nx_ioadmit_gate.nx source

1// nx_ioadmit_gate.nx -- referee for nx_ioadmit_lib, the I/O-storm admission ruler every I/O spawner 2// (first consumer: nx_torrent_daemon) asks before adding uninterruptible I/O to the shared array. 3// 4// It gates the SAME functions the daemon runs (nx_ioadmit_lib.nx), not a reimplementation. The budget 5// arithmetic is tested as a pure function on synthetic inputs (deterministic, no box state needed); the 6// /proc readers are tested against the live kernel (any Linux answers) plus a fixture parse so the 7// parser is proven on bytes whose answer is KNOWN, not merely "something came back". 8// 9// THE TEETH THAT MATTER: 10// T3/T4 pin the two numbers that make this a ruler and not a wish: the storm line clamps the budget to 11// ZERO (never negative, never "a little over"), and the reserve slot is LOAD-BEARING -- drop it and 12// the spawner becomes the process that crosses the line. 13// T5 is the THIRD STATE: unobservable inputs return IOA_UNREADABLE, never a budget. A caller that reads 14// -1 as "minus one worker" would be the fabrication this estate forbids; the daemon names its own 15// fallback (D_UNOBS_SPAWNS) and this tooth proves the lib never invents one. 16// T7 neg-control: a comm nobody runs counts 0 -- a counter that returns >0 for a nonsense name is 17// counting something other than the name. 18// T8 positive control: the gate's OWN comm (read from /proc/self/comm, not assumed) counts >= 1, so the 19// /proc walk is proven to SEE a running process, not just to return without error. 20// T9 bite: the ruler FIRES at the storm line and stays SILENT with headroom -- proven in one cell. 21// license_tier: ORIGINAL expect_exit: 0 22import "nx_gate_verdict.nx" 23import "nx_ioadmit_lib.nx" 24 25const IG_FIX_A: *u8 = "cpu 10 20 30 40\ncpu0 1 2 3\ncpu1 1 2 3\ncpu2 1 2 3\nintr 55 1 2 3\nctxt 99\nprocs_running 2\nprocs_blocked 3\n" 26const IG_FIX_NOCPU: *u8 = "cpu 10 20 30 40\nintr 55\nprocs_running 2\n" 27const IG_NCPU: i64 = 8 // synthetic box for the pure budget teeth (the measured host, but any value works) 28const IG_COMMBUF: i64 = 64 // /proc/self/comm is at most TASK_COMM_LEN bytes + newline 29const IG_FIX_STAT_A: *u8 = "4242 (nx_torrent_get.) S 1 4242 4242 0 -1 4194560 91 0 0 0 3 1 0 0 20 0 1 0 176053211 1048576 0 18446744073709551615\n" 30const IG_FIX_STAT_B: *u8 = "7 (a) b) R 77 7 7 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 5 0 0 0\n" 31// ---- writeback-congestion fixtures and synthetic bars (2026-09-03) ---- 32// The bars below are SYNTHETIC and exist only to exercise the three bands. They are deliberately NOT the 33// shipped bars: knowledge/ioadmit.conf carries 0 and 0 until a healthy distribution exists, and T13 is the 34// tooth that proves the shipped zeros are inert. 35const IG_CONG_WARN_KB: i64 = 100000 36const IG_CONG_STORM_KB: i64 = 400000 37// A backlog no real box reaches, used to show an UNARMED axis stays CLEAR no matter how bad the level is. 38const IG_CONG_ABSURD_KB: i64 = 99999999 39// Comfortably under the warn bar, so the CLEAR band is tested at a value and not at zero. 40const IG_CONG_BELOW_WARN_KB: i64 = 1000 41const IG_DW_SLOTS: i64 = 32 42// The meminfo fixture and the THREE values it carries, bound here beside the literal they are read from so 43// the string and its expected numbers cannot drift apart. WritebackTmp is FIRST and carries a DIFFERENT 44// value on purpose: a key that lost its colon matches that line instead, and T17 fails loudly. 