code wiki / _hdl_build / nx_procchurn_gate.nx
`nx_procchurn_gate.nx` source

↩ module page · 353 lines · 20683 B
1// nx_procchurn_gate.nx -- proves the four pure predicates of nx_procchurn_lib, BOTH POLARITIES.
2//
3// Non-vacuity discipline (seq395 / the quality ruler): every policy cell is a gv_bite -- it must FIRE on
4// the crafted-bad input AND stay SILENT on the crafted-good one. A cell that is green before the defect
5// exists proves nothing. The value cells are pinned to the ACTUAL 2026-07-30 field measurement so the
6// gate would have caught the live fork-storm, not merely compiled.
7// license_tier: ORIGINAL   expect_exit: 0   No hw writes (Rule 26).
8import "nx_procchurn_lib.nx"
9import "nx_gate_verdict.nx"
10
11const PG_BUF: i64 = 2048
12const PG_OUT_BYTES: i64 = 256
13// the real numbers measured on the NAS 2026-07-30 (two /proc/stat samples 117s apart)
14const PG_FIELD_FORKS: i64 = 9164
15const PG_FIELD_MS: i64 = 117000
16const PG_FIELD_FORKS_PS: i64 = 78
17const PG_FIELD_SYS_J: i64 = 21639
18const PG_FIELD_USR_J: i64 = 9163
19const PG_FIELD_RATIO: i64 = 2361
20const PG_FIELD_CTXSW_PS: i64 = 91718
21// thresholds under test (the shipped defaults)
22const PG_F_AMBER: i64 = 20
23const PG_F_RED: i64 = 50
24const PG_R_AMBER: i64 = 1000
25const PG_R_RED: i64 = 1500
26const PG_C_AMBER: i64 = 20000
27const PG_C_RED: i64 = 50000
28// OB5 consumer bars. 6s = two 3000ms measurement windows, i.e. the SHIPPED derivation, so the gate
29// tests the same arithmetic the organ runs rather than a number chosen to make the teeth pass.
30const PG_ACT_MAXAGE: i64 = 6
31const PG_ACT_STALE_AGE: i64 = 999
32// OB4 fixture bounds. PG_PIDCAP is generously above this host process count (measured ~800) so T39 can
33// distinguish a real enumeration from a capped one; PG_TALLY_MAX is small on purpose so the full-table
34// refusal is reachable in a test rather than only in production.
35const PG_PIDCAP: i64 = 4096
36const PG_PIDS_BYTES: i64 = 32768
37const PG_TALLY_MAX: i64 = 8
38const PG_TALLY_BYTES: i64 = 256
39const PG_PATHBUF: i64 = 64
40
41func pg_cpy(d: *u8, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { d[i] = s[i]; i = i + 1 }
  d[i] = 0 as u8
  return i
46}
47func pg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
48
49func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_procchurn_gate -- process-churn predicates, pinned to the 2026-07-30 field data" as *u8)
52
  gv_check("T1 pc_rate reproduces the field measurement 9164 forks / 117000ms = 78/s" as *u8,
           pg_eq(pc_rate(PG_FIELD_FORKS, PG_FIELD_MS), PG_FIELD_FORKS_PS), ctr)
  gv_bite("T2 pc_rate refuses a zero-length window" as *u8,
          pg_eq(pc_rate(PG_FIELD_FORKS, 0), 0 - 1),
          pg_eq(pc_rate(PG_FIELD_FORKS, PG_FIELD_MS), 0 - 1), ctr)
  gv_bite("T3 pc_rate refuses a BACKWARD counter (wrap/reboot between samples)" as *u8,
          pg_eq(pc_rate(0 - 5, PG_FIELD_MS), 0 - 1),
          pg_eq(pc_rate(5, PG_FIELD_MS), 0 - 1), ctr)
61
  gv_check("T4 pc_ratio_permil reproduces the field kernel:user 21639:9163 = 2361 permil" as *u8,
           pg_eq(pc_ratio_permil(PG_FIELD_SYS_J, PG_FIELD_USR_J), PG_FIELD_RATIO), ctr)
  gv_bite("T5 pc_ratio_permil saturates on zero userspace instead of reading as parity" as *u8,
          pg_eq(pc_ratio_permil(100, 0), PC_RATIO_SAT),
          pg_eq(pc_ratio_permil(100, 100), PC_RATIO_SAT), ctr)
