code wiki / (root) / nx_sc_scope_gate.nx
`nx_sc_scope_gate.nx` source

↩ module page · 517 lines · 27386 B
1// nx_sc_scope_gate.nx -- the referee for LR2, structured concurrency: scoped spawn.
2//
3// SUBJECT: sc_scope_spawn and its scope verbs in runtime/nx_thread_pool.nx.
4//
5// WHY THIS GATE IS BUILT THE WAY IT IS.  A concurrency gate is the easiest kind to
6// write vacuously: if the child finishes before the parent looks, EVERY assertion
7// passes and NOTHING about joining has been tested.  So the join teeth here do not
8// ask "did the children finish" -- that is true of a no-op join too.  They ask
9// three questions a no-op join cannot answer yes to:
10//   * were the children observably INSIDE their bodies, and observably NOT
11//     finished, at the instant the parent was about to join (the fixture is
12//     asserted to have REACHED the condition before any outcome is asserted);
13//   * did join return STRICTLY AFTER every child completed, proved by a shared
14//     monotonic sequence counter rather than by a millisecond clock that can tie;
15//   * did join BLOCK for at least the interval the children were measured holding.
16// A no-op join returns in microseconds while the children hold for witness-hold-ms,
17// so the third tooth alone separates them, and the second proves the ordering exactly.
18//
19// NO FIXTURE FILES.  This gate builds its whole fixture at RUNTIME out of mmapped
20// words and pool tasks, so it shares no path with any production beat and needs no
21// /tmp scratch directory to create or clean up.
22//
23// EVERY THRESHOLD IS A CONF ROW (knowledge/sc_scope.conf).  The two exceptions are
24// the join guard and the join spin, which carry NO row on purpose because they are
25// DERIVED from nx_pool_wait -- and one of the teeth below proves the conf really
26// does not carry them, so the derivation cannot be quietly unpinned.
27//
28// expect_exit: 0   license_tier: ORIGINAL   lineage_id: sc_scope_gate_v1
29import "nx_syscalls.nx"
30import "nx_atom.nx"
31import "nx_hw.nx"
32import "nx_thread_pool.nx"
33import "nx_gate_verdict.nx"
34import "nx_lineconf_lib.nx"
35
36const SG_ERRCODE: i64 = 424242        // a child return nothing else could produce
37const SG_MAXKIDS: i64 = 256           // BOUND on the witness arrays, named not silent
38// Bound on the fixture's start-wait, in yields.  A yield is roughly a microsecond,
39// so this is about two seconds.  It is deliberately SHORT: a fixture that has not
40// got every child into its body within two seconds has NOT reached its condition,
41// and the right outcome then is a FAILING tooth that says so, never a gate that
42// hangs for minutes and reads as a dead organ to whoever called it.
43const SG_STARTWAIT_GUARD: i64 = 2000000
44const SG_ASCII_ZERO: i64 = 48
45const SG_ASCII_NINE: i64 = 57
46const SG_ASCII_DOT:  i64 = 46
47const SG_CENTI: i64 = 100
48const SG_PERMIL: i64 = 1000
49// bounds the shared sink accumulator so a long spin cannot overflow it.  Named for
50// what it DOES, not for what it is: nx_magic proposed SG_MAGIC_1024 and says itself
51// that renaming to a domain term is the owner judgment rule 11 is asking for.
52const SG_SINK_MOD: i64 = 1024
53const SG_WORD: i64 = 8
54
55static g_sg_start: *i64   // [i] = 1 once child i is inside its body
56static g_sg_done:  *i64   // [i] = sequence stamp at completion, 0 = never completed
57static g_sg_rel:   *i64   // [0] release word for the T1 witnesses
58static g_sg_rel2:  *i64   // [0] release word for the T3 cancellation fixture
59static g_sg_seq:   *i64   // [0] shared monotonic sequence -- the join ordering oracle
60static g_sg_sink:  *i64   // [0] bench accumulator, so the bench work is not dead code
61static g_sg_work:  i64    // bench spin iterations (conf)
62static g_sg_holditers: i64 // CALIBRATED spin count a witness child holds for
63
64func sg_conf(key: *u8) -> i64 { return lcf_int_of("knowledge/sc_scope.conf" as *u8, key) }
65
66// first field of /proc/loadavg as centi-load ("2.15" -> 215); -1 when unreadable.
