--- binding-DJNQQ2RA/fp-driver-d2-r6-configured.sh +++ fp-driver-d2-r10-AQ23KKNI.sh @@ -215,6 +215,9 @@ LEDGER_RESERVE_S=30 KILL_GRACE_S=5 HANDOFF_CAP_S=120 +# AQ23KKNI: independent execution allocation, not notification/handoff time. +# 9s measured around a refused capture + existing 90s capture cap + 5s reserve + 16s margin. +ELEVATED_LEG_BUDGET_S=120 # THE TEARDOWN COMMAND IS PINNED, NEVER COMPOSED (doyle 2026-09-13). The removal this run may # need is the PRODUCT'S OWN rendered cleanup command, which only the shipped binary can emit. # Until it has been emitted, decoded, reviewed and pinned here, cleanup REFUSES to dispatch any @@ -339,6 +342,14 @@ # command has finished, so it is never the command's creation record. HANDOFF_REQUEST_UTC=UNRECORDED HANDOFF_RECEIPT_UTC=UNRECORDED +HANDOFF_WAIT_END_UTC=UNRECORDED +SETUP_WAIT_STATUS=NOT_REQUESTED +SETUP_TERMINAL_RC=UNAVAILABLE +SETUP_FINAL_RECEIPT_READ=no +LEG_START_EPOCH=UNRECORDED +LEG_DEADLINE_EPOCH=UNRECORDED +LEG_CLOCK_STATUS=UNMEASURED +PRODUCT_QUERY_KILL=UNAVAILABLE TS_ORDER=UNMEASURED # the six stamps above compared with the calendar, not assumed PRE_SETUP_ABSENCE=UNRECORDED RESIDUE_COUNT=UNMEASURED @@ -654,6 +665,56 @@ local n; n=$(grep '^exit=[0-9][0-9]*$' "$rf" | head -1 | cut -d= -f2) case "$n" in (''|*[!0-9]*) echo 255; return ;; esac echo "$n" +} + +# Shared by timely acceptance and the single final cleanup-side receipt observation. +# A terminal exit never overwrites SETUP_RC's timely-receipt/timeout disposition. +read_setup_terminal() { + local terminal_rc="$1" ts_hq ts_ss ts_se ts_t1s ts_t1e ts_hr + SETUP_TERMINAL_RC="$terminal_rc" + SETUP_START_UTC=$(leg_utc "$R/setup-start.utc") + SETUP_END_UTC=$(leg_utc "$R/setup-return.utc") + T1_START_UTC=$(leg_utc "$R/d2-t1-start.utc") + T1_END_UTC=$(leg_utc "$R/d2-t1-end.utc") + SETUP_EXIT_FILE=$(leg_exit "$R/setup.exit") + LEG_START_EPOCH=$(leg_exit "$R/elevated-leg-start.epoch") + LEG_DEADLINE_EPOCH=$(leg_exit "$R/d2-t1.deadline") + TS_ORDER=UNMEASURED + LEG_CLOCK_STATUS=UNMEASURED + if ts_readable "$HANDOFF_REQUEST_UTC" && ts_readable "$SETUP_START_UTC" && ts_readable "$SETUP_END_UTC" \ + && ts_readable "$T1_START_UTC" && ts_readable "$T1_END_UTC" && ts_readable "$HANDOFF_RECEIPT_UTC"; then + ts_hq=$(date -u -d "$HANDOFF_REQUEST_UTC" +%s); ts_ss=$(date -u -d "$SETUP_START_UTC" +%s) + ts_se=$(date -u -d "$SETUP_END_UTC" +%s); ts_t1s=$(date -u -d "$T1_START_UTC" +%s) + ts_t1e=$(date -u -d "$T1_END_UTC" +%s); ts_hr=$(date -u -d "$HANDOFF_RECEIPT_UTC" +%s) + TS_ORDER=VIOLATED + if [ "$ts_hq" -le "$ts_ss" ] && [ "$ts_ss" -le "$ts_se" ] && [ "$ts_se" -le "$ts_t1s" ] \ + && [ "$ts_t1s" -le "$ts_t1e" ] && [ "$ts_t1e" -le "$ts_hr" ]; then TS_ORDER=OK; fi + case "$LEG_START_EPOCH:$LEG_DEADLINE_EPOCH" in + *[!0-9:]*|:*|*:) ;; + *) + LEG_CLOCK_STATUS=VIOLATED + if [ "$LEG_START_EPOCH" -eq "$ts_ss" ] && \ + [ "$LEG_DEADLINE_EPOCH" -eq "$((LEG_START_EPOCH + ELEVATED_LEG_BUDGET_S))" ]; then + LEG_CLOCK_STATUS=WITHIN + [ "$ts_t1e" -le "$LEG_DEADLINE_EPOCH" ] || LEG_CLOCK_STATUS=EXCEEDED + fi ;; + esac + fi + record "SETUP_TERMINAL exit=$terminal_rc preserved_exit=$SETUP_EXIT_FILE setup=[$SETUP_START_UTC .. $SETUP_END_UTC] t1=[$T1_START_UTC .. $T1_END_UTC]" + record "TIMESTAMP_ORDER=$TS_ORDER handoff_request=$HANDOFF_REQUEST_UTC setup_start=$SETUP_START_UTC setup_return=$SETUP_END_UTC t1_start=$T1_START_UTC