code wiki / (root) / nx_enginelab_gate.nx
`nx_enginelab_gate.nx` source

↩ module page · 619 lines · 35101 B
1// nx_enginelab_gate.nx -- END-TO-END gate for the sovereign engine instrument.
2//
3// WHAT A GREEN HERE MEANS, AND WHAT IT DOES NOT. Every tooth below asserts an ARITHMETIC property of
4// the instrument on a fixture built at runtime inside this process. A green says the five instrument
5// classes compute what they claim on data whose right answer is known by construction. It says
6// NOTHING about any engine's real performance -- that is the instrument's job, not the gate's.
7//
8// FIXTURES ARE BUILT IN MEMORY, NEVER ON DISK AND NEVER SHARED. A gate that shares scratch with a
9// production beat measures the fixture instead of the code (this estate has the receipt: a segguard
10// fold took a gate RED while the same code went 24/24 GREEN on private scratch). Nothing here opens
11// a file, so there is no teardown to skip and no run that can poison the next one.
12//
13// NEGATIVE CONTROLS ARE NAMED neg-control-* so a census can COUNT them. A control nobody can find is
14// a control nobody maintains.
15import "nx_syscalls.nx"
16import "nx_gate_verdict.nx"
17import "nx_visual_diff.nx"
18import "nx_enginelab_lib.nx"
19import "nx_enginelab_golden.nx"
20import "nx_enginelab_store.nx"
21
22const EG_SCRATCH: i64 = 32          // i64 slots for any out-buffer used below
23const EG_STORE_CAP: i64 = 96
24const EG_IMG_W: i64 = 8
25const EG_IMG_H: i64 = 8
26const EG_IMG_NC: i64 = 3
27const EG_GRID: i64 = 4              // 4x4 cells over the 8x8 fixture = 2x2 px per cell
28const EG_THRESH: i64 = 4            // per-cell mean tolerance
29const EG_BASE_VAL: i64 = 100        // fixture background level
30const EG_ALTER_VAL: i64 = 200       // a level far outside EG_THRESH, so the change cannot be a rounding artefact
31const EG_TARGET_FPS: i64 = 60
32// ---- EL7 / browser-wire fixture parameters (added by the overlay lane, 2026-08-28) --------------
33// Named rather than written inline because a bare literal in a tooth is a bar nobody can find again.
34// Two are load-bearing and say so: EG_DROP_CAP is small ENOUGH that the store provably OVERFLOWS,
35// without which the coverage-survives-the-round-trip tooth would be vacuous; and EG_TRIS is the real
36// 2,419,200 triangles-per-frame figure the world page's own geometry-actuator comment records, so
37// the fixture carries the actual scale the instrument was built to make visible rather than a toy.
38const EG_DROP_CAP: i64 = 2
39const EG_SMALL_BUF: i64 = 8
40const EG_Q_PERMIL: i64 = 354
41const EG_TRIS: i64 = 2419200
42const EG_ASCII_9: i64 = 57
43const EG_DEC_BASE: i64 = 10
44// One frame at the fixture's target rate, in microseconds. NAMED FOR ITS PURPOSE, never for its
45// value: the fixtures below mark frames at multiples of it, so a reader sees 'one frame' and 'two
46// frames' rather than two unexplained five-digit numbers that happen to differ by 16000.
47const EG_FRAME_US: i64 = 16000
48// A magic word deliberately NOT equal to ELS_MAGIC, for the bad-magic refusal fixture. The value is
49// arbitrary and that is exactly the point -- what matters is that it is not ours, which is what this
50// name says and what the bare digits did not.
51const EG_NOT_OUR_MAGIC: i64 = 12345
52
53func eg_buf() -> *i64 { return sys_mmap(EG_SCRATCH * EL_I64) as *i64 }
54
55func eg_mk_img(val: i64) -> *VdImg {
  let im: *VdImg = sys_mmap(VD_IMG_BYTES) as *VdImg
  let npx: i64 = EG_IMG_W * EG_IMG_H * EG_IMG_NC
  let px: *u8 = sys_mmap(npx)
  var i: i64 = 0
  while i < npx { px[i] = val as u8; i = i + 1 }
  im.px = px
  im.w = EG_IMG_W
  im.h = EG_IMG_H
  im.nc = EG_IMG_NC
  return im
66}
67
68// paint the top-left 2x2 block (exactly one grid cell) to val
69func eg_alter(im: *VdImg, val: i64) -> i64 {
  var y: i64 = 0
  while y < 2 {
      var x: i64 = 0
      while x < 2 {
          let o: i64 = (y * im.w + x) * im.nc
          im.px[o] = val as u8
          im.px[o+1] = val as u8
          im.px[o+2] = val as u8
          x = x + 1
      }
      y = y + 1
  }
  return 0
83}
84
85// a capture of three draws; verts_last lets a caller build a DIVERGENT twin
86func eg_mk_capture(verts_last: i64) -> *i64 {
  let st: *i64 = el_new(EG_STORE_CAP)
  el_draw(st, 10, 1, 500, 1, 100, 11)
  el_draw(st, 20, 1, 501, 2, 200, 22)
  el_draw(st, 30, 1, 502, 3, verts_last, 33)
  return st
92}
93
94// a frame series: five 16ms frames, optionally with one 100ms spike
95func eg_mk_frames(spike: i64) -> *i64 {
  let st: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(st, 0)
  el_frame_mark(st, 16000)
  el_frame_mark(st, 32000)
  el_frame_mark(st, 48000)
  if spike == 1 { el_frame_mark(st, 148000); el_frame_mark(st, 164000) }