67func sg_load1_centi() -> i64 {
  let lp: *i64 = sys_mmap(SG_WORD * 2) as *i64
  let b: *u8 = sys_read_file("/proc/loadavg" as *u8, lp)
  if (b as i64) == 0 { return 0 - 1 }
  let n: i64 = lp[0]
  var i: i64 = 0
  var whole: i64 = 0
  var wd: i64 = 0
  while i < n {
      let c: i64 = b[i] as i64
      if c < SG_ASCII_ZERO { break }
      if c > SG_ASCII_NINE { break }
      whole = whole * 10 + (c - SG_ASCII_ZERO)
      wd = wd + 1
      i = i + 1
  }
  if wd == 0 { return 0 - 1 }
  var frac: i64 = 0
  var got: i64 = 0
  if i < n {
      let dot: i64 = b[i] as i64
      if dot == SG_ASCII_DOT {
          i = i + 1
          while got < 2 {
              if i >= n { break }
              let c2: i64 = b[i] as i64
              if c2 < SG_ASCII_ZERO { break }
              if c2 > SG_ASCII_NINE { break }
              frac = frac * 10 + (c2 - SG_ASCII_ZERO)
              got = got + 1
              i = i + 1
          }
      }
  }
  while got < 2 { frac = frac * 10; got = got + 1 }
  return whole * SG_CENTI + frac
103}
104
105// ---- fixture tasks (all plain COLORLESS func(i64) -> i64) --------------------
106
107// PURE ARITHMETIC, NO SYSCALL, NO ALLOCATION.  Used both for the parent-side
108// calibration and, at the calibrated count, for the child hold.
109func _sg_spin(n: i64) -> i64 {
  var s: i64 = 0
  var k: i64 = 0
  while k < n { s = s + (k % 7) * 3; k = k + 1 }
  return s
114}
115
116// Announces it is running, waits for release, holds for the CALIBRATED interval,
117// then stamps a monotonic sequence number.  The stamp is q+1 so that 0 means "never".
118//
119// WHY THE HOLD IS A SPIN AND NOT A CLOCK -- MEASURED 2026-08-25, IT CRASHED THIS
120// GATE ONCE ALREADY.  sys_now_ms allocates its timespec with sys_mmap(16); a small
121// request comes from nx_syscalls' bump arena; and that arena advances its cursor
122// with a PLAIN non-atomic read-modify-write on nxa_st[0].  Eight pool workers
123// calling sys_now_ms in a spin loop therefore raced the cursor, handed two threads
124// overlapping 16-byte allocations, tripped the ring canary (ARENA-OVERRUN
125// prev_alloc_size=16) and ended in SIGSEGV.  The hazard is general and it is not
126// this scope's: ANY small sys_mmap is unsafe from more than one thread at a time,
127// which puts sys_now_ms, sys_now_us and lcf_int_of off limits inside a pool task.
128// It is also why _sc_kid_main allocates nothing -- that is a load-bearing property
129// of the scope, not an incidental one.
130func _sg_hold_task(ctx: i64) -> i64 {
  nx_atom_store_i64(((g_sg_start as i64) + ctx * SG_WORD) as *i64, 1, NX_MO_SEQ_CST)
  while nx_atom_load_i64(g_sg_rel, NX_MO_SEQ_CST) == 0 { nx_thread_yield() }
  let s: i64 = _sg_spin(g_sg_holditers)
  nx_atom_faa_i64(g_sg_sink, s % SG_SINK_MOD, NX_MO_SEQ_CST)
  let q: i64 = nx_atom_faa_i64(g_sg_seq, 1, NX_MO_SEQ_CST)
  nx_atom_store_i64(((g_sg_done as i64) + ctx * SG_WORD) as *i64, q + 1, NX_MO_SEQ_CST)
  return 0
138}
139func _sg_ok_task(ctx: i64) -> i64 { return 0 }
140func _sg_err_task(ctx: i64) -> i64 { return SG_ERRCODE }
141// occupies a worker until rel2, so the rest of its scope is still QUEUED at cancel time
142func _sg_gate_task(ctx: i64) -> i64 {
  while nx_atom_load_i64(g_sg_rel2, NX_MO_SEQ_CST) == 0 { nx_thread_yield() }
  return 0
145}
