test: port the sep scratch-contract observer to ww; retire 989_sepscratch

sepscratch_test.ww pins the #59 build_one_sep scratch ownership on
both driver stages: build -o keeps <stem>.sepwork, `run` leaves no
/tmp/ww_run_<pid> root, and a foreign pre-existing .sepwork is
refused with exit exactly 1, sentinel intact. The C fork/execl pid
capture becomes `sh -c 'echo $$ ...; exec <drv> run ...'` -- exec
keeps the shell's pid and passes the full driver path as argv[0].

Makefile

@@ -363,7 +363,7 @@ BYTEID_WW_TARGETS = $(BYTEID_WW_TESTS:%=wwtest/%)
 # units, link rejects), NOT byteid suites: they run under
 # test-compiler beside the surviving residual carriers.
 SEP_WW_TESTS = test/sep/sepbuild_test.ww test/sep/sepimport_test.ww \
-	  test/sep/seplink_test.ww
+	  test/sep/seplink_test.ww test/sep/sepscratch_test.ww
 SEP_WW_TARGETS = $(SEP_WW_TESTS:%=wwtest/%)
 BOOTSTRAP_WRAPPER_SOURCES = test/wcc/950_selfcheck.c \
 	  test/wcc/991_w6a_ww.c \

test/sep/sepscratch_test.ww

@@ -0,0 +1,127 @@
+package sepscratch_test;
+
+// #59 scratch-ownership contract of build_one_sep, both driver stages.
+// Port of the retired native carrier test/wcc/989_sepscratch_run.c;
+// every assertion preserved.
+//
+//  keep      — `build -o` scratch (<stem>.sepwork) SURVIVES the build
+//              (keepscratch: the byte-id gates read it).
+//  cleanrun  — `run` leaves no /tmp/ww_run_<pid> scratch root behind.
+//              The driver keys the root on its OWN pid, so the child is
+//              launched via `sh -c 'echo $$ > pid; exec <drv> ...'` —
+//              exec keeps the shell's pid, and the full driver path
+//              lands in argv[0] (the driver derives self_dir from it).
+//  collision — a pre-existing <stem>.sepwork belongs to someone else:
+//              build must refuse with exit EXACTLY 1 (not adopt), and
+//              the foreign sentinel must survive byte-for-byte.
+//
+// Dropped C machinery, not assertions: the fork/execl pid capture (the
+// sh exec trick above carries it) and the per-path unlink/rmdir
+// accounting (testenv.clean asserts the recursive removal).
+
+import os;
+import os.exec;
+import strings;
+import testenv;
+import time;
+
+fn fail(label: str, why: str) void = {
+	let m: str = strings.concat("sepscratch FAIL: ", label, " -- ", why,
+		"\n");
+	os.write(2, m.ptr, m.len: u64);
+	assert(false);
+};
+
+fn tmo() time.duration = {
+	return (240i64 * (time.second: i64)): time.duration;
+};
+
+// A no-import root: builds fast, still produces a real __root scratch.
+fn rootsrc() str = {
+	return strings.concat(
+		"package main;\n",
+		"fn main() i32 = { return 0; };\n");
+};
+
+@test fn keep() void = {
+	let td: str = testenv.fresh();
+	let rootww: str = strings.concat(td, "/root.ww");
