The clock was monotonic and the process restarted

# Self-authored for the EML case corpus (no external origin). Durations use a
# monotonic clock, which is the correct choice and immune to every wall-clock
# hazard. How long a thirty-second lease lasts is computed below.
#
# The choice is right and it was made deliberately. A wall clock can step
# backwards when time is corrected, jump an hour at a transition, and produce
# negative durations; the code was moved off it after exactly that bug. The
# monotonic clock never goes backwards and is not affected by any of it.
#
# A monotonic clock has no fixed origin. Its zero is whenever the counter it
# reads started, and comparing two readings is only meaningful if they came from
# the same one. Persisting a reading writes a number whose origin is not stored
# beside it.
#
# The lease deadline is written to shared storage so other instances can honour
# it, and the process that wrote it has since restarted.

30 => lease_seconds
804000 => uptime_at_write_seconds
62 => restarts_per_week
2400000 => leases_persisted
0 => negative_durations_observed

# After a restart the reader's monotonic clock starts near zero, so a deadline
# written as (old uptime + lease) is far in its future.
uptime_at_write_seconds + lease_seconds => stored_deadline
int(stored_deadline / lease_seconds) => times_longer_than_intended

"lease, seconds                : " + str(lease_seconds) ^0
"uptime when the deadline was written : " + str(uptime_at_write_seconds) ^0
"stored deadline value         : " + str(stored_deadline) ^0
"" ^0
"after a restart the reader's clock starts near : 0" ^0
"so the lease appears to last, seconds : " + str(stored_deadline) ^0
"which is longer than intended by : " + str(times_longer_than_intended) + " times" ^0
"" ^0

# ---- what the monotonic clock guarantees ----

"the clock" ^0
"  goes backwards      : never" ^0
"  affected by time correction : no" ^0
"  affected by a daylight transition : no" ^0
"  negative durations observed : " + str(negative_durations_observed) ^0
"  verdict             : MONOTONIC" ^0
"" ^0
"  the move to it fixed a real bug and none of the wall" ^0
"  clock's hazards can recur" ^0
"" ^0

# ---- what it does not have ----

"comparing two readings" ^0
"  same process, same boot : meaningful" ^0
"  different process       : the origins differ" ^0
"  origin stored beside the value : no" ^0
"  a way to detect the mismatch   : none, both are just" ^0
"    numbers of seconds" ^0
"" ^0
"  the reading is not wrong and the comparison is not" ^0
"  detectable as invalid; it is arithmetic on two scales" ^0
"" ^0

# ---- what it costs ----

restarts_per_week * 52 => restarts_per_year
int(leases_persisted / 52 / 7) => leases_per_day

"the exposure" ^0
"  leases persisted        : " + str(leases_persisted) ^0
"  leases per day          : " + str(leases_per_day) ^0
"  restarts per week       : " + str(restarts_per_week) ^0
"  restarts per year       : " + str(restarts_per_year) ^0
"  every lease written before a restart and read after it" ^0
"    is held for " + str(stored_deadline) + " seconds instead of " + str(lease_seconds) ^0
"" ^0

# ---- why it looks like a leak rather than a clock ----

# The symptom is a resource nobody releases. Every investigation looks at the
# release path, which is correct, and at the deadline arithmetic, which is also
# correct within one process.
"what the investigation finds" ^0
"  release path        : correct" ^0
"  deadline arithmetic within one process : correct" ^0
"  negative durations  : " + str(negative_durations_observed) ^0
"  clock hazards       : none, it is monotonic" ^0
"  the reading that is wrong : neither of them" ^0
"" ^0

# ---- null control ----

# The same clock for measuring, with the persisted deadline written as a wall
# clock instant instead.
lease_seconds => nc_effective_lease_seconds
0 => nc_leases_outliving_their_deadline

"null control - persist a wall-clock instant, measure with monotonic" ^0
"  negative durations   : " + str(negative_durations_observed) + ", unchanged" ^0
"  effective lease, seconds : " + str(nc_effective_lease_seconds) ^0
"  leases outliving their deadline : " + str(nc_leases_outliving_their_deadline) ^0
"  the monotonic clock is still used for every duration;" ^0
"  the value that crosses a process boundary stopped being" ^0
"  one of its readings" ^0
"" ^0

# ---- the rule ----

"what a monotonic clock guarantees" ^0
"  the difference of two readings is a true elapsed time : exactly," ^0
"    within one origin" ^0
"  a reading means anything elsewhere                    : not" ^0
"    addressed; the origin is not part of the value and" ^0
"    cannot be recovered from it" ^0
"" ^0
"monotonic readings are for measuring and wall-clock instants" ^0
"are for communicating; a value that outlives its process has" ^0
"crossed from the first use to the second" ^0
"" ^0

