{ "ablation_matrix_min_cap": { "dyncap": { "nec_cpu": 95, "nec_dist": 80, "nec_mem": 112, "nec_rate": 86, "nec_retx": 88 }, "dyncap_no_cpu": { "nec_cpu": 128, "nec_dist": 80, "nec_mem": 113, "nec_rate": 86, "nec_retx": 88 }, "dyncap_no_dist": { "nec_cpu": 95, "nec_dist": 113, "nec_mem": 112, "nec_rate": 86, "nec_retx": 88 }, "dyncap_no_mem": { "nec_cpu": 93, "nec_dist": 80, "nec_mem": 128, "nec_rate": 86, "nec_retx": 88 }, "dyncap_no_rate": { "nec_cpu": 93, "nec_dist": 84, "nec_mem": 113, "nec_rate": 104, "nec_retx": 88 }, "dyncap_no_retx": { "nec_cpu": 95, "nec_dist": 80, "nec_mem": 112, "nec_rate": 86, "nec_retx": 128 } }, "ablation_matrix_tolerances": { "diag_min": 10, "off_max_reported_not_gated": 8 }, "ablation_runs": { "dyncap_no_fairness/flood": { "attempts": [ { "admits": 1948, "conforming_unexcused": 20, "manifested": true, "max_starve_ns": 527983000, "starvation_unexcused": 500 } ], "build": "dyncap_no_fairness", "manifested": true, "scenario": "flood" } }, "checks": [ { "detail": "every binary was DELETED before build.sh ran, so this counts what this run produced rather than what a previous one left behind. build.sh exited 0; 13/13 binaries present (the engine plus twelve -D ablations), missing=[]. One source, twelve flags: an ablation that is a separate file is an ablation of a different program", "name": "builds-present", "ok": true }, { "detail": "shipped flood: live=True, arena_mapped=True, port=63641, 9 forked sender pids (receiver 86018 not among them), wall=1600847000 ns, cpu=79305000 ns from getrusage. Foil: live=False, port=0, senders=[]. BOTH halves are required: 'this run is live' is only a claim if the thing it denies is built and reports otherwise", "name": "live-not-simulated", "ok": true }, { "detail": "`dyncap --prove-guard` writes one byte past the 65536-byte arena and the process is killed by signal 10 (returncode -10). The foil exits 4: it has no mapping, so it cannot be killed for exceeding a ceiling it does not have", "name": "arena-guard", "ok": true }, { "detail": "ONE bug, two arenas. `dyncap_off_by_one --scenario fill` (real mmap) was killed by signal 10 on attempt 1, with the engine's own guard-page marker on stderr, so the death is attributable to the arena ceiling. `dyncap_sim_off_by_one` (the same weakening, arena as a size_t) exits 0 and runs to completion with peak_resident=66048 B against a 65536 B arena and peak_live=129 against 128 slots. STATED AT ITS REAL STRENGTH: the simulator's own numbers do exceed the arena, so a reader checking that field catches it too. What the mapping buys is that nobody has to have written the check", "name": "off-by-one-fatal-on-real-bytes-only", "ok": true }, { "detail": "(M1) over 7 scenarios: 0 admissions crossed the cap in force ({'flood': 0, 'nec_rate': 0, 'nec_dist': 0, 'nec_cpu': 0, 'nec_retx': 0, 'nec_mem': 0, 'fill': 0}); peak resident 65536 B of 65536, peak live 128 of 128 slots. The last equality is the anti-vacuity: a bound nothing ever reaches is not a bound that was tested", "name": "memory-bound", "ok": true }, { "detail": "shipped: 0 allocations preceded their own decision across all 7 scenarios. -DDYNCAP_ALLOC_BEFORE_ADMIT: 1120 on nec_retx, AND under --scenario fill it was killed by signal 10 on attempt 1, with the engine's own guard-page marker on stderr, so the death is attributable to the arena ceiling. THE SECOND HALF IS THE ONE WORTH READING and it was not designed in -- the build kept dying during this gate's own bring-up. Allocating before deciding does not merely mis-order an audit log: at saturation it takes the slot after the last one, which is the guard page. The interlock is load-bearing for the memory bound, not just for the ordering claim, and that is measured rather than argued. THAT THE BROKEN BUILD STILL BREAKS IS ITSELF A GATE -- if it ever stops driving the counter or stops faulting, the zeros above it mean nothing", "name": "ordering", "ok": true }, { "detail": "(M2) shipped: 0 refusals of a source below its reservation OUTSIDE the window a cap decrease