45const IG_FIX_MEM: *u8 = "Dirty: 644820 kB\nWritebackTmp: 12345 kB\nWriteback: 19340 kB\n" 46const IG_FIX_MEM_DIRTY: i64 = 644820 47const IG_FIX_MEM_WB: i64 = 19340 48// ---- diskstats fixture (2026-09-03, OB1) ---- 49// md40 is FIRST and md4 SECOND on purpose. If the device match were a PREFIX rather than exact, asking for 50// "md4" would hit the md40 line -- because md40 starts with md4 -- and return 2 instead of 500. Ordering the 51// fixture this way is what makes T20 able to fail; with md4 first the prefix bug would pass unnoticed. 52const IG_FIX_DS: *u8 = " 9 40 md40 1 0 2 3 4 0 6 7 8 9 10\n 9 4 md4 100 0 500 10 200 0 700 20 3 40 50\n" 53const IG_DS_MD4_SREAD: i64 = 500 54const IG_DS_MD4_SWRIT: i64 = 700 55const IG_DS_MD4_INFLIGHT: i64 = 3 56const IG_DS_MD4_MSIO: i64 = 40 57const IG_DS_MD40_SREAD: i64 = 2 58const IG_DS_MD40_SWRIT: i64 = 6 59const IG_DS_OUT_SLOTS: i64 = 64 60// 2048 sectors is 1 MiB at 512 bytes each, so over exactly one second the answer is 1024 KB/s -- a value a 61// reader can check by hand rather than trust. 62const IG_DS_RATE_SECTORS: i64 = 2048 63const IG_DS_RATE_MS: i64 = 1000 64const IG_DS_RATE_EXPECT_KBS: i64 = 1024 65// ---- smoothed-witness fixtures (2026-09-03) ---- 66// S0..S4 are the FIRST FIVE OF THE TWELVE REAL SAMPLES measured on this box: procs_blocked read 67// 14,10,5,10,9,5,5,5,5,4,2,8 two seconds apart. Their median is 10. Using the real numbers rather than 68// invented ones keeps the tooth anchored to the measurement that motivated the function. 69const IG_MED_S0: i64 = 14 70const IG_MED_S1: i64 = 10 71const IG_MED_S2: i64 = 5 72const IG_MED_S3: i64 = 10 73const IG_MED_S4: i64 = 9 74const IG_MED_REAL_EXPECT: i64 = 10 75// A quiet box carrying ONE two-second burst -- the case that has been refusing builds all day. 76const IG_MED_QUIET: i64 = 2 77const IG_MED_SPIKE: i64 = 14 78const IG_MED_SPIKE_EXPECT: i64 = 2 79// A genuinely sustained storm: every sample at or above the line, so the median MUST stay high. 80const IG_MED_STORM_LO: i64 = 9 81const IG_MED_STORM_HI: i64 = 10 82const IG_MED_STORM_EXPECT: i64 = 10 83const IG_MED_K5: i64 = 5 84const IG_MED_SLOTS: i64 = 64 85const IG_MED_LIVE_K: i64 = 3 86const IG_MED_LIVE_GAP_MS: i64 = 50 87// ---- ownership-attribution fixtures (OB3) ---- 88// The real prefix every organ in this estate carries. This gate IS one, so a census with it must find at 89// least ONE of us -- that is the positive control that stops the census passing by counting nothing. 90const IG_OWN_PREFIX: *u8 = "nx_" 91// A prefix no process carries, so ours must be 0 and foreign must be the WHOLE population. 92const IG_OWN_NOBODY: *u8 = "zzq_nosuchprefix_" 93const IG_OWN_SLOTS: i64 = 64 94// 250 of 1000 is 250 permil -- hand-checkable, and deliberately not a round fraction of the buffer size so 95// a stray length cannot produce it by accident. 