@scalebun/react-native 1.0.2 → 1.0.4

package/ios/Crash/ScaleBunCrashSignalBridge.m

@@ -1,131 +1,296 @@
-/**
- * ScaleBunCrashSignalBridge — C-level fatal signal handlers.
- *
- * SAFETY CONTRACT:
- * All code in signal handlers below uses ONLY async-signal-safe operations:
- *   open(2), write(2), close(2), signal(3), raise(3).
- * No malloc, no ObjC runtime, no Swift runtime, no stdio.
- *
- * LIMITATION:
- * Stack traces are NOT captured in signal handlers. For symbolicated stacks,
- * integrate PLCrashReporter (https://github.com/microsoft/plcrashreporter).
- */
-
-#include "ScaleBunCrashSignalBridge.h"
-#include <signal.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <string.h>
-#include <time.h>
-
-// ─── Statics (set once at install time, read-only after) ────────────────────
-
-static const char *scalebun_crash_path = NULL;
-
-static struct sigaction scalebun_prev_sigabrt;
-static struct sigaction scalebun_prev_sigbus;
-static struct sigaction scalebun_prev_sigsegv;
-static struct sigaction scalebun_prev_sigill;
-static struct sigaction scalebun_prev_sigfpe;
-
-// ─── Async-signal-safe integer serializer ───────────────────────────────────
-
-/* Writes decimal representation of n into buf, returns bytes written. */
-static int scalebun_itoa(char *buf, long long n) {
-    if (n == 0) { buf[0] = '0'; return 1; }
-    int i = 0;
-    long long tmp = n;
-    while (tmp > 0) { buf[i++] = '0' + (tmp % 10); tmp /= 10; }
-    // reverse
-    for (int j = 0, k = i - 1; j < k; j++, k--) {
-        char t = buf[j]; buf[j] = buf[k]; buf[k] = t;
-    }
-    return i;
-}
-
-// ─── Write minimal crash record ─────────────────────────────────────────────
-
-static void scalebun_write_signal_crash(int sig) {
-    if (!scalebun_crash_path) return;
-
-    int fd = open(scalebun_crash_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-    if (fd < 0) return;
-
-    // Build: {"name":"crash.native","signal":<sig>,"platform":"ios","timestamp":<ms>}
-    // All strings are compile-time constants — no heap allocation.
-    char sigbuf[8];
-    int siglen = scalebun_itoa(sigbuf, (long long)sig);
-
-    // Timestamp in milliseconds using clock_gettime (async-signal-safe on Darwin)
-    struct timespec ts;
-    clock_gettime(CLOCK_REALTIME, &ts);
-    long long ms = (long long)ts.tv_sec * 1000LL + ts.tv_nsec / 1000000LL;
-    char tsbuf[24];
-    int tslen = scalebun_itoa(tsbuf, ms);
-
-    const char *prefix = "{\"name\":\"crash.native\",\"signal\":";
-    const char *mid    = ",\"platform\":\"ios\",\"timestamp\":";
-    const char *suffix = "}";
-
-    write(fd, prefix, strlen(prefix));
-    write(fd, sigbuf, (size_t)siglen);
-    write(fd, mid,    strlen(mid));
-    write(fd, tsbuf,  (size_t)tslen);
-    write(fd, suffix, strlen(suffix));
-    close(fd);
-}
-
-// ─── Individual signal handlers ─────────────────────────────────────────────
-
-static void scalebun_handle_sigabrt(int sig) {
-    scalebun_write_signal_crash(sig);
-    sigaction(SIGABRT, &scalebun_prev_sigabrt, NULL);
-    raise(sig);
-}
-
-static void scalebun_handle_sigbus(int sig) {
-    scalebun_write_signal_crash(sig);
-    sigaction(SIGBUS, &scalebun_prev_sigbus, NULL);
-    raise(sig);
-}
-
-static void scalebun_handle_sigsegv(int sig) {
-    scalebun_write_signal_crash(sig);
-    sigaction(SIGSEGV, &scalebun_prev_sigsegv, NULL);
-    raise(sig);
-}
-
-static void scalebun_handle_sigill(int sig) {
-    scalebun_write_signal_crash(sig);
-    sigaction(SIGILL, &scalebun_prev_sigill, NULL);
