{ "ap_budget_bytes": 65536, "arms": { "naive": { "max_retained_bytes": 78643200, "retained_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 19200.0 }, "rows": [ { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 22138, "refused": 0, "retained_bytes": 19200, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 87180, "refused": 0, "retained_bytes": 76800, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 16, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 347220, "refused": 0, "retained_bytes": 307200, "rss_peak_delta_bytes": 0 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 64, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 1387380, "refused": 0, "retained_bytes": 1228800, "rss_peak_delta_bytes": 1196032 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 256, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 5548116, "refused": 0, "retained_bytes": 4915200, "rss_peak_delta_bytes": 5062656 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1024, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 22191220, "refused": 0, "retained_bytes": 19660800, "rss_peak_delta_bytes": 20414464 }, { "arm": "naive", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4096, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 88761076, "refused": 0, "retained_bytes": 78643200, "rss_peak_delta_bytes": 81543168 } ], "rss_law": { "intercept": -94572.18262958899, "n": 7, "r2": 0.9999873527750995, "slope": 19937.433671197057 } }, "per_session": { "max_retained_bytes": 66060288, "retained_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 16128.000000000002 }, "rows": [ { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 34456, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 16384 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 86345, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 32768 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 16, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 292717, "refused": 0, "retained_bytes": 258048, "rss_peak_delta_bytes": 262144 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 64, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 1117069, "refused": 0, "retained_bytes": 1032192, "rss_peak_delta_bytes": 1064960 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 256, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 4417069, "refused": 0, "retained_bytes": 4128768, "rss_peak_delta_bytes": 4227072 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1024, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 17617229, "refused": 0, "retained_bytes": 16515072, "rss_peak_delta_bytes": 16941056 }, { "arm": "per_session", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4096, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 70415309, "refused": 0, "retained_bytes": 66060288, "rss_peak_delta_bytes": 70074368 } ], "rss_law": { "intercept": -115301.0641949866, "n": 7, "r2": 0.9999333865592555, "slope": 17107.82996692271 } }, "quota": { "max_retained_bytes": 64512, "retained_law": { "intercept": 55443.114315139035, "n": 7, "r2": 0.05194157390925358, "slope": 2.7647316963975053 }, "rows": [ { "ap": { "admitted": 1, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 1, "n_max": 4, "peak_reserved_bytes": 16384, "peak_resident_bytes": 16128, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 19793, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 73462, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 12 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 73166, "refused": 12, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 60 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72870, "refused": 60, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 252 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72638, "refused": 252, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 1020 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72486, "refused": 1020, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 4092 }, "arm": "quota", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72334, "refused": 4092, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 } ], "rss_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 0.0 }, "saturated_law": { "intercept": 64512.0, "n": 6, "r2": 1.0, "slope": 0.0 } }, "quota_bytes": { "max_retained_bytes": 64512, "retained_law": { "intercept": 55443.114315139035, "n": 7, "r2": 0.05194157390925358, "slope": 2.7647316963975053 }, "rows": [ { "ap": { "admitted": 1, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 1, "n_max": 8, "peak_reserved_bytes": 