code wiki / _hdl_build / nx_tool_run_timeout_gate.nx
`nx_tool_run_timeout_gate.nx` source

↩ module page · 723 lines · 32486 B
1// nx_tool_run_timeout_gate.nx -- proves tr_run_capture_to actually BOUNDS a hanging child (seq1412).
2//
3// The claim under test is not "the function returns a timeout constant" -- that is trivial to fake. It is
4// "a child that would run for 10 seconds is KILLED at the deadline, its output is still captured, it is
5// REAPED rather than orphaned, and a fast child is NOT falsely timed out". So every tooth measures
6// something an empty implementation would fail:
7//
8//   T1 the deadline FIRES        -- 10s sleeper, 500ms budget -> TR_ERR_TIMEOUT
9//   T2 the deadline is REAL TIME -- that call returns in well under the sleeper's 10s (the load-bearing
10//                                  tooth: returning -5 after waiting the full 10s would be a lie)
11//   T3 NEG-CONTROL fast child    -- a 50ms sleeper with a 5s budget exits 0, NOT timed out
12//   T4 output survives           -- the fast child's stdout is captured intact
13//   T5 REPEATABLE                -- a second timeout run behaves identically; resource-leak
14//                                  accounting requires separate lifecycle evidence
15//   T6 opt-out is explicit       -- timeout_ms<=0 delegates to the unbounded path and still succeeds
16//
17// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
18import "nx_syscalls.nx"
19import "nx_tool_run.nx"
20import "nx_os_proc.nx"
21import "nx_gate_verdict.nx"
22static TG_COUNTER: *i64
23// Linux resource ABI, not a workload policy.
24const TG_RLIMIT_NOFILE: i64 = 7
25// Regression witness beyond the former descriptor cleanup boundary of 1024.
26const TG_HIGH_FD_WITNESS: i64 = 2048
27const TG_CHILDREN_READ_WINDOW: i64 = 4096
28
29const TG_STDOUT: i64 = 1
30const TG_SLEEPER: *u8 = "_build/nx_tr_sleeper.sov.elf"
31const TG_OUTCAP: i64 = 65536
32
33// A 10s sleeper against a 500ms budget. If the kill did not happen the call cannot return before 10s.
34const TG_HANG_MS: i64 = 10000
35const TG_BUDGET_MS: i64 = 500
36// Generous ceiling: anything under this proves we did not sit out the full sleep. Deliberately far from
37// both 0.5s and 10s so neither scheduler jitter nor a slow NAS can flip the verdict either way.
38const TG_MAX_ELAPSED_S: i64 = 5
39const TG_FAST_MS: i64 = 50
40const TG_FAST_BUDGET_MS: i64 = 5000
41
42func tg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(TG_STDOUT, s, n); return 0 }
43func tg_num(v: i64) -> i64 {
  var m: i64 = v
  if m < 0 { m = 0 - m; sys_write(TG_STDOUT, "-" as *u8, 1) }
  let t: *u8 = sys_mmap(28)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(28)
  var i: i64 = 0
  while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(TG_STDOUT, o, k)
  return 0
55}
56func tg_check(ok: i64, label: *u8, got: i64, want: i64) -> i64 {
  gv_check(label,ok,TG_COUNTER)
  if ok == 1 { tg_puts("  PASS " as *u8) } else { tg_puts("  FAIL " as *u8) }
  tg_puts(label)
  tg_puts("  got=" as *u8); tg_num(got)
  tg_puts(" want=" as *u8); tg_num(want)
  tg_puts("\n" as *u8)
  if ok == 1 { return 0 }
  return 1
65}
66
67// run the sleeper for ms with a budget; returns tr_run_capture_to's result
68func tg_run(ms: *u8, budget: i64, out: *u8, ol: *i64) -> i64 {
  let av: *i64 = sys_mmap(32) as *i64
  av[0] = TG_SLEEPER as i64
  av[1] = ms as *u8 as i64
  av[2] = 0
  return tr_run_capture_to(TG_SLEEPER, av, out, TG_OUTCAP, ol, budget)
74}
75
76
77const TG_STREAM_CAP: i64 = 16384
78const TG_STREAM_BLOCKS: i64 = 16
79const TG_STREAM_EXIT: i64 = 23
80const TG_SYS_GETPID: i64 = 172 // portable syscall ABI used by nx_getpid_const_probe
81func tg_stream_child(mode: i64) -> i64 {
  if mode == 102 { let probe: *u8=sys_mmap(16); if sys_read(2048,probe,1) == (0-9) { return 0 }; return 31 }
  if mode == 114 { return 126 }
  if mode == 107 {
      let self: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
      if self <= 1 { return 27 }
      nx_kill(self,TR_SIGKILL); return 28
  }
  if mode == 120 { sys_close(1); sys_close(2); sys_sleep_ms(TG_HANG_MS); return 29 }
  if mode == 103 {