-    raise(sig);
-}
-
-static void scalebun_handle_sigfpe(int sig) {
-    scalebun_write_signal_crash(sig);
-    sigaction(SIGFPE, &scalebun_prev_sigfpe, NULL);
-    raise(sig);
-}
-
-// ─── Install ─────────────────────────────────────────────────────────────────
-
-void ScaleBunCrashSignalBridgeInstall(const char *crashFilePath) {
-    scalebun_crash_path = crashFilePath;
-
-    struct sigaction sa;
-    memset(&sa, 0, sizeof(sa));
-    sigemptyset(&sa.sa_mask);
-    sa.sa_flags = SA_RESETHAND; // restore default after first signal
-
-#define INSTALL(signo, handler, prev) \
-    sa.sa_handler = (handler); \
-    sigaction((signo), &sa, &(prev));
-
-    INSTALL(SIGABRT, scalebun_handle_sigabrt, scalebun_prev_sigabrt)
-    INSTALL(SIGBUS,  scalebun_handle_sigbus,  scalebun_prev_sigbus)
-    INSTALL(SIGSEGV, scalebun_handle_sigsegv, scalebun_prev_sigsegv)
-    INSTALL(SIGILL,  scalebun_handle_sigill,  scalebun_prev_sigill)
-    INSTALL(SIGFPE,  scalebun_handle_sigfpe,  scalebun_prev_sigfpe)
-
-#undef INSTALL
-}
+/**
+ * ScaleBunCrashSignalBridge — C-level fatal signal handlers.
+ *
+ * SAFETY CONTRACT:
+ * All code in signal handlers below uses ONLY async-signal-safe operations:
+ *   open(2), write(2), close(2), signal(3), raise(3).
+ * No malloc, no ObjC runtime, no Swift runtime, no stdio.
+ *
+ * LIMITATION:
+ * Stack traces are NOT captured in signal handlers. For symbolicated stacks,
+ * integrate PLCrashReporter (https://github.com/microsoft/plcrashreporter).
+ */
+
+#include "ScaleBunCrashSignalBridge.h"
+#include <signal.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <string.h>
+#include <time.h>
+#include <stdlib.h>
+
+// ─── Statics (set once at install time, read-only after) ────────────────────
+
+static const char *scalebun_crash_path = NULL;
+
+/**
+ * The active session id, published as a FILE and read back through the filesystem.
+ *
+ * ── WHY NOT A SHARED BUFFER ────────────────────────────────────────────────────────────────────
+ *
+ * The previous version of this file kept the id in a static char array and published its length
+ * last through a `volatile sig_atomic_t`, arguing that a handler therefore saw either the old id or
+ * the new one. THAT ARGUMENT WAS WRONG, and the counter-example is short:
+ *
+ *   published:  "sess-AAAAAAAAAAAAAAAA"   len = 21
+ *   setter begins overwriting IN PLACE with "sess-BBBBBBBBBBBBBBBB" (same length)
+ *   signal arrives after 3 bytes           buffer = "sess-BBBAAAAAAAAAAAAA"
+ *   len is UNCHANGED and still valid  →    handler emits the torn id
+ *
+ * Publishing the length last only orders the length against the bytes. It does nothing when the new
+ * id is the same length as the old one — which is the normal case, since every session id here is
+ * `sess-` plus a UUID. Modelled over every interrupt point, 15 of 22 tore.
+ *
+ * `volatile sig_atomic_t` guarantees atomic access to THAT SCALAR. It says nothing about the
+ * ordinary `char[]` beside it. C11 7.14.1.1p5 is stricter still: inside a handler, the only objects
+ * a program may access are lock-free atomics and objects of type `volatile sig_atomic_t`. Reading a
+ * concurrently-modified ordinary array is undefined behaviour regardless of how it is ordered.
+ *
+ * A double buffer does not fix this either: with two slots, the third publication overwrites the
+ * slot a handler may still be reading. More slots widen the window without closing it, because
+ * nothing tells the publisher when a handler has finished.