+	testenv.writefile(rootww, rootsrc());
+	let drvs: []str = ["ww", "ww_ww"];
+	let i: i32 = 0;
+	for (i < drvs.len) {
+		let prog: str = strings.concat(td, "/prog_", drvs[i]);
+		let av: []str = [testenv.driver(drvs[i]), "build", "-o", prog,
+			rootww];
+		let co: testenv.commandout;
+		testenv.runcommand(td, td, strings.concat("build_", drvs[i]),
+			av, tmo(), &co);
+		if (co.termination != exec.termination.EXIT || co.code != 0) {
+			fail(drvs[i], "build -o failed");
+		};
+		if (!testenv.exists(strings.concat(prog, ".sepwork"))) {
+			fail(drvs[i], strings.concat("build -o scratch was removed ",
+				"(gates read it; keepscratch must hold)"));
+		};
+		i += 1;
+	};
+	testenv.clean(td);
+};
+
+@test fn cleanrun() void = {
+	let td: str = testenv.fresh();
+	let rootww: str = strings.concat(td, "/root.ww");
+	testenv.writefile(rootww, rootsrc());
+	let drvs: []str = ["ww", "ww_ww"];
+	let i: i32 = 0;
+	for (i < drvs.len) {
+		let pidf: str = strings.concat(td, "/pid_", drvs[i]);
+		let script: str = strings.concat("echo $$ > ", pidf, "; exec ",
+			testenv.driver(drvs[i]), " run ", rootww);
+		let av: []str = ["/bin/sh", "-c", script];
+		let co: testenv.commandout;
+		testenv.runcommand(td, td, strings.concat("run_", drvs[i]),
+			av, tmo(), &co);
+		if (co.termination != exec.termination.EXIT || co.code != 0) {
+			fail(drvs[i], strings.concat("run exit != 0 (must have ",
+				"built+run, proving non-vacuity)"));
+		};
+		let pid: str = strings.trim(testenv.readfile(pidf), '\n');
+		if (testenv.exists(strings.concat("/tmp/ww_run_", pid))) {
+			fail(drvs[i], "leaked the run scratch root");
+		};
+		i += 1;
+	};
+	testenv.clean(td);
+};
+
+@test fn collision() void = {
+	let td: str = testenv.fresh();
+	let rootww: str = strings.concat(td, "/root.ww");
+	testenv.writefile(rootww, rootsrc());
+	let drvs: []str = ["ww", "ww_ww"];
+	let i: i32 = 0;
+	for (i < drvs.len) {
+		let coll: str = strings.concat(td, "/collision_", drvs[i]);
+		let scr: str = strings.concat(coll, ".sepwork");
+		assert(os.mkdir(scr, 493) == 0);
+		let sentinel: str = strings.concat(scr, "/sentinel");
+		testenv.writefile(sentinel, "owned\n");
+		let av: []str = [testenv.driver(drvs[i]), "build", "-o", coll,
+			rootww];
+		let co: testenv.commandout;
+		testenv.runcommand(td, td, strings.concat("coll_", drvs[i]),
+			av, tmo(), &co);
+		if (co.termination == exec.termination.EXIT && co.code == 0) {
+			fail(drvs[i], "adopted a pre-existing .sepwork");
+		};
+		if (co.termination != exec.termination.EXIT || co.code != 1) {
+			fail(drvs[i], "collision refusal exit != 1");
+		};
+		if (!testenv.same(testenv.readfile(sentinel), "owned\n")) {
+			fail(drvs[i], "deleted or altered the foreign sentinel");
+		};
+		i += 1;
+	};
+	testenv.clean(td);
+};