"The clock is monotonic, " + str(negative_durations_observed) + " negative durations have been seen, and moving to it" ^0
"fixed a real wall-clock bug. Its readings have no stored origin, so a " + str(lease_seconds) ^0
"second lease written at uptime " + str(uptime_at_write_seconds) + " and read after a restart lasts " + str(stored_deadline) ^0
"seconds - " + str(times_longer_than_intended) + " times its length - across " + str(restarts_per_year) + " restarts a year," ^0
"and no reading is wrong." ^0

lease_seconds = 30
uptime_at_write_seconds = 804000
restarts_per_week = 62
leases_persisted = 2400000
negative_durations_observed = 0
stored_deadline = uptime_at_write_seconds + lease_seconds
times_longer_than_intended = int(stored_deadline / lease_seconds)
print("lease, seconds                : " + str(lease_seconds))
print("uptime when the deadline was written : " + str(uptime_at_write_seconds))
print("stored deadline value         : " + str(stored_deadline))
print("")
print("after a restart the reader's clock starts near : 0")
print("so the lease appears to last, seconds : " + str(stored_deadline))
print("which is longer than intended by : " + str(times_longer_than_intended) + " times")
print("")
print("the clock")
print("  goes backwards      : never")
print("  affected by time correction : no")
print("  affected by a daylight transition : no")
print("  negative durations observed : " + str(negative_durations_observed))
print("  verdict             : MONOTONIC")
print("")
print("  the move to it fixed a real bug and none of the wall")
print("  clock's hazards can recur")
print("")
print("comparing two readings")
print("  same process, same boot : meaningful")
print("  different process       : the origins differ")
print("  origin stored beside the value : no")
print("  a way to detect the mismatch   : none, both are just")
print("    numbers of seconds")
print("")
print("  the reading is not wrong and the comparison is not")
print("  detectable as invalid; it is arithmetic on two scales")
print("")
restarts_per_year = restarts_per_week * 52
leases_per_day = int(leases_persisted / 52 / 7)
print("the exposure")
print("  leases persisted        : " + str(leases_persisted))
print("  leases per day          : " + str(leases_per_day))
print("  restarts per week       : " + str(restarts_per_week))
print("  restarts per year       : " + str(restarts_per_year))
print("  every lease written before a restart and read after it")
print("    is held for " + str(stored_deadline) + " seconds instead of " + str(lease_seconds))
print("")
print("what the investigation finds")
print("  release path        : correct")
print("  deadline arithmetic within one process : correct")
print("  negative durations  : " + str(negative_durations_observed))
print("  clock hazards       : none, it is monotonic")
print("  the reading that is wrong : neither of them")
print("")
nc_effective_lease_seconds = lease_seconds
nc_leases_outliving_their_deadline = 0
print("null control - persist a wall-clock instant, measure with monotonic")
print("  negative durations   : " + str(negative_durations_observed) + ", unchanged")
print("  effective lease, seconds : " + str(nc_effective_lease_seconds))
print("  leases outliving their deadline : " + str(nc_leases_outliving_their_deadline))
print("  the monotonic clock is still used for every duration;")
print("  the value that crosses a process boundary stopped being")
print("  one of its readings")
print("")
print("what a monotonic clock guarantees")
print("  the difference of two readings is a true elapsed time : exactly,")
print("    within one origin")
print("  a reading means anything elsewhere                    : not")
print("    addressed; the origin is not part of the value and")
print("    cannot be recovered from it")
print("")
print("monotonic readings are for measuring and wall-clock instants")
print("are for communicating; a value that outlives its process has")
print("crossed from the first use to the second")
print("")
print("The clock is monotonic, " + str(negative_durations_observed) + " negative durations have been seen, and moving to it")
print("fixed a real wall-clock bug. Its readings have no stored origin, so a " + str(lease_seconds))
print("second lease written at uptime " + str(uptime_at_write_seconds) + " and read after a restart lasts " + str(stored_deadline))
print("seconds - " + str(times_longer_than_intended) + " times its length - across " + str(restarts_per_year) + " restarts a year,")
print("and no reading is wrong.")

lease, seconds                : 30
uptime when the deadline was written : 804000
stored deadline value         : 804030

after a restart the reader's clock starts near : 0
so the lease appears to last, seconds : 804030
which is longer than intended by : 26801 times

the clock
  goes backwards      : never
  affected by time correction : no
  affected by a daylight transition : no
  negative durations observed : 0
  verdict             : MONOTONIC

  the move to it fixed a real bug and none of the wall
  clock's hazards can recur

comparing two readings
  same process, same boot : meaningful
  different process       : the origins differ
  origin stored beside the value : no
  a way to detect the mismatch   : none, both are just
    numbers of seconds

  the reading is not wrong and the comparison is not
  detectable as invalid; it is arithmetic on two scales

the exposure
  leases persisted        : 2400000
  leases per day          : 6593
  restarts per week       : 62
  restarts per year       : 3224
  every lease written before a restart and read after it
    is held for 804030 seconds instead of 30

what the investigation finds
  release path        : correct
  deadline arithmetic within one process : correct
  negative durations  : 0
  clock hazards       : none, it is monotonic
  the reading that is wrong : neither of them

null control - persist a wall-clock instant, measure with monotonic
  negative durations   : 0, unchanged
  effective lease, seconds : 30
  leases outliving their deadline : 0
  the monotonic clock is still used for every duration;
  the value that crosses a process boundary stopped being
  one of its readings

what a monotonic clock guarantees
  the difference of two readings is a true elapsed time : exactly,
    within one origin
  a reading means anything elsewhere                    : not
    addressed; the origin is not part of the value and
    cannot be recovered from it

monotonic readings are for measuring and wall-clock instants
are for communicating; a value that outlives its process has
crossed from the first use to the second

The clock is monotonic, 0 negative durations have been seen, and moving to it
fixed a real wall-clock bug. Its readings have no stored origin, so a 30
second lease written at uptime 804000 and read after a restart lasts 804030
seconds - 26801 times its length - across 3224 restarts a year,
and no reading is wrong.

Trace event types