output: correct window counts, grade the readout, fix the progress bar

Window candidate counts read the closed [lo, hi] range as half-open, so a
count never reconciled with the edges printed beside it, a pin reported
zero candidates, and vslot_valid rejected a base sitting exactly on
virt_kaslr_text_max -- the value the readout prints as the likely answer.
Count both edges.

The readout grades what it reports: "narrowed" replaces "not derandomized"
above rows that do show narrowing, every window row states its grade rather
than only those a likely row contrasts, and residual entropy is stated
against what the KASLR window started with (~5 of 9 bits), in json and
markdown too. Leak rows disclose interior-only groups and their
contributing components.

The progress bar owns its terminal line: diagnostics erase and repaint it
instead of concatenating onto it, both perror paths gain the missing quiet
gate, and the bar is erased on the stream it was drawn on rather than
walked off by newlines on stdout. Killed components are reported in the
readout, not only in narration the bar scrolls past.

Author: bcoles

README.md

@@ -75,7 +75,7 @@ The default text mode prints an answer-first overview:
 KASLD 0.3.1-dev  --  Kernel ASLR derandomization
 Target: x86_64 / 6.15.6
 
-Running 94 components (3 experimental skipped; use -x to enable)...
+Running 94 of 97 components (3 experimental skipped; use -x to enable)...
 [####################] 100%  94/94  13.9s
 
   Virtual image base  0xffffffff8fe00000   slide +0xee00000

docs/architecture.md

@@ -98,8 +98,8 @@ raise the floor (DRAM bounds) and the 2 MiB `IMAGE_ALIGN` slot grid is applied.
 With only this one leak the result is still a window — several slots wide:
 
 ```
-  Virtual image base   not derandomized     ~3 bits
-                       0xffffffff81000000 - 0xffffffff81f41000   (7 x 2.0 MiB)
+  Virtual image base   narrowed             ~3 of 9 bits
+                       0xffffffff81000000 - 0xffffffff81f41000   guaranteed  (8 x 2.0 MiB)
 ```
 
 A second observation — a `_stext` base witness, a DRAM floor, or the

src/estimate.c

@@ -494,14 +494,17 @@ unsigned long quantity_slots(enum kasld_quantity q, const struct estimate *e,
         continue;
       slots += (rs[i].hi - first) / e->stride + 1;
     } else {
-      /* Whole-slot span. A non-empty range narrower than one slot still
-       * occupies one slot (the base sits inside it) — so it counts as 1
-       * candidate (0 bits), not 0. Without this a sub-slot window would report
-       * "0 slots" and be indistinguishable from an empty result. */
-      unsigned long w = (rs[i].hi - rs[i].lo) / step;
-      if (w == 0 && rs[i].hi > rs[i].lo)
-        w = 1;
-      slots += w;
+      /* Whole-slot pitch over the closed range [lo, hi]: the `+ 1` counts the
+       * floor itself, so a pin (lo == hi) is one candidate and a range
+       * narrower than one slot is one candidate rather than none.
+       *
+       * A carved hole can leave a sub-range whose floor is off the slot grid,
+       * in which case this counts one placement more than exist. That
+       * direction is deliberate: the count feeds the residual-entropy
+       * headline, where over-stating what survives is the conservative error
+       * and under-stating it would claim more of KASLR is defeated than the
+       * evidence shows. */
+      slots += (rs[i].hi - rs[i].lo) / step + 1;
     }
   }
   return slots;

src/include/kasld/estimate.h

@@ -139,9 +139,11 @@ int quantity_ranges(enum kasld_quantity q, const struct estimate *e,
                     int n_cs, struct range *out, int out_max);
 
 /* Hole-aware count of aligned candidate positions for q's resolved estimate:
- * the sum over quantity_ranges() of (span / align), span = hi - lo per range.
- * With no excludes this is (hi - lo) / align; each interior C_EXCLUDE hole at
- * conf >= floor strictly reduces it. Returns 0 for align == 0 or a non-interval
+ * the sum over quantity_ranges() of the candidates in each closed range,
+ * (hi - lo) / align + 1. The ranges are inclusive of both edges (see `struct
+ * range` above), so the trailing + 1 counts the floor: a pinned quantity is one
+ * candidate, not none. Each interior C_EXCLUDE hole at conf >= floor strictly
+ * reduces the total. Returns 0 for align == 0 or a non-interval
  * lattice. `floor` has the same meaning and requirement as in quantity_ranges:
  * pass the floor `e` was resolved at. This is the terminal consumer over the
  * range iterator above — the basis for hole-aware slot/entropy reporting, and

src/include/kasld/internal.h

@@ -407,6 +407,18 @@ struct kaslr_info {
   unsigned long pslots;
   int pbits;
   int has_phys;
+  /* Entropy the virtual KASLR window started with, counted over
+   * Q_VIRT_IMAGE_BASE's honest top at the same alignment as vbits. The
+   * baseline that makes vbits interpretable: "5 bits remain" says nothing
+   * without it. 0 means not computed, and every format then reports the
+   * residual alone.
+   *
+   * Virtual only, deliberately. That quantity's honest top IS the arch's
+   * KASLR window, so the ratio means what a reader will take it to mean. The
+   * physical and direct-map tops are addressable-range bounds rather than
+   * randomization windows, so a denominator drawn from them would read as
+   * KASLR entropy the kernel never had. */
+  int vbits_top;
   /* Speculative "likely" window: the engine resolved a second time with ALL
    * signals, including those below the sound floor (timing/heuristic/brute).
    * It is a subset of the guaranteed window in the vtext/ptext fields above and

src/include/kasld/render_internal.h

@@ -52,7 +52,14 @@ unsigned long section_consensus(enum kasld_addr_type type, const char *section,
 void section_consensus_info(enum kasld_addr_type type, const char *section,
                             enum kasld_region region_filter,
                             const char **best_method, int *n_sources,
-                            int *n_conflicts);
+                            int *n_conflicts, int *interior_only);
+
+/* Distinct contributing components, and "no edge record, only interior samples"
+ * predicate, for a (type, section, optional region_filter). */
+int section_source_count(enum kasld_addr_type type, const char *section,
+                         enum kasld_region region_filter);
+int section_is_interior_only(enum kasld_addr_type type, const char *section,
+                             enum kasld_region region_filter);
 
 /* (type, section) extent across all in-bounds results. lo/hi = 0 when none. */
 void section_range(enum kasld_addr_type type, const char *section,