fix(classify): assign alarm to FamilyTime, not Misc

alarm(2) arranges for a SIGALRM after a given number of seconds; it is a
simplified setitimer(ITIMER_REAL) and, per alarm(2) NOTES, "alarm() and
setitimer(2) share the same timer; calls to one will interfere with use of
the other." The syscallFamilies table omitted alarm, so it fell through to
FamilyMisc while its siblings setitimer/getitimer/timer_create were correctly
FamilyTime — an adjtimex-style misclassification (cf. 7243b7c). Add
alarm -> FamilyTime and move it from Misc to Time in the tracing plan;
regenerate the family maps (trace IDs 468/469 now FamilyTime,
"alarm": "Time").

Kind classification (KindNull/null_event: the single arg is an unsigned int
seconds, no fd/path) and the UNCLASSIFIED return (seconds remaining, not a
byte count; alarm never fails) were already correct.

Also harden the misc-basic integration test with a deterministic
enter_alarm assertion (alarm(0) is issued unconditionally by the scenario;
the syscall-entry tracepoint always fires) so the alarm enter path is
covered end-to-end even though alarm is now FamilyTime rather than Misc.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/internal/generate/family.go b/internal/generate/family.go
index 71f23a9..95b354b 100644
--- a/internal/generate/family.go
+++ b/internal/generate/family.go
@@ -164,6 +164,17 @@ var syscallFamilies = map[string]SyscallFamily{
 	// is a userspace struct timex *, so argument capture is KindNull (null_event)
 	// and the return is UNCLASSIFIED (a state code, not a byte count).
 	"adjtimex":      FamilyTime,
+	// alarm(2) arranges for a SIGALRM after a given number of seconds; it is a
+	// simplified setitimer(ITIMER_REAL) and, per alarm(2) NOTES, "alarm() and
+	// setitimer(2) share the same timer; calls to one will interfere with use of
+	// the other." It therefore belongs in FamilyTime alongside setitimer/
+	// getitimer/timer_create, not in Misc (where it previously fell through by
+	// omission, an adjtimex-style misclassification). The single argument is an
+	// unsigned int seconds (no fd/path), so argument capture is KindNull
+	// (null_event); the return is the seconds remaining on any previously set
+	// alarm (or 0) and alarm never fails, so the return is UNCLASSIFIED — not a
+	// byte count.
+	"alarm":         FamilyTime,
 	"clock_adjtime": FamilyTime, "clock_getres": FamilyTime, "clock_gettime": FamilyTime,
 	"clock_nanosleep": FamilyTime, "clock_settime": FamilyTime, "getitimer": FamilyTime,
 	"gettimeofday": FamilyTime, "nanosleep": FamilyTime, "setitimer": FamilyTime,