67
  gv_check("T6 pc_verdict is GREEN when every axis is quiet" as *u8,
           pg_eq(pc_verdict(1, 100, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 0), ctr)
  gv_bite("T7 the FORK axis alone raises RED" as *u8,
          pg_eq(pc_verdict(60, 100, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2),
          pg_eq(pc_verdict(10, 100, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2), ctr)
  gv_bite("T8 the KERNEL:USER axis alone raises RED" as *u8,
          pg_eq(pc_verdict(1, 1600, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2),
          pg_eq(pc_verdict(1, 900, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2), ctr)
  gv_bite("T9 the CONTEXT-SWITCH axis alone raises RED" as *u8,
          pg_eq(pc_verdict(1, 100, 60000, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2),
          pg_eq(pc_verdict(1, 100, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2), ctr)
  gv_check("T10 RED dominates AMBER (amber-only input stays 1)" as *u8,
           pg_eq(pc_verdict(25, 900, 100, PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 1), ctr)
81
  let buf: *u8 = sys_mmap(PG_BUF)
  let out: *i64 = sys_mmap(PG_OUT_BYTES) as *i64
  let n: i64 = pg_cpy(buf, "cpu0 999 999 999\ncpu  11 22 33 44 55 66 77 88 99 1010\nprocesses 4153147\nctxt 5007810360\n" as *u8)
  let cnt: i64 = pc_line_ints(buf, n, "cpu " as *u8, out, 10)
  gv_check("T11 pc_line_ints reads all 10 jiffy fields off the aggregate cpu line" as *u8, pg_eq(cnt, 10), ctr)
  var t12: i64 = 0
  if out[0] == 11 { if out[2] == 33 { if out[9] == 1010 { t12 = 1 } } }
  gv_check("T12 PREFIX DISCIPLINE: cpu-space takes the aggregate line, NOT cpu0 decoy 999s" as *u8, t12, ctr)
  let pcnt: i64 = pc_line_ints(buf, n, "processes " as *u8, out, 1)
  var t13: i64 = 0
  if pcnt == 1 { if out[0] == 4153147 { t13 = 1 } }
  gv_check("T13 pc_line_ints reads the scalar processes fork counter" as *u8, t13, ctr)
  gv_bite("T14 pc_line_ints is FAIL-CLOSED on an absent key (-1, never a silent 0)" as *u8,
          pg_eq(pc_line_ints(buf, n, "nosuchkey " as *u8, out, 1), 0 - 1),
          pg_eq(pc_line_ints(buf, n, "ctxt " as *u8, out, 1), 0 - 1), ctr)
97
  gv_check("T15 the REAL 2026-07-30 numbers (78/s, 2361 permil, 91718 ctxsw/s) verdict RED" as *u8,
           pg_eq(pc_verdict(PG_FIELD_FORKS_PS, PG_FIELD_RATIO, PG_FIELD_CTXSW_PS,
                            PG_F_AMBER, PG_F_RED, PG_R_AMBER, PG_R_RED, PG_C_AMBER, PG_C_RED), 2), ctr)
101
  // ---- the append-only journal frame: proven BYTE-FOR-BYTE without touching a filesystem ----
  let fb: *u8 = sys_mmap(PG_BUF)
  let eb: *u8 = sys_mmap(PG_BUF)
  let frmn: i64 = pc_frame(fb, 1785433000, 3000, 18, 81480, 47557, 2361, 98, 231, 351, 2, 3, 11)
  let expn: i64 = pg_cpy(eb, "ts=1785433000 window_ms=3000 forks_ps=18 ctxsw_ps=81480 intr_ps=47557 ku_permil=2361 usr_permil=98 sys_permil=231 busy_permil=351 sev=2 running=3 blocked=11\n" as *u8)
  var t16: i64 = 0
  if frmn == expn {
      var q: i64 = 0
      var same: i64 = 1
      while q < frmn { if fb[q] != eb[q] { same = 0 } q = q + 1 }
      t16 = same
  }
  gv_check("T16 pc_frame emits the journal frame BYTE-FOR-BYTE (parseable trend line)" as *u8, t16, ctr)
115
  // An UNMEASURED axis is -1. If pc_catn dropped the sign it would land in the journal as a huge
  // positive number and read as a catastrophic measurement instead of an absent one.
