nx_bck_elide_gate.nx source

1// nx_bck_elide_gate.nx -- THE ELISION PROOF GATE for LN7 (bck_elide_dominated). 2// 3// WHAT IT PROVES, and why the load-bearing tooth is not the fast one. An unsound bounds-check 4// elision does not crash and does not print anything: it removes the check that would have 5// caught a real overrun, and the program then reads or writes memory it had no right to while 6// still returning plausible answers. There is no downstream detector for that. So this gate's 7// centre of gravity is the REFUSAL: a check that is not PROVABLY dominated must still be there, 8// and the two witnesses that prove it are deliberately out-of-bounds programs whose only 9// remaining protection is the check the pass was asked not to remove. 10// 11// HOW ELISION IS OBSERVED. Not from a counter the pass prints -- a pass that narrates can 12// narrate something other than what it did. The oracle is the EMITTED ASSEMBLY: the same 13// source compiled by the same binary with and without --bckelide. A source with a genuinely 14// dominated re-check must produce DIFFERENT assembly; a source whose re-check is not dominated 15// must produce BYTE-IDENTICAL assembly. Either half alone is worthless -- "identical" passes 16// trivially on a pass that does nothing at all -- so they are also submitted together to 17// gv_bite, which fails unless the detector fires on the one and stays silent on the other. 18// 19// WHY THIS GATE IS RED ON THE LIVE COMPILER. nx_compile_x86's argv loop ignores long flags it 20// does not recognise, so a compiler without the LN7 pass accepts --bckelide and emits exactly 21// what it would have emitted anyway. The dominated-source tooth therefore fails against it, 22// and the refusal tooth PASSES against it -- vacuously. That asymmetry is the point, and it is 23// why the refusal tooth is never read on its own. 24// 25// THE COMPILER UNDER TEST IS argv[1] AND THERE IS NO DEFAULT. A gate that forks whichever 26// compiler happens to be installed will produce a complete, confident verdict about a binary 27// nobody chose; the estate has paid for that mistake before. Absence is a refusal here. 28// 29// SCOPE STATED PLAINLY -- WHAT THIS GATE DOES NOT MEASURE. The matrix row's "unchecked band" 30// (a build with NX_BOUNDS_CHECK_LIVE = 0) is NOT measured here. That constant lives in 31// nx_parse.nx, which this lane does not own, and fabricating the number from anything else 32// would be a constant wearing the shape of a measurement. What IS measured is the honest h2h 33// available from one compiler: checked-with-elision against checked-without-elision, on the 34// same binary, same box, same minute -- i.e. how much of the check's cost the elision actually 35// removes. Both figures are PRINTED with the host load beside them, and NOTHING branches on 36// them: a wall-clock comparison on a shared, loaded NAS is a measurement to report, never a 37// threshold to gate on, and building a tooth out of it would just be a flake generator. 