16384, "peak_resident_bytes": 16128, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 1, "n_fragments_per_session": 50, "n_sessions": 1, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 19761, "refused": 0, "retained_bytes": 16128, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 0 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72874, "refused": 0, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 12 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 16, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72722, "refused": 12, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 60 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 64, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72570, "refused": 60, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 252 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 256, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72482, "refused": 252, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 1020 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 1024, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72510, "refused": 1020, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 8, "peak_reserved_bytes": 65536, "peak_resident_bytes": 64512, "per_session_cap_bytes": 16384, "refused": 4092 }, "arm": "quota_bytes", "frag_mtu": 384, "global_budget_bytes": 65536, "live_sessions": 4, "n_fragments_per_session": 50, "n_sessions": 4096, "per_session_cap_bytes": 16384, "python_heap_peak_bytes": 72502, "refused": 4092, "retained_bytes": 64512, "rss_peak_delta_bytes": 0 } ], "rss_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 0.0 } } }, "called_by": "lib/wifipqc/statemachine.py (Handshake.ap_admission, consulted before a reassembly context is allocated) via lib/wifipqc/incremental_auth.simulate_flood_ap -- wired 2026-09-09; before that date no envelope module imported it", "check": "ap_quota", "checks": { "ablation_overruns": { "ablated_peak_bytes": 16515072, "ap_budget_bytes": 65536, "guarded_peak_bytes": 64512, "ok": true, "what": "a caller that BYPASSES the admission decision and allocates anyway overruns the budget, while the guarded path does not. This isolates ADMISSION-PRECEDES-ALLOCATION specifically; the byte-level reservation interlock is isolated separately by `reservation_interlock_binds` below." }, "bytes_arm_ablation_overruns": { "ablated_peak_bytes": 1032192, "ap_budget_bytes": 65536, "ok": true, "what": "the byte-accounted policy with its interlock removed and admission bypassed overruns the budget (the control that makes the next check a measurement)" }, "bytes_arm_admits_more_at_half_fill": { "admitted_quota": 4, "admitted_quota_bytes": 8, "fill_bytes_per_session": 8192, "ninth_refused": true, "ok": true, "resident_quota_bytes": 65536, "resident_quota_bytes_bytes_arm": 65536, "rmin_bytes": 7533, "what": "on the half-fill schedule (8 sessions x 8192 B) the whole-window rule seats G/CAP sessions, the byte-accounted rule seats G/RMIN with the budget attained, and a ninth open is refused" }, "bytes_arm_bounded_on_the_flood": { "ap_budget_bytes": 65536, "live_at_max_n": 4, "max_retained_bytes": 64512, "ok": true, "refused_at_max_n": 4092, "what": "under the overfill flood the byte-accounted arm never retains more than the budget", "whole_sweep_slope_bytes_per_session": 2.7647316963975053 }, "bytes_arm_matches_lean": { "engine_half_fill_admitted": 8, "engine_n_max": 8, "lean_n_max_bytes_canonical": 8, "ok": true, "what": "the engine's admitted count on the half-fill schedule equals the number Lean evaluated for ApBoundBytes (lean_ap_bytes_ci.json)" }, "envelope_calls_the_quota": { "ap_budget_bytes": 65536, "every_n_under_budget": true, "expected_refusal_reason_substring": "ap_quota_exhausted", "first_refusal_at_session": 5, "live_sessions_by_n": { "1": 1, "4": 4, "16": 4, "64": 4, "170": 4, "171": 4, "256": 4 }, "max_retained_bytes": 1536, "n_max": 4, "ok": true, "refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "refused_by_n": { "1": 0, "4": 0, "16": 12, "64": 60, "170": 166, "171": 167, "256": 252 }, "what": "the SHIPPED envelope now consults lib/wifipqc/ap_admission.ApAdmissionControl before it allocates a reassembly context: session n_max+1 at one AP is REFUSED with `ap_quota_exhausted` and retains ZERO bytes, live contexts never exceed n_max, and the AP-wide sum stays under the budget at every N. Same sweep, same adversary, same design as the arm above; the only difference is that the AP has a quota." }, "envelope_without_quota_is_unbounded_in_n": { "ap_budget_bytes": 65536, "exceeds_ap_budget_by": 