t1_end=$T1_END_UTC receipt_observed=$HANDOFF_RECEIPT_UTC" + record "ELEVATED_LEG_CLOCK start=$LEG_START_EPOCH deadline=$LEG_DEADLINE_EPOCH budget=${ELEVATED_LEG_BUDGET_S}s status=$LEG_CLOCK_STATUS — notification latency belongs only to the handoff" + [ "$SETUP_EXIT_FILE" = "$terminal_rc" ] || record "SETUP_EXIT_DISAGREES_OR_UNAVAILABLE receipt=$terminal_rc leg_file=$SETUP_EXIT_FILE — neither value replaces the other" + return 0 +} + +record_product_query_findings() { + PRODUCT_QUERY_KILL=UNAVAILABLE + [ -n "${SETUP_ERR:-}" ] && [ -f "$SETUP_ERR" ] || return 0 + PRODUCT_QUERY_KILL=NOT_RECORDED + if grep '^bootstrap-firewall leg=verify-query .* outcome=killed$' "$SETUP_ERR" > "$R/product-query-findings.txt"; then + PRODUCT_QUERY_KILL=OBSERVED + record "PRODUCT_FINDING leg=verify-query outcome=killed evidence=$R/product-query-findings.txt — separate from handoff/capture deadline failure" + fi } # PREPARATION (600 s, carried from the provisioning controller). Read-only preflight and @@ -1554,6 +1615,18 @@ [ "$r6_nonce" -eq 1 ] || r6_missing="$r6_missing nonce-lines=$r6_nonce" r6_exit=$(HO_RECEIPT="$SETUP_RECEIPT" handoff_exit) [ "$r6_exit" = 255 ] && r6_missing="$r6_missing exit-record-unread" + # One final observation at the cleanup boundary, after the timed wait has ended. + # Recover terminal stamps from a late receipt; never resume activity or erase its timeout. + if [ "$SETUP_WAIT_STATUS" = EXPIRED ] && [ "$SETUP_FINAL_RECEIPT_READ" = no ]; then + SETUP_FINAL_RECEIPT_READ=yes + if [ "$r6_nonce" -eq 1 ] && [ "$r6_exit" != 255 ]; then + HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + read_setup_terminal "$r6_exit" + record "HANDOFF_FINAL_RECEIPT observed=$HANDOFF_RECEIPT_UTC wait_ended=$HANDOFF_WAIT_END_UTC — late terminal evidence, NOT timely acceptance" + else + record "HANDOFF_FINAL_RECEIPT unavailable_or_invalid — setup remains unproven; no second wait or retry" + fi + fi case "$SETUP_END_UTC" in ABSENT|UNPARSEABLE|'') r6_missing="$r6_missing setup-return-stamp=$SETUP_END_UTC" ;; esac @@ -1892,15 +1965,18 @@ local qf=$(( ${D2_T1_QF:-0} + ${D2_T2_QF:-0} + ${D2_T3_QF:-0} )) if [ "$D2_T1" = 0 ] && [ "$D2_T2" = 0 ] && [ "$D2_T3" = 0 ] \ && [ "$t1v" = COMPLETE ] && [ "$t2v" = COMPLETE ] && [ "$t3v" = COMPLETE ] \ - && [ "$qf" -eq 0 ]; then + && [ "$qf" -eq 0 ] && [ "$LEG_CLOCK_STATUS" = WITHIN ]; then CAPTURE_CONTRACT=SATISFIED fi + record_product_query_findings { echo "D2 RUN LEDGER — run=$RUN_ID" echo " this file reports; it does not congratulate. The driver's own exit means the" echo " sequence ran and this ledger was written, never that the run was green." echo "EXITS, four separate values, none inferred from another:" echo " setup_elevated_exit=$SETUP_RC" + echo " setup_terminal_exit=$SETUP_TERMINAL_RC (may be learned after timeout; does not replace setup_elevated_exit)" + echo " handoff_wait=$SETUP_WAIT_STATUS wait_end=$HANDOFF_WAIT_END_UTC final_receipt_read=$SETUP_FINAL_RECEIPT_READ" echo " d2_t1_exit=$D2_T1 (UNAVAILABLE = the elevated capture never ran: a labelled evidence gap)" echo " d2_t2_exit=$D2_T2" echo " d2_t3_exit=$D2_T3" @@ -1909,6 +1985,9 @@ echo " t1=$t1v t2=$t2v t3=$t3v" echo "QUERY FAILURES among the required observations -- observed, recorded, and NOT successful:" echo " t1=${D2_T1_QF:-0} t2=${D2_T2_QF:-0} t3=${D2_T3_QF:-0} (any nonzero refuses the contract, however