38// 39// FIXTURES ARE ASSEMBLED AT RUNTIME into a PER-RUN /tmp/nx_bck_elide_gate_<us>/ (a detector that scans source 40// finds its own fixture, and prose is source bytes too). Products land in _build/ because NAS 41// /tmp is mounted NOEXEC and an ELF written there dies exec-127 on every run -- which reads 42// exactly like a miscompiling compiler. 43// 44// license_tier: ORIGINAL No hw writes (Rule 26). 45import "nx_gate_verdict.nx" 46import "nx_ccbuild_lib.nx" 47import "nx_gatekit_lib.nx" 48 49// nx_parse.nx NX_TRAP_BOUNDS -- the code emit_bounds_trap passes to exit_group. This is an 50// EXPECTED VALUE in a test, not a tunable: if it were wrong the trap teeth would simply fail. 51const BCKG_TRAP_BOUNDS: i64 = 71 52const BCKG_MODE_644: i64 = 420 53const BCKG_MODE_755: i64 = 493 54const BCKG_WAIT_SIGMASK: i64 = 128 55const BCKG_WAIT_CODESHIFT: i64 = 256 56const BCKG_SCRATCH: i64 = 64 57// Three sources are compiled two ways each. Named so the subjects count below is derived from 58// the plan rather than hand-counted beside it. 59const BCKG_N_SOURCES: i64 = 3 60const BCKG_PATHCAP: i64 = 512 61// PER-RUN PATHS (2026-09-03). Every fixture and every build product this gate touches used to be a 62// CONSTANT path, so two runs launched together overwrote each other and BOTH returned a false SKIP 63// ("the named compiler built none of the fixtures") while each was individually healthy. A false SKIP 64// acquits nothing and alarms nobody -- it only destroys the evidence, which is why it survived unseen. 65// The /tmp side composes gk_fixture_dir (shared primitive, refereed by nx_gk_fixture_gate). The _build 66// side carries its own per-run token because those products MUST stay on the same filesystem as the 67// assembler temp. The two tokens are independent on purpose: each need only be unique per run. 68func bckg_path(pfx: *u8, name: *u8) -> *u8 { 69 let q: *u8 = sys_mmap(BCKG_PATHCAP) 70 var o: i64 = gk_cat(q, 0, pfx) 71 o = gk_cat(q, o, name) 72 return q 73} 74 75// Resolve the compiler-under-test from argv into out[0]. 0 = none given. 76// Split out as a function precisely so the refusal can be exercised BOTH ways by a real call, 77// rather than asserted by a comment next to an `if`. 78func bckg_resolve_cc(argc: i64, argv: *i64, out: *i64) -> i64 { 79 out[0] = 0 80 if argc < 2 { return 0 } 81 let p: *u8 = argv[1] as *u8 82 if p[0] == (0 as u8) { return 0 } 83 out[0] = p as i64 84 return 1 85} 86 87// Raw wait status -> exit code, or -1 when the child did NOT exit normally. 88// A child killed by a signal is a different outcome from one that exited with a code, and 89// collapsing them would let a SIGSEGV read as a bounds trap -- which is exactly the distinction 90// this gate exists to make. Arithmetic rather than bit ops so the decode is obvious. 91func bckg_exit_code(st: i64) -> i64 { 92 if (st % BCKG_WAIT_SIGMASK) != 0 { return 0 - 1 } 93 return (st / BCKG_WAIT_CODESHIFT) % 256 94} 95 96// Write one fixture source. Returns 0 on any short or failed write -- a partially written 97// fixture would compile to something nobody designed. 