146// real arithmetic, so the bench arms measure the pool and not the dispatch alone
147func _sg_work_task(ctx: i64) -> i64 {
  var s: i64 = 0
  var i: i64 = 0
  while i < g_sg_work { s = s + (i % 7) * 3 + ctx; i = i + 1 }
  nx_atom_faa_i64(g_sg_sink, s % SG_SINK_MOD, NX_MO_SEQ_CST)
  return 0
153}
154
155func sg_kv(k: *u8, v: i64) -> i64 { gv_puts(k); gv_num(v); gv_puts("\n" as *u8); return 0 }
156
157func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("=== NX-SC-SCOPE-GATE -- LR2 structured concurrency: scoped spawn over the colorless pool ===" as *u8)
160
  // ---- conf: a missing row REFUSES, it never defaults ----------------------
  let cap:        i64 = sg_conf("max-children-per-scope" as *u8)
  let hold_ms:    i64 = sg_conf("witness-hold-ms" as *u8)
  let ovh_max:    i64 = sg_conf("scope-overhead-max-permil" as *u8)
  let sp_floor:   i64 = sg_conf("pool-speedup-floor-permil" as *u8)
  let bench_n:    i64 = sg_conf("bench-tasks" as *u8)
  let bench_w:    i64 = sg_conf("bench-work-iters" as *u8)
  let cal_iters:  i64 = sg_conf("witness-calibration-iters" as *u8)
  let hold_acc:   i64 = sg_conf("witness-hold-accept-permil" as *u8)
  var conf_ok: i64 = 1
  if cal_iters == LCF_MISS { conf_ok = 0 }
  if hold_acc == LCF_MISS { conf_ok = 0 }
  if cap == LCF_MISS { conf_ok = 0 }
  if hold_ms == LCF_MISS { conf_ok = 0 }
  if ovh_max == LCF_MISS { conf_ok = 0 }
  if sp_floor == LCF_MISS { conf_ok = 0 }
  if bench_n == LCF_MISS { conf_ok = 0 }
  if bench_w == LCF_MISS { conf_ok = 0 }
  if gv_need("knowledge/sc_scope.conf carries every declared row" as *u8, conf_ok, ctr) == 0 {
      return gv_verdict("SC-SCOPE-GATE" as *u8, ctr, "subject sc_scope_spawn -- strength is in each check name" as *u8)
  }
  g_sg_work = bench_w
183
  // CALIBRATE the child hold, single-threaded, before any worker exists.  The spin
  // count is DERIVED from this host's measured rate rather than picked for it, so
  // the witness stays decisive on a fast box and on a slow one.
  let cal0: i64 = sys_now_ms()
  let cal_sink: i64 = _sg_spin(cal_iters)
  var cal_ms: i64 = sys_now_ms() - cal0
  if cal_ms < 1 { cal_ms = 1 }   // divide-by-zero guard, not a tunable
  g_sg_holditers = cal_iters * hold_ms / cal_ms
  let hold_floor_ms: i64 = hold_ms * hold_acc / SG_PERMIL
193
  let pool: *NxThreadPool = nx_pool_new(0, 64)
  var nw: i64 = pool.n_workers
  if nw > SG_MAXKIDS { nw = SG_MAXKIDS }
  let l1: i64 = sg_load1_centi()
  let ncpu: i64 = nx_hw_worker_count()
  sg_kv("  workers=" as *u8, pool.n_workers)
  sg_kv("  witnesses=" as *u8, nw)
  sg_kv("  ncpu=" as *u8, ncpu)
  sg_kv("  load1_centi=" as *u8, l1)
  sg_kv("  conf max-children-per-scope=" as *u8, cap)
  sg_kv("  conf witness-hold-ms=" as *u8, hold_ms)
  sg_kv("  calibration iters=" as *u8, cal_iters)
  sg_kv("  calibration ms=" as *u8, cal_ms)
  sg_kv("  calibration sink (proves the spin was not elided)=" as *u8, cal_sink % SG_SINK_MOD)
  sg_kv("  DERIVED child hold iters=" as *u8, g_sg_holditers)
  sg_kv("  join must be observed blocking at least ms=" as *u8, hold_floor_ms)
  gv_puts("  join-guard-iters=" as *u8); gv_num(sc_join_guard_iters())
  gv_puts("  join-spin=" as *u8); gv_num(sc_join_spin())
  gv_puts("  provenance=DERIVED source=nx_pool_wait (no conf row exists for either)\n" as *u8)