      let helper: i64=sys_fork()
      if helper < 0 { return 26 }
      if helper == 0 { sys_sleep_ms(TG_HANG_MS); sys_exit(0); return 0 }
  }
  let block: *u8 = sys_mmap(TG_STREAM_CAP)
  var i: i64 = 0
  while i < TG_STREAM_CAP { block[i] = 65 as u8; i=i+1 }
  var remaining: i64 = TG_STREAM_CAP
  if mode == 98 || mode == 104 || mode == 103 { remaining = TG_STREAM_CAP*TG_STREAM_BLOCKS }
  if mode == 115 { remaining = TG_STREAM_CAP-1 }
  while remaining > 0 {
      var n: i64 = remaining
      if n > TG_STREAM_CAP { n = TG_STREAM_CAP }
      let wrote: i64 = sys_write(1,block,n)
      if wrote <= 0 { return 24 }
      remaining = remaining-wrote
  }
  if mode == 104 { sys_sleep_ms(TG_HANG_MS) }
  return TG_STREAM_EXIT
110}
111func tg_stream_check(self: *u8, mode: *u8, traced: i64, wantcut: i64, wantlen: i64) -> i64 {
  let av: *i64 = sys_mmap(32) as *i64
  av[0]=self as i64; av[1]=mode as i64; av[2]=0
  let buf: *u8 = sys_mmap(TG_STREAM_CAP+1)
  buf[TG_STREAM_CAP]=90 as u8
  let len: *i64 = sys_mmap(16) as *i64
  let cut: *i64 = sys_mmap(16) as *i64
  var rc: i64 = 0
  if traced == 1 {
      rc=tr_run_capture_tr(self,av,buf,TG_STREAM_CAP,len,TG_FAST_BUDGET_MS,cut)
  } else {
      rc=tr_run_capture_to(self,av,buf,TG_STREAM_CAP,len,TG_FAST_BUDGET_MS)
  }
  var fail: i64 = 0
  var ok: i64 = 0; if rc == TG_STREAM_EXIT { ok=1 }
  fail=fail+tg_check(ok,"stream child reaches post-output exit" as *u8,rc,TG_STREAM_EXIT)
  ok=0; if len[0] == wantlen { ok=1 }
  fail=fail+tg_check(ok,"captured prefix length" as *u8,len[0],wantlen)
  ok=1
  var i: i64=0
  while i < len[0] { if buf[i] != 65 as u8 { ok=0 }; i=i+1 }
  if buf[TG_STREAM_CAP] != 90 as u8 { ok=0 }
  fail=fail+tg_check(ok,"prefix bytes and boundary canary" as *u8,ok,1)
  if traced == 1 {
      ok=0; if cut[0] == wantcut { ok=1 }
      fail=fail+tg_check(ok,"observed truncation" as *u8,cut[0],wantcut)
  }
  return fail
139}
140
141
142func tg_stream_timeout(self: *u8) -> i64 {
  let av: *i64 = sys_mmap(32) as *i64
  av[0]=self as i64; av[1]="h" as *u8 as i64; av[2]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  let len: *i64=sys_mmap(16) as *i64
  let start: i64=sys_now_realtime_sec()
  let rc: i64=tr_run_capture_to(self,av,buf,TG_STREAM_CAP,len,TG_BUDGET_MS)
  let elapsed: i64=sys_now_realtime_sec()-start
  var ok: i64=0; if rc == TR_ERR_TIMEOUT { ok=1 }
  var fails: i64=tg_check(ok,"deadline after overflow" as *u8,rc,TR_ERR_TIMEOUT)
  ok=0; if elapsed < TG_MAX_ELAPSED_S { ok=1 }
  fails=fails+tg_check(ok,"overflow timeout elapsed" as *u8,elapsed,TG_MAX_ELAPSED_S)
  ok=0; if len[0] == TG_STREAM_CAP { ok=1 }
  fails=fails+tg_check(ok,"overflow timeout prefix retained" as *u8,len[0],TG_STREAM_CAP)
  return fails
157}
158
159func tg_invalid_capacity() -> i64 {
  let av: *i64 = sys_mmap(32) as *i64
  av[0]=TG_SLEEPER as i64; av[1]="50" as *u8 as i64; av[2]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  let len: *i64=sys_mmap(16) as *i64
  let cut: *i64=sys_mmap(16) as *i64
  let rc: i64=tr_run_capture_tr(TG_SLEEPER,av,buf,0-1,len,TG_FAST_BUDGET_MS,cut)
  var ok: i64=0; if rc == TR_ERR_DRAIN { ok=1 }
  var fails: i64=tg_check(ok,"invalid capacity returns drain error" as *u8,rc,TR_ERR_DRAIN)
  ok=0; if len[0] == 0 { ok=1 }
  fails=fails+tg_check(ok,"error does not become negative byte count" as *u8,len[0],0)
  return fails
171}
172
173func tg_descendant_deadline(self: *u8) -> i64 {
  let av: *i64=sys_mmap(32) as *i64
  av[0]=self as i64; av[1]="g" as *u8 as i64; av[2]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  let len: *i64=sys_mmap(16) as *i64
  let cut: *i64=sys_mmap(16) as *i64
  let start: i64=sys_now_realtime_sec()
  let rc: i64=tr_run_capture_tr(self,av,buf,TG_STREAM_CAP,len,TG_BUDGET_MS,cut)
  let elapsed: i64=sys_now_realtime_sec()-start
  var ok: i64=0; if elapsed < TG_MAX_ELAPSED_S { ok=1 }
  var fails: i64=tg_check(ok,"inherited writer cannot extend deadline" as *u8,elapsed,TG_MAX_ELAPSED_S)
  ok=0; if rc == TR_ERR_TIMEOUT { ok=1 }
  fails=fails+tg_check(ok,"inherited writer reports deadline" as *u8,rc,TR_ERR_TIMEOUT)
  return fails
187}
188
189func tg_lifecycle_exit(self: *u8, mode: *u8, budget: i64, expected: i64) -> i64 {