98func bckg_write_src(path: *u8, body: *u8) -> i64 { 99 let fd: i64 = sys_openat_wr(path, BCKG_MODE_644) 100 if fd < 0 { return 0 } 101 var n: i64 = 0 102 while body[n] != (0 as u8) { n = n + 1 } 103 let w: i64 = sys_write(fd, body, n) 104 sys_close(fd) 105 if w != n { return 0 } 106 return 1 107} 108 109// Run a product with ONE argument (the witness phase letter), capturing stdout. 110// Composes cb_run, the shared fork/exec primitive -- cb_run_capture passes no argv slot, and 111// re-implementing the fork here to add one would be a second spelling of the same move. 112func bckg_run1(elf: *u8, arg1: *u8, out_path: *u8, envp: *i64, errfd: i64) -> i64 { 113 let ofd: i64 = sys_openat_wr(out_path, BCKG_MODE_644) 114 let a: *i64 = sys_mmap(BCKG_SCRATCH) as *i64 115 a[0] = elf as i64 116 a[1] = arg1 as i64 117 a[2] = 0 118 let st: i64 = cb_run(elf, a, envp, ofd, errfd) 119 sys_close(ofd) 120 return st 121} 122 123// Print " <label>=<n>\n". Every value this gate decides on is printed, because a gate that 124// reports a boolean cannot say why it said it. 125func bckg_kv(label: *u8, v: i64) -> i64 { 126 gv_puts(" " as *u8) 127 gv_puts(label) 128 gv_puts("=" as *u8) 129 gv_num(v) 130 gv_puts("\n" as *u8) 131 return 0 132} 133 134func main(argc: i64, argv: *i64) -> i64 { 135 let ctr: *i64 = gv_ctr() 136 gv_head("nx_bck_elide_gate -- LN7: an elision fires ONLY where dominance proves it safe, and every check it declines to remove still traps" as *u8) 137 138 let ccbuf: *i64 = sys_mmap(BCKG_SCRATCH) as *i64 139 // Exercised BOTH ways against the real resolver: absent argv must refuse, present must not. 140 let neg_absent: i64 = bckg_resolve_cc(1, argv, ccbuf) 141 let pos_present: i64 = bckg_resolve_cc(argc, argv, ccbuf) 142 gv_bite("neg-control-refuses-a-silent-default-compiler-and-accepts-an-explicit-one" as *u8, 143 1 - neg_absent, 1 - pos_present, ctr) 144 145 if gv_need("compiler-under-test named in argv[1]" as *u8, pos_present, ctr) == 0 { 146 gv_puts(" usage: nx_bck_elide_gate <path-to-compiler-elf>\n" as *u8) 147 sys_exit(gv_verdict("BCK-ELIDE-GATE" as *u8, ctr, "no compiler named" as *u8)) 148 } 149 let cc: *u8 = ccbuf[0] as *u8 150 151 let anchored: i64 = cb_anchor_root() 152 if gv_need("buildroot tree reachable from the working directory" as *u8, anchored, ctr) == 0 { 153 sys_exit(gv_verdict("BCK-ELIDE-GATE" as *u8, ctr, "tree not found" as *u8)) 154 } 155 156 let dir: *u8 = sys_mmap(BCKG_PATHCAP) 157 gk_fixture_dir("nx_bck_elide_gate" as *u8, dir) // creates it; per-RUN, not per-gate 158 let fxp: *u8 = sys_mmap(BCKG_PATHCAP) 159 var fxo: i64 = gk_cat(fxp, 0, dir) 160 fxo = gk_cat(fxp, fxo, "/" as *u8) 161 let bxp: *u8 = sys_mmap(BCKG_PATHCAP) 162 var bxo: i64 = gk_cat(bxp, 0, "_build/bckg_" as *u8) 163 bxo = gk_catn(bxp, bxo, sys_clock_now_us()) 164 bxo = gk_cat(bxp, bxo, "_" as *u8) 165 166 // ---- fixtures, assembled at runtime ---------------------------------------------------- 167 // DOM: three accesses through ONE SSA index in straight-line code. The 2nd and 3rd checks 168 // are dominated by the 1st, so --bckelide must change this program's assembly. 