  else { el_frame_mark(st, 64000); el_frame_mark(st, 80000) }
  return st
104}
105
106func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_enginelab_gate -- the sovereign engine instrument: zones, frames, GPU queues, draw capture, golden images, and the join" as *u8)
109
  let o: *i64 = eg_buf()
  let o2: *i64 = eg_buf()
112
  // ---- population -----------------------------------------------------------------------------
  let base: *i64 = el_new(EG_STORE_CAP)
  el_push(base, EL_K_DRAW, 1, 0, 7, 42, 3, 4, 5)
  gv_subjects("events in the base fixture" as *u8, el_count(base), ctr)
117
  gv_check("T1 a pushed record reads back on every field" as *u8,
      eg_eq6(el_get(base,0,EL_F_KIND), EL_K_DRAW, el_get(base,0,EL_F_TID), 7,
             el_get(base,0,EL_F_NAME), 42), ctr)
121
  // ---- NO SILENT CAPS -------------------------------------------------------------------------
  let tiny: *i64 = el_new(2)
  el_push(tiny, EL_K_ZONE, 1, 0, 0, 0, 0, 0, 0)
  el_push(tiny, EL_K_ZONE, 2, 0, 0, 0, 0, 0, 0)
  let before_full: i64 = el_complete(tiny)
  let refused: i64 = el_push(tiny, EL_K_ZONE, 3, 0, 0, 0, 0, 0, 0)
  var t2: i64 = 0
  if refused < 0 { if el_dropped(tiny) == 1 { if el_complete(tiny) == 0 { t2 = 1 } } }
  gv_check("T2 a full store REFUSES the event, counts the refusal, and reports incomplete coverage" as *u8, t2, ctr)
  gv_check("neg-control-store-reports-complete-before-it-overflows" as *u8, before_full, ctr)
132
  // ---- CPU ZONES: the self-time arithmetic ------------------------------------------------------
  // outer 0..100, inner 10..40. inclusive(outer)=100, children=30, self=70.
  let z: *i64 = el_new(EG_STORE_CAP)
  let zo: i64 = el_zone_begin(z, 0, 1, 900)
  let zi: i64 = el_zone_begin(z, 10, 1, 901)
  el_zone_end(z, 40)
  el_zone_end(z, 100)
  gv_check("T3 zone SELF time excludes the child -- 100 inclusive minus 30 child equals 70 self" as *u8,
      eg_eq(el_zone_self(z, zo), 70), ctr)
  gv_check("T4 zone INCLUSIVE time is the full span, and the child keeps its own 30" as *u8,
      eg_eq2(el_get(z, zo, EL_F_DUR), 100, el_zone_self(z, zi), 30), ctr)
  gv_check("T5 every zone opened was closed (stack depth back to zero)" as *u8,
      eg_eq(el_zone_open(z), 0), ctr)
146
  // ---- neg-controls on broken instrumentation ---------------------------------------------------
  let bad: *i64 = el_new(EG_STORE_CAP)
  let und: i64 = el_zone_end(bad, 10)
  var t6: i64 = 0
  if und < 0 { if bad[EL_H_ERRUND] == 1 { t6 = 1 } }
  gv_check("neg-control-zone-END-without-BEGIN-is-refused-and-counted-not-given-a-duration" as *u8, t6, ctr)
153
  let bk: *i64 = el_new(EG_STORE_CAP)
  el_zone_begin(bk, 100, 1, 1)
  let mono: i64 = el_zone_end(bk, 50)
  var t7: i64 = 0
  if mono < 0 { if bk[EL_H_ERRMONO] == 1 { t7 = 1 } }
  gv_check("neg-control-backwards-clock-refused-rather-than-aggregated-as-negative-time" as *u8, t7, ctr)
160
  // ---- FRAME PACING ----------------------------------------------------------------------------
  let fspike: *i64 = eg_mk_frames(1)
  let fflat: *i64 = eg_mk_frames(0)
  el_frame_stats(fspike, EL_STUTTER_NUM_DEFAULT, EL_STUTTER_DEN_DEFAULT, o)
  gv_check("T8 five closed frames measured, the sixth mark correctly left OPEN and excluded" as *u8,
      eg_eq2(o[EL_FS_FRAMES], 5, o[EL_FS_OPEN], 1), ctr)
  gv_check("T9 the 100ms spike is the worst frame and the median stays at the 16ms cadence" as *u8,
      eg_eq2(o[EL_FS_WORST], 100000, o[EL_FS_MEDIAN], 16000), ctr)
  // DISCRIMINATION, not saturation: a low that equals the average measures nothing.
  var t10: i64 = 0
  if o[EL_FS_LOW1] < o[EL_FS_AVGFPS] { t10 = 1 }
  gv_check("T10 the 1 percent low is STRICTLY worse than the average -- the statistic discriminates" as *u8, t10, ctr)
173
  let spike_fired: i64 = eg_pos(o[EL_FS_STUTTER])
  el_frame_stats(fflat, EL_STUTTER_NUM_DEFAULT, EL_STUTTER_DEN_DEFAULT, o2)
  let flat_fired: i64 = eg_pos(o2[EL_FS_STUTTER])
  gv_bite("T11 stutter detection" as *u8, spike_fired, flat_fired, ctr)
  gv_check("neg-control-a-perfectly-paced-series-has-no-worst-1-percent-outlier" as *u8,
      eg_eq(o2[EL_FS_LOW1], o2[EL_FS_AVGFPS]), ctr)
180
  // ---- COMPOSITION: the rolling meter is nx_fpsmeter, not a second opinion ----------------------
  gv_check("T13 rolling FPS routes through nx_fpsmeter and counts all six frame marks" as *u8,
      eg_eq(el_fps_rolling(fspike, 164), 6), ctr)
  // T13 FAILED on first run and the failure was real, not a fixture slip: fm_fps scanned all FM_CAP
  // slots and counted the zero-initialised tail as frames whenever the clock was near zero -- which
  // is exactly the regime a REPLAYED capture lives in. This asserts the incumbent directly, so the
  // gate that found the defect also carries its proof.