valid the document is)" + echo "PRODUCT FINDINGS, independent of the handoff squeeze:" + echo " verify_query_outcome_killed=$PRODUCT_QUERY_KILL evidence=product-query-findings.txt" + echo " M5XKQ2DN historical failed candidate b8482445: query budget=3000ms, starts before spawn and includes output collection" echo "IDENTITY the records bind to (never InstanceID):" echo " run=$RUN_ID" echo " pre_setup_absence=$PRE_SETUP_ABSENCE" @@ -1917,6 +1996,7 @@ echo " handoff_interval=[$HANDOFF_REQUEST_UTC .. $HANDOFF_RECEIPT_UTC] (this driver's request-write and receipt-verify -- a DIFFERENT interval, never the command's)" echo " timestamp_order=$TS_ORDER (the six stamps compared with the calendar; UNMEASURED = at least one is a gap)" echo " setup_exit_preserved_by_leg=$SETUP_EXIT_FILE (written before t1 ran; the receipt's exit= above stays the declared channel)" + echo " elevated_leg_clock start=$LEG_START_EPOCH deadline=$LEG_DEADLINE_EPOCH budget=${ELEVATED_LEG_BUDGET_S}s status=$LEG_CLOCK_STATUS" echo " rule_names=$RULE_TAILNET,$RULE_LAN port=$PORT isolated_home=$H" echo "VERDICTS:" echo " CAPTURE_CONTRACT=$CAPTURE_CONTRACT" @@ -2490,6 +2570,7 @@ python "$BIN/launch-record.py" argv "$(cygpath -w "$R/d2-t1.argv.json")" -NoProfile -Command "$T1_CODE" || die "capture argv preparation failed" ( set -o noclobber; printf '{}\n' > "$R/d2-t1.environment.json" ) || die "capture environment reservation failed" T1_LAUNCH="pwsh -NoProfile -File '$BIN/launch-v2.ps1' -Label 't1-$RUN_ID' -Seconds ([Math]::Min(90, ([long][IO.File]::ReadAllText('$R/d2-t1.deadline') - [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - 5))) -RecordFile '$R/d2-t1.native.json' -ArgsFile '$R/d2-t1.argv.json' -Exe '$CAPTURE_PWSH' -OutFile '$R/d2-t1.out' -ErrFile '$R/d2-t1.err' -Admission process-tree -Scope step -EnvironmentFile '$R/d2-t1.environment.json'" +LEG_CLOCK_BEGIN="\$ErrorActionPreference='Stop'; \$legStart=[DateTimeOffset]::UtcNow; \$entries=@(@('$R/setup-start.utc',\$legStart.UtcDateTime.ToString('yyyy-MM-ddTHH:mm:ssZ')),@('$R/elevated-leg-start.epoch',[string]\$legStart.ToUnixTimeSeconds()),@('$R/d2-t1.deadline',[string](\$legStart.ToUnixTimeSeconds()+$ELEVATED_LEG_BUDGET_S))); foreach(\$entry in \$entries){\$file=[IO.File]::Open(\$entry[0],[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read); try{\$bytes=[Text.Encoding]::ASCII.GetBytes(\$entry[1]);\$file.Write(\$bytes,0,\$bytes.Length);\$file.Flush(\$true)}finally{\$file.Dispose()}}" handoff_request prepare \ "ACKNOWLEDGE ONLY -- RUN NOTHING. Confirm you are prepared to execute the setup leg and that you have started nothing yet, and report the sha256 of BOTH subjects this leg would run, AS YOU MEASURE THEM NOW: the pinned executable and the capture script." \ "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with these four tokens, EACH ON A LINE OF ITS OWN AND NOTHING ELSE ON THAT LINE: PREPARED, NOT_STARTED, then executable_sha256= followed by the sha256 you measure of $EXE, then capture_sha256= followed by the sha256 you measure of $BIN/d2_capture.ps1. If you are NOT prepared, say so in words -- do not write NOT_PREPARED on a line by itself and expect it to read as a refusal. NOTE ON PHRASING: this text carries no angle brackets deliberately. handoff_request refuses any command text containing a redirect character, because capture paths are composed inside