  let av: *i64=sys_mmap(32) as *i64
  av[0]=self as i64; av[1]=mode as i64; av[2]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  let len: *i64=sys_mmap(16) as *i64
  let start: i64=sys_now_realtime_sec()
  let rc: i64=tr_run_capture_to(self,av,buf,TG_STREAM_CAP,len,budget)
  let elapsed: i64=sys_now_realtime_sec()-start
  var ok: i64=0; if rc == expected { ok=1 }
  var fails: i64=tg_check(ok,"termination cause retained" as *u8,rc,expected)
  ok=0; if elapsed < TG_MAX_ELAPSED_S { ok=1 }
  fails=fails+tg_check(ok,"closed-output lifecycle is bounded" as *u8,elapsed,TG_MAX_ELAPSED_S)
  return fails
202}
203
204func tg_wait_observe() -> i64 {
  let pid: i64=sys_fork()
  if pid < 0 { return 1 }
  if pid == 0 { sys_exit(TG_STREAM_EXIT); return 0 }
  let info: *u8=sys_mmap(NX_WAIT_SIGINFO_BYTES)
  let status: *i64=sys_mmap(16) as *i64
  let first: i64=sys_waitid(NX_WAIT_P_PID,pid,info,NX_WAIT_EXITED | NX_WAIT_NOWAIT)
  var ok: i64=0; if first == 0 { ok=1 }
  var fails: i64=tg_check(ok,"observe termination without reap",first,0)
  let again: i64=sys_waitid(NX_WAIT_P_PID,pid,info,NX_WAIT_EXITED | NX_WAIT_NOWAIT)
  ok=0; if again == 0 { ok=1 }
  fails=fails+tg_check(ok,"observed child remains waitable",again,0)
  let reaped: i64=tr_reap(pid,status)
  ok=0; if reaped == pid { ok=1 }
  fails=fails+tg_check(ok,"explicit reap retains ownership",reaped,pid)
  let ec: i64=wait_status_rc(status[0])
  ok=0; if ec == TG_STREAM_EXIT { ok=1 }
  fails=fails+tg_check(ok,"observation preserves exit status",ec,TG_STREAM_EXIT)
  return fails
223}
224
225
226func tg_cwd_check(self: *u8, mode: *u8, cwd: *u8, expected: i64) -> i64 {
  let av: *i64=sys_mmap(32) as *i64
  av[0]=self as i64; av[1]=mode as i64; av[2]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  let len: *i64=sys_mmap(16) as *i64
  var budget: i64=TG_FAST_BUDGET_MS
  if mode[0] == 120 as u8 { budget=TG_BUDGET_MS }
  let start: i64=sys_now_realtime_sec()
  let rc: i64=tr_run_capture_cwd(self,av,buf,TG_STREAM_CAP,len,budget,cwd)
  var ok: i64=0; if rc == expected { ok=1 }
  var fails: i64=tg_check(ok,"cwd capture preserves actual cause",rc,expected)
  if mode[0] == 120 as u8 {
      let elapsed: i64=sys_now_realtime_sec()-start
      ok=0; if elapsed < TG_MAX_ELAPSED_S { ok=1 }
      fails=fails+tg_check(ok,"cwd closed-output deadline bounded",elapsed,TG_MAX_ELAPSED_S)
  }
  return fails
243}
244
245
246// Bounded contention fixtures requested by the operator; these are test workloads, not admission limits.
247const TG_PARALLEL_SMALL: i64=8
248const TG_PARALLEL_LARGE: i64=15
249const TG_PARALLEL_ROW: i64=8
250func tg_parallel_producer(identity: i64) -> i64 {
  sys_sleep_ms(TG_FAST_MS)
  let buf: *u8=sys_mmap(TG_STREAM_CAP)
  var i: i64=0
  while i < TG_STREAM_CAP { buf[i]=identity as u8; i=i+1 }
  var blocks: i64=1
  if (identity-65)%2 == 0 { blocks=TG_STREAM_BLOCKS }
  var off: i64=0
  let total: i64=blocks*TG_STREAM_CAP
  while off < total {
      var amount: i64=total-off
      if amount > TG_STREAM_CAP { amount=TG_STREAM_CAP }
      let rc: i64=sys_write(1,buf,amount)
      if rc <= 0 { return 24 }
      off=off+rc
  }
  return identity
267}
268func tg_parallel_worker(self: *u8, index: i64, row: *i64) -> i64 {
  let av: *i64=sys_mmap(32) as *i64
  let arg: *u8=sys_mmap(8)
  arg[0]=(65+index) as u8; arg[1]=0 as u8
  av[0]=self as i64; av[1]="q" as *u8 as i64; av[2]=arg as i64; av[3]=0
  let buf: *u8=sys_mmap(TG_STREAM_CAP+1)
  buf[TG_STREAM_CAP]=90 as u8
  let ts: *i64=sys_mmap(16) as *i64
  let selfpid: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
  let fdBefore: i64=osp_fd_count(selfpid)
  row[0]=tr_clock_ms(ts)
  row[2]=tr_run_capture_tr(self,av,buf,TG_STREAM_CAP,((row as i64)+24) as *i64,TG_FAST_BUDGET_MS,((row as i64)+32) as *i64)
  row[1]=tr_clock_ms(ts)
  let fdAfter: i64=osp_fd_count(selfpid)
  row[6]=0-1
  if fdBefore >= 0 && fdAfter >= 0 { row[6]=fdAfter-fdBefore }
  let childStatus: *i64=sys_mmap(16) as *i64
  row[7]=sys_wait4(0-1,childStatus,WNOHANG)
  row[5]=1
  var i: i64=0
  if row[3] < 0 || row[3] > TG_STREAM_CAP { row[5]=0 } else {