96const IG_SHARE_PART: i64 = 250 97const IG_SHARE_WHOLE: i64 = 1000 98const IG_SHARE_EXPECT: i64 = 250 99 100func ig_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 101 102func main(argc: i64, argv: *i64) -> i64 { 103 let ctr: *i64 = gv_ctr() 104 gv_head("nx_ioadmit_gate -- the I/O-storm admission ruler (nx_ioadmit_lib)" as *u8) 105 106 // T1 -- the live kernel answers: ncpu > 0 and procs_blocked >= 0 read from /proc/stat. 107 let m: *i64 = sys_mmap(32) as *i64 108 let rc: i64 = ioa_measure(m) 109 var t1: i64 = 0 110 if rc == 0 { if m[0] > 0 { if m[1] >= 0 { t1 = 1 } } } 111 gv_check("T1-measure-reads-live-proc-stat-ncpu-and-blocked" as *u8, t1, ctr) 112 gv_puts(" live: ncpu=" as *u8); gv_num(m[0]); gv_puts(" procs_blocked=" as *u8); gv_num(m[1]); gv_puts("\n" as *u8) 113 114 // T2 -- headroom is DERIVED: per_cpu*ncpu - blocked - reserve. 115 var t2: i64 = 0 116 if ioa_spawn_budget(IG_NCPU, 3, 1, 1) == 4 { t2 = 1 } 117 gv_check("T2-budget-is-derived-headroom-8cpu-3blk-reserve1-is-4" as *u8, t2, ctr) 118 119 // T3 -- at and beyond the storm line the budget clamps to ZERO (never negative). 120 var t3: i64 = 0 121 if ioa_spawn_budget(IG_NCPU, 8, 1, 1) == 0 { if ioa_spawn_budget(IG_NCPU, 12, 1, 1) == 0 { t3 = 1 } } 122 gv_check("T3-budget-clamps-to-zero-at-and-past-the-storm-line" as *u8, t3, ctr) 123 124 // T4 -- the reserve slot is load-bearing: one below the line with reserve 1 admits nothing; reserve 0 admits one. 125 var t4: i64 = 0 126 if ioa_spawn_budget(IG_NCPU, 7, 1, 1) == 0 { if ioa_spawn_budget(IG_NCPU, 7, 1, 0) == 1 { t4 = 1 } } 127 gv_check("T4-reserve-slot-is-load-bearing-never-the-crossing-process" as *u8, t4, ctr) 128 129 // T5 -- third state: unobservable inputs return IOA_UNREADABLE, never a budget. 130 var t5: i64 = 0 131 if ioa_spawn_budget(0, 3, 1, 1) == IOA_UNREADABLE { if ioa_spawn_budget(IG_NCPU, 0 - 1, 1, 1) == IOA_UNREADABLE { t5 = 1 } } 132 gv_check("T5-unobservable-returns-third-state-not-a-number" as *u8, t5, ctr) 133 134 // T6 -- parser on KNOWN bytes: 3 cpuN lines -> 3 (the aggregate "cpu " line is not one), procs_blocked 3; 135 // anti-vacuity: a fixture with no cpuN lines parses to 0, not to "something". 136 var t6: i64 = 0 137 let fa: *u8 = IG_FIX_A 138 let fn: i64 = ig_slen(fa) 139 let fb: *u8 = IG_FIX_NOCPU 140 if ioa_ncpu(fa, fn) == 3 { if rm_field(fa, fn, "procs_blocked" as *u8) == 3 { if ioa_ncpu(fb, ig_slen(fb)) == 0 { if rm_field(fb, ig_slen(fb), "procs_blocked" as *u8) < 0 { t6 = 1 } } } } 141 gv_check("T6-parser-proven-on-fixture-bytes-3cpu-3blocked-and-empty-is-0" as *u8, t6, ctr) 142 143 // T7 -- neg-control: a comm nobody runs counts exactly 0. 144 let c7: i64 = ioa_count_comm("zz_no_such_comm_xx" as *u8) 145 var t7: i64 = 0 146 if c7 == 0 { t7 = 1 } 147 gv_check("T7-neg-control-absent-comm-counts-zero" as *u8, t7, ctr) 148 149 // T8 -- positive control: our OWN comm, read from the kernel (not assumed), counts >= 1. 150 let cb: *u8 = sys_mmap(IG_COMMBUF) 151 let cfd: i64 = sys_openat_rd("/proc/self/comm" as *u8) 152 var cn: i64 = 0 153 if cfd >= 0 { cn = sys_read(cfd, cb, IG_COMMBUF - 1); sys_close(cfd) } 154 var t8: i64 = 0 155 if cn > 0 { 156 var z: i64 = 0 157 while z < cn { if cb[z] == (10 as u8) { cb[z] = 0 as u8; z = cn } else { z = z + 1 } } 158 cb[cn] = 0 as u8 159 let own: i64 = ioa_count_comm(cb) 160 gv_puts(" self comm=" as *u8); gv_puts(cb); gv_puts(" count=" as *u8); gv_num(own); gv_puts("\n" as *u8) 161 if own >= 1 { t8 = 1 } 162 } 163 gv_check("T8-positive-control-own-comm-from-proc-self-counts-at-least-1" as *u8, t8, ctr) 164 165 // T10 -- ROOTS vs ALL: our own comm as a ROOT counts >= 1 and never more than the whole-tree count 166 // (the spawner's reading must be the population of workers, not the tree of their handlers -- 167 // measured live: 2 workers read as 63 when handlers were counted). 