R3 simulator lifetime/source and exposure transition amendment proposal01

Prospective only: no source mutation, helper build, native trial or full soak is admitted by this proposal. It follows the static finding acknowledged by C-078 and the actual source counterexamples recorded at wiki32fd5d6.

Observed source and constraint

The frozen simulator parses no hold-through-boundary or live-begin option (examples/spindle_sim.rs:265–317). Its worker can return immediately after the final7199 offer is ACKed (:516–518); began_unix_ns appears only after joins in its end summary (:549–556). A harness that keeps its own probes alive after native exit cannot satisfy R3's explicit refusal of early simulator exit or supply a native pre-offer begin witness. This is static source evidence; no elapsed7200-second run has occurred.

Canonical cross_family/inputs.py:49–55 requires the unchanged complete source tuple and all three canonical uninstalled helper hashes. A corrected helper cannot honestly keep that source tuple or replace the original manifest. Packages, native lower-metadata fixtures, canonical helper files and canonical manifests remain unchanged.

Proposed separate simulator authority

Keep canonical DEB/RPM/source/provenance admission intact, including default refusal of any changed canonical helper. Keep original server_dump and spool_dump as the actual graders. Introduce a separate explicitly admitted R3 simulator source/build manifest alongside those canonical inputs. The active R3 simulator identity is a second authority, never a rewritten canonical manifest.

The prospective source branch is milestone/simulator-exposure-witness from the exact candidate code8fb6f413; the only changed executable compilation input is examples/spindle_sim.rs. The build must demonstrate complete byte equality of every non-helper compilation input against canonical source: Cargo.lock/manifests/config, crate sources, build scripts, vendored code and other transitive inputs. Separate trust controls/docs may change but cannot conceal a changed compilation input. Reject any additional compilation-input difference.

Limit the native correction to: (1) publish an exclusive atomic begin witness before worker offers, with actual monotonic/Unix correlation brackets and uncertainty bound to the same native begin used by simulator events/summary; (2) refuse successful completion before the native duration boundary and emit its actual exit/lifetime observations. Preserve the100 workers/identities, seed, rates, body generation, burst behavior, wire/delivery semantics, retry and drain refusals. No new project dependency or core change is needed.

The separate admission record supplies the independently reviewed source commit/tree, source manifest/bundle, canonical parent input hashes, exact changed file, Cargo.lock, rustc/build configuration, native binary hash, build command/exit/resource/stop and known native lifecycle control receipts. Freeze/runtime/checkpoint/grading receipts bind both canonical inputs and the actual loaded R3 simulator executable/source/build identity. A self-consistent witness or self-asserted hash is insufficient; expected identities come from the owner-admitted external record.

Register independent literal controls before implementation: early completion by1ns and exact boundary completion; absent/changed/nonexclusive begin witness; summary/witness/identity mismatch; uncertain/reversed clock brackets; missing worker offers; changed loaded executable; changed helper source or build receipt; altered non-helper compilation input; unchanged canonical manifest and dump-helper refusal behavior. Record named red before correction. Then run the named example tests, existing fast/extended gates on exact helper compilation inputs, contained short native lifetime/begin controls and reproducible isolated simulator construction. Each run needs a later exact frozen command/admission; no historical candidate check is described as checking new helper code.

Proposed exposure-phase transition margin

The current registration simultaneously requires observed coverage >=7200s and a phase ceiling exactly7200s, and remaining_ns refuses blocking operations at the exact deadline. This leaves no observation, clock-conversion or transition allowance. Rounding an observation, inventing an exact end, or charging the delayed transition to drain would violate the registration.

Propose keeping the offered interval/cohorts exactly7200 seconds and registering a separate measured10-second transition/observation allowance inside the exposure phase. Prospective ceilings: setup170, exposure7210 (7200 offered + at most10 transition), shared drain/seal60, shutdown20, checkpoint20, closeout20; total7500. No phase borrows another allowance, and the actual native offer interval remains7200. This is a prospective replacement of two ceiling values in a separate trust commit, never a retroactive reinterpretation of an old run.

Full admission remains conditional on real S1 observations plus25%margin for every non-exposure phase, including setup maximum<=136s, and separately measured exposure transition/anchor/observation maximum<=8s. All original query/RSS/delivery/cohort thresholds stay unchanged. If measured maxima cannot fit this allocation, retain7200 offered seconds and request a concrete larger outer deadline from the owner with actual values. No deadline increase or synthetic timing assumption is requested here.

Resource and completion limits

No Cargo run is authorized by this amendment proposal. The shared cache has been cleared; the next compile is cold. A new compile plan must reserve its complete cold footprint using actual historical inventory/measurement, account for copies/toolchain/output/margin and pass a fresh95GB complete census; the obsolete4GiB reserve is forbidden. The default enforced resource launcher remains mandatory, and any longer local run requires its own owner scope. Avoid building twice unless a real mismatch needs investigation.

The original candidate build/console hashes and package extended evidence remain unchanged for shipped packages. New helper evidence is separate and cannot qualify product migration. FULL still needs fresh41,42,45,43,46; actual integration and source admission; an admitted smoke; all stopped immutable raw/checkpoint/grader bindings; and complete S1 observations. This proposal requests prospective scope review only, not a full run.