      while i < row[3] { if buf[i] != arg[0] { row[5]=0 }; i=i+1 }
  }
  if buf[TG_STREAM_CAP] != 90 as u8 { row[5]=0 }
  return 0
293}
294func tg_parallel_capture(self: *u8, count: i64) -> i64 {
  let shared: *i64=sys_mmap_shared(TR_CONTROL_BYTES) as *i64
  if (shared as i64) <= 0 { return 1 }
  let fds: *i64=sys_mmap(16) as *i64
  if sys_pipe2(fds,0) != 0 { sys_munmap(shared as *u8,TR_CONTROL_BYTES); return 1 }
  let readfd: i64=fds[0] & 0xFFFFFFFF
  let writefd: i64=(fds[0] >> 32) & 0xFFFFFFFF
  let pids: *i64=sys_mmap(TR_CONTROL_BYTES) as *i64
  var made: i64=0
  while made < count {
      let pid: i64=sys_fork()
      if pid < 0 { break }
      if pid == 0 {
          sys_close(writefd)
          let start: *u8=sys_mmap(8)
          let ready: i64=sys_read(readfd,start,1)
          sys_close(readfd)
          if ready != 1 { sys_exit(30); return 30 }
          tg_parallel_worker(self,made,((shared as i64)+made*TG_PARALLEL_ROW*8) as *i64)
          sys_exit(0); return 0
      }
      pids[made]=pid; made=made+1
  }
  sys_close(readfd)
  let starts: *u8=sys_mmap(TR_CONTROL_BYTES)
  var sent: i64=0
  while sent < made {
      let wrote: i64=sys_write(writefd,starts+sent,made-sent)
      if wrote <= 0 { break }
      sent=sent+wrote
  }
  sys_close(writefd)
  var ok: i64=0; if made == count && sent == made { ok=1 }
  var fails: i64=tg_check(ok,"parallel workers released",made,count)
  var latestStart: i64=0
  var earliestEnd: i64=0
  var i: i64=0
  let status: *i64=sys_mmap(16) as *i64
  while i < made {
      let reaped: i64=tr_reap(pids[i],status)
      ok=0; if reaped == pids[i] && wait_status_rc(status[0]) == 0 { ok=1 }
      fails=fails+tg_check(ok,"parallel caller reaped",reaped,pids[i])
      let row: *i64=((shared as i64)+i*TG_PARALLEL_ROW*8) as *i64
      tg_puts("  WORKER index="); tg_num(i); tg_puts(" start_ms="); tg_num(row[0]); tg_puts(" end_ms="); tg_num(row[1]); tg_puts("\n")
      ok=0; if row[2] == 65+i { ok=1 }
      fails=fails+tg_check(ok,"parallel exit identity",row[2],65+i)
      ok=0; if row[3] == TG_STREAM_CAP { ok=1 }
      fails=fails+tg_check(ok,"parallel capture length",row[3],TG_STREAM_CAP)
      var expectedCut: i64=0; if i%2 == 0 { expectedCut=1 }
      ok=0; if row[4] == expectedCut { ok=1 }
      fails=fails+tg_check(ok,"parallel truncation identity",row[4],expectedCut)
      fails=fails+tg_check(row[5],"parallel byte identity and canary",row[5],1)
      ok=0; if row[6] == 0 { ok=1 }
      fails=fails+tg_check(ok,"parallel caller descriptor delta",row[6],0)
      ok=0; if row[7] == TR_ECHILD { ok=1 }
      fails=fails+tg_check(ok,"parallel caller has no remaining children",row[7],TR_ECHILD)
      if row[0] > latestStart { latestStart=row[0] }
      if i == 0 || row[1] < earliestEnd { earliestEnd=row[1] }
      i=i+1
  }
  ok=0; if latestStart > 0 && earliestEnd > latestStart { ok=1 }
  fails=fails+tg_check(ok,"all capture intervals overlap ms",earliestEnd-latestStart,1)
  sys_munmap(shared as *u8,TR_CONTROL_BYTES)
  return fails
358}
359
360
361func tg_resource_finish(pid: i64, baseline: i64) -> i64 {
  var ok: i64=0; if baseline >= 0 { ok=1 }
  var fails: i64=tg_check(ok,"descriptor baseline available",baseline,baseline)
  let before: i64=osp_fd_count(pid)
  ok=0; if before == baseline { ok=1 }
  fails=fails+tg_check(ok,"capture suite restores descriptor count",before,baseline)
  let fds: *i64=sys_mmap(16) as *i64
  let opened: i64=sys_pipe2(fds,0)
  let during: i64=osp_fd_count(pid)
  ok=0; if opened == 0 && during == before+2 { ok=1 }
  fails=fails+tg_check(ok,"descriptor meter detects real pipe",during,before+2)
  if opened == 0 { sys_close(fds[0] & 0xFFFFFFFF); sys_close((fds[0] >> 32) & 0xFFFFFFFF) }
  let after: i64=osp_fd_count(pid)
  ok=0; if after == before { ok=1 }
  fails=fails+tg_check(ok,"closed pipe releases both descriptors",after,before)
  let nonDirectory: i64=sys_openat_rd("/dev/null")
  let meterCause: *i64=sys_mmap(16) as *i64
  let invalidCount: i64=osp_fd_count_from_fd_result(nonDirectory,meterCause)
  if nonDirectory >= 0 { sys_close(nonDirectory) }
  ok=0; if nonDirectory >= 0 && invalidCount == OSP_SENTINEL { ok=1 }