  let nb: *u8 = sys_mmap(PG_BUF)
  let nb2: *u8 = sys_mmap(PG_BUF)
  let nn1: i64 = pc_catn(nb, 0, 0 - 1)
  var neg_ok: i64 = 0
  if nn1 == 2 { if nb[0] == (45 as u8) { if nb[1] == (49 as u8) { neg_ok = 1 } } }
  pc_catn(nb2, 0, 1)
  var pos_signed: i64 = 0
  if nb2[0] == (45 as u8) { pos_signed = 1 }
  gv_bite("T17 pc_catn keeps the sign on -1 (UNMEASURED stays visible, never wraps huge)" as *u8,
          neg_ok, pos_signed, ctr)
128
  // ==== OB5: THE SEVERITY CONSUMER =================================================================
  // Every tooth below runs the SHIPPED lib functions in-process on crafted bytes, so the fixture is
  // assembled at runtime and no filesystem is touched. The gate can therefore never share a fixture
  // with a production beat, and a RED here tracks the CODE rather than the state of a directory.
  let jb2: *u8 = sys_mmap(PG_BUF)
  let so2: *i64 = sys_mmap(PG_OUT_BYTES) as *i64
135
  // T18 -- the head of an append-only file is its PAST: the oldest and most-tested part, where no
  // regression has ever lived. A reader that takes the first frame reports history as current.
  let jn18: i64 = pg_cpy(jb2, "ts=1000 window_ms=3000 forks_ps=1 sev=0 running=1 blocked=0\nts=2000 window_ms=3000 forks_ps=99 sev=2 running=3 blocked=14\n" as *u8)
  let r18: i64 = pc_sev_last(jb2, jn18, so2)
  var t18: i64 = 0
  if r18 == 1 { if so2[0] == 2 { if so2[1] == 2000 { t18 = 1 } } }
  gv_check("T18 pc_sev_last takes the LAST frame of the journal, never its head" as *u8, t18, ctr)
143
  // T19 -- the same defect that made WritebackTmp: answer for Writeback: in the I/O ruler. The key
  // carries its leading space, so a longer key ending in the same letters cannot shadow it.
  let jn19: i64 = pg_cpy(jb2, "ts=3000 prevsev=9 sev=1 running=1 blocked=0\n" as *u8)
  let r19: i64 = pc_sev_last(jb2, jn19, so2)
  var t19bad: i64 = 0
  if r19 == 1 { if so2[0] == 1 { t19bad = 1 } }
  let jn19b: i64 = pg_cpy(jb2, "ts=3000 prevsev=9 running=1 blocked=0\n" as *u8)
  let r19b: i64 = pc_sev_last(jb2, jn19b, so2)
  var t19good: i64 = 0
  if r19b == 1 { t19good = 1 }
  gv_bite("T19 the severity key carries its leading space, so prevsev=9 cannot shadow sev=1" as *u8,
          t19bad, t19good, ctr)
156
  // T20 -- ts= is ANCHORED to line start rather than searched. An unanchored key would take the tail
  // of starts= and return a number from a field that is not the timestamp.
  let jn20: i64 = pg_cpy(jb2, "starts=999 sev=1 running=1 blocked=0\n" as *u8)
  var t20bad: i64 = 0
  if pc_sev_last(jb2, jn20, so2) < 0 { t20bad = 1 }
  let jn20b: i64 = pg_cpy(jb2, "ts=500 sev=1 running=1 blocked=0\n" as *u8)
  var t20good: i64 = 1
  if pc_sev_last(jb2, jn20b, so2) == 1 { if so2[1] == 500 { t20good = 0 } }
  gv_bite("T20 ts= is anchored to LINE START, so starts=999 is UNPARSEABLE and not a timestamp" as *u8,
          t20bad, t20good, ctr)
167
  // T21 -- THREE STATES. An empty journal and a corrupt one demand opposite remedies, and a single
  // negative word would have the reader guess the alarming one.
  var t21bad: i64 = 0
  if pc_sev_last(jb2, 0, so2) == 0 { t21bad = 1 }
  let jn21: i64 = pg_cpy(jb2, "ts=7 sev=0 running=0 blocked=0\n" as *u8)
  var t21good: i64 = 0
  if pc_sev_last(jb2, jn21, so2) == 0 { t21good = 1 }
  gv_bite("T21 an EMPTY journal reads NO-FRAME(0), distinct from UNPARSEABLE(-1)" as *u8,
          t21bad, t21good, ctr)
177
  // T22 -- a journal that ends in blank lines must still yield its last real frame.