169 let src_dom: *u8 = bckg_path(fxp, "dom.nx\x00" as *u8) 170 let body_dom: *u8 = "func main() -> i64 {\n var a: [64]i64\n var f: i64 = 0\n var st: i64 = 1 171 while f < 64 { a[f] = f; f = f + st; st = st + 1 }\n let i: i64 = a[0] + 7\n a[i] = a[i] + 1\n return a[i] % 7\n}\n" 172 // NODOM: the SAME index and the SAME array, but the first access sits inside a conditional, 173 // so the path where that test fails reaches the second access having proven nothing. 174 // --bckelide must leave this program's assembly byte-identical. 175 let src_nodom: *u8 = bckg_path(fxp, "nodom.nx\x00" as *u8) 176 let body_nodom: *u8 = "func main() -> i64 {\n var a: [64]i64\n var f: i64 = 0\n var st: i64 = 1 177 while f < 64 { a[f] = f; f = f + st; st = st + 1 }\n let i: i64 = a[0] + 7\n var acc: i64 = 0\n if i < 8 { acc = acc + a[i] }\n acc = acc + a[i]\n return acc % 7\n}\n" 178 let w1: i64 = bckg_write_src(src_dom, body_dom) 179 let w2: i64 = bckg_write_src(src_nodom, body_nodom) 180 var nsrc: i64 = 0 181 if w1 == 1 { nsrc = nsrc + 1 } 182 if w2 == 1 { nsrc = nsrc + 1 } 183 // The third subject is the shipped witness organ, which carries the trap legs. 184 let src_bck: *u8 = "runtime/nx_boundscheck.nx\x00" 185 if cb_fsize(src_bck) > 0 { nsrc = nsrc + 1 } 186 if gv_subjects("witness sources available to compile" as *u8, nsrc, ctr) == 0 { 187 sys_exit(gv_verdict("BCK-ELIDE-GATE" as *u8, ctr, "no fixtures" as *u8)) 188 } 189 gv_check("all-planned-witness-sources-present" as *u8, nsrc == BCKG_N_SOURCES, ctr) 190 191 // ---- build the six artifacts ----------------------------------------------------------- 192 let envp: *i64 = sys_mmap(BCKG_SCRATCH) as *i64 193 envp[0] = 0 194 let cclogp: *u8 = bckg_path(fxp, "cc.log\x00" as *u8) 195 let cclog: i64 = sys_openat_wr(cclogp, BCKG_MODE_644) 196 let asmlog: *u8 = bckg_path(fxp, "asm.log\x00" as *u8) 197 // The assembler renames its temp onto the product, so the temp must live on the SAME 198 // filesystem as the product or every rename fails and every downstream run dies 127. 199 let asmtmp: *u8 = bckg_path(bxp, "asm.tmp\x00" as *u8) 200 let flag: *u8 = "--bckelide\x00" 201 202 let s_dom_p: *u8 = bckg_path(fxp, "dom_plain.s\x00" as *u8) 203 let s_dom_f: *u8 = bckg_path(fxp, "dom_flag.s\x00" as *u8) 204 let s_nod_p: *u8 = bckg_path(fxp, "nodom_plain.s\x00" as *u8) 205 let s_nod_f: *u8 = bckg_path(fxp, "nodom_flag.s\x00" as *u8) 206 let s_bck_p: *u8 = bckg_path(fxp, "bck_plain.s\x00" as *u8) 207 let s_bck_f: *u8 = bckg_path(fxp, "bck_flag.s\x00" as *u8) 208 let e_dom_p: *u8 = bckg_path(bxp, "dom_plain.elf\x00" as *u8) 209 let e_dom_f: *u8 = bckg_path(bxp, "dom_flag.elf\x00" as *u8) 210 let e_nod_p: *u8 = bckg_path(bxp, "nodom_plain.elf\x00" as *u8) 211 let e_nod_f: *u8 = bckg_path(bxp, "nodom_flag.elf\x00" as *u8) 212 let e_bck_p: *u8 = bckg_path(bxp, "bck_plain.elf\x00" as *u8) 213 let e_bck_f: *u8 = bckg_path(bxp, "bck_flag.elf\x00" as *u8) 214 215 let rc1: i64 = cb_build_flag(cc, src_dom, s_dom_p, e_dom_p, envp, cclog, asmtmp, asmlog, 0 as *u8) 216 let rc2: i64 = cb_build_flag(cc, src_dom, s_dom_f, e_dom_f, envp, cclog, asmtmp, asmlog, flag) 