Prepare CLOCK-R2 Windows Time changes and boot persistence checks - #788

Scope

Delayed Windows Time startup leaves the WSL clock exposed during acquisition,
and the existing manual D0 check only observed the PHC0 agent. This change
prepares the bounded CLOCK-R2 administrator script and adds a read-only
first-distro-boot persistence check with the existing failure-alert handler.
All triggers and MaxTimes=7 are preserved. Host apply and attended-boot
acceptance remain pending the command-center ACK and owner execution.

• Base commit: c1300c15b42f1a6643f3dc4172f40c01d99abdcd.
• Lane: lane:foundation; draft until the command center reads it.
• Owned paths: adoption/templates/windows/, the new
  adoption/templates/systemd/clock-persistence-check.service,
  scripts/d0_check.py, tests/test_d0_check.py, and the dated decisions.
• No shared registry or generated-handbook edit is needed: all eight new files
  are outside evidence directories and absent from main's registered files.

SOTA sources

• Microsoft high-accuracy startup guidance, 16dafadd (ms.date 2025-02-25): Automatic; only the start type changes.
• Microsoft time-service settings, ef9afdb7 (ms.date 2025-09-18): Minutes=1, default MaxTimes=7; no MaxTimes=0 write.
• KB 816043 at 3b8ed12f (ms.date 2025-05-08): the three logging values, bounded to 10 MB.
• Quality-update pause policy, revision 2025-09-30, restart scheduling, revision 2025-09-30: local run-date pause request and attended pending-restart handling.
• sc.exe config, reg export, both revision 2023-02-03; SERVICE_TRIGGER actions, 2021-04-02: native SCM/Registry behavior and start/stop distinction.
• systemd v259.5, b3d8fc43 service semantics, unit ordering/OnFailure: first-user-manager oneshot, retained exit state and existing alert dependency.
• PowerShell 5.1 execution policies, 9a8a7830 (2026-08-31): use a reviewed local Windows copy while preserving policy.
• D0 ports the existing staged agent reader, SHA256
  4b5d02b55f65fa255ad53ae9a38144a70a0cb8f0cce8458573c661165340601b,
  using the unchanged native chronyc/PHC0 census and a read-only adjtimex mask.

Evidence-class table

The unsigned UNC -File -WhatIf attempt was refused before script execution
under the existing RemoteSigned policy. It is not a passing dry run. The
runbook's local-copy path preserves policy; the lane did not bypass it or stage
a Windows copy. Fixture/metadata evidence does not establish post-fix accuracy.

Local commands run

nice -n 19 python3 -B -m unittest discover -s tests -p test_d0_check.py
  exit 0; 18 focused fixtures
nice -n 19 systemd-analyze --user verify adoption/templates/systemd/clock-persistence-check.service
  exit 0
nice -n 19 python3 -B scripts/d0_check.py --persistence-only
  exit 1, expected pre-fix mismatch; read-only live fields retained privately
nice -n 19 ionice -c3 python3 -B scripts/validate.py
  current final-head exit 0; 69 components, 10315 hashes, 4 profiles, 212 receipts; integrity/scope only
git diff --cached --check
  exit 0

Decision record

docs/decisions/2026-10-06-clock-root-fix-round2.md
records narrower vendor changes, alternatives and conditions that reopen them.
The final A2 rule appears in the one-page runbook: both the +75 s absolute
and network+30 s bounds apply when the network event exists; missing-relative
evidence is recorded, slow cases through +151 s are PARTIAL and later is FAIL.
The plan/history addendum retained in coordination reopens the 09-25
steady-state protection item despite temporal overlap with peer loss.

Host apply, read-back and rollback

The co-op applies Linux staging after ACK in a ready owner window, with the five-minute lane park notice. Foundation work has no paper-window hold; heavy commands use nice -n 19 ionice -c3.
Exact commands and the backup/restore contract are in
adoption/templates/windows/README.md.
Set CLOCK_SOURCE, CLOCK_HEAD and an existing private CLOCK_BACKUP, verify
the accepted clean head, then save each selected prior file or record absence.

CLOCK_RUNTIME="$HOME/.local/lib/native-agent-stack/clock-r2"
CLOCK_UNIT="$HOME/.config/systemd/user/clock-persistence-check.service"
install -d -m 700 "$CLOCK_RUNTIME"
install -m 700 "$CLOCK_SOURCE/scripts/d0_check.py" "$CLOCK_RUNTIME/d0-check.py"
install -m 600 "$CLOCK_SOURCE/adoption/templates/systemd/clock-persistence-check.service" "$CLOCK_UNIT"
python3 "$CLOCK_RUNTIME/d0-check.py" --help
systemd-analyze --user verify "$CLOCK_UNIT"
systemctl --user daemon-reload
systemctl --user enable clock-persistence-check.service

No --now or manager restart. The next distro/user-manager boot runs the
check. Read back is-enabled, ActiveState, Result, ExecMainStatus,
OnFailure and that boot's journal; require the returned Windows fields plus
passed=true/agent_alive=true for the full check. If it fails, verify the
actual existing Alertmanager API/amtool notice and the printed administrator
remediation; an OnFailure directive alone is not delivery evidence.