+ *
+ * ── WHY A FILE IS ACTUALLY SAFE ────────────────────────────────────────────────────────────────
+ *
+ * The publisher writes a temp file and `rename(2)`s it over the marker. POSIX requires rename to be
+ * ATOMIC: a concurrent `open(2)` resolves to either the old inode or the new one, and each contains
+ * one complete id. There is no state shared between publisher and handler at all — no buffer, no
+ * length, no flag — so there is nothing to tear.
+ *
+ * That property is also what makes it correct ACROSS THREADS. A buffer scheme only reasons about a
+ * signal interrupting the publishing thread; this one holds even when the signal is delivered to a
+ * different thread while another is mid-publication, because the two never touch the same memory.
+ *
+ * The handler pays one extra open/read/close. It already performs open/write/close for the crash
+ * record itself, so this adds no new class of operation — see the safety table in the header.
+ */
+#define SCALEBUN_SESSION_MAX 128
+
+/* Set once at install, read-only afterwards — never mutated while a handler could run. */
+static const char *scalebun_session_marker_path = NULL;
+static const char *scalebun_session_tmp_path = NULL;
+
+static struct sigaction scalebun_prev_sigabrt;
+static struct sigaction scalebun_prev_sigbus;
+static struct sigaction scalebun_prev_sigsegv;
+static struct sigaction scalebun_prev_sigill;
+static struct sigaction scalebun_prev_sigfpe;
+
+// ─── Async-signal-safe integer serializer ───────────────────────────────────
+
+/* Writes decimal representation of n into buf, returns bytes written. */
+static int scalebun_itoa(char *buf, long long n) {
+    if (n == 0) { buf[0] = '0'; return 1; }
+    int i = 0;
+    long long tmp = n;
+    while (tmp > 0) { buf[i++] = '0' + (tmp % 10); tmp /= 10; }
+    // reverse
+    for (int j = 0, k = i - 1; j < k; j++, k--) {
+        char t = buf[j]; buf[j] = buf[k]; buf[k] = t;
+    }
+    return i;
+}
+
+// ─── Write minimal crash record ─────────────────────────────────────────────
+
+static void scalebun_write_signal_crash(int sig) {
+    if (!scalebun_crash_path) return;
+
+    int fd = open(scalebun_crash_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd < 0) return;
+
+    // Build: {"name":"crash.native","signal":<sig>,"platform":"ios","timestamp":<ms>}
+    // All strings are compile-time constants — no heap allocation.
+    char sigbuf[8];
+    int siglen = scalebun_itoa(sigbuf, (long long)sig);
+
+    // Timestamp in milliseconds using clock_gettime (async-signal-safe on Darwin)
+    struct timespec ts;
+    clock_gettime(CLOCK_REALTIME, &ts);
+    long long ms = (long long)ts.tv_sec * 1000LL + ts.tv_nsec / 1000000LL;
+    char tsbuf[24];
+    int tslen = scalebun_itoa(tsbuf, ms);
+
+    /*
+     * Literal lengths computed at COMPILE time, not by strlen.
+     *
+     * strlen is not on the POSIX async-signal-safe list. Calling it only on string literals is
+     * defensible in practice — it is a pure read of immutable memory — but "defensible in practice"
+     * is exactly the kind of reasoning that produced the torn buffer this file used to have. sizeof
+     * on a char array removes the call and the argument along with it.
+     */
+    static const char prefix[] = "{\"name\":\"crash.native\",\"signal\":";
+    static const char mid[]    = ",\"platform\":\"ios\",\"timestamp\":";
+    static const char sidkey[] = ",\"sessionId\":\"";
+    static const char cidkey[] = ",\"crashId\":\"sig-";
+    static const char quote[]  = "\"";
+    static const char suffix[] = "}";
+
+    write(fd, prefix, sizeof(prefix) - 1);
+    write(fd, sigbuf, (size_t)siglen);
+    write(fd, mid,    sizeof(mid) - 1);
+    write(fd, tsbuf,  (size_t)tslen);
+
+    /*
+     * Session id — read from the marker file into a STACK buffer.
+     *
+     * open/read/close are async-signal-safe, the buffer is automatic storage (no allocation), and
+     * no mutable global is touched. Because the publisher installs the marker with rename(2), this
+     * open resolves to a single complete id: either the previous one or the new one, never a mix.
