d9b17d58

test: e2e — delete the unfalsifiable check; (c) measures the time it claims; honest bounds

a73x   2026-08-12 05:05

test: e2e — delete the unfalsifiable check; (c) measures the time it claims; honest bounds

An independent review of d6888aa found real defects. The central one is
mine and worth stating plainly: the post-hoc `kill -0` added in bde1af5
could not fail. `wait_pid_gone` returns only when `kill -0` has already
failed, a dead process cannot resurrect, and so the only way that check
could ever fire is pid reuse — 4194304 pids on this box, inside a ~6s
window — in which case it would be reporting an unrelated process while
claiming ssh came back. A check that can only fail falsely is worse than
no check, and both sentences of its comment were wrong besides: one
absence observation already implies absence at every later instant for
that process, and reuse presents as ALIVE, so it was never confusable
with a corpse. Deleted.

What actually closes the ordering hole is the baseline, and it now sits
AFTER wait_pid_gone rather than before it. There it establishes exactly
what the next check needs — at the instant ssh was observed gone, the
second marker had not arrived — instead of pinning absence at some
earlier moment and silently depending on wait_pid_gone's 2s budget
staying small against the script's 6s.

(c) claimed "a stale cache costs TIME, never correctness" and measured
only the correctness half. A build that read no cache at all would take
the cold path, heal, print nothing and spawn one ssh, passing all six of
its checks without ever paying the cost the sentence is about. It now
times the attach and asserts a 1500ms floor (measured 2125ms; a
no-cache-read build lands near 300ms). Scenario (b) is what catches such
a build in practice, but (c) is what the spec names as this invariant's
pin, and it should stand on its own. Controlled in situ: raised to 9000
it fires with its own message at 2022ms, restored it is green.

(e)'s budget bound enforced <1500 while its message asserted a spent QUIC
budget — false for anything in [1500, 2000), since the budget is 2000 and
a spent one measures 2026+. The bound stays; the message now reports the
number and says which readings mean what, because a failure message may
not name a cause its own number cannot prove.

Also: the three backgrounded launches lose the `set +e` ceremony d6888aa
added — `cmd &` cannot fail, and the ceremony belongs only on foreground
RC captures; every backgrounded client pid is cleared after its wait, so
the trap's "a pid here means a failing run" doctrine holds for these as
it already did for the daemons; (b)'s spawn-progress grep is gone, since
the pidlog assertion above it already proves no ssh ran and the grep
could not have failed independently; the redundant --quic-idle-ms on the
key-mismatch daemon is gone, with a note that the 15000 in (d)'s ceiling
reasoning is the CLIENT's constant; and two comments now describe what
they actually cover — the arity guard catches `ssh HOST` with no command
(a silent no-op, not a loud 127), and (e)'s evidence note counts seven
assertions, three of them specific to the scenario.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>