{ "ap_budget_bytes": 65536, "arms": { "naive": { "max_retained_bytes": 78643200, "retained_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 19200.0 }, "rows": [ { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 22138, "refused": 0, "retained_bytes": 19200, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 87180, "refused": 0, "retained_bytes": 76800, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 16, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 347220, "refused": 0, "retained_bytes": 307200, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 64, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 1387380, "refused": 0, "retained_bytes": 1228800, "rss_peak_delta_bytes": 1212416 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 256, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 5548116, "refused": 0, "retained_bytes": 4915200, "rss_peak_delta_bytes": 5079040 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1024, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 22191220, "refused": 0, "retained_bytes": 19660800, "rss_peak_delta_bytes": 20316160 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4096, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 88761076, "refused": 0, "retained_bytes": 78643200, "rss_peak_delta_bytes": 81674240 } ], "rss_law": { "intercept": -107542.14624098688, "n": 7, "r2": 0.9999887320984241, "slope": 19966.05951724719 } }, "per_session": { "max_retained_bytes": 66060288, "retained_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 16128.000000000002 }, "rows": [ { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 34456, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 0 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 86345, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 32768 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 16, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 292717, "refused": 0, "retained_bytes": 258048, "rss_peak_delta_bytes": 262144 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 64, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 1117069, "refused": 0, "retained_bytes": 1032192, "rss_peak_delta_bytes": 1048576 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 256, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 4417069, "refused": 0, "retained_bytes": 4128768, "rss_peak_delta_bytes": 4210688 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1024, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 17617229, "refused": 0, "retained_bytes": 16515072, "rss_peak_delta_bytes": 16957440 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4096, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 70415309, "refused": 0, "retained_bytes": 66060288, "rss_peak_delta_bytes": 69861376 } ], "rss_law": { "intercept": -112123.25437692925, "n": 7, "r2": 0.9999493607834385, "slope": 17058.753851059973 } }, "quota": { "max_retained_bytes": 64512, "retained_law": { "intercept": 55443.114315139035, "n": 7, "r2": 0.05194157390925358, "slope": 2.7647316963975053 }, "rows": [ { "ap": { "admitted": 1, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 1, "n_max": 4, "peak_reserved_bytes": 16384, "peak_resident_bytes": 16128, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 19793, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 73462, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 12 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 73166, "refused": 12, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 60 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72870, "refused": 60, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 252 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72638, "refused": 252, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 1020 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72486, "refused": 1020, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 4092 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72334, "refused": 4092, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 } ], "rss_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 0.0 }, "saturated_law": { "intercept": 64512.0, "n": 6, "r2": 1.0, "slope": 0.0 } }, "quota_bytes": { "max_retained_bytes": 64512, "retained_law": { "intercept": 55443.114315139035, "n": 7, "r2": 0.05194157390925358, "slope": 2.7647316963975053 }, "rows": [ { "ap": { "admitted": 1, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 1, "n_max": 8, "peak_reserved_bytes": 16384, "peak_resident_bytes": 16128, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 19761, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72874, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 32768 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 12 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72722, "refused": 12, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 60 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72570, "refused": 60, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 252 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72482, "refused": 252, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 1020 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72510, "refused": 1020, "retained_bytes": 64512, "rss_peak_delta_bytes": 16384 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 4092 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72502, "refused": 4092, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 } ], "rss_law": { "intercept": 8248.244421558531, "n": 7, "r2": 0.03380328122456144, "slope": -1.5721865868723153 } } }, "check": "ap_quota", "checks": { "ablation_overruns": { "ablated_peak_bytes": 16515072, "ap_budget_bytes": 65536, "guarded_peak_bytes": 64512, "ok": true, "what": "a caller that BYPASSES the admission decision and allocates anyway overruns the budget, while the guarded path does not. This isolates ADMISSION-PRECEDES-ALLOCATION specifically; the byte-level reservation interlock is isolated separately by `reservation_interlock_binds` below." }, "bytes_arm_ablation_overruns": { "ablated_peak_bytes": 1032192, "ap_budget_bytes": 65536, "ok": true, "what": "the byte-accounted policy with its interlock removed and admission bypassed overruns the budget (the control that makes the next check a measurement)" }, "bytes_arm_admits_more_at_half_fill": { "admitted_quota": 4, "admitted_quota_bytes": 8, "fill_bytes_per_session": 8192, "ninth_refused": true, "ok": true, "resident_quota_bytes": 65536, "resident_quota_bytes_bytes_arm": 65536, "rmin_bytes": 7533, "what": "on the half-fill schedule (8 sessions x 8192 B) the whole-window rule seats G/CAP sessions, the byte-accounted rule seats G/RMIN with the budget attained, and a ninth open is refused" }, "bytes_arm_bounded_on_the_flood": { "ap_budget_bytes": 65536, "live_at_max_n": 4, "max_retained_bytes": 64512, "ok": true, "refused_at_max_n": 4092, "what": "under the overfill flood the byte-accounted arm never retains more than the budget", "whole_sweep_slope_bytes_per_session": 2.7647316963975053 }, "bytes_arm_matches_lean": { "engine_half_fill_admitted": 8, "engine_n_max": 8, "lean_n_max_bytes_canonical": 8, "ok": true, "what": "the engine's admitted count on the half-fill schedule equals the number Lean evaluated for ApBoundBytes (lean_ap_bytes_ci.json)" }, "n_max_enforced": { "derivation": "65536 // 16384", "n_max": 4, "ok": true, "refused": 3, "seated": [ true, true, true, true, false, false, false ], "what": "N_MAX_AP was a MODELED parameter at tools/check_reassembly_floor.py:83 ('modeled worst-case concurrent reassembly contexts'); it is now enforced and proven (WifiPQC.Ap.n_max_is_enforced)" }, "naive_grows_with_n": { "max_retained_bytes": 78643200, "ok": true, "r2": 1.0, "slope_bytes_per_session": 19200.0, "what": "reassemble-then-verify retains every offered byte, linearly in N" }, "per_session_cap_alone_is_unbounded_in_n": { "ap_budget_bytes": 65536, "exceeds_ap_budget_by": 65994752, "max_retained_bytes": 66060288, "ok": true, "r2": 1.0, "slope_bytes_per_session": 16128.000000000002, "what": "the SHIPPED pre-2026-08-18 mechanism O: every session individually bounded at the per-session cap, and the AP-wide SUM still linear in N. This check must PASS for the quota to be necessary; it is the machine-measured form of Lean's ap_unbounded_without_quota." }, "proof_code_constants_agree": { "code": { "CAP_S": 16384, "G": 65536, "N_MAX": 4 }, "lean": { "CAP_S": 16384, "G": 65536, "N_MAX": 4 }, "note": "ok", "ok": true, "what": "the bound proven in Lean and the bound enforced in code are about the same numbers -- a proof about different numbers is a proof about a different program" }, "quota_bounds_the_sum": { "ap_budget_bytes": 65536, "every_n_under_budget": true, "max_retained_bytes": 64512, "n_max_reached": 4, "n_points_saturated": 6, "ok": true, "saturated_from_n": 4, "saturated_slope_bytes_per_session": 0.0, "what": "retained <= the AP budget at EVERY N over 1..4096, and exactly flat once the quota saturates at n_max", "whole_sweep_slope_bytes_per_session": 2.7647316963975053 }, "reservation_interlock_binds": { "accepted_with_interlock": 4096, "accepted_without_interlock": 16384, "ok": true, "per_session_cap_bytes": 16384, "refusal_reason": "ap_quota_exhausted (over reservation)", "reservation_bytes": 4096, "what": "a session cannot retain more than its RESERVATION even when the per-session cap would allow more; with the interlock removed and nothing else changed, it runs past the reservation to the cap" } }, "does_not_prove": [ "that a production hostapd enforces this quota (it does not; this is the reference path)", "any wire-level or over-the-air result -- see `wire_level_leg`, which is BLOCKED on a non-Linux host and reports exactly what is missing", "that 65536 is the right budget for a particular deployment -- N_max is DERIVED from the budget and the window, and different parameters give a different N_max" ], "enforced_by": "lib/wifipqc/ap_admission.py", "failed_checks": [], "honest_scope": "MEASURED on the Python reference path (lib/wifipqc/incremental_auth.py), the same path the estate's other mechanism-O evidence uses, with every session held live simultaneously. NOT in-daemon hostapd enforcement and NOT real 802.11 frames: no packet crosses a radio here. The wire-level leg is tools/run_ap_resource_hwsim_linux.sh, which drives ONE association, not a flood, and is Linux-only. `retained_bytes` is exact (measured from the buffers); `rss_peak_delta_bytes` is quantised to the page size and is reported for honesty, not used as a threshold.", "host": { "platform": "macOS-26.6-arm64-arm-64bit", "python": "3.11.14" }, "n_max": 4, "n_sweep": [ 1, 4, 16, 64, 256, 1024, 4096 ], "ok": true, "per_session_cap_bytes": 16384, "proven_by": "06_formal_models/lean/ApBound.lean (make lean-proof)", "wire_level_leg": { "blocked_because": "this host is Darwin; missing: linux, hostapd, wpa_supplicant, modprobe, mac80211_hwsim. mac80211_hwsim is Linux-only and the repo's own hwsim workflow (.github/workflows/hwsim.yml) requires a self-hosted runner labelled `hwsim-yes`. No wire-level number is published from this run.", "existing_leg": "tools/run_ap_resource_hwsim_linux.sh (make ap-resource-hwsim)", "existing_leg_scale": "ONE association, accept + reject. artifacts/native/ap_resource_hwsim_ci.json records policy.active_sessions=0, admitted=1 -- not a flood.", "missing": [ "linux", "hostapd", "wpa_supplicant", "modprobe", "mac80211_hwsim" ], "repro_when_unblocked": "on a Linux host with mac80211_hwsim: sudo modprobe mac80211_hwsim radios=2 && make ap-resource-hwsim, extended to open N sessions against lib/wifipqc/ap_admission.ApAdmissionControl", "requirements": { "hostapd": false, "linux": false, "mac80211_hwsim": false, "modprobe": false, "wpa_supplicant": false }, "status": "BLOCKED", "what_it_would_add": "the same N-session flood driven through real hostapd + wpa_supplicant over mac80211_hwsim, so the AP-wide bound is observed on frames rather than on the Python reference path" } }