168 var t10: i64 = 0 169 if cn > 0 { 170 let roots: i64 = ioa_count_comm_roots(cb) 171 let allc: i64 = ioa_count_comm(cb) 172 gv_puts(" self roots=" as *u8); gv_num(roots); gv_puts(" all=" as *u8); gv_num(allc); gv_puts("\n" as *u8) 173 if roots >= 1 { if roots <= allc { t10 = 1 } } 174 } 175 gv_check("T10-roots-count-is-the-population-not-the-tree-self-roots-ge1-le-all" as *u8, t10, ctr) 176 177 // T11 -- stat parser on KNOWN bytes: comm span + ppid, including a comm that itself holds ')'. 178 var t11: i64 = 0 179 let st: *i64 = sys_mmap(32) as *i64 180 let f1: *u8 = IG_FIX_STAT_A 181 if ioa_stat_parse(f1, ig_slen(f1), st) == 0 { if st[1] == 15 { if st[2] == 1 { if f1[st[0]] == (110 as u8) { 182 let f2: *u8 = IG_FIX_STAT_B 183 if ioa_stat_parse(f2, ig_slen(f2), st) == 0 { if st[1] == 4 { if st[2] == 77 { t11 = 1 } } } 184 } } } } 185 gv_check("T11-stat-parser-fixture-comm-span-and-ppid-incl-paren-in-comm" as *u8, t11, ctr) 186 187 // T9 -- bite: fires (budget 0) at the storm line, silent (budget > 0) with headroom. 188 var bad: i64 = 0 189 if ioa_spawn_budget(IG_NCPU, 8, 1, 1) == 0 { bad = 1 } 190 var good: i64 = 0 191 if ioa_spawn_budget(IG_NCPU, 3, 1, 1) == 0 { good = 1 } 192 gv_bite("T9-bite-storm-line-refuses-headroom-admits" as *u8, bad, good, ctr) 193 194 // ---- THE WRITEBACK-CONGESTION AXIS (teeth added 2026-09-03 in the same edit as the axis) ---- 195 // WHY IT IS HERE AND NOT IN A NEW GATE: this file already gates nx_ioadmit_lib. A second gate over the 196 // same lib would be the duplicate-ruler defect, and the two would drift. 197 let cw: i64 = IG_CONG_WARN_KB 198 let cs: i64 = IG_CONG_STORM_KB 199 200 // T12 -- the live kernel answers: Dirty and Writeback read from /proc/meminfo on any Linux. 201 let dw: *i64 = sys_mmap(IG_DW_SLOTS) as *i64 202 let drc: i64 = ioa_dirty(dw) 203 var t12: i64 = 0 204 if drc == 0 { if dw[0] >= 0 { if dw[1] >= 0 { t12 = 1 } } } 205 gv_check("T12-dirty-reads-live-proc-meminfo-dirty-and-writeback" as *u8, t12, ctr) 206 gv_puts(" live: dirty_kb=" as *u8); gv_num(dw[0]); gv_puts(" writeback_kb=" as *u8); gv_num(dw[1]); gv_puts("\n" as *u8) 207 208 // T13 -- UNARMED MUST BE INERT. With either bar at or below zero the axis returns CLEAR even at an 209 // absurd backlog, so shipping it unarmed cannot refuse a single lane. This is the tooth that makes 210 // "landed but not armed" a checkable claim instead of a promise in a comment. 