--- history/fp-driver-d2-f7b7773f.sh 2026-09-12 19:36:20.983438300 -0700 +++ fp-driver-d2.sh 2026-09-12 20:35:54.329651700 -0700 @@ -126,7 +126,13 @@ SP='C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5' BIN="$SP/fp-bin" # INSTRUMENTS — never written to by a run RUN_ROOT="$SP/fp-run" # one timestamped subdir per run -H="$SP/fp-home" # isolated SPT_HOME, this experiment only +H="$SP/fp-home-d2" # isolated SPT_HOME, THIS experiment only. D2 SUCCESSOR: + # r10 left a populated fp-home beside this one (measured + # present, 10 entries), and a run that adopted it could not + # tell its own state from r10's. The name is fresh so S0b's + # pre-existence refusal -- which is KEPT, unchanged -- bites + # on a prior D2 run rather than on r10's evidence, and + # nothing here reads, writes or removes r10's home. EXE="$W/target/release/spt.exe" # THE EXECUTABLE r10 ALREADY BUILT. Nothing here builds. EXE_SHA='72d309011415b419aabfdb0b4065df1183bfd0069a9f95b5779da62e43349b10' PORT=29470 # never 5470 @@ -173,8 +179,23 @@ VALIDATE_QF=0 SETUP_RC=255 TEARDOWN_RC=255 +# THE SETUP COMMAND'S OWN BOUNDS, stamped INSIDE the elevated leg and read back from the +# files that leg was asked to write. They are not this driver's clock: it never runs the +# command, so it cannot time it. UNRECORDED until the leg answers. SETUP_START_UTC=UNRECORDED SETUP_END_UTC=UNRECORDED +SETUP_EXIT_FILE=ABSENT # the exit the leg preserved BEFORE t1 ran; a cross-check on + # the receipt's exit= claim, never a substitute for it +# THE ELEVATED CAPTURE'S OWN BOUNDS, likewise stamped inside the leg. A document utc plus an +# exit file is ONE instant and a file mtime; these are two stamps taken around the command. +T1_START_UTC=UNRECORDED +T1_END_UTC=UNRECORDED +# THE HANDOFF'S BOUNDS -- a DIFFERENT interval, this driver's own: when it wrote the request +# and when it verified the receipt. It opens before the command exists and closes after the +# command has finished, so it is never the command's creation record. +HANDOFF_REQUEST_UTC=UNRECORDED +HANDOFF_RECEIPT_UTC=UNRECORDED +TS_ORDER=UNMEASURED # the six stamps above compared with the calendar, not assumed PRE_SETUP_ABSENCE=UNRECORDED RESIDUE_COUNT=UNMEASURED RESIDUE_LIVE=0 # tracked identities re-queried and still running @@ -1142,7 +1163,11 @@ echo "IDENTITY the records bind to (never InstanceID):" echo " run=$RUN_ID" echo " pre_setup_absence=$PRE_SETUP_ABSENCE" - echo " setup_interval=[$SETUP_START_UTC .. $SETUP_END_UTC]" + echo " setup_interval=[$SETUP_START_UTC .. $SETUP_END_UTC] (the COMMAND's own bounds, stamped INSIDE the elevated leg)" + echo " t1_interval=[$T1_START_UTC .. $T1_END_UTC] (the elevated capture's own two stamps, same leg)" + echo " handoff_interval=[$HANDOFF_REQUEST_UTC .. $HANDOFF_RECEIPT_UTC] (this driver's request-write and receipt-verify -- a DIFFERENT interval, never the command's)" + echo " timestamp_order=$TS_ORDER (the six stamps compared with the calendar; UNMEASURED = at least one is a gap)" + echo " setup_exit_preserved_by_leg=$SETUP_EXIT_FILE (written before t1 ran; the receipt's exit= above stays the declared channel)" echo " rule_names=$RULE_TAILNET,$RULE_LAN port=$PORT isolated_home=$H" echo "VERDICTS:" echo " CAPTURE_CONTRACT=$CAPTURE_CONTRACT" @@ -1628,7 +1653,30 @@ mark_state fw_mutation_may_have_occurred "an elevated reconcile is about to be REQUESTED; rules may exist from this moment even if the setup is refused" mark_state daemon_may_run "serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running" mark_state listener_may_exist "the elevated setup binds a listener on port $PORT" -SETUP_START_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" +# A TIMESTAMP THIS DRIVER DID NOT TAKE (D2 successor). The setup command and the elevated +# capture both run in a leg this driver never enters, so their