# Output of shift/run_v14_demo.sh — 2026-10-15T14:00:19Z, gcc 13, cargo 1.97.0 (c980f4866 2026-06-30), OpenSSL 3.0.13
# (Temporary paths and timings vary per run.)

True date: 2026-10-15. Program time under the 28-year shift: 1998-10-15.

== V1. Full stop: a program that never checks time() for an error, past the shifted window (2066-06-01)
   (v0.13 returned -1, which this program read as 1969-12-31 and kept running)
  helper: REFUSED - true time 3042576000 minus shift 883612800 does not fit a 32-bit field
  helper: FULL STOP - refused in time(); stopping the program so it never sees a time it cannot trust
  -> exit status 134 (134 = stopped by the helper)

== V2. Every clock and file-time route through the C library reads in program time
program clock (time())       908460021
  CLOCK_REALTIME               908460021  in program time
  CLOCK_REALTIME_COARSE        908460021  in program time
  CLOCK_REALTIME_ALARM         908460021  in program time
  CLOCK_TAI (UTC + offset)     908460021  in program time
  gettimeofday                 908460021  in program time
  timespec_get                 908460021  in program time
  ftime                        908460021  in program time
  fstat (new file)             908460021  in program time
  stat                         908460021  in program time
  lstat                        908460021  in program time
  fstatat                      908460021  in program time
  __xstat (old-glibc programs)   908460021  in program time
  statx mtime                  908460021  in program time
  after utimensat(now+1d), program reads back 908546421 (expect 908546421) OK
  after utime(now+2d), program reads back 908632821 (expect 908632821) OK
RESULT: every reading in program time
  -> exit status 0
   On disk, seen without the helper (file times set by the program land as true time):
   2026-10-17 14:00 UTC (true now + 2 days)

== V3. A file dated past the program's window (2070): full stop
  helper: REFUSED - file time 3168806400 minus shift 883612800 does not fit a 32-bit field
  helper: FULL STOP - refused in stat(); stopping the program so it never sees a time it cannot trust
  -> exit status 134

== V4. Timed waits with absolute wall-clock deadlines (each asked to wait 1 s)
   (v0.13: the shifted deadline was 28 years in the past; 14 of these returned at once)
  pthread_cond_timedwait (realtime)    waited 1.00 s (want 1) OK
  pthread_cond_timedwait (monotonic)   waited 1.00 s (want 1) OK
  pthread_cond_clockwait (realtime)    waited 1.00 s (want 1) OK
  sem_timedwait                        waited 1.00 s (want 1) OK
  pthread_mutex_timedlock              waited 1.00 s (want 1) OK
  pthread_rwlock_timedrdlock           waited 1.00 s (want 1) OK
  pthread_rwlock_timedwrlock           waited 1.00 s (want 1) OK
  pthread_timedjoin_np                 waited 1.00 s (want 1) OK
  clock_nanosleep REALTIME ABSTIME     waited 1.00 s (want 1) OK
  clock_nanosleep TAI ABSTIME          waited 1.00 s (want 1) OK
  cnd_timedwait (C11)                  waited 1.00 s (want 1) OK
  mtx_timedlock (C11)                  waited 1.00 s (want 1) OK
  mq_timedreceive                      waited 1.00 s (want 1) OK
  timerfd ABSTIME (realtime)           waited 1.00 s (want 1) OK
  timer_settime ABSTIME (realtime)     waited 1.01 s (want 1) OK
  deadline already passed (sem)        waited 0.00 s (want 0) OK
RESULT: all waits correct
  -> exit status 0

== V5. Asking the kernel directly (inline system calls, no C library): the guard
program clock              908460036
asm time syscall           908460036
asm clock_gettime          908460036
asm CLOCK_MONOTONIC (untouched, small) 473
asm newfstatat mtime       1792245621  (KNOWN GAP: direct file-information reads get true time)
asm utimensat(now+1h) read back 908463636 (expect 908463636)
fopen/fread (libc-internal fstat): ok
  -> exit status 0
   32-bit system-call form:
  helper: REFUSED - 32-bit or other-ABI system call
  helper: FULL STOP - refused in guard(); stopping the program so it never sees a time it cannot trust
  -> exit status 134
   Program tries to replace the guard's SIGSYS handler:
  helper: REFUSED - the program tried to replace the helper's SIGSYS handler
  helper: FULL STOP - refused in signal(); stopping the program so it never sees a time it cannot trust
  -> exit status 134

== V6. The program tries to switch the helper off by changing its own environment
  before: 908460036
  after program sets STB_UNCHECKED=1: 908460036
  -> exit status 0

== V7. Children: every way of starting one; each prints the date it sees
  system(date):       1998-10-15
  -> exit status 0
  popen(date):        1998-10-15
  -> exit status 0
  posix_spawn(date):  1998-10-15
  -> exit status 0
  grandchild(date):   1998-10-15
  -> exit status 0
  env stripped, date: 1998-10-15
  -> exit status 0
  empty env, date:  1998-10-15
  -> exit status 0
  missing program: exec failed normally (No such file or directory)
  -> exit status 0
  #! script child sees:   1998-10-15
  -> exit status 0
   A statically linked child (the helper cannot be loaded into it):
  helper: REFUSED - child program /tmp/tmp.32q1VBsRXu/static_probe is statically linked; the helper cannot be loaded into it
  helper: FULL STOP - refused in exec(); stopping the program so it never sees a time it cannot trust
  -> exit status 134

== V8. stb_run: start a program under the helper, or refuse it before it starts
  date under stb_run:       1998-10-15
  -> exit status 0
  #! script child sees:   1998-10-15
  -> exit status 0
stb_run: REFUSED - static_probe is statically linked; the helper cannot be loaded into it and it would run on true time; the program was not started
  -> exit status 126
   The same static program started with LD_PRELOAD directly (what stb_run prevents): true time, no warning
  time()                  1792072836
