Row 299 / Vikunja 573: direct P10 timing

Execution method: Gander implements inline after Mos's old-test ruling and Filbert's static read. No delegation. Static implementation authorized by mos-1409 / sage-3181. Every runtime step remains held for CLEAR.

Goal: Measure whether P10 takes its two-second inner path or four-second outer path under load, without subtracting unrelated work from another run.

Architecture: Add a test helper that makes a private, instrumented copy of the current acceptance script. Two root-side observer statements bracket only the P10 capture's actual bounded wait. Read a complete monotonic begin/end pair from a separate fixture file, while all existing refusal, residual and cleanup assertions still examine the real acceptance output.

Tech stack: Existing Node test runner, Bash builtins, Linux /proc/uptime. No new package, interpreter, product hook or live host action.

Spec: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: 573, the P10 hop band"; sage-3175. Base 4a9c536e8, branch gander/row299-p10. Reviewer Filbert; gate owner Sage. Row 293 is done. Queue claim is held because it executes Node, forbidden in the present slot.

Constraints and current status

Static implementation only, authorized by mos-1409. No Node, tests, HTTPS Git, queue call or push has run for 299. No production edit.
Mos approved the measurement semantics in mos-1409 via sage-3181 under mos-1272. The numeric bands stay unchanged.
All script/supervisor bytes, 2/4-second budgets, 128-byte cap, exact reason assertions, no-observed assertion, hop residual assertion and cleanup assertions remain authoritative.
Keep the same healthy baseline status and baseline leaves no session assertions. It may remain as an independent healthy control and diagnostic; it no longer supplies the clock value being asserted.
No extra retry, smoothing, percentile selection, ignored red, clock fallback, or widened band. Missing clock evidence fails.
Tests use a short TMPDIR directly under /mnt/storage/scratch/tmp/gXXXXXX, never /tmp. No live units, ports, credentials or instance state.

Source of the band and evidence

The original row 253 test timed the full acceptance run. Row 276 exposed it after adding stdout spooling: the old inner <4 s whole-run bound already failed 2/5 before that delta and 5/5 after it. Mos's mos-1350 ruled that tests 9 and 10 must measure the probe's cost, offering probe stamps or a same-mode no-fault baseline. See agents/gander/work/queue-276/BUILD.md:120-145 and ASSERTION-PRESERVATION.json.
We chose baseline subtraction in 135bb8fae (original source 6f8c5653a). e06130fc0 added the required clean baseline check. Current test lines 371-388 measure two separate full runs and compute probeSeconds=seconds-baselineSeconds.
The adopted windows are inner [1.25,2.75) and outer [3.25,4.75): 0.75 s around the configured 2/4 s budgets, with 0.5 s between windows. Duckworth-0218 accepted them; the isolated proof in queue-276/BUILD.md reported inner exec 2.033..2.171, inner hop 2.055..2.135, outer exec 3.758..3.961, outer hop 3.736..3.911. Those are historical evidence, not a new run or carried result.
The recorded failure is agents/gizmoduck/work/queue-270/BUILD.md:629-636: run 3 on 53406f3e4 had CLI 904/905, inner hop estimate 1.08 below 1.25. The file was unchanged. Its isolated whole rerun passed 50/50 at load 3.19 (mos-1367). No other seat's scratch has been read for this packet.
Production is scripts/case1-accept.sh:744, tester_capture 2 4 128. Its inner timer is after the uid drop; its outer timeout is started at :238 and waited at :244. The capture validates tools and creates its private files at :233-235, before the timer is armed. Exact refusal mapping is :224-229. The stalled-supervisor case remains an explicit same-uid residual.

Static mechanism: let H be the healthy probe cost, I the true faulty wait and U the rest of the full run, including scheduling delays. The current estimate is (I + U_fault) - (H + U_baseline). It contains U_fault-U_baseline-H, so it can underestimate I when the baseline gets more delay. The 1.08 report is consistent with that mechanism; we do not invent the separate component timings absent from the committed record. A direct bracket removes the unrelated subtraction; execution must still establish its margins under the agreed load.

Approaches considered

Repeat baselines or use a median: reduces some noise but still subtracts two unrelated schedules and adds work to every whole-file gate. Reject as the fix.
Stamp in the peer Python or sudo fake: the inner/outer timer is already armed before a delayed child reaches the stamp, so it can measure only the remaining budget and undercount again. Reject.
Recommend a direct root-side bracket in a private script copy. Begin immediately before the actual outer timeout launch, after validation; end immediately after its wait, before unrelated post-checks. Includes sudo dispatch, the inner wait and its cleanup, or the outer timeout. Excludes preceding functional checks, the healthy run, metadata work before capture, and tool-validation cost. It measures the same timing distinction, using both existing fake sudo modes.

Mos approved this approach in mos-1409. Timing still includes kernel scheduling and inner cleanup. Arbitrary starvation cannot be given a hard wall-time guarantee; an overshoot remains a red for placement, not permission to retune.