  let mz: *i64 = sys_mmap((2 + FM_CAP) * EL_I64) as *i64
  fm_init(mz)
  fm_tick(mz, 0)
  fm_tick(mz, 10)
  fm_tick(mz, 20)
  gv_check("T13b a near-zero replay clock counts its 3 real frames, not the zero-initialised ring tail" as *u8,
      eg_eq(fm_fps(mz, 20), 3), ctr)
195
  // ---- COMPOSITION: the budget is nx_frame_budget -----------------------------------------------
  let fits: i64 = el_budget_verdict(16000, EG_TARGET_FPS, o)
  let over: i64 = el_budget_verdict(20000, EG_TARGET_FPS, o2)
  gv_check("T14 a 16ms frame fits the 60fps budget from nx_frame_budget and reports its headroom" as *u8,
      eg_eq3(fits, 1, o[0], 16666, o[1], 666), ctr)
  gv_bite("T15 budget over-run detection" as *u8, eg_zero(over), eg_zero(fits), ctr)
202
  // ---- GPU QUEUES AND THE BOUND VERDICT ---------------------------------------------------------
  // GPU-bound: the queue is busy for 980 permil of the frame while the CPU root zone is idle-ish.
  let g: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(g, 0)
  el_gpu_slice(g, 50, 100, 9800, 1, 700)
  el_zone_begin(g, 200, 1, 800)
  el_zone_end(g, 1200)
  el_frame_mark(g, 10000)
  let gv: i64 = el_bound_verdict(g, 0, EL_OCC_HI_DEFAULT, o)
  gv_check("T16 a queue busy 980 permil of the frame is called GPU-BOUND" as *u8,
      eg_eq2(gv, EL_BOUND_GPU, o[EL_BV_GPUOCC], 980), ctr)
214
  // CPU-bound: same shape, the occupancies swapped.
  let c: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(c, 0)
  el_gpu_slice(c, 50, 100, 100, 1, 700)
  el_zone_begin(c, 100, 1, 800)
  el_zone_end(c, 9900)
  el_frame_mark(c, 10000)
  let cv: i64 = el_bound_verdict(c, 0, EL_OCC_HI_DEFAULT, o)
  gv_check("T17 the same frame with the load on the CPU root zone is called CPU-BOUND" as *u8,
      eg_eq2(cv, EL_BOUND_CPU, o[EL_BV_CPUOCC], 980), ctr)
225
  // THE ABSTENTION. No GPU evidence must NOT resolve to CPU-BOUND.
  let u: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(u, 0)
  el_zone_begin(u, 100, 1, 800)
  el_zone_end(u, 9900)
  el_frame_mark(u, 10000)
  let uv: i64 = el_bound_verdict(u, 0, EL_OCC_HI_DEFAULT, o)
  gv_check("neg-control-with-no-GPU-evidence-the-verdict-ABSTAINS-UNKNOWN-and-never-acquits-as-CPU-BOUND" as *u8,
      eg_eq(uv, EL_BOUND_UNKNOWN), ctr)
235
  // queue latency: submit at 50, start at 100 -- the 50us the work sat waiting
  el_gpu_stats(g, 1, o)
  gv_check("T19 submit-to-start latency is measured, not just execution time" as *u8,
      eg_eq3(o[EL_GQ_SLICES], 1, o[EL_GQ_BUSY], 9800, o[EL_GQ_WORST], 50), ctr)
240
  // ---- DRAW CAPTURE AND DIFF --------------------------------------------------------------------
  let capa: *i64 = eg_mk_capture(300)
  let capb: *i64 = eg_mk_capture(300)
  let capc: *i64 = eg_mk_capture(999)
  let same: i64 = el_capture_diff(capa, capb, o)
  let diff: i64 = el_capture_diff(capa, capc, o2)
  gv_check("T20 two identical captures compare SAME across all three draws" as *u8,
      eg_eq2(same, EL_DIFF_SAME, o[EL_DF_ACNT], 3), ctr)
  gv_check("T21 a divergent capture NAMES the exact draw ordinal, the field, and both values" as *u8,
      eg_eq4(diff, EL_DIFF_DIVERGENT, o2[EL_DF_ORD], 2, o2[EL_DF_FIELD], EL_DFF_VERTS, o2[EL_DF_BVAL], 999), ctr)
  gv_bite("T22 capture divergence detection" as *u8, eg_eq(diff, EL_DIFF_DIVERGENT), eg_eq(same, EL_DIFF_DIVERGENT), ctr)
252
  // THE EMPTY-SET LAW. Two captures that recorded nothing are not two identical frames.