211 var t13: i64 = 0 212 if ioa_congestion(IG_CONG_ABSURD_KB, IG_CONG_ABSURD_KB, 0, 0) == IOA_CONG_CLEAR { 213 if ioa_congestion(IG_CONG_ABSURD_KB, IG_CONG_ABSURD_KB, 0, cs) == IOA_CONG_CLEAR { 214 if ioa_congestion(IG_CONG_ABSURD_KB, IG_CONG_ABSURD_KB, cw, 0) == IOA_CONG_CLEAR { t13 = 1 } } } 215 gv_check("T13-unarmed-bars-are-inert-not-permissive-looking-like-armed" as *u8, t13, ctr) 216 217 // T14 -- armed, the three bands are the three bands, AT the bar as well as above it. 218 var t14: i64 = 0 219 if ioa_congestion(IG_CONG_BELOW_WARN_KB, 0, cw, cs) == IOA_CONG_CLEAR { 220 if ioa_congestion(cw, 0, cw, cs) == IOA_CONG_RISING { 221 if ioa_congestion(cs, 0, cw, cs) == IOA_CONG_STORM { t14 = 1 } } } 222 gv_check("T14-armed-bands-clear-rising-storm-at-and-above-each-bar" as *u8, t14, ctr) 223 224 // T15 -- the LEVEL is Dirty PLUS Writeback. A backlog split across the two must still cross the bar; 225 // reading Dirty alone would miss exactly the moment writeback has started and is losing. 226 var t15: i64 = 0 227 // NEITHER operand alone reaches the storm bar -- only their SUM does. An implementation that read 228 // Dirty and ignored Writeback would return CLEAR here, which is exactly the miss this tooth exists for. 229 if ioa_congestion(cs - cw, cw, cw, cs) == IOA_CONG_STORM { t15 = 1 } 230 gv_check("T15-dirty-plus-writeback-is-the-level-not-dirty-alone" as *u8, t15, ctr) 231 232 // T16 -- THIRD STATE, as a neg-control: an unreadable input must abstain and must NOT come back CLEAR. 233 // Acquitting on a blind axis is the failure this estate refuses by name, and CLEAR is the acquittal. 234 var t16: i64 = 0 235 if ioa_congestion(IOA_UNREADABLE, 0, cw, cs) == IOA_CONG_UNREADABLE { 236 if ioa_congestion(0, IOA_UNREADABLE, cw, cs) == IOA_CONG_UNREADABLE { t16 = 1 } } 237 gv_check("neg-control-T16-unreadable-abstains-and-never-acquits-as-clear" as *u8, t16, ctr) 238 239 // T17 -- THE COLON IN THE KEY IS LOAD-BEARING. /proc/meminfo carries BOTH "Writeback:" and 240 // "WritebackTmp:", and rm_field matches the line that STARTS with the key -- so a bare "Writeback" 241 // reads whichever the kernel printed first. The fixture puts WritebackTmp FIRST with a different 242 // value, so a key that lost its colon returns 12345 and this tooth fails loudly. 243 let fx: *u8 = IG_FIX_MEM 244 var t17: i64 = 0 245 if rm_field(fx, ig_slen(fx), "Writeback:" as *u8) == IG_FIX_MEM_WB { 246 if rm_field(fx, ig_slen(fx), "Dirty:" as *u8) == IG_FIX_MEM_DIRTY { t17 = 1 } } 247 gv_check("T17-meminfo-keys-carry-their-colon-so-writebacktmp-cannot-shadow-writeback" as *u8, t17, ctr) 248 249 // T18 -- bite in one cell: STORM above the bar, silent below. Two teeth that each see one condition 250 // cannot show the function discriminates between them. 251 var cbad: i64 = 0 252 if ioa_congestion(cs + 1, 0, cw, cs) == IOA_CONG_STORM { cbad = 1 } 253 var cgood: i64 = 0 254 if ioa_congestion(1, 0, cw, cs) == IOA_CONG_STORM { cgood = 1 } 255 gv_bite("T18-bite-congestion-fires-above-the-bar-and-is-silent-below" as *u8, cbad, cgood, ctr) 256 257 // ---- THE BLOCK-DEVICE AXIS (teeth added 2026-09-03 with the axis itself, rung OB1) ---- 258 // The PARSER is tested on fixture bytes and the READER on the live file, because a tooth that needs a 259 // particular device to be mounted is a tooth that only works on one box. 260 let ds: *i64 = sys_mmap(IG_DS_OUT_SLOTS) as *i64 261 let fdb: *u8 = IG_FIX_DS 262 let fdn: i64 = ig_slen(fdb) 263 264 // T19 -- all four counters for md4, from bytes whose answer is KNOWN rather than from whatever is mounted. 