test/wcc/989_sepscratch_run.c

@@ -1,240 +0,0 @@
-/*
- * 989_sepscratch_run (#59) — the driver must not LEAK its per-build
- * `<stem>.sepwork` scratch dir. Pre-fix, `ww run` / `ww test` removed only
- * the built binary (unlink) and left `/tmp/ww_run_<pid>.sepwork/` behind
- * every invocation — the tmpfs filler. The fix (build_one_sep keepscratch
- * param + guarded rm at the wrapper choke-point) removes run/test scratch
- * while KEEPING build -o scratch (the byte-id gates read it).
- *
- * Three deterministic, self-scoped checks per driver stage (ww + ww_ww), with
- * no global /tmp glob:
- *  A. KEEP control: `<drv> build -o <td>/prog <root.ww>` → assert
- *     `<td>/prog.sepwork` STILL EXISTS (keepscratch 1). Proves the test is
- *     non-vacuous AND that the gate-read build scratch survives.
- *  B. CLEAN: fork a child that exec's `<drv> run <root.ww>`; the child's
- *     pid P fixes the driver-owned root at `/tmp/ww_run_<P>` EXACTLY. The
- *     invocation uses only its `main` and `main.sepwork` paths; after the
- *     child exits, assert that the whole root is gone. Self-scoped to P, so
- *     concurrent builds do not share ownership.
- *  C. COLLISION: pre-create the exact build scratch with a sentinel, require
- *     build refusal, and require that sentinel to survive.
- *
- * run/test share the build_one_sep scratch-cleanup choke-point and apply the
- * same exact output/root cleanup immediately around it. Revert the wrapper
- * rm or the owned-root cleanup and check B reddens.
- *
- * The trivial no-import root keeps all artifacts under a fresh mkdtemp-owned
- * directory or the driver's own exact /tmp temporary directory. Models
- * 989_sepbuild_run.c.
- */
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/wait.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-static const char *
-absbin(void)
-{
-	const char *b = getenv("BIN");
-	if (!b) b = "out/bin";
-	if (b[0] == '/') return b;
-	static char buf[2048];
-	char cwd[1024];
-	if (getcwd(cwd, sizeof cwd) == NULL) return NULL;
-	snprintf(buf, sizeof buf, "%s/%s", cwd, b);
-	return buf;
-}
-
-static int
-runwait(const char *cmd)
-{
-	int rc = system(cmd);
-	if (rc == -1) return -1;
-	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
-	return 1;
-}
-
-static int
-write_file(const char *path, const char *body, int *acquired)
-{
-	*acquired = 0;
-	FILE *f = fopen(path, "wb");
-	if (!f) return -1;
-	*acquired = 1;
-	if (fputs(body, f) == EOF) { fclose(f); return -1; }
-	return fclose(f);
-}
-
-/* fork+exec `<bin>/<drv> run <root>` with output muted; return the child's
- * pid via *outpid so the caller can name the driver's /tmp scratch. */
-static int
-run_child(const char *bin, const char *drv, const char *root, pid_t *outpid)
-{
-	char drvpath[2048];
-	snprintf(drvpath, sizeof drvpath, "%s/%s", bin, drv);
-	pid_t pid = fork();
-	if (pid < 0) return -1;
-	if (pid == 0) {
-		int dn = open("/dev/null", O_WRONLY);
-		if (dn >= 0) { dup2(dn, 1); dup2(dn, 2); close(dn); }
-		/* argv[0] MUST be the full path: the driver derives self_dir
-		 * (to locate w6c/w6a/w6l/libwwrt) from argv[0]. */
-		execl(drvpath, drvpath, "run", root, (char *)NULL);
-		_exit(127);
-	}
-	*outpid = pid;
-	int status = 0;
-	pid_t got;
-	do { got = waitpid(pid, &status, 0); } while (got < 0 && errno == EINTR);
-	if (got != pid) return -1;
-	if (WIFEXITED(status)) return WEXITSTATUS(status);
-	return 1;
-}
-
-/* A no-import root: builds fast, still produces a real `__root` scratch. */
-static const char *root_src =
-	"package main;\n"
-	"fn main() i32 = { return 0; };\n";
-
-int
-main(void)
-{
-	const char *bin = absbin();
-	if (!bin) return 1;
-	char td[] = "/tmp/wwscratch_XXXXXX";
-	char cmd[4096], rootww[1024];
-	int fail = 0, cleanup_fail = 0;
-	const char *drvs[] = { "ww", "ww_ww" };
-	int root_owned = 0;
-	int build_started[2] = { 0, 0 };
-	int collision_started[2] = { 0, 0 };
-	int collscr_owned[2] = { 0, 0 };
-	int marker_owned[2] = { 0, 0 };
-
-	if (mkdtemp(td) == NULL) return 1;
-
-	snprintf(rootww, sizeof rootww, "%s/root.ww", td);
-	if (write_file(rootww, root_src, &root_owned)) { fail++; goto out; }