  fails=fails+tg_check(ok,"directory read error is unavailable",invalidCount,OSP_SENTINEL)
  ok=0; if meterCause[0] == 0-20 { ok=1 }
  fails=fails+tg_check(ok,"meter retains ENOTDIR cause",meterCause[0],0-20)
  let badFdCount: i64=osp_fd_count_from_fd(0-1)
  ok=0; if badFdCount == OSP_SENTINEL { ok=1 }
  fails=fails+tg_check(ok,"invalid descriptor is unavailable",badFdCount,OSP_SENTINEL)
  let status: *i64=sys_mmap(16) as *i64
  let remaining: i64=sys_wait4(0-1,status,WNOHANG)
  ok=0; if remaining == TR_ECHILD { ok=1 }
  fails=fails+tg_check(ok,"no remaining direct children or zombies",remaining,TR_ECHILD)
  return fails
392}
393
394// Descriptor 2048 deliberately lies above both existing cleanup boundaries.
395func tg_high_descriptor_subject(self: *u8) -> i64 {
  let opened: i64=sys_openat_rd("/dev/null")
  if opened < 0 { return tg_check(0,"high descriptor fixture opens source",opened,0) }
  let copied: i64=sys_dup3(opened,2048,0)
  sys_close(opened)
  if copied != 2048 {
      let limits: *i64=sys_mmap(16) as *i64
      let measured: i64=nx_prlimit(0,TG_RLIMIT_NOFILE,0 as *u8,limits as *u8)
      tg_puts("  FD-FIXTURE requested=2048 dup_result=");tg_num(copied)
      tg_puts(" rlimit_result=");tg_num(measured);tg_puts(" soft=");tg_num(limits[0]);tg_puts(" hard=");tg_num(limits[1]);tg_puts("\n")
      sys_munmap(limits as *u8,16)
      return tg_check(0,"high descriptor fixture allocation",copied,TG_HIGH_FD_WITNESS)
  }
  let av: *i64=sys_mmap(32) as *i64
  av[0]=self as i64; av[1]="f" as *u8 as i64; av[2]=0
  let out: *u8=sys_mmap(4096)
  let len: *i64=sys_mmap(16) as *i64
  var fails: i64=0
  var rc: i64=tr_run_capture_to(self,av,out,4096,len,TG_FAST_BUDGET_MS)
  var ok: i64=0; if rc == 0 { ok=1 }
  fails=fails+tg_check(ok,"bounded child cannot inherit descriptor 2048",rc,0)
  rc=tr_run_capture(self,av,out,4096,len)
  ok=0; if rc == 0 { ok=1 }
  fails=fails+tg_check(ok,"legacy child cannot inherit descriptor 2048",rc,0)
  let fallback: i64=sys_fork()
  if fallback == 0 {
      let cleaned: i64=sys_close_inherited_proc(3)
      if cleaned != 0 { sys_exit(32); return 32 }
      if sys_read(2048,out,1) != (0-9) { sys_exit(33); return 33 }
      if sys_write(1,"",0) != 0 { sys_exit(34); return 34 }
      sys_exit(0); return 0
  }
  let status: *i64=sys_mmap(16) as *i64
  var fallbackrc: i64=0-1
  if fallback > 0 { if tr_reap(fallback,status) == fallback { fallbackrc=wait_status_rc(status[0]) } }
  ok=0; if fallbackrc == 0 { ok=1 }
  fails=fails+tg_check(ok,"proc fallback closes high fd and preserves stdout",fallbackrc,0)
  rc=sys_read(2048,out,1)
  ok=0; if rc == 0 { ok=1 }
  fails=fails+tg_check(ok,"parent descriptor remains owned and open",rc,0)
  sys_close(2048)
  sys_munmap(out,4096)
  return fails
438}
439
440func tg_high_descriptor(self: *u8) -> i64 {
  let saved: *i64=sys_mmap(16) as *i64
  let requested: *i64=sys_mmap(16) as *i64
  let queried: i64=nx_prlimit(0,TG_RLIMIT_NOFILE,0 as *u8,saved as *u8)
  var fails: i64=0
  if queried < 0 {
      fails=tg_check(0,"descriptor fixture reads kernel limits",queried,0)
  } else {
      requested[0]=saved[0];requested[1]=saved[1]
      if requested[0] <= TG_HIGH_FD_WITNESS { requested[0]=TG_HIGH_FD_WITNESS+1 }
      if requested[0] > requested[1] {
          fails=tg_check(0,"descriptor witness fits kernel hard limit",requested[1],requested[0])
      } else {
          let raised: i64=nx_prlimit(0,TG_RLIMIT_NOFILE,requested as *u8,0 as *u8)
          if raised < 0 { fails=tg_check(0,"descriptor fixture applies local soft limit",raised,0) } else {
              fails=tg_high_descriptor_subject(self)
              let restored: i64=nx_prlimit(0,TG_RLIMIT_NOFILE,saved as *u8,0 as *u8)
              var ok: i64=0;if restored == 0 { ok=1 }
              fails=fails+tg_check(ok,"descriptor fixture restores original limits",restored,0)
          }
      }
  }
  sys_munmap(saved as *u8,16);sys_munmap(requested as *u8,16)
  return fails
464}
465
466// The fixture becomes a subreaper only inside an isolated child, so the gate
467// does not adopt unrelated workload descendants.