265 var t19: i64 = 0 266 if ioa_ds_parse(fdb, fdn, "md4" as *u8, ds) == 0 { 267 if ds[0] == IG_DS_MD4_SREAD { if ds[1] == IG_DS_MD4_SWRIT { 268 if ds[2] == IG_DS_MD4_INFLIGHT { if ds[3] == IG_DS_MD4_MSIO { t19 = 1 } } } } } 269 gv_check("T19-diskstats-parser-reads-all-four-counters-from-known-bytes" as *u8, t19, ctr) 270 271 // T20 -- EXACT device match, never a prefix. md40 sits BEFORE md4 in the fixture, so a prefix matcher 272 // asked for md4 would answer the md40 line; asking for md40 and getting ITS values pins both directions. 273 var t20: i64 = 0 274 if ioa_ds_parse(fdb, fdn, "md40" as *u8, ds) == 0 { 275 if ds[0] == IG_DS_MD40_SREAD { if ds[1] == IG_DS_MD40_SWRIT { t20 = 1 } } } 276 gv_check("T20-device-match-is-exact-so-md40-cannot-shadow-md4" as *u8, t20, ctr) 277 278 // T21 -- NEG-CONTROL: an absent device is UNOBSERVABLE, never a zero. A zero here would let a typo 279 // publish a perfectly healthy-looking idle array while the real one was saturated. 280 var t21: i64 = 0 281 if ioa_ds_parse(fdb, fdn, "nosuchdev" as *u8, ds) == IOA_UNREADABLE { 282 if ds[0] == IOA_UNREADABLE { if ds[1] == IOA_UNREADABLE { t21 = 1 } } } 283 gv_check("neg-control-T21-absent-device-is-unreadable-never-a-zero" as *u8, t21, ctr) 284 285 // T22 -- the LIVE reader actually opens /proc/diskstats. Asking for a device nobody has proves the read 286 // path runs on any Linux without pinning the tooth to this box's array layout. 287 var t22: i64 = 0 288 if ioa_diskstats("nosuchdev" as *u8, ds) == IOA_UNREADABLE { t22 = 1 } 289 gv_check("T22-live-reader-opens-proc-diskstats-and-abstains-on-an-absent-device" as *u8, t22, ctr) 290 291 // T23 -- the rate is DERIVED and hand-checkable: 2048 sectors of 512 bytes over one second is 1024 KB/s. 292 var t23: i64 = 0 293 if ioa_sector_rate_kbs(IG_DS_RATE_SECTORS, IG_DS_RATE_MS) == IG_DS_RATE_EXPECT_KBS { t23 = 1 } 294 gv_check("T23-sector-rate-is-derived-2048-sectors-per-second-is-1024-kbs" as *u8, t23, ctr) 295 296 // T24 -- NEG-CONTROL: a non-positive interval, or a negative delta from a counter wrap or a sample pair 297 // read in the wrong order, ABSTAINS. Returning 0 there would publish a stalled array as an idle one. 298 var t24: i64 = 0 299 if ioa_sector_rate_kbs(IG_DS_RATE_SECTORS, 0) == IOA_UNREADABLE { 300 if ioa_sector_rate_kbs(0 - 1, IG_DS_RATE_MS) == IOA_UNREADABLE { t24 = 1 } } 301 gv_check("neg-control-T24-rate-abstains-on-a-bad-interval-or-a-wrapped-counter" as *u8, t24, ctr) 302 303 // T25 -- bite in one cell: the parser FINDS a device that is present and REFUSES one that is not. 304 var dbad: i64 = 0 305 if ioa_ds_parse(fdb, fdn, "md4" as *u8, ds) == 0 { dbad = 1 } 306 var dgood: i64 = 0 307 if ioa_ds_parse(fdb, fdn, "nosuchdev" as *u8, ds) == 0 { dgood = 1 } 308 gv_bite("T25-bite-parser-finds-a-present-device-and-refuses-an-absent-one" as *u8, dbad, dgood, ctr) 309 310 // ---- THE SMOOTHED WITNESS (teeth added 2026-09-03 with the function) ---- 311 let mv: *i64 = sys_mmap(IG_MED_SLOTS) as *i64 312 let mo: *i64 = sys_mmap(IG_MED_SLOTS) as *i64 313 314 // T26 -- the median of the FIRST FIVE REAL SAMPLES this box produced, checkable by hand: 14,10,5,10,9 315 // sorts to 5,9,10,10,14 and medians to 10. 