  let jn22: i64 = pg_cpy(jb2, "ts=8000 sev=2 running=1 blocked=9\n\n\n" as *u8)
  var t22: i64 = 0
  if pc_sev_last(jb2, jn22, so2) == 1 { if so2[0] == 2 { if so2[1] == 8000 { t22 = 1 } } }
  gv_check("T22 trailing blank lines do not hide the last real frame" as *u8, t22, ctr)
183
  // T23 -- the mapping itself, all three severities in one condition so a dropped arm cannot hide.
  var t23: i64 = 0
  if pc_sev_consumer(0, 1, PG_ACT_MAXAGE) == PC_ACT_PROCEED {
      if pc_sev_consumer(1, 1, PG_ACT_MAXAGE) == PC_ACT_SLOW {
          if pc_sev_consumer(2, 1, PG_ACT_MAXAGE) == PC_ACT_DEFER { t23 = 1 }
      }
  }
  gv_check("T23 severity maps 0->PROCEED 1->SLOW 2->DEFER on a fresh, armed reading" as *u8, t23, ctr)
192
  // T24 -- THE LOAD-BEARING ONE. A stale GREEN is the flattering direction: it says go ahead at the
  // exact moment the consumer could not look, and it fails silently because nobody investigates a
  // permission. Abstention is the only safe answer, and it must beat sev=0.
  var t24bad: i64 = 0
  if pc_sev_consumer(0, PG_ACT_STALE_AGE, PG_ACT_MAXAGE) == PC_ACT_UNOBSERVABLE { t24bad = 1 }
  var t24good: i64 = 1
  if pc_sev_consumer(0, 1, PG_ACT_MAXAGE) == PC_ACT_PROCEED { t24good = 0 }
  gv_bite("T24 a STALE sev=0 abstains and does NOT acquit, while a fresh sev=0 proceeds" as *u8,
          t24bad, t24good, ctr)
202
  // T25 -- an UNARMED guard that returns PROCEED is byte-for-byte indistinguishable from no guard.
  var t25bad: i64 = 0
  if pc_sev_consumer(0, 0, 0) == PC_ACT_UNOBSERVABLE { t25bad = 1 }
  var t25good: i64 = 1
  if pc_sev_consumer(0, 0, PG_ACT_MAXAGE) == PC_ACT_PROCEED { t25good = 0 }
  gv_bite("T25 an UNARMED consumer (no bar declared) abstains rather than waving work through" as *u8,
          t25bad, t25good, ctr)
210
  // T26 -- a future timestamp is clock skew, not freshness. Negative age is a third unobservable.
  var t26bad: i64 = 0
  if pc_sev_consumer(0, 0 - 1, PG_ACT_MAXAGE) == PC_ACT_UNOBSERVABLE { t26bad = 1 }
  var t26good: i64 = 1
  if pc_sev_consumer(2, 1, PG_ACT_MAXAGE) == PC_ACT_DEFER { t26good = 0 }
  gv_bite("T26 a NEGATIVE age (future stamp / clock skew) abstains, never reads as fresh" as *u8,
          t26bad, t26good, ctr)
218
  // T27 -- an unmeasurable severity is -1, and -1 compares below every threshold. Without this screen
  // it would read as a confident GREEN: the partial-as-complete defect wearing an actuator costume.
  var t27bad: i64 = 0
  if pc_sev_consumer(0 - 1, 1, PG_ACT_MAXAGE) == PC_ACT_UNOBSERVABLE { t27bad = 1 }
  var t27good: i64 = 1
  if pc_sev_consumer(0, 1, PG_ACT_MAXAGE) == PC_ACT_PROCEED { t27good = 0 }
  gv_bite("T27 an UNMEASURABLE severity (-1) abstains and never reads as GREEN" as *u8,
          t27bad, t27good, ctr)
227
  // T28 -- THE WIRE. The producer and the consumer are each proven correct above IN ISOLATION, which
  // is exactly the state in which two organs still disagree on the format between them. This is the
  // only tooth that tests the format itself: pc_frame writes the bytes, pc_sev_last reads them back.
  let wb: *u8 = sys_mmap(PG_BUF)
  let wn: i64 = pc_frame(wb, 1788400000, 3000, 37, 151312, 73865, 1200, 147, 177, 330, 2, 3, 14)
  var t28: i64 = 0
  if pc_sev_last(wb, wn, so2) == 1 { if so2[0] == 2 { if so2[1] == 1788400000 { t28 = 1 } } }
  gv_check("T28 WIRE ROUND-TRIP: pc_frame writes a frame that pc_sev_last reads back exactly" as *u8, t28, ctr)
236
  // T29 -- a control that MUST fail. Without it, a parser that accepted anything would score 100pct.
