# Output of shift/run_anchor_demo.sh — 2026-10-15T13:43:16Z, gcc 13, cargo 1.97.0 (c980f4866 2026-06-30), OpenSSL 3.0.13
# (Temporary paths and timings vary per run.)

== R1. Bridge on the host clock, anchored every 1 s; the program runs normally
LOG now=2026-10-15T13:43:18.000000000Z due=2026-11-14T13:43:18.000000000Z
LOG now=2026-10-15T13:43:19.000000000Z due=2026-11-14T13:43:19.000000000Z
LOG now=2026-10-15T13:43:20.000000000Z due=2026-11-14T13:43:20.000000000Z
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  anchor records written: 3
  verifier: PASS: 3 anchor record(s); every token verifies and the chain is unbroken
  latest record:
    bridge_time=1792071800.593297504
    source=host
    seq=3
    prev_sha256=2a8764302623779a98e57593c807bafffc1b3def5bb5ec15505c376435351b6e

== R2. Bridge clock is WRONG (test clock set to 2040) while the timestamp authority says today.
   The bridge must catch its own wrong time and declare FAULT; the helper relays it and stops the program.
time_shift_shim: FAULT declared by bridge: bridge time disagrees with timestamp authority by 420848199105 ms
time_shift_shim: FULL STOP - refused in time(); stopping the program so it never sees a time it cannot trust
shift/run_anchor_demo.sh: line 23:  5091 Aborted                 STB_BRIDGE_SOCKET="$SOCK" STB_BRIDGE_UID="$(id -u)" STB_SHIFT_SECS="$SHIFT" STB_CACHE_MS="${1:-1000}" LD_PRELOAD="$WORK/shim.so" "$WORK/legacy_app"
  legacy_app exited with status 134 (full stop; no time given)
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: FAULT declared: bridge time disagrees with timestamp authority by 420848199105 ms; refusing NOW until restarted

== R3. Timestamp authority unavailable at startup (no anchor yet): bridge refuses as UNVERIFIED
time_shift_shim: REFUSED - bridge error: UNVERIFIED anchor command failed (exit status: 1)
time_shift_shim: FULL STOP - refused in time(); stopping the program so it never sees a time it cannot trust
shift/run_anchor_demo.sh: line 23:  5123 Aborted                 STB_BRIDGE_SOCKET="$SOCK" STB_BRIDGE_UID="$(id -u)" STB_SHIFT_SECS="$SHIFT" STB_CACHE_MS="${1:-1000}" LD_PRELOAD="$WORK/shim.so" "$WORK/legacy_app"
  legacy_app exited with status 134 (full stop; no time given)

== R3b. Authority comes back: the same bridge (not restarted) verifies and serves again
LOG now=2026-10-15T13:43:22.000000000Z due=2026-11-14T13:43:22.000000000Z
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: UNVERIFIED: anchoring failed (anchor command failed (exit status: 1)); refusing NOW

== R4. Authority goes away AFTER a good anchor (interval 500 ms, max age 1500 ms)
   expected: served while the last good anchor is under 1.5 s old; refused after
LOG now=2026-10-15T13:43:22.000000000Z due=2026-11-14T13:43:22.000000000Z
  at about +0.7 s:
LOG now=2026-10-15T13:43:23.000000000Z due=2026-11-14T13:43:23.000000000Z
  at about +1.9 s:
time_shift_shim: REFUSED - bridge error: UNVERIFIED anchor command failed (exit status: 1)
time_shift_shim: FULL STOP - refused in time(); stopping the program so it never sees a time it cannot trust
shift/run_anchor_demo.sh: line 23:  5225 Aborted                 STB_BRIDGE_SOCKET="$SOCK" STB_BRIDGE_UID="$(id -u)" STB_SHIFT_SECS="$SHIFT" STB_CACHE_MS="${1:-1000}" LD_PRELOAD="$WORK/shim.so" "$WORK/legacy_app"
  legacy_app exited with status 134 (full stop; no time given)
  bridge: Self-check: FAULT if the time source moves backward or stalls longer than 1000 ms
  bridge: WARNING: anchoring failed (anchor command failed (exit status: 1)); last good anchor still within max age
  bridge: UNVERIFIED: anchoring failed (anchor command failed (exit status: 1)); refusing NOW

== R5. Someone edits an anchor record after the fact: the chain verifier must catch it
  verifier: FAIL: record 000001 does not match its timestamp token (altered or token invalid)
  verifier: FAIL: record 000002 does not link to the previous record