  gv_puts("  bytes-per-scope-mapping=" as *u8); gv_num(SC_SCOPE_BYTES + cap * SC_KID_BYTES)
  gv_puts("  bytes-per-spawn=" as *u8); gv_num(SC_KID_BYTES)
  gv_puts("  bump-arena-threshold=" as *u8); gv_num(NXA_SMALL_MAX); gv_puts("\n" as *u8)
216
  if gv_need("pool has at least two workers (a one-worker pool cannot witness a join)" as *u8, ((nw > 1) as i64), ctr) == 0 {
      return gv_verdict("SC-SCOPE-GATE" as *u8, ctr, "subject sc_scope_spawn -- strength is in each check name" as *u8)
  }
220
  g_sg_start = sys_mmap(SG_MAXKIDS * SG_WORD) as *i64
  g_sg_done  = sys_mmap(SG_MAXKIDS * SG_WORD) as *i64
  g_sg_rel   = sys_mmap(SG_WORD * 2) as *i64
  g_sg_rel2  = sys_mmap(SG_WORD * 2) as *i64
  g_sg_seq   = sys_mmap(SG_WORD * 2) as *i64
  g_sg_sink  = sys_mmap(SG_WORD * 2) as *i64
  g_sg_rel[0] = 0
  g_sg_rel2[0] = 0
  g_sg_seq[0] = 0
  g_sg_sink[0] = 0
  var i: i64 = 0
  while i < SG_MAXKIDS { g_sg_start[i] = 0; g_sg_done[i] = 0; i = i + 1 }
233
  // ================= T1: DOES THE JOIN ACTUALLY WAIT =========================
  let scA: *NxScope = sc_scope_open(pool)
  var openedA: i64 = 0
  if (scA as i64) != 0 { openedA = 1 }
  if gv_need("sc_scope_open returns a scope" as *u8, openedA, ctr) == 0 {
      sg_kv("  sc_last_refusal=" as *u8, sc_last_refusal())
      return gv_verdict("SC-SCOPE-GATE" as *u8, ctr, "subject sc_scope_spawn -- strength is in each check name" as *u8)
  }
  i = 0
  while i < nw { sc_scope_spawn(scA, _sg_hold_task, i); i = i + 1 }
244
  // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING ANY OUTCOME:
  // spin until every witness is observably inside its body.
  var started: i64 = 0
  var guard: i64 = 0
  while started < nw {
      started = 0
      i = 0
      while i < nw {
          if nx_atom_load_i64(((g_sg_start as i64) + i * SG_WORD) as *i64, NX_MO_SEQ_CST) == 1 { started = started + 1 }
          i = i + 1
      }
      nx_thread_yield()
      guard = guard + 1
      if guard > SG_STARTWAIT_GUARD { break }
  }
  var done_early: i64 = 0
  i = 0
  while i < nw {
      if nx_atom_load_i64(((g_sg_done as i64) + i * SG_WORD) as *i64, NX_MO_SEQ_CST) != 0 { done_early = done_early + 1 }
      i = i + 1
  }
  let probe_running: i64 = sc_scope_is_joined(scA)   // the BAD input for the bite
  let t_pre: i64 = nx_atom_faa_i64(g_sg_seq, 1, NX_MO_SEQ_CST) + 1
  let ms_rel: i64 = sys_now_ms()
  nx_atom_store_i64(g_sg_rel, 1, NX_MO_SEQ_CST)
  let joinA: i64 = sc_scope_join(scA)
  let ms_join: i64 = sys_now_ms()
  let t_join: i64 = nx_atom_faa_i64(g_sg_seq, 1, NX_MO_SEQ_CST) + 1
  let probe_after: i64 = sc_scope_is_joined(scA)     // the GOOD input for the bite
  let elapsed: i64 = ms_join - ms_rel
275
  var all_before_join: i64 = 1
  var all_after_pre: i64 = 1
  var all_state_done: i64 = 1
  i = 0
  while i < nw {
      let d: i64 = nx_atom_load_i64(((g_sg_done as i64) + i * SG_WORD) as *i64, NX_MO_SEQ_CST)
      if d == 0 { all_before_join = 0 }
      if d >= t_join { all_before_join = 0 }
      if d <= t_pre { all_after_pre = 0 }
      if sc_scope_kid_state(scA, i) != SC_KID_DONE { all_state_done = 0 }
      i = i + 1
  }
  sg_kv("  T1 children observed running before join=" as *u8, started)
  sg_kv("  T1 children already finished before join=" as *u8, done_early)
  sg_kv("  T1 join blocked ms=" as *u8, elapsed)