bounds can only be stamped +# THERE and read back HERE. An absent file is a LABELLED GAP: it is never "now", and never +# the neighbouring stamp. A present value that the calendar cannot parse is UNPARSEABLE -- +# a string, not a time -- because shape is not validity (ts_readable's rule). +leg_utc() { # PATH -> the stamp | ABSENT | UNPARSEABLE + local f="$1" v + [ -f "$f" ] || { echo ABSENT; return; } + v=$(tr -d ' \r\n' < "$f") + if ts_readable "$v"; then echo "$v"; else echo UNPARSEABLE; fi +} +leg_exit() { # PATH -> the exit | ABSENT | UNPARSEABLE (an unread exit is not a zero one) + local f="$1" v + [ -f "$f" ] || { echo ABSENT; return; } + v=$(tr -d ' \r\n' < "$f") + case "$v" in (''|*[!0-9]*) echo UNPARSEABLE ;; (*) echo "$v" ;; esac +} +# THE HANDOFF'S BOUNDS ARE NOT THE COMMAND'S (doyle, 2026-09-13). f7b7773f stamped +# SETUP_START_UTC where this line stands -- at the moment the REQUEST WAS WRITTEN -- and +# SETUP_END_UTC at the moment the RECEIPT WAS VERIFIED, then labelled that pair "THE CREATION +# RECORD". It is not one: it opens before the command exists and closes after the command has +# finished, and it includes however long liam took to read the request and answer it. Both +# intervals are recorded here, each under a name that says whose clock took it. +HANDOFF_REQUEST_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" handoff_request setup \ "create the owned pair with the product itself (never a hand netsh, so the rules carry the shipped desired_specs shape) AND take the t1 capture inside this same elevated leg" \ "env -u SPT_INSTALL_NO_FIREWALL SPT_HOME=\"$H\" \"$EXE\" serve lan --bootstrap --port $PORT" @@ -1646,19 +1694,45 @@ echo " path does not hash to this value when you run it, REFUSE THE LEG and say so in the receipt:" echo " a pair written by a different binary is a different subject." echo "" - echo "then_run_exactly (SECOND command, same elevated leg, same nonce):" - echo "& '$BIN/d2_capture.ps1' -CapturePoint 't1' -RuleName @('$RULE_TAILNET','$RULE_LAN') -Port $PORT -IsolatedHome '$H' -RunId '$RUN_ID' -OutPath '$R/d2-t1.json' -ControlRuleName '$CONTROL_RULE' -AbsentControlName '$ABSENT_CONTROL' -PreSetupAbsence '$PRE_SETUP_ABSENCE' -SetupIntervalStart '$SETUP_START_UTC' -SetupIntervalEnd 'IN_LEG'" - echo "then_write_its_native_exit_to: $R/d2-t1.exit" - echo " Run it with powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command \"; exit \$LASTEXITCODE\"." + echo "elevated_leg_sequence: EIGHT STEPS, IN THIS ORDER, IN ONE LEG UNDER ONE NONCE." + echo " The two stamps around run_exactly are THE COMMAND'S OWN BOUNDS. The requested_utc line" + echo " above and the moment I verify this receipt are the HANDOFF's bounds. They are different" + echo " intervals — the handoff one opens before the command exists and closes after it has" + echo " finished — and neither may be reported as the other." + echo " 1. stamp_utc_now_to (immediately BEFORE step 2, with nothing in between): $R/setup-start.utc" + echo " 2. run_exactly (the command and the redirections named above)" + echo " 3. PRESERVE ITS EXIT IN A VARIABLE THE INSTANT IT RETURNS, before running anything else:" + echo " every later command overwrites \$LASTEXITCODE / \$?, INCLUDING the stamp in step 4." + echo " 4. stamp_utc_now_to (immediately AFTER step 2): $R/setup-return.utc" + echo " 5. write_the_exit_preserved_in_step_3_to: $R/setup.exit" + echo " THIS HAPPENS BEFORE t1 RUNS. The capture must not be able to overwrite the setup's exit." + echo " 6. stamp_utc_now_to (immediately BEFORE step 7): $R/d2-t1-start.utc" + echo " 7. then_run_exactly (SECOND command, same elevated leg, same nonce):" + echo "& '$BIN/d2_capture.ps1' -CapturePoint 't1' -RuleName @('$RULE_TAILNET','$RULE_LAN') -Port $PORT -IsolatedHome '$H' -RunId '$RUN_ID' -OutPath '$R/d2-t1.json' -ControlRuleName '$CONTROL_RULE' -AbsentControlName '$ABSENT_CONTROL' -PreSetupAbsence '$PRE_SETUP_ABSENCE' -SetupIntervalStart (Get-Content -Raw '$R/setup-start.utc').Trim() -SetupIntervalEnd (Get-Content -Raw '$R/setup-return.utc').Trim()" + echo " then_write_its_native_exit_to: $R/d2-t1.exit" + echo " 8. stamp_utc_now_to (immediately AFTER step 7): $R/d2-t1-end.utc" + echo "" + echo "stamp_utc_now_to means EXACTLY this, and nothing that merely resembles it:" + echo " powershell.exe -NoLogo -NoProfile -NonInteractive -Command \"[DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ') | Set-Content -NoNewline -Encoding ascii ''\"" + echo " A FILE MTIME IS NOT ONE OF THESE STAMPS. A document's own utc plus an exit file gives one" + echo " instant and a filesystem attribute, which is not a start and an end; steps 6 and 8 exist" + echo " because the capture's two bounds have to be TAKEN, not reconstructed afterwards." + echo " THE SETUP INTERVAL RIDES INTO THE CAPTURE FROM THOSE FILES (step 7 reads them), so the" + echo " interval recorded in every t1 document is the one THIS LEG measured. I cannot supply it:" + echo " when I write this request the command has not started." + echo "" + echo " Run each command with powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command \"; exit \$LASTEXITCODE\"." echo " MEASURED, and the reason the form is spelled out: -File binds -RuleName a,b as ONE element" echo " \"a,b\" (a name that cannot exist, recording NO_RULE for a pair that is present), two bare" echo " tokens fail binding, and without the trailing exit \$LASTEXITCODE a capture exit of 2 arrives as 1." - echo " THE TWO EXITS STAY SEPARATE: the setup's exit goes in this receipt's exit= line, the capture's" - echo " exit goes in the file named above. Neither substitutes for the other." + echo " THE TWO EXITS STAY SEPARATE: the setup's exit goes in this receipt's exit= line AND in the" + echo " step-5 file, the capture's exit goes in the step-7 file. Neither substitutes for the other." echo " If this capture is not run, say so in the receipt: t1 is then UNAVAILABLE, which is a labelled" echo " evidence gap. It is NOT a reason to withhold the setup's own result." + echo " Any step you did not run: say which one. A missing stamp is read here as a gap, never as a pass." } >> "$R/handoff/$HO_SEQ-setup-request.txt" record "HANDOFF_T1_RIDER appended to the seq-$HO_SEQ setup request — the only elevated read this design has; omission is a labelled gap, not a pass" +record "HANDOFF_REQUEST_UTC=$HANDOFF_REQUEST_UTC — a bound on THIS DRIVER's request, not on the command it asks for" # The wait cannot outlive the experimental budget: the deadline ends activity, whoever is # holding it up. HANDOFF_WAIT_S=$(exp_left) @@ -1667,13 +1741,57 @@ # opposed to 'cleanup'. There are no trials here; renaming it would edit a function this # change has no reason to touch, so the name stays and this line says what it means. if ! handoff_await trial; then - SETUP_END_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — the handoff's bounds. The setup command's own bounds were never returned." die "no verified setup receipt within the experimental budget. State markers are left set for the authorized teardown: a REFUSED or UNANSWERED setup can still have left rules behind." fi -SETUP_END_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" +HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" SETUP_RC=$(handoff_exit) exits "setup_elevated_EXIT=$SETUP_RC" -record "SETUP_INTERVAL start=$SETUP_START_UTC end=$SETUP_END_UTC — THE CREATION RECORD. No provider creation timestamp is claimed and no instant is invented between these bounds." +# THE LEG'S OWN MEASUREMENTS, read back from the files it was asked to write. +SETUP_START_UTC=$(leg_utc "$R/setup-start.utc") +SETUP_END_UTC=$(leg_utc "$R/setup-return.utc") +T1_START_UTC=$(leg_utc "$R/d2-t1-start.utc") +T1_END_UTC=$(leg_utc "$R/d2-t1-end.utc") +SETUP_EXIT_FILE=$(leg_exit "$R/setup.exit") +record "SETUP_INTERVAL start=$SETUP_START_UTC end=$SETUP_END_UTC — THE CREATION RECORD, and it is the ELEVATED LEG's measurement of its own command, not this driver's measurement of the handoff. No provider creation timestamp is claimed and no instant is invented between these bounds." +record "T1_INTERVAL start=$T1_START_UTC end=$T1_END_UTC — the elevated capture's own two stamps" +record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — SEPARATELY LABELLED. This is how long the handoff took, and it is not a bound on anything the leg ran." +# THE SETUP'S EXIT, TWICE, FROM TWO CHANNELS. The receipt's exit= line keeps its authority +# (SETUP_RC is unchanged); the step-5 file is the evidence that the value was preserved BEFORE +# the capture ran. A disagreement is reported, never resolved by preference: it means one of +# the two readings is of something else. +case "$SETUP_EXIT_FILE" in + "$SETUP_RC") + record "SETUP_EXIT_PRESERVED=$SETUP_EXIT_FILE — the leg's own file agrees with the receipt's exit=, and it was written before t1 ran" ;; + ABSENT) + record "SETUP_EXIT_PRESERVED=ABSENT — step 5 produced no file. The receipt's exit=$SETUP_RC is then the ONLY reading of the setup's exit, and nothing here shows it was captured before the capture command overwrote \$LASTEXITCODE." ;; + UNPARSEABLE) + record "SETUP_EXIT_PRESERVED=UNPARSEABLE — a step-5 file exists and carries no readable exit. An unread exit is not a zero one." ;; + *) + record "SETUP_EXIT_DISAGREES receipt=$SETUP_RC leg_file=$SETUP_EXIT_FILE — TWO CHANNELS, TWO ANSWERS. Neither is preferred here; the receipt's value continues to be used because that is the declared channel, and this line is the standing caveat on it." ;; +esac +# ORDERING IS ASSERTED, NOT ASSUMED. Six stamps taken in an order this driver REQUESTED are a +# claim about that order until they are compared. Parsed with the calendar (ts_readable's rule, +# GNU date -u -d) and compared as epochs; a gap or an unparseable value leaves the comparison +# UNMEASURED rather than passing it. Stamps one second apart or identical are expected: the +# resolution is one second, so the test is <=, and an out-of-order pair is a real violation. +TS_ORDER=UNMEASURED +if ts_readable "$HANDOFF_REQUEST_UTC" && ts_readable "$SETUP_START_UTC" && ts_readable "$SETUP_END_UTC" \ + && ts_readable "$T1_START_UTC" && ts_readable "$T1_END_UTC" && ts_readable "$HANDOFF_RECEIPT_UTC"; then + ts_hq=$(date -u -d "$HANDOFF_REQUEST_UTC" +%s); ts_ss=$(date -u -d "$SETUP_START_UTC" +%s) + ts_se=$(date -u -d "$SETUP_END_UTC" +%s); ts_t1s=$(date -u -d "$T1_START_UTC" +%s) + ts_t1e=$(date -u -d "$T1_END_UTC" +%s); ts_hr=$(date -u -d "$HANDOFF_RECEIPT_UTC" +%s) + if [ "$ts_hq" -le "$ts_ss" ] && [ "$ts_ss" -le "$ts_se" ] && [ "$ts_se" -le "$ts_t1s" ] \ + && [ "$ts_t1s" -le "$ts_t1e" ] && [ "$ts_t1e" -le "$ts_hr" ]; then + TS_ORDER=OK + else + TS_ORDER=VIOLATED + fi +fi +record "TIMESTAMP_ORDER=$TS_ORDER handoff_request=$HANDOFF_REQUEST_UTC <= setup_start=$SETUP_START_UTC <= setup_return=$SETUP_END_UTC <= t1_start=$T1_START_UTC <= t1_end=$T1_END_UTC <= handoff_receipt=$HANDOFF_RECEIPT_UTC" +[ "$TS_ORDER" = VIOLATED ] && record " THE SEQUENCE THE REQUEST ASKED FOR DID NOT HAPPEN IN THAT ORDER. The stamps are kept as taken; nothing is reordered or discarded, and every interval above is read with this line beside it." +[ "$TS_ORDER" = UNMEASURED ] && record " ORDER NOT MEASURED — at least one of the six stamps is missing or unparseable, so no ordering claim is made either way." # t1's OWN exit, read from its OWN file. Absent file = the elevated capture never ran. if [ -f "$R/d2-t1.exit" ]; then D2_T1=$(tr -d ' \r\n' < "$R/d2-t1.exit")