# Output of shift/run_anchor_demo.sh — 2026-10-15T03:57:47Z, gcc 13, cargo 1.97.0 (c980f4866 2026-06-30), OpenSSL 3.0.13
# (Temporary paths and timings vary per run.)

== R1. Bridge on the host clock, anchored every 1 s; the program runs normally
LOG now=2026-10-15T03:57:49.000000000Z due=2026-11-14T03:57:49.000000000Z
LOG now=2026-10-15T03:57:50.000000000Z due=2026-11-14T03:57:50.000000000Z
LOG now=2026-10-15T03:57:51.000000000Z due=2026-11-14T03:57:51.000000000Z
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  anchor records written: 3
  verifier: PASS: 3 anchor record(s); every token verifies and the chain is unbroken
  latest record:
    bridge_time=1792036671.865875079
    source=host
    seq=3
    prev_sha256=123cd99ca3bcdfe36b41d9442fbb2fad94023d07951fcc9d954e281458ec70fc

== R2. Bridge clock is WRONG (test clock set to 2040) while the timestamp authority says today.
   The bridge must catch its own wrong time and declare FAULT; the helper relays it and refuses.
time_shift_shim: FAULT declared by bridge: bridge time disagrees with timestamp authority by 420883327003 ms
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: FAULT declared: bridge time disagrees with timestamp authority by 420883327003 ms; refusing NOW until restarted

== R3. Timestamp authority unavailable at startup (no anchor yet): bridge refuses as UNVERIFIED
time_shift_shim: REFUSED - bridge error: UNVERIFIED anchor command failed (exit status: 1)
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== R3b. Authority comes back: the same bridge (not restarted) verifies and serves again
LOG now=2026-10-15T03:57:53.000000000Z due=2026-11-14T03:57:53.000000000Z
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: UNVERIFIED: anchoring failed (anchor command failed (exit status: 1)); refusing NOW

== R4. Authority goes away AFTER a good anchor (interval 500 ms, max age 1500 ms)
   expected: served while the last good anchor is under 1.5 s old; refused after
LOG now=2026-10-15T03:57:53.000000000Z due=2026-11-14T03:57:53.000000000Z
  at about +0.7 s:
LOG now=2026-10-15T03:57:54.000000000Z due=2026-11-14T03:57:54.000000000Z
  at about +1.9 s:
time_shift_shim: REFUSED - bridge error: UNVERIFIED anchor command failed (exit status: 1)
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: WARNING: anchoring failed (anchor command failed (exit status: 1)); last good anchor still within max age
  bridge: UNVERIFIED: anchoring failed (anchor command failed (exit status: 1)); refusing NOW

== R5. Someone edits an anchor record after the fact: the chain verifier must catch it
  verifier: FAIL: record 000001 does not match its timestamp token (altered or token invalid)
  verifier: FAIL: record 000002 does not link to the previous record