468const TG_LIFETIME_WAIT_MS: i64 = 10
469const TG_LIFETIME_ATTEMPTS: i64 = 50
470func tg_lifetime_fixture(late: i64) -> i64 {
  if sys_prctl(NX_PR_SET_CHILD_SUBREAPER,1) != 0 { return 40 }
  let state: *i64=sys_mmap_shared(4096) as *i64
  let barrier: *i64=sys_mmap(16) as *i64
  if sys_pipe2(barrier,0) != 0 { return 41 }
  let rfd: i64=barrier[0] & 0xFFFFFFFF
  let wfd: i64=(barrier[0] >> 32) & 0xFFFFFFFF
  let owner: i64=sys_fork()
  if owner < 0 { sys_close(rfd); sys_close(wfd); return 42 }
  if owner == 0 {
      let identity: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
      let worker: i64=sys_fork()
      if worker < 0 { state[1]=0-1; sys_exit(43); return 43 }
      if worker == 0 {
          sys_close(wfd)
          let byte: *u8=sys_mmap(16)
          if sys_read(rfd,byte,1) != 1 { sys_exit(44); return 44 }
          sys_close(rfd)
          var rc: i64=0
          if late != 2 { rc=sys_bind_parent_lifetime(identity,TR_SIGKILL) }
          state[1]=rc
          state[2]=1
          if rc != 0 { sys_exit(45); return 45 }
          sys_sleep_ms(TG_HANG_MS)
          sys_exit(46); return 46
      }
      state[0]=worker
      sys_close(rfd); sys_close(wfd)
      if late == 1 { sys_exit(0); return 0 }
      sys_sleep_ms(TG_HANG_MS)
      sys_exit(47); return 47
  }
  sys_close(rfd)
  let status: *i64=sys_mmap(16) as *i64
  var result: i64=0
  if late == 1 {
      if tr_reap(owner,status) != owner { result=48 }
  }
  if sys_write(wfd,"R",1) != 1 { result=49 }
  sys_close(wfd)
  var spins: i64=0
  while state[2] == 0 && spins < TG_LIFETIME_ATTEMPTS {
      sys_sleep_ms(TG_LIFETIME_WAIT_MS); spins=spins+1
  }
  if state[2] == 0 { result=50 }
  if late != 1 {
      if state[1] != 0 { result=51 }
      nx_kill(owner,TR_SIGKILL)
      if tr_reap(owner,status) != owner { result=52 }
  } else {
      if state[1] != TR_ECHILD { result=53 }
  }
  let worker: i64=state[0]
  if worker <= 1 { return 54 }
  var reaped: i64=0
  spins=0
  while reaped == 0 && spins < TG_LIFETIME_ATTEMPTS {
      reaped=sys_wait4(worker,status,1)
      if reaped == 0 { sys_sleep_ms(TG_LIFETIME_WAIT_MS) }
      spins=spins+1
  }
  if reaped == 0 { nx_kill(worker,TR_SIGKILL); tr_reap(worker,status); result=55 }
  if reaped < 0 { result=56 }
  if result == 0 {
      if late == 0 { if wait_status_rc(status[0]) != 137 { result=57 } }
      if late == 1 { if wait_status_rc(status[0]) != 45 { result=58 } }
  }
  if sys_wait4(0-1,status,1) != TR_ECHILD { result=59 }
  sys_munmap(state as *u8,4096)
  return result
540}
541func tg_lifetime_check(late: i64) -> i64 {
  let child: i64=sys_fork()
  if child == 0 { let rc: i64=tg_lifetime_fixture(late); sys_exit(rc); return rc }
  if child < 0 { return 1 }
  let status: *i64=sys_mmap(16) as *i64
  if tr_reap(child,status) != child { return 1 }
  let rc: i64=wait_status_rc(status[0])
  var ok: i64=0; if rc == 0 { ok=1 }
  if late == 2 { ok=0; if rc == 55 { ok=1 }; return tg_check(ok,"unbound control survives parent, fixture kills and reaps it",rc,55) }
  if late == 1 { return tg_check(ok,"parent already dead before binding is rejected",rc,0) }
  return tg_check(ok,"bound child dies with parent and is reaped",rc,0)
552}
553
554// Read only this fixture owner's direct children; retain identities before killing it.
