nx_poolwidth_gate.nx source

1// nx_poolwidth_gate.nx -- proves the width governor on the REAL measured numbers (seq1402). 2// 3// T2 is the whole point: it quantifies the live defect. Today's policy gives every instance MAXP=32, and 4// nx_procchurn measured ~9 concurrent instances => an aggregate of 288 concurrent slots against a 5// 32-slot budget, and pw_within_budget says 0. The governed policy yields 3 each = 27, within budget. 6// license_tier: ORIGINAL expect_exit: 0 No hw writes (Rule 26). 7import "nx_poolwidth_lib.nx" 8import "nx_gate_verdict.nx" 9 10// the live measurement this gate is pinned to 11const PG_BUDGET: i64 = 32 12const PG_INSTANCES: i64 = 9 13const PG_TODAY_MAXP: i64 = 32 14const PG_TODAY_AGG: i64 = 288 15const PG_LOAD_QUIET: i64 = 400 16const PG_LOAD_MEASURED: i64 = 1172 17const PG_LOAD_2X: i64 = 1600 18const PG_CEILING: i64 = 800 19const PG_WMIN: i64 = 2 20const PG_WMAX: i64 = 32 21 22func pg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 } 23func cg_ge(a: i64, b: i64) -> i64 { if a >= b { return 1 } return 0 } 24 25func main() -> i64 { 26 let ctr: *i64 = gv_ctr() 27 gv_head("nx_poolwidth_gate -- headroom-derived pool width, pinned to the 2026-07-30 measurement" as *u8) 28 29 gv_check("T1 budget 32 shared by the 9 measured instances yields 3 slots each" as *u8, 30 pg_eq(pw_width(PG_BUDGET, PG_INSTANCES, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), 3), ctr) 31 32 // ---- THE DEFECT, QUANTIFIED ---- 33 gv_check("T2a TODAY: MAXP=32 x 9 instances = 288 concurrent slots" as *u8, 34 pg_eq(pw_aggregate(PG_TODAY_MAXP, PG_INSTANCES), PG_TODAY_AGG), ctr) 35 gv_bite("T2b TODAY's per-instance policy BLOWS the budget; the governed one holds it" as *u8, 36 pg_eq(pw_within_budget(PG_TODAY_MAXP, PG_INSTANCES, PG_BUDGET), 0), 37 pg_eq(pw_within_budget(pw_width(PG_BUDGET, PG_INSTANCES, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_INSTANCES, PG_BUDGET), 0), ctr) 38 gv_check("T2c the governed aggregate (3 x 9 = 27) fits inside the 32 budget" as *u8, 39 pg_eq(pw_aggregate(3, PG_INSTANCES), 27), ctr) 40 41 // ---- a lone instance may use the whole budget: governing width must not punish the common case ---- 42 gv_check("T3 a SINGLE instance still gets the full budget (no gratuitous throttling)" as *u8, 43 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_BUDGET), ctr) 44 45 // ---- proportional squeeze, not a cliff ---- 46 gv_check("T4 at 2x the load ceiling the width halves proportionally (3 -> 1, wmin=1)" as *u8, 47 pg_eq(pw_width(PG_BUDGET, PG_INSTANCES, PG_LOAD_2X, PG_CEILING, 1, PG_WMAX), 1), ctr) 48 gv_check("T5 at the REAL measured load 11.72 the 9-way split squeezes to 2" as *u8, 49 pg_eq(pw_width(PG_BUDGET, PG_INSTANCES, PG_LOAD_MEASURED, PG_CEILING, PG_WMIN, PG_WMAX), 2), ctr) 50 gv_bite("T6 load ABOVE the ceiling squeezes; load BELOW it does not" as *u8, 51 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_2X, PG_CEILING, PG_WMIN, PG_WMAX), PG_BUDGET / 2), 52 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_BUDGET / 2), ctr) 53 54 // ---- fail-safe + guards ---- 55 gv_bite("T7 an UNREADABLE load yields wmin -- not knowing the pressure is not permission to grab" as *u8, 56 pg_eq(pw_width(PG_BUDGET, 1, 0 - 1, PG_CEILING, PG_WMIN, PG_WMAX), PG_WMIN), 57 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_WMIN), ctr) 58 gv_bite("T8 n_instances=0 is treated as 1, never a divide-by-zero" as *u8, 59 pg_eq(pw_width(PG_BUDGET, 0, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_BUDGET), 60 pg_eq(pw_width(PG_BUDGET, PG_INSTANCES, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_BUDGET), ctr) 61 gv_check("T9 width is clamped to wmax when the budget would exceed it" as *u8, 62 pg_eq(pw_width(1000, 1, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_WMAX), ctr) 63 gv_check("T10 the wmin FLOOR keeps a pool usable -- a 0-width pool is a dead feature, not a throttle" as *u8, 64 pg_eq(pw_width(1, 100, PG_LOAD_QUIET, PG_CEILING, PG_WMIN, PG_WMAX), PG_WMIN), ctr) 65 gv_bite("T11 REFUSES an inverted clamp (wmax < wmin) instead of returning nonsense" as *u8, 66 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_QUIET, PG_CEILING, 10, 2), 0 - 1), 67 pg_eq(pw_width(PG_BUDGET, 1, PG_LOAD_QUIET, PG_CEILING, 2, 10), 0 - 1), ctr) 68 69 // ---- the honest edge: the floor can legitimately overshoot, and it must be VISIBLE ---- 70 gv_bite("T12 wmin x many instances CAN exceed budget, and the predicate SAYS SO (admit fewer instances, not thinner pools)" as *u8, 71 pg_eq(pw_within_budget(PG_WMIN, 100, PG_BUDGET), 0), 72 pg_eq(pw_within_budget(PG_WMIN, 4, PG_BUDGET), 0), ctr) 73 74 // ---- HARDWARE ADAPTIVITY: the budget must come from THIS machine (seq1410) ---- 75 let cpus: i64 = nx_hw_cpu_count() 76 // ★REGRESSION GUARD for the war story in nx_hw.nx's own header: a wrong syscall number once made this 77 // probe return 1 SILENTLY (mask all-zero -> popcount 0), so every auto-sized pool ran single-threaded 78 // and nothing complained. This NAS has 8 logical CPUs; asserting >=2 fires the moment that returns. 79 gv_check("T13 nx_hw_cpu_count reports a REAL cpu count (>=2), not the silent-1 failure" as *u8, 80 cg_ge(cpus, 2), ctr) 81 gv_check("T14 the budget is DERIVED from this machine (cpus x 4), never a literal" as *u8, 82 pg_eq(pw_budget_from_hw(4, 8), cpus * 4), ctr) 83 gv_bite("T15 a nonsense slots_per_cpu falls back to the floor instead of zeroing the pool" as *u8, 84 pg_eq(pw_budget_from_hw(0, 8), 8), 85 pg_eq(pw_budget_from_hw(4, 8), 8), ctr) 86 gv_bite("T16 pw_budget_from_hw REFUSES a nonsense floor" as *u8, 87 pg_eq(pw_budget_from_hw(4, 0), 0 - 1), 88 pg_eq(pw_budget_from_hw(4, 8), 0 - 1), ctr) 89 90 let rc: i64 = gv_verdict("POOLWIDTH-GATE" as *u8, ctr, "one headroom-derived governor for every pool; 288-slot overcommit quantified" as *u8) 91 sys_exit(rc) 92 return rc 93}