it; a bracketed placeholder was refused by that guard on the first live PREP (run 20260913T070453Z), before any request was written." @@ -2501,7 +2582,10 @@ echo "$T1_LAUNCH" echo "The environment overlay is exactly {}; preserve the live parent. Child argv is -NoProfile -Command plus the capture expression in d2-t1.argv.json." echo "The no-field Get-Command/Get-FileHash fixture control ran through this same pwsh/L2/pwsh shape before driver invocation; see the attached admission packet." - echo "Dry-run this shape and both hashes; mismatch REFUSES. The deadline file is published only with the setup request." + echo "Dry-run the launcher shape, clock initializer and both hashes; mismatch REFUSES. Do not initialize the clock during this acknowledgment." + echo "elevated_leg_budget_seconds: $ELEVATED_LEG_BUDGET_S" + echo "leg_clock_begin_powershell:" + echo "$LEG_CLOCK_BEGIN" } >> "$R/handoff/$HO_SEQ-prepare-request.txt" # BOUNDED BY WHAT IS LEFT OF PREPARATION (doyle 2026-09-13). HANDOFF_WAIT_S is 900s and the whole # preparation budget is 600s, so an unbounded-by-prep wait could sit past the deadline and then @@ -2629,9 +2713,9 @@ # finished, and it includes however long liam took to read the request and answer it. Both # intervals are recorded here, each under a name that says whose clock took it. HANDOFF_REQUEST_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" -T1_HANDOFF_DEADLINE=$(( $(date +%s) + HANDOFF_CAP_S )) -[ "$T1_HANDOFF_DEADLINE" -le "$EXP_DEADLINE" ] || T1_HANDOFF_DEADLINE="$EXP_DEADLINE" -( set -o noclobber; printf '%s' "$T1_HANDOFF_DEADLINE" > "$R/d2-t1.deadline" ) || die "capture deadline reservation failed" +SETUP_HANDOFF_DEADLINE=$(( $(date +%s) + HANDOFF_CAP_S )) +[ "$SETUP_HANDOFF_DEADLINE" -le "$EXP_DEADLINE" ] || SETUP_HANDOFF_DEADLINE="$EXP_DEADLINE" +SETUP_WAIT_STATUS=WAITING handoff_request setup \ "create the owned pair with the product itself (never a hand netsh, so the rules carry the shipped desired_specs shape) AND take the t1 capture inside this same elevated leg" \ "env -u SPT_INSTALL_NO_FIREWALL SPT_HOME=\"$H\" \"$EXE\" serve lan --bootstrap --port $PORT" @@ -2648,7 +2732,9 @@ echo "" echo "capture_identity_REQUIRED: sha256 $CAPTURE_SHA" echo "capture_launcher_identity_REQUIRED: $CAPTURE_PWSH" - echo "capture_deadline_epoch: $T1_HANDOFF_DEADLINE (includes setup/handoff time; never restarted)" + echo "handoff_deadline_epoch: $SETUP_HANDOFF_DEADLINE (request-to-receipt only; includes notification latency)" + echo "elevated_leg_budget_seconds: $ELEVATED_LEG_BUDGET_S (starts inside step 1 immediately before run_exactly)" + echo "capture_deadline_file: $R/d2-t1.deadline (executor publishes leg_start_epoch + $ELEVATED_LEG_BUDGET_S; never request time)" echo "executable_identity_REQUIRED: sha256 $EXE_SHA" echo " at $EXE — MEASURED by this driver immediately before this request (S1) and stated here" echo " because a clean source tree does not identify reused executable BYTES. If the file at that" @@ -2660,7 +2746,11 @@ echo " above and the moment I verify this receipt are the HANDOFF's bounds. They are different" echo " intervals — the handoff one opens before the command exists and closes after it has" echo " finished — and neither may be reported as the other." - echo " 1. stamp_utc_now_to (immediately BEFORE step 2, with nothing in between): $R/setup-start.utc" + echo " 1. initialize_leg_clock (immediately BEFORE step 2, with nothing in between):" + echo "leg_clock_begin_powershell:" + echo "$LEG_CLOCK_BEGIN" + echo " Run that expression in the pinned PowerShell 7 host. All three files use CreateNew; any existing file REFUSES the leg, never resets it." + echo " The expression stamps setup-start.utc and publishes elevated-leg-start.epoch plus d2-t1.deadline from ONE UTC observation." echo " 2. run_exactly (the command and the redirections named above)" echo " 3. PRESERVE ITS EXIT IN A VARIABLE THE INSTANT IT RETURNS, before running anything else:" echo " every later command overwrites \$LASTEXITCODE / \$?, INCLUDING the stamp in step 4." @@ -2670,7 +2760,7 @@ echo " 6. stamp_utc_now_to (immediately BEFORE step 7): $R/d2-t1-start.utc" echo " 7. then_run_exactly (SECOND command, same elevated leg, same nonce):" echo "$T1_LAUNCH" - echo " then_write_its_native_exit_to: $R/d2-t1.exit" + echo " then_write_its_launcher_exit_to: $R/d2-t1.exit (native capture exit remains in d2-t1.native.json)" echo " 8. stamp_utc_now_to (immediately AFTER step 7): $R/d2-t1-end.utc" echo "" echo "stamp_utc_now_to means EXACTLY this, and nothing that merely resembles it:" @@ -2711,8 +2801,9 @@ # opposed to 'cleanup'. There are no trials here; renaming it would edit a function this # change has no reason to touch, so the name stays and this line says what it means. if ! handoff_await trial; then - HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — the handoff's bounds. The setup command's own bounds were never returned." + SETUP_WAIT_STATUS=EXPIRED + HANDOFF_WAIT_END_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC wait_end=$HANDOFF_WAIT_END_UTC — no timely receipt; final terminal re-read belongs to cleanup" # THE WAIT STOPPED; THE COMMAND MAY NOT HAVE. This driver never entered that leg and has no # authority to stop it, asks for none, and does not re-ask: one nonce is one execution, so a # second request would be a second authorization rather than a retry. It also does NOT proceed @@ -2723,53 +2814,13 @@ record "HANDOFF_CAP_EXPIRED nonce=$SETUP_NONCE receipt_awaited=$SETUP_RECEIPT — the wait ended, the command's disposition is UNKNOWN, and nothing was killed or re-requested" die "no verified setup receipt within the bounded wait. The elevated command may still be acting: state markers are left set, no cleanup mutation may run while it is outstanding (R6), and a REFUSED or UNANSWERED setup can still have left rules behind." fi +SETUP_WAIT_STATUS=TIMELY HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" +HANDOFF_WAIT_END_UTC="$HANDOFF_RECEIPT_UTC" SETUP_RC=$(handoff_exit) exits "setup_elevated_EXIT=$SETUP_RC" # THE LEG'S OWN MEASUREMENTS, read back from the files it was asked to write. -SETUP_START_UTC=$(leg_utc "$R/setup-start.utc") -SETUP_END_UTC=$(leg_utc "$R/setup-return.utc") -T1_START_UTC=$(leg_utc "$R/d2-t1-start.utc") -T1_END_UTC=$(leg_utc "$R/d2-t1-end.utc") -SETUP_EXIT_FILE=$(leg_exit "$R/setup.exit") -record "SETUP_INTERVAL start=$SETUP_START_UTC end=$SETUP_END_UTC — THE CREATION RECORD, and it is the ELEVATED LEG's measurement of its own command, not this driver's measurement of the handoff. No provider creation timestamp is claimed and no instant is invented between these bounds." -record "T1_INTERVAL start=$T1_START_UTC end=$T1_END_UTC — the elevated