Proposed files and interfaces

New packages/cli/tests/case-p10-timing-fixture.mjs: instrumentP10Probe(source) returns a copy of the current script with exactly two observer blocks; readProbeSeconds(text) returns (end-begin) in seconds from two validated centisecond readings.
Existing packages/cli/tests/case1-accept.test.mjs: an optional script-path argument to run(), defaulting to SCRIPT for every current caller. Only inner/outer P10 fault runs execute the private copy. The baseline still uses SCRIPT. Overflow stays on SCRIPT and unchanged.
agents/gander/work/queue-299/: plan, assertion-preservation record, manifest, raw logs, load/timing receipts and mutant records after authorization. No production path in the candidate manifest.

Observer details:

Locate exactly one tester_capture() ( function, scoped before the unique row276-legacy marker. Each insertion anchor must occur once within that slice. Never apply an unscoped global replace.
Just before :238 and just after :244, use shell read on /proc/uptime plus printf to append begin <uptime> / end <uptime> to ROW299_TIMING_FILE, only when maximum is 128. Selecting the existing probe cap, rather than the 2/4 budgets, keeps the observer active when a timer mutant changes a budget. Config query uses 4096 and emits no probe pair.
Read and printf are Bash builtins: no new process or Python/Node startup inside the timed span. Preserve $rc and every original command, redirection and heredoc byte. Do not emit observer bytes on stdout/stderr. The file is private fixture evidence, not a product authority channel.
The copy retains the original absolute /proc reads and the --root fixture seam. The script has no relative self-path imports. Write the copy under h.dir with executable mode and pass the private timing path only to that run. No product script is rewritten.
Reverse the two recorded insertions and assert byte equality with freshly read SCRIPT. This applies to the current script, including a deliberately mutated source, rather than a stale frozen healthy copy. The same source/copy comparison and unique anchors fail closed on drift.
Parser requires exactly one newline-terminated begin and end pair, in that order, each <integer>.<two digits>, and end strictly above begin. No extra pair, missing value, NaN or negative interval is accepted. Use integer centiseconds before converting to seconds. A 10 ms clock resolution is much smaller than the existing 0.5 s window gap.
Keep inner [1.25,2.75) and outer [3.25,4.75) exactly. Change only the source of probeSeconds and its diagnostic description. Preserve every existing status/reason/no-observed/residual/cleanup assertion, including the healthy baseline checks. The existing 7 s fixture safety guard stays unchanged and remains cleanup only, never proof of an outer timeout. If it intervenes or masks a measurement, stop for Sage/Mos; do not silently extend it.

Review focus

A delayed healthy baseline cannot change the measured interval: it is diagnostic only. No baseline value enters readProbeSeconds or a timing assertion.
A child delayed after timer arming is not used as the start observer. The begin read precedes timer launch in the root-side capture copy.
Missing/duplicated/reversed records fail before a band assertion. Add named observer-record tests; no fallback to the old arithmetic.
A timer mutant reaches the actual observer copy. Source reconstruction and cap-based selection prevent budgets changed to 1/3 seconds from disabling observation.
Observer code must not change stdout, refusal status, cleanup or trust. Preserve original source bytes by inverse comparison and all original non-timing assertion lines by an assertion-preservation receipt.

Implementation and evidence sequence (held)

Proposal sent in gander-0183; mos-1409 / sage-3181 approve the measurement change. Filbert accepts the observation points and supplies implementation checks I1-I5.
Source 1ec2b9765 adds the helper and observer wiring, plus source/variable, streams/status/trap, and record-validation tests. ASSERTION-PRESERVATION.json lists all six old line replacements; only two original assertion messages change. No runtime or syntax claim.
Static review on the committed candidate and manifest. Prove scripts/case1-accept.sh and scripts/case2-unit.sh are byte-identical to the approved base, and no unrelated assertion moved. Finalize all mutant anchors with exactly-one checks.
On Sage CLEAR, first record a passing named base for each killer and then M1-M6 from MUTANT-PLAN.json. Report the actual assertion killed. Every restore is byte-identical and git status is checked. A timeout or survivor stops for placement, not a kill.
Run case1-accept.test.mjs whole at least three times under load, then CLI whole, as the brief requires. Record ambient load at each of the three starts and throughout each file; >=4 is a target, never a wait condition (mos-1409). No stress process. The whole CLI suite is the required loaded proof; record its load and all exec/hop direct intervals, plus min/max. Do not hold the slot for load.
Record all timeout limits before launch: per-node-file timeout -k 10; use at least ceil(3x longest receipt)+120, with 900 s for an unknown file. Whole case1 gets 1200 s from the row293 receipt; stack-release 2400 s from its 683.647 s historical receipt; recheck measured maxima before the current gate. Print the full CLI file list and run the package whole with its normal test-file concurrency, so the suite itself supplies the required loaded proof. Use timeout -k 10 5400 around that whole invocation: 3x the row293 1367.764 s CLI receipt plus 120 is 4224 s, below 5400. TMPDIR is fresh short scratch. No runs are authorized now.
Any old-test red, reason mismatch, fixture-guard intervention, timeout, or survivor goes to Sage/Mos before edits or retry. No carried result from row293. Commit and publish records only in Sage's gap, claimant review move only in a queue gap. Filbert reviews; Sage gates and lands.