  let jn29: i64 = pg_cpy(jb2, "ts=9000 Sev=2 running=1 blocked=0\n" as *u8)
  var t29: i64 = 0
  if pc_sev_last(jb2, jn29, so2) < 0 { t29 = 1 }
  gv_check("neg-control-T29 a mis-cased Sev= is UNPARSEABLE, never silently accepted" as *u8, t29, ctr)
242
  // ==== OB4: FORK SOURCES BY PARENT ===============================================================
  let pbA: *u8 = sys_mmap(PG_BUF)
  let pbB: *u8 = sys_mmap(PG_BUF)
  let pathb: *u8 = sys_mmap(PG_PATHBUF)
  let stout: *i64 = sys_mmap(PG_OUT_BYTES) as *i64
  let o4: *i64 = sys_mmap(PG_OUT_BYTES) as *i64
  let fullf: *i64 = sys_mmap(PG_OUT_BYTES) as *i64
250
  // T30/T31 -- /proc holds named entries beside the pids. A walk that does not screen them hands
  // "self" to a decimal parser, which returns 0, which is a REAL PID -- a fabricated process.
  pg_cpy(pbA, "31039" as *u8)
  pg_cpy(pbB, "self" as *u8)
  gv_check("T30 pc_name_is_pid accepts an all-digit /proc entry" as *u8, pg_eq(pc_name_is_pid(pbA), 1), ctr)
  var t31bad: i64 = 0
  if pc_name_is_pid(pbB) == 0 { pg_cpy(pbB, "" as *u8); if pc_name_is_pid(pbB) == 0 { t31bad = 1 } }
  var t31good: i64 = 1
  if pc_name_is_pid(pbA) == 1 { t31good = 0 }
  gv_bite("neg-control-T31 named /proc entries and the empty name are REJECTED, digits are not" as *u8,
          t31bad, t31good, ctr)
  gv_check("T32 pc_name_to_i64 reads the enumerated name back as its number" as *u8,
           pg_eq(pc_name_to_i64(pbA), 31039), ctr)
264
  // T33/T34 -- the tally is the only pure part of the attribution, so it is the only part that can be
  // proven without a /proc. A table that grows past its cap would corrupt the arrays beside it.
  let tp: *i64 = sys_mmap(PG_TALLY_BYTES) as *i64
  let tc: *i64 = sys_mmap(PG_TALLY_BYTES) as *i64
  var np: i64 = 0
  np = pc_tally_parent(tp, tc, np, PG_TALLY_MAX, 100)
  np = pc_tally_parent(tp, tc, np, PG_TALLY_MAX, 200)
  np = pc_tally_parent(tp, tc, np, PG_TALLY_MAX, 100)
  var t33: i64 = 0
  if np == 2 { if tc[0] == 2 { if tc[1] == 1 { if tp[0] == 100 { if tp[1] == 200 { t33 = 1 } } } } }
  gv_check("T33 pc_tally_parent adds a new parent once and increments a repeat" as *u8, t33, ctr)
  var t34bad: i64 = 0
  let npf: i64 = pc_tally_parent(tp, tc, PG_TALLY_MAX, PG_TALLY_MAX, 999)
  if npf == PG_TALLY_MAX { t34bad = 1 }
  var t34good: i64 = 1
  if pc_tally_parent(tp, tc, 2, PG_TALLY_MAX, 300) == 3 { t34good = 0 }
  gv_bite("T34 a FULL parent table refuses to grow, while a table with room still admits" as *u8,
          t34bad, t34good, ctr)
283
  // T35 -- membership, including the empty set. A seen-test that answers yes on an empty array would
  // make every pid look old and the new-process count would be permanently zero.
  var t35: i64 = 0
  if pc_pid_seen(tp, 2, 100) == 1 { if pc_pid_seen(tp, 2, 555) == 0 { if pc_pid_seen(tp, 0, 100) == 0 { t35 = 1 } } }
  gv_check("T35 pc_pid_seen finds a member, rejects a non-member, and says NO on the empty set" as *u8, t35, ctr)
289
  // T36/T37/T38 -- the coverage ratio, which is the whole point of this rung: the attributed number is
  // a LOWER BOUND and it is only honest beside the kernel counter.