  let e1: *i64 = el_new(EG_STORE_CAP)
  let e2: *i64 = el_new(EG_STORE_CAP)
  gv_check("neg-control-diff-over-ZERO-draws-is-UNMEASURABLE-never-SAME" as *u8,
      eg_eq(el_capture_diff(e1, e2, o), EL_DIFF_UNMEASURABLE), ctr)
258
  // redundant state binds
  let rr: *i64 = el_new(EG_STORE_CAP)
  el_draw(rr, 1, 1, 1, 1, 10, 55)
  el_draw(rr, 2, 1, 2, 1, 10, 55)
  el_draw(rr, 3, 1, 3, 2, 10, 66)
  let rd: *i64 = el_new(EG_STORE_CAP)
  el_draw(rd, 1, 1, 1, 1, 10, 55)
  el_draw(rd, 2, 1, 2, 2, 10, 66)
  el_draw(rd, 3, 1, 3, 3, 10, 77)
  gv_bite("T24 redundant-state-bind detection" as *u8, eg_pos(el_draw_redundant(rr)), eg_pos(el_draw_redundant(rd)), ctr)
  gv_check("T25 the redundant bind is COUNTED exactly once, not merely flagged" as *u8,
      eg_eq(el_draw_redundant(rr), 1), ctr)
271
  // state hash must be order-sensitive: same bindings in a different order are a different state
  let h1: *i64 = eg_buf()
  let h2: *i64 = eg_buf()
  h1[0]=1; h1[1]=2; h1[2]=3
  h2[0]=3; h2[1]=2; h2[2]=1
  var t26: i64 = 0
  if el_state_hash(h1,3) != el_state_hash(h2,3) { t26 = 1 }
  gv_check("T26 the pipeline state hash is ORDER-SENSITIVE -- reordered bindings are a different state" as *u8, t26, ctr)
280
  // ---- GOLDEN-IMAGE REGRESSION ------------------------------------------------------------------
  let ia: *VdImg = eg_mk_img(EG_BASE_VAL)
  let ib: *VdImg = eg_mk_img(EG_BASE_VAL)
  let ic: *VdImg = eg_mk_img(EG_BASE_VAL)
  eg_alter(ic, EG_ALTER_VAL)
  let gpass: i64 = el_golden(ia, 0, ib, 0, EG_IMG_W, EG_IMG_H, EG_GRID, EG_GRID, EG_THRESH, EL_GOLD_PASS_PERMIL_DEFAULT, o)
  gv_check("T27 a golden image against itself PASSES at 1000 permil over all 16 cells" as *u8,
      eg_eq3(gpass, EL_GOLD_PASS, o[EL_GD_PERMIL], 1000, o[EL_GD_TOTAL], 16), ctr)
  let gfail: i64 = el_golden(ia, 0, ic, 0, EG_IMG_W, EG_IMG_H, EG_GRID, EG_GRID, EG_THRESH, EL_GOLD_PASS_PERMIL_DEFAULT, o2)
  gv_check("T28 one altered cell FAILS and the report names 15 of 16 cells matched" as *u8,
      eg_eq3(gfail, EL_GOLD_FAIL, o2[EL_GD_MATCH], 15, o2[EL_GD_TOTAL], 16), ctr)
  gv_bite("T29 golden-image regression detection" as *u8, eg_eq(gfail, EL_GOLD_FAIL), eg_eq(gpass, EL_GOLD_FAIL), ctr)
293
  // A window the comparator cannot actually measure must not come back as a pass. nx_visual_diff
  // refuses it with -1 because that exact case once banked eight frames that were never compared;
  // this asserts the refusal SURVIVES the composition instead of being flattened into PASS.
  let gdeg: i64 = el_golden(ia, 0, ib, 0, EG_IMG_W, 0, EG_GRID, EG_GRID, EG_THRESH, EL_GOLD_PASS_PERMIL_DEFAULT, o)
  gv_check("neg-control-a-degenerate-window-is-UNMEASURABLE-and-the-refusal-survives-composition" as *u8,
      eg_eq2(gdeg, EL_GOLD_UNMEASURABLE, o[EL_GD_PERMIL], 0 - 1), ctr)
300
  // ---- MEMORY ----------------------------------------------------------------------------------
  let m: *i64 = el_new(EG_STORE_CAP)
  el_alloc(m, 1, 1, 10, 4096, 500)
  el_alloc(m, 2, 1, 11, 2048, 600)
  el_free(m, 3, 1, 500)
  let live: i64 = el_mem_stats(m, o)
  gv_check("T31 live bytes are allocations minus the allocations actually matched by a free" as *u8,
      eg_eq2(live, 2048, o[EL_MEM_ORPHAN], 0), ctr)
  let m2: *i64 = el_new(EG_STORE_CAP)
  el_free(m2, 1, 1, 777)
  el_mem_stats(m2, o2)
  gv_check("neg-control-a-free-with-no-matching-alloc-is-counted-as-ORPHAN-not-silently-dropped" as *u8,
      eg_eq(o2[EL_MEM_ORPHAN], 1), ctr)
314
  // ---- THE JOIN: the thing five separate capture formats cannot do -----------------------------
  let j: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(j, 0)
  el_draw(j, 100, 1, 1, 1, 10, 1)
  el_draw(j, 110, 1, 2, 2, 20, 2)
  el_gpu_slice(j, 120, 130, 4000, 1, 700)
  el_lock_wait(j, 200, 350, 1, 800, 2)
  el_alloc(j, 210, 1, 12, 8192, 900)
  el_zone_begin(j, 300, 1, 950)      // cheap root
  el_zone_end(j, 400)
  el_zone_begin(j, 500, 1, 951)      // expensive root -- the hot one by self time
  el_zone_end(j, 5000)
  el_frame_mark(j, 16000)
  let found: i64 = el_frame_attr(j, 0, o)
  gv_check("T33 ONE call ties this frame to its draws, GPU queue time, CPU root time, lock wait and bytes" as *u8,
      eg_eq5(found, 1, o[EL_FA_DRAWS], 2, o[EL_FA_GPUUS], 4000, o[EL_FA_LOCKUS], 350, o[EL_FA_ALLOCB], 8192), ctr)
  gv_check("T34 CPU root time sums the two root zones without double-counting, and the frame dur is exact" as *u8,
      eg_eq2(o[EL_FA_CPUUS], 4600, o[EL_FA_DUR], 16000), ctr)
  gv_check("T35 the join NAMES the hottest zone in the frame by SELF time, not by inclusive time" as *u8,
      eg_eq(o[EL_FA_HOTNAME], 951), ctr)
335
  // ---- EL1: PERSISTENCE, AND ITS REFUSALS ------------------------------------------------------
  // Gate scratch is PRIVATE and created at SETUP. A gate sharing a fixture with a production beat
  // measures the fixture rather than the code, and a teardown does not run when a run crashes.
