# Output of shift/run_bridge_demo.sh — 2026-10-15T03:57:37Z, gcc 13, cargo 1.97.0 (c980f4866 2026-06-30), OpenSSL 3.0.13
# (Temporary paths and timings vary per run.)

== F. Bridge reports 2040-02-15 (test clock); helper takes its time from the bridge
LOG now=2040-02-15T12:00:00.000000000Z due=2040-03-16T12:00:00.000000000Z
  now:      2012-02-15 Wed 12:00:00
  due:      2012-03-16 Fri 12:00:00
  due after now?  yes
  license:        valid

== G. Bridge on the real host clock; same chain (today's date, shifted and restored)
  host clock: 2026-10-15T03:57:38Z
LOG now=2026-10-15T03:57:38.000000000Z due=2026-11-14T03:57:38.000000000Z
  now:      1998-10-15 Thu 03:57:38
  due:      1998-11-14 Sat 03:57:38
  due after now?  yes
  license:        valid

== H. Bridge stopped: helper must refuse, with no fallback to the host clock
time_shift_shim: REFUSED - bridge unreachable at /tmp/tmp.3GBnyT5Yuh/bridge.sock
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== I. Bridge reports 2066-01-19T03:14:08Z: past the shifted 32-bit limit, helper must refuse
time_shift_shim: REFUSED - true time 3031096448 minus shift 883612800 does not fit a 32-bit field
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== J. Impostor (same account as the bridge) sends a malformed reply: helper must refuse
time_shift_shim: REFUSED - malformed bridge reply
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== K. STB_BRIDGE_UID not set: helper cannot verify the bridge, must refuse
time_shift_shim: REFUSED - STB_BRIDGE_UID not set; cannot verify the bridge
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== L. Genuine bridge, but the helper expects a different account: must refuse (the check is enforced)
time_shift_shim: REFUSED - process on bridge socket runs as uid 0, expected 65534
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)

== M. Impostor running as a DIFFERENT account (uid 65534) sends a WELL-FORMED reply: must refuse
time_shift_shim: REFUSED - process on bridge socket runs as uid 65534, expected 0
legacy_app: clock unavailable
  legacy_app exited with status 1 (no time given)
  (impostor: helper hung up without sending a request)

== N. Control: the same well-formed impostor running as the BRIDGE'S OWN account is accepted
   (this is the trust boundary: anything running as the bridge's account is trusted)
LOG now=2040-02-15T12:00:00.000000000Z due=2040-03-16T12:00:00.000000000Z