555func tg_owner_children(owner: i64, pids: *i64) -> i64 {
  return osp_children(owner,pids,2)
557}
558func tg_capture_owner_crash(self: *u8, incomplete: i64) -> i64 {
  if sys_prctl(NX_PR_SET_CHILD_SUBREAPER,1) != 0 { return 60 }
  let owner: i64=sys_fork()
  if owner < 0 { return 61 }
  if owner == 0 {
      let av: *i64=sys_mmap(32) as *i64
      av[0]=self as i64; av[1]="x" as *u8 as i64; av[2]=0
      let out: *u8=sys_mmap(4096)
      let length: *i64=sys_mmap(16) as *i64
      let rc: i64=tr_run_capture_to(self,av,out,4096,length,TG_FAST_BUDGET_MS)
      sys_exit(62); return rc
  }
  let pids: *i64=sys_mmap(32) as *i64
  let status: *i64=sys_mmap(16) as *i64
  var count: i64=0
  var attempt: i64=0
  while count != 2 && attempt < TG_LIFETIME_ATTEMPTS {
      count=tg_owner_children(owner,pids)
      if count < 0 { break }
      if count != 2 { sys_sleep_ms(TG_LIFETIME_WAIT_MS) }
      attempt=attempt+1
  }
  nx_kill(owner,TR_SIGKILL)
  if tr_reap(owner,status) != owner { return 63 }
  // Deliberately discard an observation in the negative fixture. Cleanup must
  // discover adopted children rather than trust the incomplete observation.
  if incomplete == 1 { count=0 }
  if count != 2 {
      let fixture: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
      let adopted: i64=tg_owner_children(fixture,pids)
      if adopted < 0 { return 69 }
      var child: i64=0
      while child < adopted {
          // Unreaped direct children retain these identities until this wait.
          nx_kill(pids[child],TR_SIGKILL)
          if tr_reap(pids[child],status) != pids[child] { return 69 }
          child=child+1
      }
      if sys_wait4(0-1,status,WNOHANG) != TR_ECHILD { return 69 }
      return 64
  }
  var i: i64=0
  var result: i64=0
  while i < count {
      var reaped: i64=0
      attempt=0
      while reaped == 0 && attempt < TG_LIFETIME_ATTEMPTS {
          reaped=sys_wait4(pids[i],status,1)
          if reaped == 0 { sys_sleep_ms(TG_LIFETIME_WAIT_MS) }
          attempt=attempt+1
      }
      if reaped == 0 { nx_kill(pids[i],TR_SIGKILL); tr_reap(pids[i],status); result=65 }
      if reaped < 0 { result=66 }
      if reaped > 0 {
          let rc: i64=wait_status_rc(status[0])
          if rc != 137 && rc != 126 { result=67 }
      }
      i=i+1
  }
  if sys_wait4(0-1,status,1) != TR_ECHILD { result=68 }
  return result
619}
620func tg_capture_crash_check(self: *u8, incomplete: i64) -> i64 {
  let child: i64=sys_fork()
  if child == 0 { let rc: i64=tg_capture_owner_crash(self,incomplete); sys_exit(rc); return rc }
  if child < 0 { return 1 }
  let status: *i64=sys_mmap(16) as *i64
  if tr_reap(child,status) != child { return 1 }
  let rc: i64=wait_status_rc(status[0])
  var ok: i64=0; if rc == 0 { ok=1 }
  if incomplete == 1 {
      ok=0; if rc == 64 { ok=1 }
      return tg_check(ok,"incomplete observation fails only after adopted children are reaped",rc,64)
  }
  return tg_check(ok,"actual capture owner crash closes worker and watchdog",rc,0)
633}
634
635// Focused host qualification: no build, network, persistent writes, or parallel cohort.
636func tg_lifecycle_gate(self: *u8) -> i64 {
  let pid: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
  let before: i64=osp_fd_count(pid)
  var fails: i64=tg_capture_crash_check(self,0)
  fails=fails+tg_capture_crash_check(self,1)
  fails=fails+tg_lifetime_check(0)
  fails=fails+tg_lifetime_check(1)
  fails=fails+tg_lifetime_check(2)
  fails=fails+tg_high_descriptor(self)
  fails=fails+tg_resource_finish(pid,before)
  tg_puts("NX-LIFECYCLE checks=");tg_num(TG_COUNTER[1]);tg_puts(" fails="); tg_num(fails); tg_puts("\n")
  let result: i64=gv_verdict("LIFECYCLE",TG_COUNTER,"owned process and descriptor regression suite");sys_exit(result);return result
648}
649func main(argc: i64, argv: *i64) -> i64 {
  TG_COUNTER=gv_ctr()
  if argc > 1 { if (argv[1] as *u8)[0] == 108 as u8 { return tg_lifecycle_gate(argv[0] as *u8) } }