opens; 62 inside it, and the longest any source waited was 120261000 ns against a derived bound of 300000000 ns (R_MAX=12 epochs of descent, each opening a 60000000 ns window). -DDYNCAP_NO_FAIRNESS: 500 unexcused and a longest wait of 527983000 ns, past the bound. The 62 is required to be NON-zero: the transient is real, and a gate that hid it would be checking a stronger claim than this engine makes", "name": "no-starvation", "ok": true }, { "detail": "(M3) two conforming senders run straight through a flood two orders of magnitude larger. Shipped: 76 admitted, 4 refused, of which 0 outside the post-decrease window. -DDYNCAP_NO_FAIRNESS: 20 unexcused. conforming_admits > 0 is the anti-vacuity -- a sender that never ran would also be refused zero times", "name": "bounded-false-rejection", "ok": true }, { "detail": "(M4) the flood ends at epoch 44 and the cap is back at 128 12 epochs later, against a proved bound of R_MAX=12. -DDYNCAP_RATCHET_ONLY: recovery_epochs=-1 (never) and max_cap_rise=0 -- the cap it dropped to is the cap it keeps. An adaptive limiter that only tightens is a permanent self-inflicted DoS and this is that, measured", "name": "recovery", "ok": true }, { "detail": "(M5) shipped: largest single-epoch drop 8 and rise 8 against CAP_STEP=8. -DDYNCAP_NO_SMOOTHING: drop 96 in one epoch -- and its recovery is still 12 epochs, inside R_MAX. THAT is why (M5) is a separate check from (M4): this build breaks one and not the other, so a gate with only a recovery check would call it clean", "name": "descent-rate-limited", "ok": true }, { "detail": "for each signal, the number of epochs in which zeroing THAT term of the price list -- and nothing else, on the same measured inputs -- moves the synthesised cap target: {'rate': 89, 'dist': 65, 'cpu': 35, 'retx': 65, 'mem': 28}. Signals that never mattered: []. These are in-engine counterfactuals, so there is no jitter and no feedback in them: a re-run of an ablated binary answers a different question because the ablated cap admits differently, which changes the memory and cpu the next epoch measures", "name": "five-signals-load-bearing", "ok": true }, { "detail": "all 20 ordered pairs of signals have at least one epoch where the first moves the cap target and the second does not; pairs with no such epoch: []. Five ablations that each change something would ALSO be produced by one mechanism wearing five hats, and this repo has shipped that defect before (F4-02's gate 4)", "name": "signals-not-one-mechanism", "ok": true }, { "detail": "the 5x5 re-run matrix on the trough of the cap. GATED: the diagonal -- removing signal S in scenario nec_S must raise the trough by at least 10 -- {'nec_rate': 18, 'nec_dist': 33, 'nec_cpu': 33, 'nec_retx': 40, 'nec_mem': 16}. REPORTED BUT NOT GATED: off-diagonal cells outside +-8, none.\nTHE OFF-DIAGONAL IS NOT A CONSTRAINT AND AN EARLIER REVISION OF THIS CHECK WRONGLY MADE IT ONE. This is a closed loop: an ablated cap admits differently, which changes the occupancy and cpu the next epoch measures, which moves the trough -- so an off-diagonal cell measures FEEDBACK, not mechanism overlap. The band was set from three quiet trials that happened to stay inside +-7, and the first run after it was written produced dyncap_no_rate@nec_retx at -16: removing the rate term left the cap higher, which admitted more, which drove the memory term instead. Nothing was wrong with the engine. The claim that the five signals are FIVE is carried by `signals-not-one-mechanism`, which is exact because it holds the inputs fixed; what this matrix adds is end-to-end evidence that each ablation is a real program whose removal changes real behaviour in the scenario built to drive it, and that is the diagonal alone", "name": "ablation-matrix-diagonal", "ok": true }, { "detail": "`lean DynCapGuarantees.lean` exited 0. Kernel axiom trace over 9 theorems: sorryAx present: False; theorems with no trace line (missing from the file): none; constants disagreeing with dyncap.c (lean, c): none. (M1) admission_preserves_arena, (M2) no_starvation, (M3) conforming_never_refused, (M4) recovery, (M5) descent_bounded, and the foil ratchet_never_recovers. The soundness question is put to the KERNEL rather than to a regex over the source -- this check's first draft grepped for the word `sorry` and went red on the sentence in the Lean file's own header saying there is none. A proof about different constants than the program uses is a proof about a different program, which is why the constants are re-derived here rather than trusted", "name": "lean-guarantees", "ok": true }, { "detail": "24 constants re-read from the running binary's own JSON and compared against the #defines in dyncap.c; disagreements (runtime, source): none. The report quotes the runtime values, so this is what stops a published figure describing a build nobody has", "name": "constants-agree", "ok": true }, { "detail": "sha256 of the declared price list block = b14eccb14047df2d25dd12621f09fbf18c99f693d228fc57ad9fd06690bea341. The weights and thresholds are a receiver's declared figures, not measurements, and changing one is a change to the published policy", "name": "policy-digest", "ok": true }, { "detail": "every scenario produced both admissions and refusals; refusal reasons exercised: ['over_cap', 'shared_full']; each nec_S scenario drove signal S above nominal in [35, 35, 35, 35, 22] epochs respectively. Problems: none", "name": "corpus-not-vacuous", "ok": true }, { "detail": "THE SIMULATOR PASSES. -DDYNCAP_SIM_COUNTER reports starvation_unexcused=0, admit_over_cap_events=0, recovery_epochs=12 -- the same four guarantees, green, from a program with no socket, no forked senders and no mapping. This check REQUIRES that, because it is the item's whole point: a simulator cannot falsify a bound, it can only restate it, and any reading of the four green guarantees above that does not account for this is reading a number the foil produces too", "name": "the-foil-reports-success", "ok": true }, { "detail": "0 variant run(s) failed to produce a result after three attempts each: none. Without this check a run that never started contributes a zero, and zero is the PASSING value for half the counters above -- 'the broken build reported 0 violations' would read as a fixed interlock rather than as a measurement that did not happen", "name": "every-measurement-happened", "ok": true } ], "engine": "dyncap", "failures": [], "item": "F4-05", "lean_rc": 0, "measurements_are_not_reproducible": "This engine runs real processes over a real socket. Arrival counts, cpu shares and cap troughs move between runs and the fields below are a record of ONE run, not a pinned expectation. No check in this gate compares a measured value against a stored one.", "n_checks": 19, "n_passed": 19, "not_a_gate": { "bounded-false-rejection / conforming_unexcused == 0": "ENTAILED, not independent. conforming_unexcused is a sub-sum of starvation_unexcused over the conforming sources, and `no-starvation` already requires starvation_unexcused == 0 on all seven scenarios. The independent content of this check is the -DDYNCAP_NO_FAIRNESS half and `conforming_admits > 0`. This is a sharper statement than the shared_mechanism note below: not merely the same mechanism, the same arithmetic.", "descent-rate-limited / max_cap_drop and max_cap_rise <= CAP_STEP in the shipped build": "tautological. synth_cap computes next as g_cap +/- CAP_STEP_SLOTS clamped toward the target, so neither can exceed CAP_STEP by construction. The falsifiable content is the -DDYNCAP_NO_SMOOTHING half, which reports a 96-slot drop while its recovery stays inside R_MAX.", "memory-bound / admit_over_cap_events == 0": "tautological in the shipped build. `admit_decide` requires live < cap, the code then does live++ and asks whether live > cap: if live < cap then live+1 <= cap. It is `if (x < c) { x++; if (x > c) }`. The counter is real evidence about -DDYNCAP_OFF_BY_ONE, which drives it off zero; it is not evidence about the shipped build. The falsifiable content of this check is `peak_resident == ARENA_CAP`.", "ordering / ordering_violations == 0 in the shipped build": "tautological. The shipped path is dec_seq = g_seq++ then alloc_seq = g_seq++ then `alloc_seq < dec_seq`, and g_seq is monotone. The falsifiable content is the -DDYNCAP_ALLOC_BEFORE_ADMIT half: a non-zero count AND the guard-page fault at saturation.", "signals-not-one-mechanism": "discharged by the CORPUS rather than by the controller. cap_target_wo is computed from five independent array entries, so a separating epoch for the pair (a,b) exists exactly when some epoch has u_a > 0 and u_b == 0 -- which `corpus-not-vacuous` already guarantees by requiring each nec_S scenario to drive S alone. The check is worth keeping because it would catch a future controller that coupled two terms, but on THIS controller it cannot fail while the corpus is non-vacuous, and reading it as independent evidence that the five signals are five would be reading the load, not the design." }, "off_by_one_needs_two_comparisons": "dyncap_off_by_one weakens both the cap test and the shared-pool test. A lone off-by-one in the cap test is UNREACHABLE: live_total can equal the cap only when every source is at or above its reservation, and in that state the shared-pool test refuses first. The fairness mechanism masks a single off-by-one in the memory bound -- good for the design, and the reason this break had to be two characters rather than one.", "overrun_runs": { "dyncap_alloc_first/fill": { "arena_cap": 65536, "attempts": [ { "guard_marker": true, "outcome": "fatal", "peak_resident": null, "returncode": -10, "stderr_tail": "dyncap: GUARD-PAGE-WRITE slot 128 of 128; the 512 bytes below land past the 65536-byte arena" } ], "build": "dyncap_alloc_first", "outcome": "fatal", "scenario": "fill" }, "dyncap_off_by_one/fill": { "arena_cap": 65536, "attempts": [ { "guard_marker": true, "outcome": "fatal", "peak_resident": null, "returncode": -10, "stderr_tail": "dyncap: GUARD-PAGE-WRITE slot 128 of 128; the 512 bytes below land past the 65536-byte arena" } ], "build": "dyncap_off_by_one", "outcome": "fatal", "scenario": "fill" } }, "policy": { "arena_cap": 65536, "cap_base": 128, "cap_floor": 32, "cap_step": 8, "epoch_ns": 20000000, "max_src": 16, "nominal": { "cpu": 120, "dist": 400, "mem": 850, "rate": 2000, "retx": 50 }, "nslots": 128, "r_max": 12, "reserve": 2, "session_bytes": 512, "session_ttl_ns": 60000000, "step": { "cpu": 25, "dist": 60, "mem": 18, "rate": 2000, "retx": 60 }, "u_max": 8, "w": { "cpu": 5, "dist": 6, "mem": 5, "rate": 6, "retx": 5 } }, "policy_digest": "b14eccb14047df2d25dd12621f09fbf18c99f693d228fc57ad9fd06690bea341", "run": { "alloc_first_fill_outcome": "fatal", "alloc_first_fill_returncode": -10, "alloc_first_nec_retx": { "admit_over_cap_events": 0, "admits": 991, "arrivals": 3360, "cap_at_end": 88, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 13975000, "dups": 2240, "epochs": 35, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 0, "max_epoch_r_cap": 10, "max_overcommit": 0, "max_starve_ns": 0, "min_cap": 88, "min_source_admits": 118, "nslots": 128, "ordering_violations": 1120, "overcommit_arrivals": 0, "peak_live": 104, "peak_resident": 53248, "recovery_epochs": -1, "refusals": 129, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 1120, "wall_ns": 701313000 }, "no_fairness_flood": { "admit_over_cap_events": 0, "admits": 1948, "arrivals": 20471, "cap_at_end": 128, "cap_step": 8, "conforming_admits": 49, "conforming_refusals": 31, "conforming_unexcused": 20, "cpu_ns": 74897000, "dups": 11994, "epochs": 80, "flood_end_epoch": 44, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 232, "max_overcommit": 8, "max_starve_ns": 527983000, "min_cap": 32, "min_source_admits": 24, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 1277, "peak_live": 120, "peak_resident": 61440, "recovery_epochs": 12, "refusals": 6529, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 769, "starvation_unexcused": 500, "uniq": 8477, "wall_ns": 1602142000 }, "no_smoothing_flood": { "admit_over_cap_events": 0, "admits": 