32768, "first_n_over_budget": 171, "max_retained_bytes": 98304, "ok": true, "r2": 1.0, "refusals": 0, "slope_bytes_per_session": 384.0, "what": "THE NEGATIVE CONTROL FOR THE ENVELOPE ARM. Every session is individually bounded by mechanism O and the AP-WIDE SUM is still linear in N, because nothing in the shipped envelope could refuse on AP-wide grounds. This is Lean's ap_unbounded_without_quota measured on the program a buyer downloads, not on a re-enactment of it. It must PASS for the wiring below to be worth anything." }, "n_max_enforced": { "derivation": "65536 // 16384", "n_max": 4, "ok": true, "refused": 3, "seated": [ true, true, true, true, false, false, false ], "what": "N_MAX_AP was a MODELED parameter at tools/check_reassembly_floor.py:83 ('modeled worst-case concurrent reassembly contexts'); it is now enforced and proven (WifiPQC.Ap.n_max_is_enforced)" }, "naive_grows_with_n": { "max_retained_bytes": 78643200, "ok": true, "r2": 1.0, "slope_bytes_per_session": 19200.0, "what": "reassemble-then-verify retains every offered byte, linearly in N" }, "per_session_cap_alone_is_unbounded_in_n": { "ap_budget_bytes": 65536, "exceeds_ap_budget_by": 65994752, "max_retained_bytes": 66060288, "ok": true, "r2": 1.0, "slope_bytes_per_session": 16128.000000000002, "what": "the SHIPPED pre-2026-08-18 mechanism O: every session individually bounded at the per-session cap, and the AP-wide SUM still linear in N. This check must PASS for the quota to be necessary; it is the machine-measured form of Lean's ap_unbounded_without_quota." }, "proof_code_constants_agree": { "code": { "CAP_S": 16384, "G": 65536, "N_MAX": 4 }, "lean": { "CAP_S": 16384, "G": 65536, "N_MAX": 4 }, "note": "ok", "ok": true, "what": "the bound proven in Lean and the bound enforced in code are about the same numbers -- a proof about different numbers is a proof about a different program" }, "quota_bounds_the_sum": { "ap_budget_bytes": 65536, "every_n_under_budget": true, "max_retained_bytes": 64512, "n_max_reached": 4, "n_points_saturated": 6, "ok": true, "saturated_from_n": 4, "saturated_slope_bytes_per_session": 0.0, "what": "retained <= the AP budget at EVERY N over 1..4096, and exactly flat once the quota saturates at n_max", "whole_sweep_slope_bytes_per_session": 2.7647316963975053 }, "reservation_interlock_binds": { "accepted_with_interlock": 4096, "accepted_without_interlock": 16384, "ok": true, "per_session_cap_bytes": 16384, "refusal_reason": "ap_quota_exhausted (over reservation)", "reservation_bytes": 4096, "what": "a session cannot retain more than its RESERVATION even when the per-session cap would allow more; with the interlock removed and nothing else changed, it runs past the reservation to the cap" } }, "does_not_prove": [ "that a production hostapd enforces this quota (it does not; this is the reference path)", "any wire-level or over-the-air result -- see `wire_level_leg`, which is BLOCKED on a non-Linux host and reports exactly what is missing", "that 65536 is the right budget for a particular deployment -- N_max is DERIVED from the budget and the window, and different parameters give a different N_max", "that an AP with NO ApAdmissionControl is bounded -- it is not, and `envelope_without_quota_is_unbounded_in_n` measures exactly that. The envelope can call the quota and does when the AP has one; it does not manufacture an AP-wide budget out of a single session" ], "enforced_by": "lib/wifipqc/ap_admission.py", "envelope": { "arms": { "envelope_no_quota": { "first_n_over_budget": 171, "max_retained_bytes": 98304, "retained_law": { "intercept": 0.0, "n": 7, "r2": 1.0, "slope": 384.0 }, "rows": [ { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 1, "n_sessions": 1, "refused": 0, "retained_bytes": 384 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 4, "n_sessions": 4, "refused": 0, "retained_bytes": 1536 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 16, "n_sessions": 16, "refused": 0, "retained_bytes": 6144 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 64, "n_sessions": 64, "refused": 0, "retained_bytes": 24576 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 170, "n_sessions": 170, "refused": 0, "retained_bytes": 65280 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 171, "n_sessions": 171, "refused": 0, "retained_bytes": 65664 }, { "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 256, "n_sessions": 256, "refused": 0, "retained_bytes": 98304 } ] }, "envelope_quota": { "first_n_over_budget": null, "max_retained_bytes": 1536, "retained_law": { "intercept": 1195.730963501686, "n": 7, "r2": 