capture's own two stamps" -record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — SEPARATELY LABELLED. This is how long the handoff took, and it is not a bound on anything the leg ran." -# THE SETUP'S EXIT, TWICE, FROM TWO CHANNELS. The receipt's exit= line keeps its authority -# (SETUP_RC is unchanged); the step-5 file is the evidence that the value was preserved BEFORE -# the capture ran. A disagreement is reported, never resolved by preference: it means one of -# the two readings is of something else. -case "$SETUP_EXIT_FILE" in - "$SETUP_RC") - record "SETUP_EXIT_PRESERVED=$SETUP_EXIT_FILE — the leg's own file agrees with the receipt's exit=, and it was written before t1 ran" ;; - ABSENT) - record "SETUP_EXIT_PRESERVED=ABSENT — step 5 produced no file. The receipt's exit=$SETUP_RC is then the ONLY reading of the setup's exit, and nothing here shows it was captured before the capture command overwrote \$LASTEXITCODE." ;; - UNPARSEABLE) - record "SETUP_EXIT_PRESERVED=UNPARSEABLE — a step-5 file exists and carries no readable exit. An unread exit is not a zero one." ;; - *) - record "SETUP_EXIT_DISAGREES receipt=$SETUP_RC leg_file=$SETUP_EXIT_FILE — TWO CHANNELS, TWO ANSWERS. Neither is preferred here; the receipt's value continues to be used because that is the declared channel, and this line is the standing caveat on it." ;; -esac -# ORDERING IS ASSERTED, NOT ASSUMED. Six stamps taken in an order this driver REQUESTED are a -# claim about that order until they are compared. Parsed with the calendar (ts_readable's rule, -# GNU date -u -d) and compared as epochs; a gap or an unparseable value leaves the comparison -# UNMEASURED rather than passing it. Stamps one second apart or identical are expected: the -# resolution is one second, so the test is <=, and an out-of-order pair is a real violation. -TS_ORDER=UNMEASURED -if ts_readable "$HANDOFF_REQUEST_UTC" && ts_readable "$SETUP_START_UTC" && ts_readable "$SETUP_END_UTC" \ - && ts_readable "$T1_START_UTC" && ts_readable "$T1_END_UTC" && ts_readable "$HANDOFF_RECEIPT_UTC"; then - ts_hq=$(date -u -d "$HANDOFF_REQUEST_UTC" +%s); ts_ss=$(date -u -d "$SETUP_START_UTC" +%s) - ts_se=$(date -u -d "$SETUP_END_UTC" +%s); ts_t1s=$(date -u -d "$T1_START_UTC" +%s) - ts_t1e=$(date -u -d "$T1_END_UTC" +%s); ts_hr=$(date -u -d "$HANDOFF_RECEIPT_UTC" +%s) - if [ "$ts_hq" -le "$ts_ss" ] && [ "$ts_ss" -le "$ts_se" ] && [ "$ts_se" -le "$ts_t1s" ] \ - && [ "$ts_t1s" -le "$ts_t1e" ] && [ "$ts_t1e" -le "$ts_hr" ]; then - TS_ORDER=OK - else - TS_ORDER=VIOLATED - fi -fi -record "TIMESTAMP_ORDER=$TS_ORDER handoff_request=$HANDOFF_REQUEST_UTC <= setup_start=$SETUP_START_UTC <= setup_return=$SETUP_END_UTC <= t1_start=$T1_START_UTC <= t1_end=$T1_END_UTC <= handoff_receipt=$HANDOFF_RECEIPT_UTC" -[ "$TS_ORDER" = VIOLATED ] && record " THE SEQUENCE THE REQUEST ASKED FOR DID NOT HAPPEN IN THAT ORDER. The stamps are kept as taken; nothing is reordered or discarded, and every interval above is read with this line beside it." -[ "$TS_ORDER" = UNMEASURED ] && record " ORDER NOT MEASURED — at least one of the six stamps is missing or unparseable, so no ordering claim is made either way." +read_setup_terminal "$SETUP_RC" # t1's OWN exit, read from its OWN file. Absent file = the elevated capture never ran. if [ -f "$R/d2-t1.exit" ]; then D2_T1=$(tr -d ' \r\n' < "$R/d2-t1.exit")