rework merged-record provenance: uncapped + method bitmask

Size provenance to MAX_COMPONENTS so a record holds every contributor —
overflow is impossible by construction, retiring the 8-entry cap, its
warning, and the saturation flag that truncated attribution on leaky
systems. Replace the per-contributor methods[] array (only [0] was ever
read) with a method_set bitmask; result_method now returns the strongest
method, consistent with the resolved confidence, not the earliest
contributor's. JSON and verbose text surface the method diversity; the
default Leaks line clamps to the first few contributors + "+N more"
(verbose lists all).

Author: bcoles

src/include/kasld/constraint.h

@@ -24,7 +24,9 @@
 
 #include <stdint.h>
 
-/* Cap on lineage entries per constraint (matches MAX_PROVENANCE in spirit). */
+/* Cap on lineage entries per constraint: an engine-side termination bound on
+ * per-constraint provenance depth. Independent of the display-side
+ * MAX_PROVENANCE (which now equals MAX_COMPONENTS). */
 #ifndef MAX_LINEAGE
 #define MAX_LINEAGE 8
 #endif

src/include/kasld/internal.h

@@ -28,8 +28,10 @@
 #define MAX_RESULTS 4096
 #define NAME_LEN 48   /* specific instance: kernel symbol, ACPI ID, BDF, ... */
 #define ORIGIN_LEN 64 /* component name (orchestrator-filled) */
-#define METHOD_LEN 16 /* method: meta value */
-#define MAX_PROVENANCE 8 /* cap on merged-record contributors */
+/* A merged record can be corroborated by at most every component, so size its
+ * provenance to the structural maximum — overflow is impossible by
+ * construction. */
+#define MAX_PROVENANCE MAX_COMPONENTS
 /* Captured-stdout lines are kept only for --verbose / --json output. The log
  * is grown geometrically on demand from this initial capacity; there is no
  * hard cap (the previous fixed cap of 64 silently truncated noisy components).
@@ -119,6 +121,72 @@ enum kasld_set_bits {
 };
 #endif
 
+/* Analytical method a component claims for a leak (the `method:` meta value).
+ * Closed set, ordered weakest->strongest so the strongest member of a set is
+ * the highest bit. A merged record stores the union of its contributors'
+ * methods as a bitmask (method_set); this is the only place the names live. */
+enum kasld_method {
+  KM_DETECTION = 0,
+  KM_BRUTE,
+  KM_TIMING,
+  KM_HEURISTIC,
+  KM_INFERRED,
+  KM_DERIVED,
+  KM_PARSED,
+  KM_COUNT
+};
+
+static inline const char *kasld_method_name(enum kasld_method m) {
+  switch (m) {
+  case KM_DETECTION:
+    return "detection";
+  case KM_BRUTE:
+    return "brute";
+  case KM_TIMING:
+    return "timing";
+  case KM_HEURISTIC:
+    return "heuristic";
+  case KM_INFERRED:
+    return "inferred";
+  case KM_DERIVED:
+    return "derived";
+  case KM_PARSED:
+    return "parsed";
+  case KM_COUNT:
+    break;
+  }
+  return "unknown";
+}
+
+/* Strongest method present in a set, as a display string ("unknown" if empty).
+ */
+static inline const char *kasld_method_set_strongest(uint16_t set) {
+  for (int m = KM_COUNT - 1; m >= 0; m--)
+    if (set & (1u << m))
+      return kasld_method_name((enum kasld_method)m);
+  return "unknown";
+}
+
+/* Format a method set strongest-first as "parsed+timing" into buf ("unknown" if
+ * empty). Surfaces method diversity where a single line has room (verbose). */
+static inline void kasld_method_set_str(uint16_t set, char *buf, size_t sz) {
+  if (sz == 0)
+    return;
+  buf[0] = '\0';
+  size_t o = 0;
+  for (int m = KM_COUNT - 1; m >= 0; m--) {
+    if (!(set & (1u << m)))
+      continue;
+    int w = snprintf(buf + o, sz - o, "%s%s", o ? "+" : "",
+                     kasld_method_name((enum kasld_method)m));
+    if (w < 0 || (size_t)w >= sz - o)
+      break;
+    o += (size_t)w;
+  }
+  if (o == 0)
+    snprintf(buf, sz, "unknown");
+}
+
 struct result {
   enum kasld_addr_type type;
   enum kasld_region region;
@@ -132,9 +200,11 @@ struct result {
   enum kasld_position pos;
   enum kasld_confidence conf;
 