  sys_mkdir("/tmp/enginelabgate" as *u8, MODE_0755)
  let capf: *u8 = "/tmp/enginelabgate/cap.nxel" as *u8
  let rs: *i64 = eg_buf()
  let wrc: i64 = el_capture_write(j, capf)
  let jr: *i64 = el_capture_read(capf, rs)
  var t37: i64 = 0
  if wrc == ELS_OK { if (jr as i64) != 0 { if rs[ELS_R_CODE] == ELS_OK { t37 = 1 } } }
  gv_check("T37 a capture written to a file reopens, and reopens as a REAL store" as *u8, t37, ctr)
  // THE DONE-RULE: every analyzer figure bit-identical, not merely a plausible-looking reload.
  let o3: *i64 = eg_buf()
  var t38: i64 = 0
  if t37 == 1 {
      el_frame_attr(jr, 0, o3)
      el_frame_attr(j, 0, o)
      if eg_eq5(o3[EL_FA_DUR], o[EL_FA_DUR], o3[EL_FA_DRAWS], o[EL_FA_DRAWS],
                o3[EL_FA_GPUUS], o[EL_FA_GPUUS], o3[EL_FA_CPUUS], o[EL_FA_CPUUS],
                o3[EL_FA_LOCKUS], o[EL_FA_LOCKUS]) == 1 {
          if eg_eq3(o3[EL_FA_ALLOCB], o[EL_FA_ALLOCB], o3[EL_FA_HOTNAME], o[EL_FA_HOTNAME],
                    el_count(jr), el_count(j)) == 1 { t38 = 1 }
      }
  }
  gv_check("T38 the reopened capture reproduces EVERY join figure bit-identically, not approximately" as *u8, t38, ctr)
361
  // A TRUNCATED CAPTURE MUST BE REFUSED, NOT PARSED SHORT. This is the whole reason the byte length
  // is written down: a short file otherwise parses into a SMALLER capture that looks perfectly
  // healthy -- fewer frames, fewer draws, every analyzer confidently wrong over it.
  let cutf: *u8 = "/tmp/enginelabgate/cut.nxel" as *u8
  let cutn: i64 = eg_copy_trunc(capf, cutf, EL_I64)
  let rs2: *i64 = eg_buf()
  let cutr: *i64 = el_capture_read(cutf, rs2)
  var t39: i64 = 0
  if cutn > 0 { if (cutr as i64) == 0 { if rs2[ELS_R_CODE] == ELS_SIZE_MISMATCH { t39 = 1 } } }
  gv_check("neg-control-a-TRUNCATED-capture-is-REFUSED-by-name-not-parsed-into-a-shorter-healthy-one" as *u8, t39, ctr)
  gv_check("T40 the truncation refusal reports the declared and actual byte counts that decided it" as *u8,
      eg_eq2(rs2[ELS_R_DECLARED], cutn + EL_I64, rs2[ELS_R_ACTUAL], cutn), ctr)
  gv_bite("T41 truncation detection" as *u8, eg_zero(cutr as i64), eg_zero(jr as i64), ctr)
375
  // Right length, wrong content: only the checksum can catch this one.
  // THE CORRUPTION MUST LAND IN THE RECORD PAYLOAD, AND THAT IS THE WHOLE POINT OF THE OFFSET.
  // This fixture used to flip the byte at ELS_PFX * EL_I64 + EL_I64, which is word ELS_PFX + EL_H_N
  // -- the RECORD COUNT. Corrupting the count makes els_slots_for(n) * EL_I64 disagree with the
  // file's actual length, so el_capture_read refuses it as ELS_SIZE_MISMATCH before the checksum is
  // ever computed. The reader was right, the file was correctly refused, and the tooth still failed:
  // it demanded one specific reason for a rejection an EARLIER and equally valid guard had already
  // made. A tooth that names the wrong refusal reads as a broken subject.
  // (ELS_PFX + EL_H) * EL_I64 is the first RECORD word, past every length and count guard, so
  // nothing but the checksum can object to it -- which is what the comment above always claimed.
  let badf: *u8 = "/tmp/enginelabgate/bad.nxel" as *u8
  eg_copy_corrupt(capf, badf, (ELS_PFX + EL_H) * EL_I64)
  let rs3: *i64 = eg_buf()
  let badr: *i64 = el_capture_read(badf, rs3)
  var t42: i64 = 0
  if (badr as i64) == 0 { if rs3[ELS_R_CODE] == ELS_CHECKSUM { t42 = 1 } }
  gv_check("neg-control-a-capture-of-the-RIGHT-LENGTH-with-one-flipped-byte-in-a-RECORD-is-caught-by-checksum" as *u8, t42, ctr)
  // The count word keeps its own tooth rather than being dropped: it IS refused, by a different
  // named guard, and both reasons are worth pinning. Two distinguishable refusals, two teeth.
  let cntf: *u8 = "/tmp/enginelabgate/cnt.nxel" as *u8
  eg_copy_corrupt(capf, cntf, ELS_PFX * EL_I64 + EL_I64)
  let rs3b: *i64 = eg_buf()
  let cntr: *i64 = el_capture_read(cntf, rs3b)
  var t42b: i64 = 0
  if (cntr as i64) == 0 { if rs3b[ELS_R_CODE] == ELS_SIZE_MISMATCH { t42b = 1 } }
  gv_check("neg-control-a-corrupted-RECORD-COUNT-is-refused-as-SIZE-MISMATCH-by-the-guard-that-owns-it" as *u8, t42b, ctr)
402
  // Not our file at all, and a file too short to even inspect: distinct causes, distinct names.