217 let rc3: i64 = cb_build_flag(cc, src_nodom, s_nod_p, e_nod_p, envp, cclog, asmtmp, asmlog, 0 as *u8) 218 let rc4: i64 = cb_build_flag(cc, src_nodom, s_nod_f, e_nod_f, envp, cclog, asmtmp, asmlog, flag) 219 let rc5: i64 = cb_build_flag(cc, src_bck, s_bck_p, e_bck_p, envp, cclog, asmtmp, asmlog, 0 as *u8) 220 let rc6: i64 = cb_build_flag(cc, src_bck, s_bck_f, e_bck_f, envp, cclog, asmtmp, asmlog, flag) 221 bckg_kv("build_rc_dom_plain" as *u8, rc1) 222 bckg_kv("build_rc_dom_flag" as *u8, rc2) 223 bckg_kv("build_rc_nodom_plain" as *u8, rc3) 224 bckg_kv("build_rc_nodom_flag" as *u8, rc4) 225 bckg_kv("build_rc_witness_plain" as *u8, rc5) 226 bckg_kv("build_rc_witness_flag" as *u8, rc6) 227 var builds_ok: i64 = 0 228 if rc1 == 0 { if rc2 == 0 { if rc3 == 0 { if rc4 == 0 { if rc5 == 0 { if rc6 == 0 { builds_ok = 1 } } } } } } 229 // A PRECONDITION, NOT A CHECK -- and this line was a gv_check until a real run proved why it 230 // must not be. Pointed at a path that did not exist, all six builds failed, cb_build left 231 // the PREVIOUS run's products in place because it renames onto them only on success, and the 232 // gate then ran those stale binaries and scored four PASSes -- including both trap teeth -- 233 // for a compiler that had compiled nothing at all. A green from a stale artifact is 234 // indistinguishable from a green from the thing you meant to test. If the compiler under 235 // test cannot build the fixtures, this run produced NO EVIDENCE about elision, and that is 236 // the third state, not a failure of the language. 237 if gv_need("all six witness builds succeeded under the compiler named in argv[1]" as *u8, builds_ok, ctr) == 0 { 238 gv_puts(" the named compiler built none of the fixtures -- diagnostics in the per-run cc.log under /tmp/nx_bck_elide_gate_<us>/ .\n" as *u8) 239 gv_puts(" NOTHING below was run: the products on disk would be a PREVIOUS run's binaries.\n" as *u8) 240 sys_close(cclog) 241 sys_exit(gv_verdict("BCK-ELIDE-GATE" as *u8, ctr, "fixtures unbuildable" as *u8)) 242 } 243 244 let out_tmp: *u8 = bckg_path(fxp, "run.out\x00" as *u8) 245 let ph_o: *u8 = "o\x00" 246 let ph_d: *u8 = "d\x00" 247 let ph_n: *u8 = "n\x00" 248 let ph_x: *u8 = "x\x00" 249 let ph_p: *u8 = "p\x00" 250 let ph_q: *u8 = "q\x00" 251 252 // ---- THE POSITIVE CONTROL, RUN FIRST --------------------------------------------------- 253 // Several teeth below are satisfied by a program REFUSING to proceed (a trap). Without a 254 // tooth that an ordinary correct program must PASS, an environment fault -- a noexec mount, 255 // a missing assembler -- makes every one of them succeed and the gate reports a verdict 256 // about the language when it is really reporting on its own filesystem. 