  sg_kv("  T1 seq pre-join=" as *u8, t_pre)
  sg_kv("  T1 seq post-join=" as *u8, t_join)
293
  let t1a: i64 = ((started == nw) as i64) & ((done_early == 0) as i64) & ((nw > 0) as i64)
  gv_check("fixture-every-child-observably-inside-its-body-and-none-finished-before-join" as *u8, t1a, ctr)
  let t1b: i64 = ((nw > 0) as i64) & all_before_join & all_after_pre
  gv_check("join-returns-strictly-after-every-child-completed-proved-by-sequence-order" as *u8, t1b, ctr)
  let t1c: i64 = ((nw > 0) as i64) & ((elapsed >= hold_floor_ms) as i64) & ((hold_floor_ms > 0) as i64)
  gv_check("join-blocked-at-least-the-calibrated-child-hold-which-a-no-op-join-cannot" as *u8, t1c, ctr)
  let t1d: i64 = ((sc_scope_spawned(scA) == nw) as i64) & ((sc_scope_finished(scA) == nw) as i64) & ((nw > 0) as i64)
  gv_check("scope-reports-finished-equals-spawned-with-a-nonzero-denominator" as *u8, t1d, ctr)
  let t1e: i64 = ((nw > 0) as i64) & all_state_done
  gv_check("every-child-record-reports-DONE-not-merely-the-aggregate-counter" as *u8, t1e, ctr)
  gv_check("join-returns-zero-when-no-child-errored" as *u8, ((joinA == 0) as i64), ctr)
  gv_bite("neg-control-scope-with-a-still-running-child-must-not-report-joined" as *u8, ((probe_running == 0) as i64), ((probe_after == 0) as i64), ctr)
306
  // ================= T2: A CHILD ERROR PROPAGATES TO THE SCOPE ===============
  let scB: *NxScope = sc_scope_open(pool)
  sc_scope_spawn(scB, _sg_ok_task, 0)
  sc_scope_spawn(scB, _sg_ok_task, 1)
  sc_scope_spawn(scB, _sg_err_task, 2)
  sc_scope_spawn(scB, _sg_ok_task, 3)
  let joinB: i64 = sc_scope_join(scB)
  sg_kv("  T2 join returned=" as *u8, joinB)
  sg_kv("  T2 scope err=" as *u8, sc_scope_err(scB))
  sg_kv("  T2 scope err_child=" as *u8, sc_scope_err_child(scB))
  let t2a: i64 = ((joinB == SG_ERRCODE) as i64) & ((sc_scope_err(scB) == SG_ERRCODE) as i64)
  gv_check("child-error-propagates-to-the-scope-and-join-hands-it-back" as *u8, t2a, ctr)
  gv_check("scope-names-WHICH-child-errored-not-merely-that-one-did" as *u8, ((sc_scope_err_child(scB) == 2) as i64), ctr)
  let t2c: i64 = ((sc_scope_spawned(scB) == 4) as i64) & ((sc_scope_finished(scB) == 4) as i64)
  gv_check("scope-still-joins-every-child-after-an-error-no-child-is-abandoned" as *u8, t2c, ctr)
  gv_check("an-error-cancels-its-OWN-scope-so-unstarted-siblings-stop" as *u8, ((sc_scope_cancelled(scB) == 1) as i64), ctr)
  sc_scope_free(scB)
324
  // ================= T3: CANCELLATION IS SCOPED =============================
  let scC: *NxScope = sc_scope_open(pool)   // the cancelled scope
  let scD: *NxScope = sc_scope_open(pool)   // its live sibling, open across the cancel
  let manyC: i64 = nw * 4
  i = 0
  while i < manyC { sc_scope_spawn(scC, _sg_gate_task, i); i = i + 1 }
  i = 0
  while i < nw { sc_scope_spawn(scD, _sg_ok_task, i); i = i + 1 }
  sc_scope_cancel(scC)
  let cancD_at_cancel: i64 = sc_scope_cancelled(scD)
  nx_atom_store_i64(g_sg_rel2, 1, NX_MO_SEQ_CST)
  let joinC: i64 = sc_scope_join(scC)
  let joinD: i64 = sc_scope_join(scD)
  var skipC: i64 = 0
  var doneC: i64 = 0
  i = 0
  while i < manyC {
      let s: i64 = sc_scope_kid_state(scC, i)
      if s == SC_KID_SKIPPED { skipC = skipC + 1 }
      if s == SC_KID_DONE { doneC = doneC + 1 }
      i = i + 1
  }
  var skipD: i64 = 0
  var doneD: i64 = 0