-  /* Provenance — earliest contributor at index 0. */
+  /* Provenance: the components that corroborate this record (origins[0] is the
+   * earliest contributor) and method_set, the union of their methods. Sized to
+   * the structural max (MAX_COMPONENTS) so it can never overflow. */
   char origins[MAX_PROVENANCE][ORIGIN_LEN];
-  char methods[MAX_PROVENANCE][METHOD_LEN];
+  uint16_t method_set; /* bitmask over enum kasld_method */
   uint8_t provenance_count;
 };
 

src/include/kasld/render_internal.h

@@ -20,9 +20,9 @@
  */
 const char *human_size(unsigned long bytes, char *buf, size_t bufsz);
 
-/* Result-model helpers (mirror anchor_addr(). methods[0] is the canonical
- * single-value method; origins are iterated as r->origins[0..provenance_count]
- * at the consuming renderer). */
+/* Result-model helpers (mirror anchor_addr(). result_method returns the
+ * strongest method in the record's method_set; origins are iterated as
+ * r->origins[0..provenance_count] at the consuming renderer). */
 const char *result_method(const struct result *r);
 const char *result_section(const struct result *r);
 int in_bounds(const struct result *r);

src/orchestrator.c

@@ -164,8 +164,6 @@ int num_comp_logs;
  */
 enum orchestrator_saturation {
   ORCH_SAT_RESULTS_FULL = 1u << 0, /* MAX_RESULTS hit; drops new records */
-  ORCH_SAT_PROVENANCE_FULL =
-      1u << 1, /* MAX_PROVENANCE hit; drops later contributors */
   ORCH_SAT_COMPONENT_LINES_DROPPED =
       1u << 2, /* alloc failure during verbose-line capture */
 };
@@ -560,6 +558,30 @@ static enum kasld_confidence conf_from_wire(const char *s) {
   return CONF_UNKNOWN;
 }
 
+/* Map a method: meta value to its bit in struct result.method_set (0 if the
+ * value is empty or unrecognised). Mirrors the closed set in enum kasld_method.
+ */
+static uint16_t method_bit(const char *s) {
+  int m = -1;
+  if (!s || !*s)
+    return 0;
+  if (strcmp(s, "parsed") == 0)
+    m = KM_PARSED;
+  else if (strcmp(s, "derived") == 0)
+    m = KM_DERIVED;
+  else if (strcmp(s, "inferred") == 0)
+    m = KM_INFERRED;
+  else if (strcmp(s, "heuristic") == 0)
+    m = KM_HEURISTIC;
+  else if (strcmp(s, "timing") == 0)
+    m = KM_TIMING;
+  else if (strcmp(s, "brute") == 0)
+    m = KM_BRUTE;
+  else if (strcmp(s, "detection") == 0)
+    m = KM_DETECTION;
+  return m < 0 ? 0u : (uint16_t)(1u << m);
+}
+
 /* Power-of-two test, allowing v=0 to mean "no constraint" but the caller
  * gates on v != 0 separately. */
 static int is_pow2(unsigned long v) { return v && !(v & (v - 1)); }
@@ -879,11 +901,7 @@ static int capture_result(const char *line, const char *method,
     memcpy(r->origins[0], origin, ol);
     r->origins[0][ol] = '\0';
   }
-  if (method && *method) {
-    size_t ml = strnlen(method, METHOD_LEN - 1);
-    memcpy(r->methods[0], method, ml);
-    r->methods[0][ml] = '\0';
-  }
+  r->method_set = method_bit(method);
   r->provenance_count = 1;
   return 1;
 }
@@ -1710,22 +1728,14 @@ static int provenance_has(const struct result *r, const char *s) {
   return 0;
 }
 
-static void provenance_add(struct result *r, const char *origin,
-                           const char *method) {
+static void provenance_add(struct result *r, const char *origin) {
   if (origin && *origin && provenance_has(r, origin))
     return;
-  if (r->provenance_count >= MAX_PROVENANCE) {
-    orchestrator_saturation |= ORCH_SAT_PROVENANCE_FULL;
-    static int warned;
-    if (!warned && !quiet) {
-      fprintf(stderr,
-              "warning: merged record provenance capped at MAX_PROVENANCE=%d; "
-              "later contributors dropped\n",
-              MAX_PROVENANCE);
-      warned = 1;
-    }
+  /* Distinct origins <= number of components <= MAX_PROVENANCE, so this guard
+   * never binds; it only keeps the write in-bounds if that invariant changes.
+   */
+  if (r->provenance_count >= MAX_PROVENANCE)
     return;
-  }
   int slot = r->provenance_count++;
   if (origin && *origin) {
     size_t ol = strnlen(origin, ORIGIN_LEN - 1);
@@ -1734,13 +1744,6 @@ static void provenance_add(struct result *r, const char *origin,
   } else {
     r->origins[slot][0] = '\0';
   }
-  if (method && *method) {
-    size_t ml = strnlen(method, METHOD_LEN - 1);
-    memcpy(r->methods[slot], method, ml);
-    r->methods[slot][ml] = '\0';
-  } else {
-    r->methods[slot][0] = '\0';
-  }
 }
 