-
-	for (int s = 0; s < 2; s++) {
-		/* A. KEEP control — build -o scratch must SURVIVE. */
-		char prog[1024], buildscr[1100];
-		snprintf(prog, sizeof prog, "%s/prog_%s", td, drvs[s]);
-		snprintf(cmd, sizeof cmd,
-		    "timeout 240 %s/%s build -o %s %s >/dev/null 2>&1",
-		    bin, drvs[s], prog, rootww);
-		build_started[s] = 1;
-		int brc = runwait(cmd);
-		if (brc != 0) {
-			fprintf(stderr, "sepscratch FAIL: %s build -o\n", drvs[s]);
-			fail++;
-		}
-		snprintf(buildscr, sizeof buildscr, "%s.sepwork", prog);
-		if (access(buildscr, 0) != 0) {
-			fprintf(stderr, "sepscratch FAIL: %s build -o scratch %s was "
-			    "removed (gates read it; keepscratch must be 1)\n",
-			    drvs[s], buildscr);
-			fail++;
-		}
-
-		/* B. CLEAN — run scratch must be GONE post-exit (self-scoped P). */
-		pid_t p = 0;
-		int rrc = run_child(bin, drvs[s], rootww, &p);
-		if (rrc != 0) {
-			fprintf(stderr, "sepscratch FAIL: %s run exit=%d (expected 0; "
-			    "build must have created+run, proving non-vacuity)\n",
-			    drvs[s], rrc);
-			fail++;
-		}
-		char runroot[64];
-		snprintf(runroot, sizeof runroot, "/tmp/ww_run_%d", (int)p);
-		if (access(runroot, F_OK) == 0) {
-			fprintf(stderr, "sepscratch FAIL: %s LEAKED %s\n",
-			    drvs[s], runroot);
-			fail++;
-		}
-
-		/* C. A pre-existing scratch belongs to someone else. */
-		char collision[1024], collscr[1100], marker[1200];
-		snprintf(collision, sizeof collision, "%s/collision_%s", td, drvs[s]);
-		snprintf(collscr, sizeof collscr, "%s.sepwork", collision);
-		if (mkdir(collscr, 0755) != 0) {
-			fprintf(stderr, "sepscratch FAIL: cannot acquire %s\n", collscr);
-			fail++;
-			continue;
-		}
-		collscr_owned[s] = 1;
-		snprintf(marker, sizeof marker, "%s/sentinel", collscr);
-		if (write_file(marker, "owned\n", &marker_owned[s]) != 0) {
-			fprintf(stderr, "sepscratch FAIL: cannot write %s\n", marker);
-			fail++;
-			continue;
-		}
-		snprintf(cmd, sizeof cmd,
-		    "timeout 240 %s/%s build -o %s %s >/dev/null 2>&1",
-		    bin, drvs[s], collision, rootww);
-		collision_started[s] = 1;
-		int crc = runwait(cmd);
-		if (crc == 0) {
-			fprintf(stderr, "sepscratch FAIL: %s adopted existing %s\n",
-			    drvs[s], collscr);
-			fail++;
-		} else if (crc != 1) {
-			fprintf(stderr, "sepscratch FAIL: %s collision refusal exit=%d want=1\n",
-			    drvs[s], crc);
-			fail++;
-		}
-		char markbuf[16] = {0};
-		FILE *markf = fopen(marker, "rb");
-		if (markf == NULL
-		    || fread(markbuf, 1, sizeof "owned\n" - 1, markf)
-		        != sizeof "owned\n" - 1
-		    || memcmp(markbuf, "owned\n", sizeof "owned\n" - 1) != 0) {
-			fprintf(stderr, "sepscratch FAIL: %s deleted %s\n", drvs[s], marker);
-			fail++;
-		}
-		if (markf != NULL && fclose(markf) != 0) fail++;
-	}
-
-out:
-	for (int s = 0; s < 2; s++) {
-		char path[1200];
-		if (build_started[s]) {
-			snprintf(path, sizeof path, "%s/prog_%s.sepwork", td, drvs[s]);
-			snprintf(cmd, sizeof cmd, "rm -rf -- '%s'", path);
-			if (runwait(cmd) != 0) cleanup_fail = 1;
-			snprintf(path, sizeof path, "%s/prog_%s", td, drvs[s]);
-			if (unlink(path) != 0 && errno != ENOENT) cleanup_fail = 1;
-		}
-		if (marker_owned[s]) {
-			snprintf(path, sizeof path, "%s/collision_%s.sepwork/sentinel",
-			    td, drvs[s]);
-			if (unlink(path) != 0 && errno != ENOENT) cleanup_fail = 1;
-		}
-		if (collscr_owned[s]) {
-			snprintf(path, sizeof path, "%s/collision_%s.sepwork", td, drvs[s]);
-			if (rmdir(path) != 0) cleanup_fail = 1;
-		}
-		if (collision_started[s]) {
-			snprintf(path, sizeof path, "%s/collision_%s", td, drvs[s]);
-			if (unlink(path) != 0 && errno != ENOENT) cleanup_fail = 1;
-		}
-	}
-	if (root_owned && unlink(rootww) != 0 && errno != ENOENT) cleanup_fail = 1;
-	if (rmdir(td) != 0) cleanup_fail = 1;
-	if (cleanup_fail) {
-		fprintf(stderr, "sepscratch FAIL: cleanup incomplete under %s\n", td);
-		fail++;
-	}
-	if (fail) {
-		fprintf(stderr, "sepscratch: %d check(s) failed\n", fail);
-		return 1;
-	}
-	printf("sepscratch: ww+ww_ww — build -o scratch kept, run workspace "
-	    "removed, collisions refused without deletion\n");
-	return 0;
-}