  i = 0
  while i < nw {
      let s2: i64 = sc_scope_kid_state(scD, i)
      if s2 == SC_KID_SKIPPED { skipD = skipD + 1 }
      if s2 == SC_KID_DONE { doneD = doneD + 1 }
      i = i + 1
  }
  sg_kv("  T3 cancelled-scope children=" as *u8, manyC)
  sg_kv("  T3 cancelled-scope skipped=" as *u8, skipC)
  sg_kv("  T3 cancelled-scope ran=" as *u8, doneC)
  sg_kv("  T3 sibling-scope children=" as *u8, nw)
  sg_kv("  T3 sibling-scope skipped=" as *u8, skipD)
  sg_kv("  T3 sibling-scope ran=" as *u8, doneD)
  gv_check("fixture-cancel-landed-while-children-were-still-queued-skipped-is-nonzero" as *u8, ((skipC > 0) as i64), ctr)
  let t3b: i64 = ((skipC + doneC == manyC) as i64) & ((manyC > 0) as i64)
  gv_check("every-child-of-a-cancelled-scope-is-accounted-skipped-plus-ran-equals-spawned" as *u8, t3b, ctr)
  let t3c: i64 = ((skipD == 0) as i64) & ((doneD == nw) as i64) & ((nw > 0) as i64)
  gv_check("cancellation-is-SCOPED-the-sibling-scope-loses-not-one-child" as *u8, t3c, ctr)
  let t3d: i64 = ((cancD_at_cancel == 0) as i64) & ((sc_scope_cancelled(scD) == 0) as i64) & ((sc_scope_cancelled(scC) == 1) as i64)
  gv_check("neg-control-sibling-cancel-flag-stays-clear-while-the-target-flag-is-set" as *u8, t3d, ctr)
  let t3e: i64 = ((joinC == 0) as i64) & ((joinD == 0) as i64)
  gv_check("a-cancelled-scope-still-joins-cleanly-rather-than-tripping-its-guard" as *u8, t3e, ctr)
  sc_scope_free(scC)
  sc_scope_free(scD)
373
  // ================= T4: THE ORPHAN SHAPE IS REFUSED BY NAME =================
  let r_closed: i64 = sc_scope_spawn(scA, _sg_ok_task, 0)          // scA was joined in T1
  let r_null:   i64 = sc_scope_spawn(0 as *NxScope, _sg_ok_task, 0)
  let r_join2:  i64 = sc_scope_join(scA)                            // double join
  let scE: *NxScope = sc_scope_open(pool)
  let r_freeopen: i64 = sc_scope_free(scE)                          // free while OPEN
380
  let sub0: i64 = pool.tasks_submitted
  sc_strict_set(1)
  let r_strict: i64 = nx_pool_submit(pool, _sg_ok_task, 0)
  let sub1: i64 = pool.tasks_submitted
  i = 0
  while i < 2 { sc_scope_spawn(scE, _sg_ok_task, i); i = i + 1 }
  let joinE: i64 = sc_scope_join(scE)
  let strict_scoped: i64 = ((sc_scope_spawned(scE) == 2) as i64) & ((sc_scope_finished(scE) == 2) as i64)
  sc_strict_set(0)
  let done_b4: i64 = nx_pool_n_completed(pool)
  let sub2: i64 = pool.tasks_submitted
  let r_unstrict: i64 = nx_pool_submit(pool, _sg_ok_task, 0)
  nx_pool_wait(pool, done_b4 + 1)
  let sub3: i64 = pool.tasks_submitted
395
  let scF: *NxScope = sc_scope_open(pool)
  var okspawn: i64 = 0
  i = 0
  while i < cap {
      if sc_scope_spawn(scF, _sg_ok_task, i) == 0 { okspawn = okspawn + 1 }
      i = i + 1
  }
  let r_full: i64 = sc_scope_spawn(scF, _sg_ok_task, cap)
  let spawned_cap: i64 = sc_scope_spawned(scF)
  let joinF: i64 = sc_scope_join(scF)
406
  sg_kv("  T4 spawn-into-joined-scope=" as *u8, r_closed)
  sg_kv("  T4 spawn-with-no-scope=" as *u8, r_null)
  sg_kv("  T4 double-join=" as *u8, r_join2)
  sg_kv("  T4 free-while-open=" as *u8, r_freeopen)
  sg_kv("  T4 strict bare submit=" as *u8, r_strict)
  sg_kv("  T4 pool submitted before strict submit=" as *u8, sub0)
  sg_kv("  T4 pool submitted after strict submit=" as *u8, sub1)
  sg_kv("  T4 over-capacity spawn=" as *u8, r_full)