+     *
+     * The publisher guarantees the bytes are already JSON-safe, so nothing is escaped here —
+     * escaping arbitrary input inside a signal handler would be solving a problem we can avoid
+     * having.
+     */
+    if (scalebun_session_marker_path) {
+        char sidbuf[SCALEBUN_SESSION_MAX];
+        int sfd = open(scalebun_session_marker_path, O_RDONLY);
+        if (sfd >= 0) {
+            ssize_t n = read(sfd, sidbuf, sizeof(sidbuf));
+            close(sfd);
+            if (n > 0) {
+                write(fd, sidkey, sizeof(sidkey) - 1);
+                write(fd, sidbuf, (size_t)n);
+                write(fd, quote, sizeof(quote) - 1);
+            }
+        }
+    }
+
+    /*
+     * A STABLE crash id, so a signal crash gets the same at-least-once retry protection as every
+     * other crash. Derived from the timestamp already computed above — no allocation, no RNG, and
+     * identical on every read of this file, which is what the backend dedupes on.
+     */
+    write(fd, cidkey, sizeof(cidkey) - 1);
+    write(fd, tsbuf, (size_t)tslen);
+    write(fd, quote, sizeof(quote) - 1);
+
+    write(fd, suffix, sizeof(suffix) - 1);
+    close(fd);
+}
+
+// ─── Individual signal handlers ─────────────────────────────────────────────
+
+static void scalebun_handle_sigabrt(int sig) {
+    scalebun_write_signal_crash(sig);
+    sigaction(SIGABRT, &scalebun_prev_sigabrt, NULL);
+    raise(sig);
+}
+
+static void scalebun_handle_sigbus(int sig) {
+    scalebun_write_signal_crash(sig);
+    sigaction(SIGBUS, &scalebun_prev_sigbus, NULL);
+    raise(sig);
+}
+
+static void scalebun_handle_sigsegv(int sig) {
+    scalebun_write_signal_crash(sig);
+    sigaction(SIGSEGV, &scalebun_prev_sigsegv, NULL);
+    raise(sig);
+}
+
+static void scalebun_handle_sigill(int sig) {
+    scalebun_write_signal_crash(sig);
+    sigaction(SIGILL, &scalebun_prev_sigill, NULL);
+    raise(sig);
+}
+
+static void scalebun_handle_sigfpe(int sig) {
+    scalebun_write_signal_crash(sig);
+    sigaction(SIGFPE, &scalebun_prev_sigfpe, NULL);
+    raise(sig);
+}
+
+// ─── Install ─────────────────────────────────────────────────────────────────
+
+/**
+ * Publish the active session id for the signal handler to read.
+ *
+ * Called from normal code (the main thread, once per session) — NOT from a signal handler. All the
+ * unsafe work happens here, where it is safe, so the handler is left with a read and a write.
+ *
+ * SANITISED HERE, ON PURPOSE. Anything that is not `[A-Za-z0-9_.:-]` is dropped, which makes the
+ * stored bytes valid inside a JSON string with no escaping. That is what lets the handler emit them
+ * directly: escaping in a signal handler would mean branching over arbitrary input to solve a
+ * problem we can simply not have. Session ids are `sess-<uuid>`, so nothing legitimate is lost.
+ *
+ * Over-long ids are TRUNCATED rather than rejected — a truncated id is still a strong hint for a
+ * human, and refusing to publish would silently return to the un-attributed behaviour.
+ */
+void ScaleBunCrashSignalBridgeSetSessionId(const char *sessionId) {
+    if (!scalebun_session_marker_path || !scalebun_session_tmp_path) return;
+
+    if (sessionId == NULL) {
+        unlink(scalebun_session_marker_path);
+        return;
+    }
+
+    /*
+     * Sanitise into a local buffer. Restricted to [A-Za-z0-9_.:-] so the stored bytes are valid
+     * inside a JSON string with no escaping — which is what lets the handler emit them directly.
+     * Session ids are `sess-<uuid>`, so nothing legitimate is lost. Over-long ids are truncated
+     * rather than rejected: a truncated id still identifies the session to a human, whereas
+     * refusing to publish would silently return to unattributed crashes.