Static self-review

The proposal meets the brief's source/fix/mutant items and preserves the 2/4 s distinction and separated numeric windows. No runtime or load-stability claim is made. Timing-copy instrumentation is the main review risk: Filbert must approve the two exact observation points and source-byte reconstruction before execution. Mos approved the changed old-test measurement semantics in mos-1409. The 7 s whole-run fixture guard and scheduling overshoot remain explicit risks to measure, not hidden assertions to relax. No other test or supervisor repair is bundled.

Implemented static: mos-1409 / sage-3181 and Filbert I1-I5

Source 1ec2b9765 on base 4a9c536e8. The two observers use read -r row299_up row299_spare < /proc/uptime, never the fixture root. Both guard cap 128 and a nonempty ${ROW299_TIMING_FILE-}. printf is redirected to that absolute private fixture file; grouped stderr goes to /dev/null; errors leave absent evidence which the parser refuses. No observer assigns a production capture variable, changes rc, or touches a trap. New tests assert row299-only read targets and no other assignment; preserve explicit stdout/stderr bytes, exit 87 and the EXIT trap; and reject missing begin/end, duplicate pair, reversed order, nonnumeric/equal/backward readings, and a missing/extra final newline.

Only inner/outer fault runs receive the absolute timing path and executable 0700 private copy. Every such run reverses its two insertions and compares to a fresh read of SCRIPT, including any timer mutant. Baseline and overflow use SCRIPT; baseline status and clean-session assertions remain unchanged. The clock pair is required by assert.doesNotThrow before applying the unchanged bands. baselineSeconds stays diagnostic only. Capture launch insertion keys on its unique LC_ALL=C prefix rather than the timeout command itself, so M4 (outer removal) reaches execution instead of an anchor refusal.

M1-M6 have one target each in their defined scope. M5 now suppresses only the begin printf, preserving the constant block and reversal check so the named inner test must reject an end-only record. M6 admits equal readings so the record-validation test must catch it. M1 retains the known startup-overhead risk: save its interval and stop on a survivor, without changing the ruled bands. All production/shared fixture bytes are unchanged. Manifest is the two test/helper paths only. No Node, syntax preflight, test, mutant, queue call, or HTTPS operation has run. The implementation is unverified until Filbert's static read and Sage CLEAR.

sage-3255 integration, static only

Rebased all three commits from 4a9c536e8 onto 80793d824 under new branch gander/row299-8079, preserving gander/row299-p10. No conflict. The range-diff has three equal pairs and all per-commit stable patch-ids match. Source is e6751ecab; both manifest blobs equal the approved 1ec2b9765 blobs, so digest 277ace0b is unchanged. Direct test/helper, product case1 script, shared CLI helper and sudo-fixture paths have zero drift over 4a9c536e8..80793d824. Row294's CLI config/access and stack-release-test changes are in the new base and covered by the required full CLI suite. No package/source/test implementation changed in this integration. Full records in integration-8079/.

Gate remains held for CLEAR. Ambient load >=4 remains a target, not a wait condition under mos-1409; no stress process. Record each of three whole case1 starts and the whole CLI suite's load and per-mode direct timings. Numeric windows and the 7 s guard remain fixed. Any red, guard intervention, timeout, survivor or overshoot stops to Sage for Mos before edits or retry.

Gate run 1: sage-3268, 2026-10-23

GREEN on ffa93b054 / 277ace0b. Three whole case1 runs 53/0/0 each; whole CLI 917/0/0 across 59 files. Total 1076/0/0, no cancelled/todo. M1-M6 all killed at their intended assertions, with byte-identical clean restores. No unmutated guard intervention, external timeout, retry or carry. UTC run 07:26:52–07:50:16 (1404 s). CLI load reached 7.17; direct CLI intervals inner exec/hop 2.27/2.27, outer exec/hop 4.01/4.01.

M4 follows sage-3273 / mos-1426: the 7 s fixture guard returned, then exact outer-reason assertion at case1-accept.test.mjs:445 failed on probe-inner-command. No timeout or cleanup-only kill. M1 measured 1.23 s, preserving the noted narrow kill margin. Sweep found zero gate residuals; four MCP harness processes predate this run. Full records, load samples, assertion locations and named base evidence are in run1/RESULTS.md and run1/results.json. Manifest remains unchanged.

16 KiB Raw Permalink Blame History Unescape Escape