  sg_kv("  T4 accepted spawns at cap=" as *u8, okspawn)
416
  gv_check("orphan-shape-refused-spawn-into-an-ALREADY-JOINED-scope-named-CLOSED" as *u8, ((r_closed == SC_REFUSE_CLOSED) as i64), ctr)
  gv_check("orphan-shape-refused-spawn-with-NO-SCOPE-AT-ALL-named-NO-SCOPE" as *u8, ((r_null == SC_REFUSE_NO_SCOPE) as i64), ctr)
  gv_check("double-join-refused-by-name-rather-than-silently-succeeding-twice" as *u8, ((r_join2 == SC_REFUSE_CLOSED) as i64), ctr)
  gv_check("cannot-free-a-scope-whose-children-may-still-be-running" as *u8, ((r_freeopen == SC_REFUSE_CLOSED) as i64), ctr)
  gv_check("strict-mode-refuses-the-BARE-unscoped-submit-by-name" as *u8, ((r_strict == SC_REFUSE_UNSCOPED) as i64), ctr)
  gv_check("strict-refusal-QUEUED-NOTHING-asserted-on-the-pool-STATE-not-the-message" as *u8, ((sub1 == sub0) as i64), ctr)
  let t4g: i64 = strict_scoped & ((joinE == 0) as i64)
  gv_check("strict-mode-still-admits-the-SCOPED-spawn-so-the-law-is-a-law-not-a-ban" as *u8, t4g, ctr)
  let t4h: i64 = ((r_unstrict == 0) as i64) & ((sub3 == sub2 + 1) as i64)
  gv_check("strict-off-restores-the-incumbent-bare-submit-byte-for-byte-contract" as *u8, t4h, ctr)
  let t4i: i64 = ((r_full == SC_REFUSE_FULL) as i64) & ((spawned_cap == cap) as i64) & ((okspawn == cap) as i64) & ((cap > 0) as i64)
  gv_check("over-capacity-spawn-refused-by-name-and-the-scope-never-over-counts" as *u8, t4i, ctr)
  gv_check("a-full-scope-still-joins-every-child-it-did-accept" as *u8, ((joinF == 0) as i64), ctr)
  sc_scope_free(scE)
  sc_scope_free(scF)
432
  // ================= T5: THE JOIN BOUNDS ARE DERIVED, AND UNPINNABLE ========
  let conf_guard: i64 = sg_conf("join-guard-iters" as *u8)
  let conf_spin:  i64 = sg_conf("join-spin" as *u8)
  gv_check("join-guard-and-spin-DERIVED-from-nx_pool_wait-linkage-holds-mechanically" as *u8, ((sc_join_guard_matches_pool() == 1) as i64), ctr)
  let t5b: i64 = ((conf_guard == LCF_MISS) as i64) & ((conf_spin == LCF_MISS) as i64)
  gv_check("neg-control-the-conf-carries-NO-row-for-either-so-the-linkage-cannot-be-unpinned" as *u8, t5b, ctr)
439
  // ================= T6: THE RESOURCE ENVELOPE, MEASURED ====================
  let base_bytes: i64 = sc_live_bytes()
  let scG: *NxScope = sc_scope_open(pool)
  let held_bytes: i64 = sc_live_bytes()
  let per_scope: i64 = sc_scope_bytes(scG)
  let joinG: i64 = sc_scope_join(scG)
  let freeG: i64 = sc_scope_free(scG)
  let after_bytes: i64 = sc_live_bytes()
  sg_kv("  T6 scope bytes held at open=" as *u8, held_bytes - base_bytes)
  sg_kv("  T6 scope bytes after join and free=" as *u8, after_bytes - base_bytes)
  let t6a: i64 = ((held_bytes - base_bytes == per_scope) as i64) & ((per_scope > 0) as i64)
  gv_check("open-accounts-exactly-one-scope-mapping-no-more-and-no-less" as *u8, t6a, ctr)
  let t6b: i64 = ((after_bytes == base_bytes) as i64) & ((freeG == 0) as i64) & ((joinG == 0) as i64)
  gv_check("join-then-free-returns-every-byte-the-scope-took-measured-not-asserted" as *u8, t6b, ctr)
  gv_check("scope-mapping-exceeds-the-bump-arena-threshold-so-munmap-really-returns-it" as *u8, ((per_scope > NXA_SMALL_MAX) as i64), ctr)
455
  // ================= T7: THE POOL IS NOT REGRESSED ==========================
  let s0: i64 = sys_now_ms()
  i = 0
  while i < bench_n { _sg_work_task(i); i = i + 1 }