  if argc > 2 { if (argv[1] as *u8)[0] == 113 as u8 { return tg_parallel_producer((argv[2] as *u8)[0] as i64) } }
  if argc > 1 { return tg_stream_child((argv[1] as *u8)[0] as i64) }
  tg_puts("=== nx_tool_run_timeout_gate -- bounded exec vs a REAL hanging child ===\n" as *u8)
  var fails: i64 = 0
  let selfpid: i64=__syscall(TG_SYS_GETPID,0,0,0,0,0,0)
  let fdBaseline: i64=osp_fd_count(selfpid)
  let out: *u8 = sys_mmap(TG_OUTCAP)
  let ol: *i64 = sys_mmap(16) as *i64
660
  // ---- T1 + T2: the deadline fires, and it fires in real time ----
  let t0: i64 = sys_now_realtime_sec()
  let r1: i64 = tg_run("10000" as *u8, TG_BUDGET_MS, out, ol)
  let t1: i64 = sys_now_realtime_sec()
  let elapsed: i64 = t1 - t0
666
  var ok: i64 = 0; if r1 == TR_ERR_TIMEOUT { ok = 1 }
  fails = fails + tg_check(ok, "T1 deadline fires (TR_ERR_TIMEOUT)" as *u8, r1, TR_ERR_TIMEOUT)
669
  ok = 0; if elapsed < TG_MAX_ELAPSED_S { ok = 1 }
  fails = fails + tg_check(ok, "T2 returned in real time, not after the full 10s sleep" as *u8, elapsed, TG_MAX_ELAPSED_S)
672
  // ---- T3 + T4: NEG-CONTROL, a fast child must NOT be timed out and its output must survive ----
  ol[0] = 0
  let r3: i64 = tg_run("50" as *u8, TG_FAST_BUDGET_MS, out, ol)
  ok = 0; if r3 == 0 { ok = 1 }
  fails = fails + tg_check(ok, "T3 neg-ctrl fast child exits 0 (no false timeout)" as *u8, r3, 0)
678
  ok = tr_contains(out, ol[0], "SLEEPER-DONE" as *u8)
  fails = fails + tg_check(ok, "T4 fast child's stdout captured" as *u8, ol[0], ol[0])
681
  // ---- T5: repeatable -- a second kill must behave identically (no leaked fd/pid/zombie) ----
  let r5: i64 = tg_run("10000" as *u8, TG_BUDGET_MS, out, ol)
  ok = 0; if r5 == TR_ERR_TIMEOUT { ok = 1 }
  fails = fails + tg_check(ok, "T5 second timeout retains correct behavior" as *u8, r5, TR_ERR_TIMEOUT)
686
  // ---- T6: opt-out is explicit, never silent ----
  ol[0] = 0
  let r6: i64 = tg_run("50" as *u8, 0, out, ol)
  ok = 0; if r6 == 0 { ok = 1 }
  fails = fails + tg_check(ok, "T6 timeout_ms<=0 delegates to unbounded path" as *u8, r6, 0)
692
  fails=fails+tg_stream_check(argv[0] as *u8,"b" as *u8,0,1,TG_STREAM_CAP)
  fails=fails+tg_stream_check(argv[0] as *u8,"b" as *u8,1,1,TG_STREAM_CAP)
  fails=fails+tg_stream_check(argv[0] as *u8,"e" as *u8,1,0,TG_STREAM_CAP)
  fails=fails+tg_stream_check(argv[0] as *u8,"s" as *u8,1,0,TG_STREAM_CAP-1)
  fails=fails+tg_stream_timeout(argv[0] as *u8)
  fails=fails+tg_invalid_capacity()
  fails=fails+tg_descendant_deadline(argv[0] as *u8)
  fails=fails+tg_lifecycle_exit(argv[0] as *u8,"k" as *u8,0,137)
  fails=fails+tg_lifecycle_exit(argv[0] as *u8,"k" as *u8,TG_FAST_BUDGET_MS,137)
  fails=fails+tg_lifecycle_exit(argv[0] as *u8,"x" as *u8,TG_BUDGET_MS,TR_ERR_TIMEOUT)
  fails=fails+tg_wait_observe()
  fails=fails+tg_cwd_check(argv[0] as *u8,"b",".",TG_STREAM_EXIT)
  fails=fails+tg_cwd_check(argv[0] as *u8,"r",".",126)
  fails=fails+tg_cwd_check(argv[0] as *u8,"k",".",137)
  fails=fails+tg_cwd_check(argv[0] as *u8,"r","/dev/null",TR_ERR_CHDIR)
  fails=fails+tg_cwd_check("nx_tool_run_timeout_gate.elf","r","_build",126)
  fails=fails+tg_cwd_check(argv[0] as *u8,"x",".",TR_ERR_TIMEOUT)
  fails=fails+tg_parallel_capture(argv[0] as *u8,TG_PARALLEL_SMALL)
  fails=fails+tg_parallel_capture(argv[0] as *u8,TG_PARALLEL_LARGE)
  fails=fails+tg_capture_crash_check(argv[0] as *u8,0)
  fails=fails+tg_capture_crash_check(argv[0] as *u8,1)
  fails=fails+tg_lifetime_check(0)
  fails=fails+tg_lifetime_check(1)
  fails=fails+tg_lifetime_check(2)
  fails=fails+tg_high_descriptor(argv[0] as *u8)
  fails=fails+tg_resource_finish(selfpid,fdBaseline)
  tg_puts("NX-TOOL-RUN-TIMEOUT-GATE checks=");tg_num(TG_COUNTER[1]);tg_puts(" fails="); tg_num(fails)
  tg_puts("\n")
  let result: i64=gv_verdict("TOOL-RUN-TIMEOUT-GATE",TG_COUNTER,"executed assertions counted; process, capture and cleanup evidence")
  sys_exit(result);return result
723}
nx_tool_run_timeout_gate.nx source

`nx_tool_run_timeout_gate.nx` source