  gv_check("T36 pc_attrib_permil derives 250 of 1000 as 250 permil" as *u8,
           pg_eq(pc_attrib_permil(250, 1000), 250), ctr)
  var t37bad: i64 = 0
  if pc_attrib_permil(5, 0) == 0 - 1 { t37bad = 1 }
  var t37good: i64 = 1
  if pc_attrib_permil(250, 1000) == 250 { t37good = 0 }
  gv_bite("T37 an unusable kernel counter ABSTAINS at -1 and never reports 0 permil coverage" as *u8,
          t37bad, t37good, ctr)
  var t38bad: i64 = 0
  if pc_attrib_permil(2000, 1000) == 2000 { t38bad = 1 }
  var t38good: i64 = 1
  if pc_attrib_permil(500, 1000) == 500 { t38good = 0 }
  gv_bite("T38 coverage above 1000 is REPORTED not clamped, because it means the windows disagree" as *u8,
          t38bad, t38good, ctr)
306
  // T39/T40 -- LIVE enumeration against this very host, and its declared bound. A cap silently reached
  // becomes a measurement nobody knows is partial, so filling it must SAY SO.
  let pidsA: *i64 = sys_mmap(PG_PIDS_BYTES) as *i64
  let pidsB: *i64 = sys_mmap(PG_PIDS_BYTES) as *i64
  let nA: i64 = pc_pids(pidsA, PG_PIDCAP, fullf)
  var t39: i64 = 0
  if nA > 0 { if fullf[0] == 0 { t39 = 1 } }
  gv_puts("    live: pids_enumerated=" as *u8); gv_num(nA); gv_puts(" cap_hit=" as *u8); gv_num(fullf[0]); gv_puts("\n" as *u8)
  gv_check("T39 pc_pids enumerates this live host and does not silently hit its cap" as *u8, t39, ctr)
  var t40bad: i64 = 0
  let nOne: i64 = pc_pids(pidsB, 1, fullf)
  if nOne == 1 { if fullf[0] == 1 { t40bad = 1 } }
  var t40good: i64 = 1
  pc_pids(pidsB, PG_PIDCAP, fullf)
  if fullf[0] == 0 { t40good = 0 }
  gv_bite("T40 a cap of ONE reports cap_hit so the count reads as a FLOOR, and a roomy cap does not" as *u8,
          t40bad, t40good, ctr)
324
  // T41 -- the incumbent stat parser reached through its named accessor, both directions. /proc/0 does
  // not exist, and the answer for it must be -1 and never 0, because 0 is a real pid.
  var t41bad: i64 = 0
  if pc_ppid_of(0, pbA, pathb, stout) == 0 - 1 { t41bad = 1 }
  var t41good: i64 = 1
  if nA > 0 { if pc_ppid_of(pidsA[0], pbA, pathb, stout) >= 0 { t41good = 0 } }
  gv_bite("T41 a pid that cannot exist returns -1, while a live pid resolves its real parent" as *u8,
          t41bad, t41good, ctr)
333
  // T42 -- THE PARTITION. Attributed and vanished must SUM to the new-process count: a pid that exits
  // between the walk and the read is a DIFFERENT outcome from one that was never new, and folding them
  // into one counter is how a survivor census quietly becomes a fork rate.
  let tp2: *i64 = sys_mmap(PG_TALLY_BYTES) as *i64
  let tc2: *i64 = sys_mmap(PG_TALLY_BYTES) as *i64
  pc_fork_by_parent(pidsB, 0, pidsA, nA, tp2, tc2, PG_TALLY_MAX, pbA, pathb, stout, o4)
  var t42: i64 = 0
  if o4[0] == nA { if o4[1] + o4[3] == o4[0] { if o4[2] >= 0 { t42 = 1 } } }
  gv_puts("    live: new=" as *u8); gv_num(o4[0])
  gv_puts(" attributed=" as *u8); gv_num(o4[1])
  gv_puts(" distinct_parents=" as *u8); gv_num(o4[2])
  gv_puts(" vanished_before_read=" as *u8); gv_num(o4[3])
  gv_puts(" coverage_permil_vs_self=" as *u8); gv_num(pc_attrib_permil(o4[1], o4[0]))
  gv_puts("\n" as *u8)
  gv_check("T42 attributed plus vanished SUMS to the new-process count over the live host" as *u8, t42, ctr)
349
  let rc: i64 = gv_verdict("PROCCHURN-GATE" as *u8, ctr, "process-churn predicates proven both polarities on field data" as *u8)
  sys_exit(rc)
  return rc
353}
nx_procchurn_gate.nx source

`nx_procchurn_gate.nx` source