  let t_serial: i64 = sys_now_ms() - s0
461
  let b0: i64 = sys_now_ms()
  let d0: i64 = nx_pool_n_completed(pool)
  i = 0
  while i < bench_n { nx_pool_submit(pool, _sg_work_task, i); i = i + 1 }
  nx_pool_wait(pool, d0 + bench_n)
  let t_bare: i64 = sys_now_ms() - b0
468
  let c0: i64 = sys_now_ms()
  let scH: *NxScope = sc_scope_open(pool)
  i = 0
  while i < bench_n { sc_scope_spawn(scH, _sg_work_task, i); i = i + 1 }
  let joinH: i64 = sc_scope_join(scH)
  sc_scope_free(scH)
  let t_scoped: i64 = sys_now_ms() - c0
476
  var speedup_permil: i64 = 0
  if t_scoped > 0 { speedup_permil = t_serial * SG_PERMIL / t_scoped }
  var bare_speedup_permil: i64 = 0
  if t_bare > 0 { bare_speedup_permil = t_serial * SG_PERMIL / t_bare }
  var ovh_permil: i64 = 0
  if t_bare > 0 { ovh_permil = (t_scoped - t_bare) * SG_PERMIL / t_bare }
  sg_kv("  T7 bench tasks=" as *u8, bench_n)
  sg_kv("  T7 serial ms=" as *u8, t_serial)
  sg_kv("  T7 bare-pool ms=" as *u8, t_bare)
  sg_kv("  T7 scoped ms=" as *u8, t_scoped)
  sg_kv("  T7 bare-pool speedup permil=" as *u8, bare_speedup_permil)
  sg_kv("  T7 scoped speedup permil=" as *u8, speedup_permil)
  sg_kv("  T7 scoped overhead over bare permil=" as *u8, ovh_permil)
  sg_kv("  T7 conf overhead ceiling permil=" as *u8, ovh_max)
  sg_kv("  T7 conf speedup floor permil=" as *u8, sp_floor)
492
  let t7a: i64 = ((t_serial > 0) as i64) & ((t_bare > 0) as i64) & ((t_scoped > 0) as i64)
  gv_check("bench-arms-all-nonzero-so-every-ratio-below-has-a-real-denominator" as *u8, t7a, ctr)
  let t7b: i64 = ((t_bare > 0) as i64) & ((ovh_permil <= ovh_max) as i64)
  gv_check("scoped-form-does-not-regress-the-bare-pool-beyond-the-conf-ceiling" as *u8, t7b, ctr)
  gv_check("the-scoped-bench-arm-completed-every-child-with-no-error" as *u8, ((joinH == 0) as i64), ctr)
  // THE INCUMBENT IS THE CONTROL, NOT A LOADAVG HEURISTIC.  The absolute speedup is
  // load-dependent, so something must decide whether this box could deliver it at
  // all -- and the honest judge is the BARE POOL MEASURED IN THIS SAME RUN, on this
  // same box, in the same second.  If the incumbent itself cannot reach the floor,
  // the box is too saturated for an absolute number to mean anything and the tooth
  // SKIPs; if the incumbent CAN reach it, the scoped form has no excuse and must.
  //
  // A loadavg bar was tried first and was WRONG: it demanded load1 below ncpu on a
  // shared NAS that sits at 14-21 against 8 CPUs, so the tooth would have been
  // permanently SKIP -- the detector nobody reads.  A control drawn from the same
  // run cannot go stale that way, and it can never produce a false RED either,
  // because a saturated box fails the PRECONDITION rather than the check.
  if gv_need("incumbent bare pool reaches the floor on this box right now (the control)" as *u8, ((bare_speedup_permil >= sp_floor) as i64), ctr) == 1 {
      let t7d: i64 = ((t_scoped > 0) as i64) & ((speedup_permil >= sp_floor) as i64)
      gv_check("pooled-speedup-through-a-scope-at-or-above-the-conf-floor" as *u8, t7d, ctr)
  }
514
  nx_pool_shutdown(pool)
  return gv_verdict("SC-SCOPE-GATE" as *u8, ctr, "subject sc_scope_spawn over nx_thread_pool -- each check name carries its own strength" as *u8)
517}
nx_sc_scope_gate.nx source

`nx_sc_scope_gate.nx` source