  let magf: *u8 = "/tmp/enginelabgate/mag.nxel" as *u8
  eg_write_raw(magf, EG_NOT_OUR_MAGIC, 8)
  let rs4: *i64 = eg_buf()
  let magr: *i64 = el_capture_read(magf, rs4)
  let tinyf: *u8 = "/tmp/enginelabgate/tiny.nxel" as *u8
  eg_write_raw(tinyf, ELS_MAGIC, 1)
  let rs5: *i64 = eg_buf()
  let tinyr: *i64 = el_capture_read(tinyf, rs5)
  var t43: i64 = 0
  if (magr as i64) == 0 { if rs4[ELS_R_CODE] == ELS_BAD_MAGIC { if (tinyr as i64) == 0 { if rs5[ELS_R_CODE] == ELS_TOO_SMALL { t43 = 1 } } } }
  gv_check("T43 a foreign file and a too-short file get DISTINCT named reasons, never one generic failure" as *u8, t43, ctr)
415
  // THE SUBTLE ONE, AND THE REASON THE STORE HEADER IS SERIALISED AT ALL. A capture taken under load
  // that DROPPED events must not reload claiming complete coverage. If it did, persistence would
  // launder a partial measurement into a clean-looking one -- worse than not persisting at all.
  let dropped: *i64 = el_new(2)
  el_push(dropped, EL_K_ZONE, 1, 0, 0, 0, 0, 0, 0)
  el_push(dropped, EL_K_ZONE, 2, 0, 0, 0, 0, 0, 0)
  el_push(dropped, EL_K_ZONE, 3, 0, 0, 0, 0, 0, 0)
  let dropf: *u8 = "/tmp/enginelabgate/drop.nxel" as *u8
  el_capture_write(dropped, dropf)
  let rs6: *i64 = eg_buf()
  let dropr: *i64 = el_capture_read(dropf, rs6)
  var t44: i64 = 0
  if (dropr as i64) != 0 { if el_dropped(dropr) == 1 { if el_complete(dropr) == 0 { t44 = 1 } } }
  gv_check("T44 a capture that DROPPED events reloads still reporting incomplete coverage -- persistence cannot launder it" as *u8, t44, ctr)
  gv_bite("T45 coverage survives the round trip" as *u8, eg_zero(el_complete(dropr)), eg_zero(el_complete(jr)), ctr)
431
  // ---- coverage is on the record, always -------------------------------------------------------
  gv_check("T36 the whole fixture set recorded every event offered -- no silent truncation anywhere" as *u8,
      eg_eq5(el_complete(j), 1, el_complete(g), 1, el_complete(fspike), 1, el_complete(capa), 1, el_errors(j), 0), ctr)
435
  // ---- THE BROWSER WIRE, and EL7: one ruler, two surfaces --------------------------------------
  // The overlay half of this instrument runs IN-PAGE, so a capture must cross a JavaScript boundary
  // as TEXT before any analyzer here can touch it. These teeth prove that crossing is lossless,
  // that a SHORT crossing is refused rather than parsed into a smaller capture that looks healthy,
  // that coverage metadata survives it, and that the overlay's figures ARE el_frame_stats rather
  // than a second opinion that happens to agree today.
  let w_cw: *i64 = el_new(EG_STORE_CAP)
  el_frame_mark(w_cw, 0)
  el_draw(w_cw, 5, 1, 700, 1, 300, 77)
  el_draw(w_cw, 6, 1, 700, 1, 300, 77)
  el_frame_mark(w_cw, EG_FRAME_US)
  el_frame_mark(w_cw, 2 * EG_FRAME_US)
  let w_need: i64 = el_capture_bytes(w_cw)
  let w_buf: *u8 = sys_mmap(w_need)
  let w_len: i64 = el_capture_serialize(w_cw, w_buf, w_need)
  let w_err: *i64 = eg_buf()
  w_err[0] = 0 - 1
  let w_cr: *i64 = el_capture_parse(w_buf, w_len, w_err)
  gv_check("T60 a capture serialised to TEXT and reparsed returns a readable store and names no refusal" as *u8,
      eg_eq3(eg_pos(w_len), 1, el_ok(w_cr), 1, w_err[0], EL_CP_OK), ctr)
  var w_ok: i64 = 1
  var w_i: i64 = 0
  while w_i < el_count(w_cw) {
      var w_f: i64 = 0
      while w_f < EL_REC {
          if el_get(w_cr, w_i, w_f) != el_get(w_cw, w_i, w_f) { w_ok = 0 }
          w_f = w_f + 1
      }
      w_i = w_i + 1
  }
  // The third conjunct is the denominator: without it this tooth passes on an EMPTY store, where
  // the comparison loop never runs at all.