Rollback: at an owner safe point, disable the new unit without --now;
restore each saved selected runtime/unit file, or remove only a file recorded
absent; restore a prior enablement state only if recorded; daemon-reload.
Preserve the journal/history and do not interrupt a running check.

The user runs the reviewed, hash-matched administrator script from a local
Windows directory after CC review and paper-owner inactivity (confirmed at
5:12 PM EDT October 6, 21:12Z). The script does not restart or resync the service. It exports TriggerInfo, performs only
the six allowed configuration-value/startup changes and prints every read-back.
The pending-restart UI points to the attended acceptance slot no earlier than
12:45 AM EDT October 7 (04:45Z). A pending WU restart becomes that boot; an
unplanned earlier boot is non-acceptance. The runbook restores startup to
delayed-auto, Minutes to 15, the two present empty logging strings, log size
to 0 and the pause date to 2026-09-01, each with read-back. Compare the exact
pre-apply -WhatIf receipt first. No trigger, task-state or MaxTimes change is made.

Host evidence

No evidence/hosts receipt or platform-status change is added. The co-op owns
the first automatic run and attended-boot receipts after apply.

Checklist

• No workflow or paid-hosting change.
• No credential value/store read or required secret.
• Peer-owned emitter/trading files and other worktrees preserved.
• Source/local/synthetic and future host evidence kept distinct.
• Shared registry/hot-file protocol checked; no registered file changed.

WSL platform clock target

D0 queries the shared VM's WSL PHC agent on UDP 323, ::1 first with an IPv4
fallback. mini_init starts that agent in the system distro at every VM boot,
independently of the registered user distributions. NativeStack retirement
leaves it in place. The native 3323 NTP observer stays observe-only and is
not expected to return PHC0. The target/fault fixtures model those two roles;
all 18 focused tests pass. Source and fixture checks are separate from the
co-op's pending installed-copy/automatic-boot acceptance.

The candidate boot oneshot runs both persistence and agent checks with
--seconds 60 and orders after ns2604-alertmanager.service when both are in the
boot transaction. D0 stays disabled until the fix lands. The optional
--persistence-only mode remains available.

• WSL 3.0.1 system-distro startup, 91f161fa.
• WSL PHC configuration/start, 91f161fa.
• chronyc 4.8 upstream manual: explicit port selection for each read-only query.

Final platform disposition

The command center's item 215329Z drops the native steering takeover:
dated clock disposition and Gate 2 row.
The WSL platform agent survives NativeStack retirement; keep the native NTP
observer -x/3323. No transfer was applied, so no clock-transfer rollback is
needed. The Windows settings retain their complete, separate rollback.
The CLOCK-R2 decision and README carry the same final premise. Co-op-owned
COORD-7/8 are corrected by that owner; no peer board/configuration was edited.

Preview receipt capture

The runbook redirects information stream 6 into the success stream before
Tee-Object: .\clock-root-fix-r2.ps1 -WhatIf 6>&1 | Tee-Object .\clock-r2-before.txt.
This retains Write-Host's prior-value read-backs. Native PowerShell 5.1.26100.9168
with a synthetic message returned default-pipeline count 0 and redirected
count 1; no file or script setting was written. Both committed runbook
PowerShell blocks parse with zero AST errors and were not executed.
The administrator PS1 and D0 code remain unchanged; their previous parser
and focused-test results are reused for the identical inputs.

• Write-Host information stream, PowerShell-Docs 9a8a7830.
• PowerShell stream 6 redirection, same pin.

The public copy recipe uses CLOCK_WINDOWS_SCRIPT and Windows USERPROFILE;
the exact workstation path is supplied only in the private owner handoff.
Current repository validation passed after replacing those two public personal
paths. The earlier validation failure and sandbox timeout remain recorded in
private lane status; neither is a passed run. No evidence or historical
receipt/decision rewrite, host apply, provider or GPU run occurred.

Landing path

Required read: the co-op's first-pass review of this final head and its administrator runbook, then the command center's final-head review. ACK: the command center, relayed by the co-op. Requested landing path: 5f's remaining foundation queue after the priority sequence ending with #645. The co-op relays 5f's landing cue; rebase once on that cue under the hot-file protocol. Once queued, 5f is the sole writer. This names the requested path without claiming an ACK or queue placement has already happened.