257 let st_ctrl: i64 = bckg_run1(e_bck_f, ph_o, out_tmp, envp, cclog) 258 let cd_ctrl: i64 = bckg_exit_code(st_ctrl) 259 bckg_kv("inrange_control_exit_under_flag" as *u8, cd_ctrl) 260 gv_check("positive-control-an-ordinary-in-range-program-still-runs-clean-under-the-flag" as *u8, 261 cd_ctrl == 0, ctr) 262 263 // ---- ELISION FIRED / DID NOT FIRE ------------------------------------------------------ 264 let dom_same: i64 = cb_files_equal(s_dom_p, s_dom_f) 265 let nod_same: i64 = cb_files_equal(s_nod_p, s_nod_f) 266 let sz_dom_p: i64 = cb_fsize(s_dom_p) 267 let sz_dom_f: i64 = cb_fsize(s_dom_f) 268 let sz_nod_p: i64 = cb_fsize(s_nod_p) 269 let sz_nod_f: i64 = cb_fsize(s_nod_f) 270 bckg_kv("dominated_asm_bytes_plain" as *u8, sz_dom_p) 271 bckg_kv("dominated_asm_bytes_flag" as *u8, sz_dom_f) 272 bckg_kv("notdominated_asm_bytes_plain" as *u8, sz_nod_p) 273 bckg_kv("notdominated_asm_bytes_flag" as *u8, sz_nod_f) 274 275 gv_check("a-dominated-re-check-IS-elided-its-assembly-changes-under-the-flag" as *u8, 276 dom_same == 0, ctr) 277 gv_check("REFUSAL-a-re-check-that-is-not-provably-dominated-is-KEPT-assembly-byte-identical" as *u8, 278 nod_same == 1, ctr) 279 // Neither half means anything alone: "identical" is what a pass that does nothing produces. 280 gv_bite("bite-fires-on-the-dominated-source-and-stays-silent-on-the-non-dominated-one" as *u8, 281 1 - dom_same, 1 - nod_same, ctr) 282 var shrank: i64 = 0 283 if sz_dom_f > 0 { if sz_dom_f < sz_dom_p { shrank = 1 } } 284 gv_check("the-elision-REMOVES-work-the-dominated-assembly-is-strictly-smaller" as *u8, shrank, ctr) 285 286 // ---- THE CHECKS THAT MUST SURVIVE ------------------------------------------------------ 287 // Both legs are out-of-bounds on purpose. Under a correct pass the check that catches them 288 // was never a candidate for removal; under an unsound one it was, and the program returns 289 // an ordinary-looking value having touched memory it does not own. 290 let st_n_f: i64 = bckg_run1(e_bck_f, ph_n, out_tmp, envp, cclog) 291 let st_x_f: i64 = bckg_run1(e_bck_f, ph_x, out_tmp, envp, cclog) 292 let cd_n_f: i64 = bckg_exit_code(st_n_f) 293 let cd_x_f: i64 = bckg_exit_code(st_x_f) 294 bckg_kv("oob_notdominated_exit_under_flag" as *u8, cd_n_f) 295 bckg_kv("oob_other_extent_exit_under_flag" as *u8, cd_x_f) 296 gv_check("an-out-of-bounds-access-past-a-NON-dominating-check-still-traps-NX_TRAP_BOUNDS" as *u8, 297 cd_n_f == BCKG_TRAP_BOUNDS, ctr) 298 gv_check("an-out-of-bounds-access-at-a-DIFFERENT-extent-still-traps-NX_TRAP_BOUNDS" as *u8, 299 cd_x_f == BCKG_TRAP_BOUNDS, ctr) 300 301 // ASSERT THE FIXTURE REACHED THE CONDITION. If these legs did not trap WITHOUT the flag 302 // either, they never exercised a bounds check at all and the two teeth above would be 303 // passing on a program that simply cannot fail. 304 let st_n_p: i64 = bckg_run1(e_bck_p, ph_n, out_tmp, envp, cclog) 305 let st_x_p: i64 = bckg_run1(e_bck_p, ph_x, out_tmp, envp, cclog) 306 let cd_n_p: i64 = bckg_exit_code(st_n_p) 307 let cd_x_p: i64 = bckg_exit_code(st_x_p) 308 bckg_kv("oob_notdominated_exit_plain" as *u8, cd_n_p) 309 bckg_kv("oob_other_extent_exit_plain" as *u8, cd_x_p) 310 var fixture_live: i64 = 0 311 if cd_n_p == BCKG_TRAP_BOUNDS { if cd_x_p == BCKG_TRAP_BOUNDS { fixture_live = 1 } } 312 gv_check("non-vacuity-both-trap-legs-already-trap-WITHOUT-the-flag-so-they-do-exercise-a-check" as *u8, 313 fixture_live, ctr) 314 