test(daemon): age the stuck-probe sample from the sampler's time

[novelKR]

Summary

Test-only fix for a false failure of server::tests::native::a_stuck_probe_does_not_hold_the_authority_and_its_delay_closes_admission (DG1-C03). No product code changes.

Failure

• Run 36303237592 (pull_request, head aff986cc83623d0a1c0521771964da1346e6c094), job contracts (macos-14), step "Native host evidence functional checks", stage service-sampling: assertion failed: last_open - last_read <= 6_000 at crates/daemon/src/server.rs:2854.
• The push run 36303235570 of the same head passed. Since the assertion was added in defde38, this step ran on 33 macOS attempts and failed only this once.

Cause

• The test measured from last_read, which the scripted probe records inside read() before returning.
• The controller ages a sample from sample.at, which Sampler::sample takes after the read returns ("so its age is never understated"), and stores as its last sample (PressureController::observe). Admission closes when now - sample.at > 6_000.
• So sample.at >= last_read, and the upper-bound assertion assumed they were equal. Whenever they differed by a millisecond or more and a 20 ms poll fell between last_read + 6_000 and sample.at + 6_000, a correct controller was reported as late. The lower-bound assertion cannot fail this way.

Change

• The scripted probe blocks its third read by count (baseline, first sample, stuck read) and records when that read began, replacing "block whichever read follows a store" plus a fixed 2300 ms sleep. This makes the first sample the last completed one.
• The reference time is that sample's sample.at, read from its pressure receipt, which carries the same value the controller stores.
• Both bounds (<= 6_000 open, > 6_000 closed), the lock check, the "closed before the stuck read returned" check and the slow-read and recovery checks are unchanged. The two bound assertions now print their values.
• The "never closed" guard now counts its 12 s from when the blocked read began instead of from when the delay was armed, about one 2 s sampling interval earlier, so a controller that never closes fails about 2 s later than before. That guard and the 4 s wait for the blocked read to begin only turn a hang into a failure; the six-second admission policy is asserted by the two bounds above.

Verification

Rust 1.95.0, one Cargo job, one test thread (CARGO_BUILD_JOBS=1, RUST_TEST_THREADS=1), macOS arm64.

• Reproduction with uncommitted instrumentation (a pause between the probe's timestamp and the sampler's, and an overridable freshness limit):
  • old test, no pause: 3/3 pass; old test, 40 ms pause: 3/3 fail at this assertion
  • new test, no pause: 3/3 pass; new test, 40 ms pause: the preserved run summary records 3/3 passes, but the raw logs do not independently prove that the pause was active in those runs
  • new test, limit 5900 ms (closes early): 3/3 fail; limit 6100 ms (closes late): 3/3 fail
  • Evidence limits: the preserved command script keeps the run helper but not each case's invocation, so each case's environment is known from its name only. The early- and late-close failures print 5,915 ms and 6,094 ms, matching the intended limits. By construction the new reference is the controller's own sample time, which such a pause cannot move.
• New test: 30/30 runs pass.
• cargo test -p devguard-daemon --lib --locked: 41 passed.
• python3 scripts/qualify.py dg1-probes: passed (service-sampling 2/2).
• cargo fmt --all -- --check, cargo clippy -p devguard-daemon --all-targets --locked -- -D warnings, git diff --check: clean.
• CI for this head: push run 36311129096 and pull_request run 36311154406 passed on ubuntu-24.04 and macos-14.

Not run locally

• scripts/validate.py and workspace-wide Clippy (host memory was tight); both run in this PR's CI on macOS and Ubuntu.
• The hosted macOS 14 runner was not reproduced locally; the reproduction widens the gap on purpose. It shows the mechanism, not the gap or the failure probability of run 36303237592.

Rollback

Revert this commit; it touches one test module only.

Handoff (session of 2026-09-27)

• Tracker: Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) #14. Session record: docs(handoff): record the close of the 2026-09-27 session #15 (docs/handoff/2026-09-27-session-close.md). CodeSpace tracker: Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) CodeSpace#76; CodeSpace note: docs: record the CS-RG suspension handoff note CodeSpace#77.
• State at handoff: head 2bbe7c5ed88ad3170bc76985bdecb1fd7434d501, CLEAN, not merged. Merging needs the owner's approval of this exact head (merge track in Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) #14).
• This test-only fix is independent of the CS-RG decisions.