)
359 gv_check("actual fatal diagnostic" as *u8,dfg_contains("driver.out" as *u8,"FATAL ownership uncertain job=" as *u8),ctr)
360 gv_check("explicit reconciliation required" as *u8,dfg_contains("driver.out" as *u8,"reconciliation required" as *u8),ctr)
361 gv_check("actual fatal heartbeat" as *u8,dfg_contains("sites/nishifamily/clock_heartbeat.txt" as *u8,"fatal-ownership-uncertain" as *u8),ctr)
362 gv_check("actual park loop returned from nanosleep repeatedly" as *u8,(dfg_size("witness.driver-sleep-exit" as *u8)>=CRG_MIN_COMPLETIONS) as i64,ctr)
363 gv_check("no next window schedule reload" as *u8,(dfg_size("witness.schedule-load" as *u8)==1) as i64,ctr)
364 gv_check("no next window desired reload" as *u8,(dfg_size("witness.desired-load" as *u8)==1) as i64,ctr)
365 gv_check("no plane save attempted" as *u8,(rig_exists("witness.schedule-seed" as *u8)==0) as i64,ctr)
366 gv_check("no tick save attempted" as *u8,rrf_file_equal("clock_tick.txt" as *u8,"UNTOUCHED\n" as *u8,10),ctr)
367 gv_check("no successful window report" as *u8,rrf_file_equal("sites/nishifamily/clock_dispatch.txt" as *u8,"UNTOUCHED\n" as *u8,10),ctr)
368 gv_check("no forbidden wait" as *u8,(rig_exists("fault.forbidden-wait" as *u8)==0) as i64,ctr)
369 gv_check("no forbidden signal" as *u8,(rig_exists("fault.forbidden-signal" as *u8)==0) as i64,ctr)
370 }
371 return gv_verdict("CLOCK-DRIVER-ACCEPTANCE",ctr,"actual driver control flow; fixture store boundary; not plane durability" as *u8)
372}