0.17610819159643631, "slope": 1.8033478819475046 }, "rows": [ { "ap": { "admitted": 1, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 1, "n_max": 4, "peak_reserved_bytes": 16384, "peak_resident_bytes": 384, "per_session_cap_bytes": 16384, "refused": 0 }, "ap_resident_bytes": 384, "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 1, "n_sessions": 1, "refused": 0, "retained_bytes": 384 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 0 }, "ap_resident_bytes": 1536, "first_refusal_at_session": null, "first_refusal_reason": "", "live_sessions": 4, "n_sessions": 4, "refused": 0, "retained_bytes": 1536 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 12 }, "ap_resident_bytes": 1536, "first_refusal_at_session": 5, "first_refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "live_sessions": 4, "n_sessions": 16, "refused": 12, "retained_bytes": 1536 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 60 }, "ap_resident_bytes": 1536, "first_refusal_at_session": 5, "first_refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "live_sessions": 4, "n_sessions": 64, "refused": 60, "retained_bytes": 1536 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 166 }, "ap_resident_bytes": 1536, "first_refusal_at_session": 5, "first_refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "live_sessions": 4, "n_sessions": 170, "refused": 166, "retained_bytes": 1536 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 167 }, "ap_resident_bytes": 1536, "first_refusal_at_session": 5, "first_refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "live_sessions": 4, "n_sessions": 171, "refused": 167, "retained_bytes": 1536 }, { "ap": { "admitted": 4, "global_budget_bytes": 65536, "interlock_enforced": true, "live_sessions": 4, "n_max": 4, "peak_reserved_bytes": 65536, "peak_resident_bytes": 1536, "per_session_cap_bytes": 16384, "refused": 252 }, "ap_resident_bytes": 1536, "first_refusal_at_session": 5, "first_refusal_reason": "ap_quota_exhausted: 4 live x 16384 B reserved would exceed the 65536 B AP budget (n_max=4)", "live_sessions": 4, "n_sessions": 256, "refused": 252, "retained_bytes": 1536 } ] } }, "design": "naive_pqc_sae", "import_error": null, "n_sweep": [ 1, 4, 16, 64, 170, 171, 256 ] }, "failed_checks": [], "honest_scope": "MEASURED on the Python reference path (lib/wifipqc/incremental_auth.py), the same path the estate's other mechanism-O evidence uses, with every session held live simultaneously. NOT in-daemon hostapd enforcement and NOT real 802.11 frames: no packet crosses a radio here. The wire-level leg is tools/run_ap_resource_hwsim_linux.sh, which drives ONE association, not a flood, and is Linux-only. `retained_bytes` is exact (measured from the buffers); `rss_peak_delta_bytes` is quantised to the page size and is reported for honesty, not used as a threshold. The `envelope_*` arms drive the SHIPPED envelope (designs.build -> statemachine.Handshake.run, mechanism O on) rather than a re-enactment of it; the budget belongs to the AP and this engine has no AP object, so the control is supplied by whatever owns the AP and every session at one AP shares one control.", "host": { "platform": "macOS-26.6-arm64-arm-64bit", "python": "3.11.14" }, "n_max": 4, "n_sweep": [ 1, 4, 16, 64, 256, 1024, 4096 ], "ok": true, "per_session_cap_bytes": 16384, "proven_by": "06_formal_models/lean/ApBound.lean (make lean-proof)", "wire_level_leg": { "blocked_because": "this host is Darwin; missing: linux, hostapd, wpa_supplicant, modprobe, mac80211_hwsim. mac80211_hwsim is Linux-only and the repo's own hwsim workflow (.github/workflows/hwsim.yml) requires a self-hosted runner labelled `hwsim-yes`. No wire-level number is published from this run.", "existing_leg": "tools/run_ap_resource_hwsim_linux.sh (make ap-resource-hwsim)", "existing_leg_scale": "ONE association, accept + reject. artifacts/native/ap_resource_hwsim_ci.json records policy.active_sessions=0, admitted=1 -- not a flood.", "missing": [ "linux", "hostapd", "wpa_supplicant", "modprobe", "mac80211_hwsim" ], "repro_when_unblocked": "on a Linux host with mac80211_hwsim: sudo modprobe mac80211_hwsim radios=2 && make ap-resource-hwsim, extended to open N sessions against lib/wifipqc/ap_admission.ApAdmissionControl", "requirements": { "hostapd": false, "linux": false, "mac80211_hwsim": false, "modprobe": false, "wpa_supplicant": false }, "status": "BLOCKED", "what_it_would_add": "the same N-session flood driven through real hostapd + wpa_supplicant over mac80211_hwsim, so the AP-wide bound is observed on frames rather than on the Python reference path" } }