  gv_check("T61 EVERY field of EVERY record survives the crossing, not merely the record count" as *u8,
      eg_eq3(w_ok, 1, el_count(w_cr), el_count(w_cw), eg_pos(el_count(w_cw)), 1), ctr)
  let w_fsa: *i64 = eg_buf()
  let w_fsb: *i64 = eg_buf()
  el_frame_stats(w_cw, EL_STUTTER_NUM_DEFAULT, EL_STUTTER_DEN_DEFAULT, w_fsa)
  el_frame_stats(w_cr, EL_STUTTER_NUM_DEFAULT, EL_STUTTER_DEN_DEFAULT, w_fsb)
  gv_check("T62 the analyzers answer identically on the reloaded capture, redundant binds included" as *u8,
      eg_eq4(w_fsa[EL_FS_FRAMES], w_fsb[EL_FS_FRAMES], w_fsa[EL_FS_AVGFPS], w_fsb[EL_FS_AVGFPS],
             w_fsa[EL_FS_WORST], w_fsb[EL_FS_WORST], el_draw_redundant(w_cw), el_draw_redundant(w_cr)), ctr)
  gv_check("T63 FIXTURE REACHED THE CONDITION: the fixture really does carry a redundant bind to find" as *u8,
      eg_eq(el_draw_redundant(w_cw), 1), ctr)
  let w_terr: *i64 = eg_buf()
  w_terr[0] = 0 - 1
  let w_tr: *i64 = el_capture_parse(w_buf, w_len / EG_DEC_BASE, w_terr)
  gv_check("neg-control-T64 a capture cut short is REFUSED with a named reason, never parsed short" as *u8,
      eg_eq2((w_tr as i64), 0, eg_pos(w_terr[0]), 1), ctr)
  // Locate a DIGIT inside the first RECORD line -- past the header's newline -- and change it. This
  // is the exact case the counts are structurally blind to: the byte length is unchanged, the
  // record count is unchanged, header and trailer still agree, and the file parses cleanly into a
  // capture with one wrong number that every analyzer then computes over. Both scans carry their
  // own found-flag rather than clobbering the cursor to exit, because a loop that breaks by writing
  // its own index destroys the very position it was searching for.
  var w_nl: i64 = 0 - 1
  var w_s: i64 = 0
  while w_s < w_len {
      if w_nl < 0 { if w_buf[w_s] == (EL_NL as u8) { w_nl = w_s } }
      w_s = w_s + 1
  }
  var w_dg: i64 = 0 - 1
  var w_s2: i64 = w_nl + 1
  while w_s2 < w_len {
      if w_dg < 0 {
          if w_buf[w_s2] >= (EL_D0 as u8) { if w_buf[w_s2] <= (EL_D9 as u8) { w_dg = w_s2 } }
      }
      w_s2 = w_s2 + 1
  }
  gv_check("T65 FIXTURE REACHED THE CONDITION: a digit inside the first RECORD line was located to corrupt" as *u8,
      eg_eq2(eg_pos(w_nl + 1), 1, eg_pos(w_dg + 1), 1), ctr)
  let w_old: i64 = w_buf[w_dg] as i64
  w_buf[w_dg] = (EL_D0 + ((w_old - EL_D0 + 1) % EG_DEC_BASE)) as u8
  let w_merr: *i64 = eg_buf()
  w_merr[0] = 0 - 1
  let w_mr: *i64 = el_capture_parse(w_buf, w_len, w_merr)
  gv_check("neg-control-T66 ONE corrupted digit INSIDE a record is caught -- the silent case counts cannot see" as *u8,
      eg_eq2((w_mr as i64), 0, w_merr[0], EL_CP_CHECKSUM), ctr)
  let w_dsm: *i64 = el_new(EG_DROP_CAP)
  el_frame_mark(w_dsm, 0)
  el_frame_mark(w_dsm, EG_FRAME_US)
  el_frame_mark(w_dsm, 2 * EG_FRAME_US)
  gv_check("T67 FIXTURE REACHED THE CONDITION: the small store really OVERFLOWED and counted the refusal" as *u8,
      eg_eq2(el_complete(w_dsm), 0, eg_pos(el_dropped(w_dsm)), 1), ctr)
  let w_dneed: i64 = el_capture_bytes(w_dsm)
  let w_dbuf: *u8 = sys_mmap(w_dneed)
  let w_dlen: i64 = el_capture_serialize(w_dsm, w_dbuf, w_dneed)
  let w_derr: *i64 = eg_buf()
  let w_dr: *i64 = el_capture_parse(w_dbuf, w_dlen, w_derr)
  // Without this, persistence would LAUNDER a partial measurement into a clean-looking one, which
  // is worse than not persisting at all: a capture taken under load that dropped events would
  // reload as a smaller capture that every analyzer reads as complete.
  gv_check("T68 COVERAGE SURVIVES THE CROSSING: an incomplete capture reloads STILL reporting incomplete" as *u8,
      eg_eq3(el_ok(w_dr), 1, el_complete(w_dr), 0, el_dropped(w_dr), el_dropped(w_dsm)), ctr)
  let w_sbuf: *u8 = sys_mmap(EG_SMALL_BUF)
  gv_check("neg-control-T69 serialise REFUSES a buffer too small rather than writing a truncated capture" as *u8,
      eg_eq(el_capture_serialize(w_cw, w_sbuf, EG_SMALL_BUF), 0 - 1), ctr)
  let w_ovs: *i64 = eg_buf()
  el_overlay_stats(w_cw, EG_TARGET_FPS, EG_Q_PERMIL, EL_Q_GOVERNOR, EG_TRIS, w_ovs)
  gv_check("T70 ONE RULER TWO SURFACES: every overlay pacing figure EQUALS el_frame_stats on the same data" as *u8,
      eg_eq5(w_ovs[EL_OV_FRAMES], w_fsa[EL_FS_FRAMES], w_ovs[EL_OV_AVGFPS], w_fsa[EL_FS_AVGFPS],
             w_ovs[EL_OV_WORST], w_fsa[EL_FS_WORST], w_ovs[EL_OV_MEDIAN], w_fsa[EL_FS_MEDIAN],
             w_ovs[EL_OV_LOW1], w_fsa[EL_FS_LOW1]), ctr)
  gv_check("T71 and the remaining shared figures too, so no field is left free to drift unwatched" as *u8,
      eg_eq3(w_ovs[EL_OV_STUTTER], w_fsa[EL_FS_STUTTER], w_ovs[EL_OV_OPEN], w_fsa[EL_FS_OPEN],
             eg_pos(w_ovs[EL_OV_FRAMES]), 1), ctr)
  // A frame-time number published WITHOUT a paired image-quality number is how performance work
  // silently becomes pixels. This tooth binds the quality assertion to a NON-EMPTY cost figure, so
  // it cannot pass on a store where no cost was measured.