316 mv[0] = IG_MED_S0 317 mv[1] = IG_MED_S1 318 mv[2] = IG_MED_S2 319 mv[3] = IG_MED_S3 320 mv[4] = IG_MED_S4 321 var t26: i64 = 0 322 if ioa_median(mv, IG_MED_K5) == IG_MED_REAL_EXPECT { t26 = 1 } 323 gv_check("T26-median-of-the-five-real-measured-samples-is-ten" as *u8, t26, ctr) 324 325 // T27 -- NEG-CONTROL: an out-of-range sample count ABSTAINS rather than returning a number. A median 326 // of zero samples that answered anything would be a fabricated reading with an authoritative name. 327 var t27: i64 = 0 328 if ioa_median(mv, 0) == IOA_UNREADABLE { 329 if ioa_measure_median(mo, 0, IG_MED_LIVE_GAP_MS) == IOA_UNREADABLE { 330 if ioa_measure_median(mo, IOA_MEDIAN_MAX_K + 1, IG_MED_LIVE_GAP_MS) == IOA_UNREADABLE { t27 = 1 } } } 331 gv_check("neg-control-T27-median-abstains-on-an-out-of-range-sample-count" as *u8, t27, ctr) 332 333 // T28 -- the LIVE sampler against the real kernel: k spaced reads, with coverage published in out[2] 334 // so a thin answer says it is thin instead of passing as a full one. 335 var t28: i64 = 0 336 if ioa_measure_median(mo, IG_MED_LIVE_K, IG_MED_LIVE_GAP_MS) == 0 { 337 if mo[0] > 0 { if mo[1] >= 0 { if mo[2] == IG_MED_LIVE_K { t28 = 1 } } } } 338 gv_check("T28-live-median-samples-k-times-and-publishes-its-own-coverage" as *u8, t28, ctr) 339 gv_puts(" live median: ncpu=" as *u8); gv_num(mo[0]); gv_puts(" blocked_median=" as *u8); gv_num(mo[1]); gv_puts(" samples=" as *u8); gv_num(mo[2]); gv_puts("\n" as *u8) 340 341 // T29 -- THE BITE, and the whole reason this function exists, in ONE cell: a SUSTAINED storm still 342 // reads at or above the line, while a quiet box carrying a single burst does NOT. A witness that 343 // cannot separate those two is the coin flip that refused eight builds on this box today. 344 mv[0] = IG_MED_STORM_LO 345 mv[1] = IG_MED_STORM_HI 346 mv[2] = IG_MED_SPIKE 347 mv[3] = IG_MED_STORM_HI 348 mv[4] = IG_MED_STORM_LO 349 var mbad: i64 = 0 350 if ioa_median(mv, IG_MED_K5) >= IG_NCPU { mbad = 1 } 351 mv[0] = IG_MED_QUIET 352 mv[1] = IG_MED_QUIET 353 mv[2] = IG_MED_SPIKE 354 mv[3] = IG_MED_QUIET 355 mv[4] = IG_MED_QUIET 356 var mgood: i64 = 0 357 if ioa_median(mv, IG_MED_K5) >= IG_NCPU { mgood = 1 } 358 gv_bite("T29-bite-median-holds-high-on-a-sustained-storm-and-ignores-a-single-burst" as *u8, mbad, mgood, ctr) 359 360 // T30 -- and the two values behind that bite, stated so a reader can check them by hand rather than 361 // trust the comparison: the burst case medians to 2, the sustained case to 10. 362 var t30: i64 = 0 363 if ioa_median(mv, IG_MED_K5) == IG_MED_SPIKE_EXPECT { 364 mv[0] = IG_MED_STORM_LO 365 mv[1] = IG_MED_STORM_HI 366 mv[2] = IG_MED_SPIKE 367 mv[3] = IG_MED_STORM_HI 368 mv[4] = IG_MED_STORM_LO 369 if ioa_median(mv, IG_MED_K5) == IG_MED_STORM_EXPECT { t30 = 1 } } 370 gv_check("T30-a-single-burst-medians-to-two-and-a-sustained-storm-medians-to-ten" as *u8, t30, ctr) 371 372 // ---- OWNERSHIP ATTRIBUTION (teeth added 2026-09-03 with the axis, rung OB3) ---- 373 let ow: *i64 = sys_mmap(IG_OWN_SLOTS) as *i64 374 375 // T31 -- BOTH PARTITIONS MUST SUM. A partition is a claim, and a census whose parts do not reconcile 376 // with its total is leaking processes into neither bucket. Checked for the population AND for the 377 // blocked roster, because the roster is the one admission actually decides on. 378 var t31: i64 = 0 379 if