+     */
+    char clean[SCALEBUN_SESSION_MAX];
+    int out = 0;
+    for (int i = 0; sessionId[i] != '\0' && out < SCALEBUN_SESSION_MAX; i++) {
+        char c = sessionId[i];
+        int ok = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+                 (c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.' || c == ':';
+        if (ok) clean[out++] = c;
+    }
+    if (out == 0) {
+        unlink(scalebun_session_marker_path);
+        return;
+    }
+
+    /*
+     * WRITE THEN RENAME — this is the whole safety argument.
+     *
+     * The temp file is written and closed completely before it is visible under the marker name.
+     * `rename(2)` is required by POSIX to be atomic, so a handler's `open` of the marker resolves
+     * to exactly one inode: the previous complete id, or the new complete id. A partially written
+     * file is never reachable under that name.
+     *
+     * Runs on a normal thread, so none of this needs to be async-signal-safe — only the READ side
+     * does. That asymmetry is the point: all the delicate work happens where delicacy is allowed.
+     */
+    int fd = open(scalebun_session_tmp_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd < 0) return;
+    ssize_t written = write(fd, clean, (size_t)out);
+    close(fd);
+    if (written != (ssize_t)out) {
+        // A short or failed write must not be promoted to the marker — the old id is better than a
+        // truncated new one, and leaving the marker untouched keeps it.
+        unlink(scalebun_session_tmp_path);
+        return;
+    }
+    rename(scalebun_session_tmp_path, scalebun_session_marker_path);
+}
+
+void ScaleBunCrashSignalBridgeInstall(const char *crashFilePath,
+                                      const char *sessionMarkerPath,
+                                      const char *sessionTmpPath) {
+    scalebun_crash_path = crashFilePath;
+    // Captured once and read-only afterwards, so the handler never dereferences changing state.
+    scalebun_session_marker_path = sessionMarkerPath;
+    scalebun_session_tmp_path = sessionTmpPath;
+
+    struct sigaction sa;
+    memset(&sa, 0, sizeof(sa));
+    sigemptyset(&sa.sa_mask);
+    sa.sa_flags = SA_RESETHAND; // restore default after first signal
+
+#define INSTALL(signo, handler, prev) \
+    sa.sa_handler = (handler); \
+    sigaction((signo), &sa, &(prev));
+
+    INSTALL(SIGABRT, scalebun_handle_sigabrt, scalebun_prev_sigabrt)
+    INSTALL(SIGBUS,  scalebun_handle_sigbus,  scalebun_prev_sigbus)
+    INSTALL(SIGSEGV, scalebun_handle_sigsegv, scalebun_prev_sigsegv)
+    INSTALL(SIGILL,  scalebun_handle_sigill,  scalebun_prev_sigill)
+    INSTALL(SIGFPE,  scalebun_handle_sigfpe,  scalebun_prev_sigfpe)
+
+#undef INSTALL
+}

package/ios/Crash/ScaleBunCrashSignalStress.c

@@ -0,0 +1,137 @@
+/**
+ * Stress test for the session-id publication primitive.
+ *
+ *   clang -o /tmp/sbstress ScaleBunCrashSignalStress.c ScaleBunCrashSignalBridge.c && /tmp/sbstress
+ *
+ * (ScaleBunCrashSignalBridge.m compiles as C — it contains no Objective-C. Copy or symlink it to a
+ *  .c name, or build with `clang -x c`.)
+ *
+ * WHAT THIS DOES AND DOES NOT PROVE.
+ *
+ * It does NOT replace the safety argument. Async-signal-safety is a property of which operations are
+ * permitted in a handler, and no amount of passing runs establishes it — the previous design passed
+ * every casual test and was still wrong.
+ *
+ * What it DOES catch is implementation error: an off-by-one, a missing terminator, a truncation bug,
+ * or a publication that is not in fact atomic on this filesystem. It runs a publisher thread
+ * alternating two known ids as fast as it can, while a reader thread performs exactly the read the
+ * signal handler performs. The only acceptable observations are complete known ids.
+ *
+ * A single torn or truncated observation fails the run.