315 // ---- SEMANTICS PRESERVED --------------------------------------------------------------- 316 let st_d_f: i64 = bckg_run1(e_bck_f, ph_d, out_tmp, envp, cclog) 317 let st_d_p: i64 = bckg_run1(e_bck_p, ph_d, out_tmp, envp, cclog) 318 let cd_d_f: i64 = bckg_exit_code(st_d_f) 319 let cd_d_p: i64 = bckg_exit_code(st_d_p) 320 bckg_kv("dominated_witness_exit_under_flag" as *u8, cd_d_f) 321 bckg_kv("dominated_witness_exit_plain" as *u8, cd_d_p) 322 gv_check("the-elided-program-still-computes-the-closed-form-answer-under-the-flag" as *u8, 323 cd_d_f == 0, ctr) 324 gv_check("the-same-program-computes-the-same-closed-form-answer-without-the-flag" as *u8, 325 cd_d_p == 0, ctr) 326 327 // ---- h2h COST, REPORTED AND NOT GATED -------------------------------------------------- 328 let t0: i64 = sys_now_us() 329 let st_p_p: i64 = bckg_run1(e_bck_p, ph_p, out_tmp, envp, cclog) 330 let t1: i64 = sys_now_us() 331 let st_p_f: i64 = bckg_run1(e_bck_f, ph_p, out_tmp, envp, cclog) 332 let t2: i64 = sys_now_us() 333 let st_q_p: i64 = bckg_run1(e_bck_p, ph_q, out_tmp, envp, cclog) 334 let t3: i64 = sys_now_us() 335 let st_q_f: i64 = bckg_run1(e_bck_f, ph_q, out_tmp, envp, cclog) 336 let t4: i64 = sys_now_us() 337 let us_checked: i64 = t1 - t0 338 let us_elided: i64 = t2 - t1 339 let us_q_checked: i64 = t3 - t2 340 let us_q_elided: i64 = t4 - t3 341 // Leg A carries a remainder in the loop body that costs far more than the checks do, so its 342 // ratio is a floor on what elision is worth, not a measure of it. Leg A2 removes only that 343 // confound -- same elements, same order, same access count. BOTH are printed: a confounded 344 // figure that disappears when a better one arrives is a figure nobody can audit. 345 bckg_kv("h2h_A_modulo_checked_no_elision_us" as *u8, us_checked) 346 bckg_kv("h2h_A_modulo_checked_with_elision_us" as *u8, us_elided) 347 bckg_kv("h2h_A2_divfree_checked_no_elision_us" as *u8, us_q_checked) 348 bckg_kv("h2h_A2_divfree_checked_with_elision_us" as *u8, us_q_elided) 349 bckg_kv("h2h_perf_leg_exit_plain" as *u8, bckg_exit_code(st_p_p)) 350 bckg_kv("h2h_perf_leg_exit_flag" as *u8, bckg_exit_code(st_p_f)) 351 bckg_kv("h2h_divfree_leg_exit_plain" as *u8, bckg_exit_code(st_q_p)) 352 bckg_kv("h2h_divfree_leg_exit_flag" as *u8, bckg_exit_code(st_q_f)) 353 var timed: i64 = 0 354 if us_checked > 0 { if us_elided > 0 { if us_q_checked > 0 { if us_q_elided > 0 { if bckg_exit_code(st_p_p) == 0 { if bckg_exit_code(st_p_f) == 0 { if bckg_exit_code(st_q_p) == 0 { if bckg_exit_code(st_q_f) == 0 { timed = 1 } } } } } } } } 355 // Deliberately asserts only that BOTH legs ran and were timed. The ratio between them is 356 // wall clock on a shared, loaded host: it is evidence to publish, not a bar to clear, and a 357 // tooth built on it would fail for reasons that have nothing to do with this pass. 358 gv_check("both-h2h-cost-legs-completed-and-were-timed-ratio-published-not-gated" as *u8, timed, ctr) 359 360 sys_close(cclog) 361 sys_exit(gv_verdict("BCK-ELIDE-GATE" as *u8, ctr, "elision proven dominance-gated" as *u8)) 362 return 0 363}