1809, "arrivals": 20408, "cap_at_end": 128, "cap_step": 8, "conforming_admits": 76, "conforming_refusals": 4, "conforming_unexcused": 0, "cpu_ns": 76003000, "dups": 11952, "epochs": 80, "flood_end_epoch": 44, "max_cap": 128, "max_cap_drop": 96, "max_cap_rise": 8, "max_epoch_r_cap": 237, "max_overcommit": 94, "max_starve_ns": 79593000, "min_cap": 32, "min_source_admits": 38, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 501, "peak_live": 126, "peak_resident": 64512, "recovery_epochs": 12, "refusals": 6647, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 8, "starvation_unexcused": 0, "uniq": 8456, "wall_ns": 1601058000 }, "off_by_one_fill_outcome": "fatal", "off_by_one_fill_returncode": -10, "prove_guard_returncode": -10, "prove_guard_sim_returncode": 4, "ratchet_only_flood": { "admit_over_cap_events": 0, "admits": 1253, "arrivals": 20459, "cap_at_end": 32, "cap_step": 8, "conforming_admits": 78, "conforming_refusals": 2, "conforming_unexcused": 0, "cpu_ns": 78124000, "dups": 11986, "epochs": 80, "flood_end_epoch": 44, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 0, "max_epoch_r_cap": 232, "max_overcommit": 9, "max_starve_ns": 40541000, "min_cap": 32, "min_source_admits": 39, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 1237, "peak_live": 120, "peak_resident": 61440, "recovery_epochs": -1, "refusals": 7220, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 22, "starvation_unexcused": 0, "uniq": 8473, "wall_ns": 1602130000 }, "shipped": { "fill": { "admit_over_cap_events": 0, "admits": 792, "arrivals": 15795, "cap_at_end": 80, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 60778000, "dups": 0, "epochs": 25, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 0, "max_epoch_r_cap": 640, "max_overcommit": 24, "max_starve_ns": 0, "min_cap": 80, "min_source_admits": 93, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 2605, "peak_live": 128, "peak_resident": 65536, "recovery_epochs": -1, "refusals": 15003, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 15795, "wall_ns": 501027000 }, "flood": { "admit_over_cap_events": 0, "admits": 1936, "arrivals": 20480, "cap_at_end": 128, "cap_step": 8, "conforming_admits": 76, "conforming_refusals": 4, "conforming_unexcused": 0, "cpu_ns": 79305000, "dups": 12000, "epochs": 80, "flood_end_epoch": 44, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 231, "max_overcommit": 7, "max_starve_ns": 40694000, "min_cap": 32, "min_source_admits": 37, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 1064, "peak_live": 122, "peak_resident": 62464, "recovery_epochs": 12, "refusals": 6544, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 23, "starvation_unexcused": 0, "uniq": 8480, "wall_ns": 1600847000 }, "nec_cpu": { "admit_over_cap_events": 0, "admits": 1133, "arrivals": 1224, "cap_at_end": 98, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 193444000, "dups": 0, "epochs": 35, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 12, "max_overcommit": 6, "max_starve_ns": 0, "min_cap": 95, "min_source_admits": 137, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 42, "peak_live": 109, "peak_resident": 55808, "recovery_epochs": -1, "refusals": 91, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 1224, "wall_ns": 701032000 }, "nec_dist": { "admit_over_cap_events": 0, "admits": 929, "arrivals": 1330, "cap_at_end": 80, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 16086000, "dups": 0, "epochs": 35, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 19, "max_overcommit": 2, "max_starve_ns": 120261000, "min_cap": 80, "min_source_admits": 12, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 12, "peak_live": 112, "peak_resident": 57344, "recovery_epochs": -1, "refusals": 401, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 39, "starvation_unexcused": 0, "uniq": 1330, "wall_ns": 700000000 }, "nec_mem": { "admit_over_cap_events": 0, "admits": 1264, "arrivals": 1303, "cap_at_end": 128, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 11118000, "dups": 0, "epochs": 34, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 6, "max_overcommit": 3, "max_starve_ns": 0, "min_cap": 113, "min_source_admits": 156, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 2, "peak_live": 128, "peak_resident": 65536, "recovery_epochs": -1, "refusals": 39, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 1303, "wall_ns": 708175000 }, "nec_rate": { "admit_over_cap_events": 0, "admits": 1146, "arrivals": 11197, "cap_at_end": 92, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 40112000, "dups": 0, "epochs": 35, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 6, "max_epoch_r_cap": 320, "max_overcommit": 16, "max_starve_ns": 0, "min_cap": 86, "min_source_admits": 134, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 1400, "peak_live": 128, "peak_resident": 65536, "recovery_epochs": -1, "refusals": 10051, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 11197, "wall_ns": 700012000 }, "nec_retx": { "admit_over_cap_events": 0, "admits": 995, "arrivals": 3360, "cap_at_end": 88, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 13532000, "dups": 2240, "epochs": 35, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 0, "max_epoch_r_cap": 10, "max_overcommit": 3, "max_starve_ns": 0, "min_cap": 88, "min_source_admits": 120, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 4, "peak_live": 103, "peak_resident": 52736, "recovery_epochs": -1, "refusals": 125, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 1120, "wall_ns": 700016000 } }, "sim_counter_flood": { "admit_over_cap_events": 0, "admits": 1958, "arrivals": 20480, "cap_at_end": 128, "cap_step": 8, "conforming_admits": 70, "conforming_refusals": 10, "conforming_unexcused": 0, "cpu_ns": 0, "dups": 12000, "epochs": 81, "flood_end_epoch": 44, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 8, "max_epoch_r_cap": 232, "max_overcommit": 8, "max_starve_ns": 160000000, "min_cap": 32, "min_source_admits": 35, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 922, "peak_live": 126, "peak_resident": 64512, "recovery_epochs": 12, "refusals": 6522, "session_ttl_ns": 60000000, "sources_observed": 9, "starvation_events": 10, "starvation_unexcused": 0, "uniq": 8480, "wall_ns": 1600000000 }, "sim_off_by_one_fill": { "admit_over_cap_events": 673, "admits": 801, "arrivals": 16000, "cap_at_end": 88, "cap_step": 8, "conforming_admits": 0, "conforming_refusals": 0, "conforming_unexcused": 0, "cpu_ns": 0, "dups": 0, "epochs": 26, "flood_end_epoch": -1, "max_cap": 128, "max_cap_drop": 8, "max_cap_rise": 0, "max_epoch_r_cap": 640, "max_overcommit": 25, "max_starve_ns": 0, "min_cap": 80, "min_source_admits": 99, "nslots": 128, "ordering_violations": 0, "overcommit_arrivals": 15199, "peak_live": 129, "peak_resident": 66048, "recovery_epochs": -1, "refusals": 15199, "session_ttl_ns": 60000000, "sources_observed": 8, "starvation_events": 0, "starvation_unexcused": 0, "uniq": 16000, "wall_ns": 500000000 } }, "run_errors": [], "shared_mechanism": { "guarantees": [ "no-starvation", "bounded-false-rejection" ], "why": "(M2) and (M3) are two consequences of one per-source reservation and one ablation (-DDYNCAP_NO_FAIRNESS) removes both. They are reported as two checks because the definition-of-done names them separately, NOT because they are independently falsifiable. Reading two greens here as two mechanisms is the mistake this key exists to prevent." }, "signal_necessity": { "epochs_moved": { "cpu": 35, "dist": 65, "mem": 28, "rate": 89, "retx": 65 }, "pairs_without_separation": [], "per_scenario": { "fill": { "cpu": 0, "dist": 0, "mem": 3, "rate": 25, "retx": 0 }, "flood": { "cpu": 0, "dist": 30, "mem": 0, "rate": 29, "retx": 30 }, "nec_cpu": { "cpu": 35, "dist": 0, "mem": 0, "rate": 0, "retx": 0 }, "nec_dist": { "cpu": 0, "dist": 35, "mem": 0, "rate": 0, "retx": 0 }, "nec_mem": { "cpu": 0, "dist": 0, "mem": 22, "rate": 0, "retx": 0 }, "nec_rate": { "cpu": 0, "dist": 0, "mem": 3, "rate": 35, "retx": 0 }, "nec_retx": { "cpu": 0, "dist": 0, "mem": 0, "rate": 0, "retx": 35 } } }, "status": "PASS" }