+ */
+
+#include <pthread.h>
+#include <stdio.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#include "ScaleBunCrashSignalBridge.h"
+
+#define ITERATIONS 200000
+#define SESSION_MAX 128
+
+static const char *MARKER = "/tmp/scalebun_stress_session";
+static const char *TMPP   = "/tmp/scalebun_stress_session.tmp";
+
+static const char *ID_A = "sess-AAAAAAAAAAAAAAAA";
+static const char *ID_B = "sess-BBBBBBBBBBBBBBBB";
+
+static volatile int running = 1;
+static volatile long torn = 0;
+static volatile long reads = 0;
+
+/* Byte-for-byte what scalebun_write_signal_crash does to read the id. */
+static int read_marker(char *out, size_t cap) {
+    int fd = open(MARKER, O_RDONLY);
+    if (fd < 0) return 0;
+    ssize_t n = read(fd, out, cap);
+    close(fd);
+    return n > 0 ? (int)n : 0;
+}
+
+static void *publisher(void *arg) {
+    (void)arg;
+    for (long i = 0; i < ITERATIONS && running; i++) {
+        ScaleBunCrashSignalBridgeSetSessionId((i & 1) ? ID_A : ID_B);
+    }
+    running = 0;
+    return NULL;
+}
+
+static void *reader(void *arg) {
+    (void)arg;
+    char buf[SESSION_MAX];
+    while (running) {
+        int n = read_marker(buf, sizeof(buf));
+        if (n == 0) continue;              /* marker briefly absent is fine — never a torn value */
+        reads++;
+        int okA = (n == (int)strlen(ID_A)) && memcmp(buf, ID_A, (size_t)n) == 0;
+        int okB = (n == (int)strlen(ID_B)) && memcmp(buf, ID_B, (size_t)n) == 0;
+        if (!okA && !okB) {
+            torn++;
+            if (torn <= 5) {
+                buf[n < SESSION_MAX ? n : SESSION_MAX - 1] = '\0';
+                fprintf(stderr, "TORN OBSERVATION: \"%s\" (%d bytes)\n", buf, n);
+            }
+        }
+    }
+    return NULL;
+}
+
+int main(void) {
+    unlink(MARKER);
+    unlink(TMPP);
+    ScaleBunCrashSignalBridgeInstall("/tmp/scalebun_stress_crash.json", MARKER, TMPP);
+
+    /* Boundary cases first — these are deterministic and do not need the race. */
+    char buf[SESSION_MAX];
+
+    char maxId[SESSION_MAX + 40];
+    memset(maxId, 'a', sizeof(maxId) - 1);
+    maxId[sizeof(maxId) - 1] = '\0';
+    memcpy(maxId, "sess-", 5);
+    ScaleBunCrashSignalBridgeSetSessionId(maxId);
+    int n = read_marker(buf, sizeof(buf));
+    if (n != SESSION_MAX) {
+        fprintf(stderr, "FAIL: over-long id stored %d bytes, expected %d\n", n, SESSION_MAX);
+        return 1;
+    }
+
+    ScaleBunCrashSignalBridgeSetSessionId("sess-\"drop\\these/chars");
+    n = read_marker(buf, sizeof(buf));
+    for (int i = 0; i < n; i++) {
+        char c = buf[i];
+        int ok = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+                 (c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.' || c == ':';
+        if (!ok) {
+            fprintf(stderr, "FAIL: unsanitised byte 0x%02x survived publication\n", (unsigned char)c);
+            return 1;
+        }
+    }
+
+    ScaleBunCrashSignalBridgeSetSessionId(NULL);
+    if (read_marker(buf, sizeof(buf)) != 0) {
+        fprintf(stderr, "FAIL: NULL did not clear the marker\n");
+        return 1;
+    }
+
+    /* Now the race. */
+    pthread_t p, r;
+    pthread_create(&p, NULL, publisher, NULL);
+    pthread_create(&r, NULL, reader, NULL);
+    pthread_join(p, NULL);
+    pthread_join(r, NULL);
+
+    printf("boundary cases: PASS\n");
+    printf("reads observed : %ld\n", reads);
+    printf("torn           : %ld\n", torn);
+    if (reads < 1000) {
+        fprintf(stderr, "FAIL: too few reads (%ld) for the result to mean anything\n", reads);
+        return 1;
+    }
+    if (torn != 0) return 1;
+    printf("RESULT: PASS — every observation was a complete known id\n");
+    return 0;
+}