  gv_check("T72 COST AND QUALITY ARRIVE IN ONE STRUCTURE FROM ONE CALL -- neither axis can be reported alone" as *u8,
      eg_eq4(w_ovs[EL_OV_QPERMIL], EG_Q_PERMIL, w_ovs[EL_OV_QREASON], EL_Q_GOVERNOR,
             w_ovs[EL_OV_TRIS], EG_TRIS, eg_pos(w_ovs[EL_OV_MEDIAN]), 1), ctr)
  let w_ovz: *i64 = eg_buf()
  gv_check("neg-control-T73 with an unreadable store the overlay ABSTAINS on cost and still reports the quality handed to it" as *u8,
      eg_eq3(el_overlay_stats(0 as *i64, EG_TARGET_FPS, EG_Q_PERMIL, EL_Q_RECORD, EG_TRIS, w_ovz), 0 - 1,
             w_ovz[EL_OV_FRAMES], 0, w_ovz[EL_OV_QPERMIL], EG_Q_PERMIL), ctr)
  let w_ebuf: *u8 = sys_mmap(EL_OV_TEXT_MAX)
  gv_check("T74 the overlay text block renders within its declared maximum" as *u8,
      eg_eq(eg_pos(el_overlay_emit(w_cw, EG_TARGET_FPS, EG_Q_PERMIL, EL_Q_GOVERNOR, EG_TRIS, w_ebuf, EL_OV_TEXT_MAX)), 1), ctr)
  gv_check("neg-control-T75 el_overlay_emit REFUSES a short buffer instead of writing a partial block" as *u8,
      eg_eq(el_overlay_emit(w_cw, EG_TARGET_FPS, EG_Q_PERMIL, EL_Q_GOVERNOR, EG_TRIS, w_sbuf, EG_SMALL_BUF), 0 - 1), ctr)
556
  let rc: i64 = gv_verdict("ENGINELAB-GATE" as *u8, ctr,
      "the five instrument classes compute correctly on fixtures whose answers are known by construction, every refusal path abstains rather than acquits, and the cross-class join resolves" as *u8)
  gv_journal("nx_enginelab_gate" as *u8, ctr[0], ctr[1], eg_zero(rc))
  sys_exit(rc)
  return rc
562}
563
564// ---- tiny comparison helpers: keep the teeth readable and the intent on one line -----------------
565func eg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
566func eg_zero(a: i64) -> i64 { if a == 0 { return 1 } return 0 }
567func eg_pos(a: i64) -> i64 { if a > 0 { return 1 } return 0 }
568func eg_eq2(a: i64, b: i64, c: i64, d: i64) -> i64 { if a == b { if c == d { return 1 } } return 0 }
569func eg_eq3(a: i64, b: i64, c: i64, d: i64, e: i64, f: i64) -> i64 {
  if a == b { if c == d { if e == f { return 1 } } } return 0
571}
572func eg_eq4(a: i64, b: i64, c: i64, d: i64, e: i64, f: i64, g: i64, h: i64) -> i64 {
  if a == b { if c == d { if e == f { if g == h { return 1 } } } } return 0
574}
575func eg_eq5(a: i64, b: i64, c: i64, d: i64, e: i64, f: i64, g: i64, h: i64, i: i64, j: i64) -> i64 {
  if a == b { if c == d { if e == f { if g == h { if i == j { return 1 } } } } } return 0
577}
578func eg_eq6(a: i64, b: i64, c: i64, d: i64, e: i64, f: i64) -> i64 { return eg_eq3(a,b,c,d,e,f) }
579
580// ---- EL1 fixture builders. These CONSTRUCT the damaged files at runtime rather than shipping them,
581// because a detector that scans source will find its own checked-in fixture, and a fixture written
582// into the tree is a fixture another lane can trip over.
583func eg_copy_trunc(src: *u8, dst: *u8, drop: i64) -> i64 {
  let lb: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(src, lb)
  if (b as i64) == 0 { return 0 - 1 }
  var n: i64 = lb[0] - drop
  if n < 0 { n = 0 }
  let fd: i64 = sys_openat_wr(dst, MODE_0644)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, b, n)
  sys_close(fd)
  return n
594}
595// same LENGTH, one byte different: the case only a checksum can catch
596func eg_copy_corrupt(src: *u8, dst: *u8, off: i64) -> i64 {
  let lb: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(src, lb)
  if (b as i64) == 0 { return 0 - 1 }
  if off < lb[0] { b[off] = (((b[off] as i64) + 1) % 256) as u8 }
  let fd: i64 = sys_openat_wr(dst, MODE_0644)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, b, lb[0])
  sys_close(fd)
  return lb[0]
606}
607// a raw file of `slots` i64 whose first word is `first` -- used for the foreign-file and the
608// too-short-to-inspect cases, which are DIFFERENT causes and must not share a reason code
609func eg_write_raw(dst: *u8, first: i64, slots: i64) -> i64 {
  let w: *i64 = sys_mmap(slots * EL_I64) as *i64
  var i: i64 = 0
  while i < slots { w[i] = 0; i = i + 1 }
  w[0] = first
  let fd: i64 = sys_openat_wr(dst, MODE_0644)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, w as *u8, slots * EL_I64)
  sys_close(fd)
  return slots * EL_I64
619}
nx_enginelab_gate.nx source

`nx_enginelab_gate.nx` source