ioa_ownership_census(IG_OWN_PREFIX, ow) == 0 { 380 if ow[1] + ow[2] == ow[0] { if ow[4] + ow[5] == ow[3] { t31 = 1 } } } 381 gv_check("T31-both-partitions-reconcile-ours-plus-foreign-equals-procs-and-same-for-blocked" as *u8, t31, ctr) 382 gv_puts(" live: procs=" as *u8); gv_num(ow[0]); gv_puts(" ours=" as *u8); gv_num(ow[1]) 383 gv_puts(" foreign=" as *u8); gv_num(ow[2]); gv_puts(" blocked=" as *u8); gv_num(ow[3]) 384 gv_puts(" blocked_ours=" as *u8); gv_num(ow[4]); gv_puts(" blocked_foreign=" as *u8); gv_num(ow[5]) 385 gv_puts(" foreign_permil=" as *u8); gv_num(ioa_share_permil(ow[2], ow[0])); gv_puts("\n" as *u8) 386 387 // T32 -- POSITIVE CONTROL: this gate is itself an nx_ process, so the census MUST find at least one of 388 // us. Without this a census that counted nothing at all would satisfy every partition tooth above. 389 var t32: i64 = 0 390 if ow[1] >= 1 { t32 = 1 } 391 gv_check("T32-positive-control-the-census-sees-at-least-this-very-process-as-ours" as *u8, t32, ctr) 392 393 // T33 -- NEG-CONTROL: a prefix nobody carries yields ours=0 and foreign=THE WHOLE POPULATION, and the 394 // partition still reconciles. A census that returns >0 for a nonsense prefix is counting something 395 // other than the prefix. 396 var t33: i64 = 0 397 if ioa_ownership_census(IG_OWN_NOBODY, ow) == 0 { 398 if ow[1] == 0 { if ow[2] == ow[0] { if ow[0] > 0 { t33 = 1 } } } } 399 gv_check("neg-control-T33-a-prefix-nobody-carries-counts-zero-ours-and-all-foreign" as *u8, t33, ctr) 400 401 // T34 -- the share is DERIVED and hand-checkable: 250 of 1000 is 250 permil. 402 var t34: i64 = 0 403 if ioa_share_permil(IG_SHARE_PART, IG_SHARE_WHOLE) == IG_SHARE_EXPECT { t34 = 1 } 404 gv_check("T34-share-is-derived-250-of-1000-is-250-permil" as *u8, t34, ctr) 405 406 // T35 -- NEG-CONTROL and the one that matters most for a governor: an uncountable population ABSTAINS. 407 // Rendering it as 0 permil would tell an admission ring that NOTHING is foreign at the exact moment it 408 // could not look -- the most flattering possible lie about whose load this is. 409 var t35: i64 = 0 410 if ioa_share_permil(1, 0) == IOA_UNREADABLE { 411 if ioa_share_permil(0 - 1, IG_SHARE_WHOLE) == IOA_UNREADABLE { t35 = 1 } } 412 gv_check("neg-control-T35-an-uncountable-population-abstains-never-reports-zero-permil" as *u8, t35, ctr) 413 414 // T36 -- bite in one cell: the census FINDS us under the real prefix and REFUSES to under a false one. 415 var obad: i64 = 0 416 if ioa_ownership_census(IG_OWN_PREFIX, ow) == 0 { if ow[1] >= 1 { obad = 1 } } 417 var ogood: i64 = 0 418 if ioa_ownership_census(IG_OWN_NOBODY, ow) == 0 { if ow[1] >= 1 { ogood = 1 } } 419 gv_bite("T36-bite-census-finds-us-under-the-real-prefix-and-not-under-a-false-one" as *u8, obad, ogood, ctr) 420 421 return gv_verdict("IOADMIT-GATE" as *u8, ctr, "the budget is derived from the box, clamps at the storm line, keeps the reserve slot, abstains when unobservable, the /proc walk is proven both ways, the writeback level sums both fields and stays inert while unarmed, and the block-device axis parses known bytes, matches a device name exactly, abstains on an absent device rather than reporting an idle one, and derives its rate from a delta that cannot be a single counter" as *u8) 422}