 static void merge_into(struct result *a, const struct result *b,
@@ -1782,8 +1785,9 @@ static void merge_into(struct result *a, const struct result *b,
   }
   if (conf_weight(b->conf) > conf_weight(a->conf))
     a->conf = b->conf;
+  a->method_set |= b->method_set;
   for (int i = 0; i < b->provenance_count; i++)
-    provenance_add(a, b->origins[i], b->methods[i]);
+    provenance_add(a, b->origins[i]);
 }
 
 static int merge_consistent(const struct result *a) {
@@ -2454,9 +2458,9 @@ static void engine_report_saturation(const struct engine *e) {
             ESTIMATE_MAX_CONFLICTS);
 }
 
-/* Sibling reporter for orchestrator-side caps (results[], merged-record
- * provenance, per-component verbose-line capture). Same diagnostic shape
- * as engine_report_saturation; surfaces under --verbose. */
+/* Sibling reporter for orchestrator-side caps (results[], per-component
+ * verbose-line capture). Same diagnostic shape as engine_report_saturation;
+ * surfaces under --verbose. */
 static void orchestrator_report_saturation(void) {
   if (!orchestrator_saturation)
     return;
@@ -2465,12 +2469,6 @@ static void orchestrator_report_saturation(void) {
             "[orchestrator] saturation: MAX_RESULTS (%d) reached; "
             "further leak/scalar observations were dropped at capture\n",
             MAX_RESULTS);
-  if (orchestrator_saturation & ORCH_SAT_PROVENANCE_FULL)
-    fprintf(stderr,
-            "[orchestrator] saturation: MAX_PROVENANCE (%d) reached on at "
-            "least one merged record; additional contributors were not "
-            "recorded (the record's resolved value is unaffected)\n",
-            MAX_PROVENANCE);
   if (orchestrator_saturation & ORCH_SAT_COMPONENT_LINES_DROPPED)
     fprintf(stderr,
             "[orchestrator] saturation: allocation failure while capturing "

src/render.c

@@ -49,16 +49,17 @@ const char *human_size(unsigned long bytes, char *buf, size_t bufsz) {
  * Result-model helpers
  *
  * Mirror the orchestrator's anchor_addr() and the result_in_bounds()
- * convention. methods[0]/origins[0] are the earliest contributor for a
- * merged record; for the renderer this is the canonical display value.
+ * convention. A merged record carries method_set (the union of its
+ * contributors' methods); the single display value is the strongest method
+ * present, which stays consistent with the record's resolved confidence.
  * -------------------------------------------------------------------------
  */
 /* anchor_addr() is defined as a static inline in kasld/internal.h. */
 
 const char *result_method(const struct result *r) {
-  if (!r || r->provenance_count == 0 || r->methods[0][0] == '\0')
+  if (!r)
     return "unknown";
-  return r->methods[0];
+  return kasld_method_set_strongest(r->method_set);
 }
 
 const char *result_section(const struct result *r) {

src/render/json.c

@@ -130,8 +130,20 @@ static void render_json_group(enum kasld_addr_type gt, const char *gs) {
     }
     printf("],\n");
     printf("          \"method\": ");
-    json_print_escaped(result_method(r));
+    json_print_escaped(
+        result_method(r)); /* single strongest, for compatibility */
     printf(",\n");
+    printf("          \"methods\": [");
+    {
+      int firstm = 1;
+      for (int m = 0; m < KM_COUNT; m++)
+        if (r->method_set & (1u << m)) {
+          printf(firstm ? "" : ", ");
+          json_print_escaped(kasld_method_name((enum kasld_method)m));
+          firstm = 0;
+        }
+    }
+    printf("],\n");
     printf("          \"valid\": %s\n", in_bounds(r) ? "true" : "false");
     printf("        }");
   }

src/render/text.c

@@ -298,21 +298,25 @@ static void print_group(enum kasld_addr_type type, const char *section,
 
     if (!in_bounds(r)) {
       if (verbose) {
+        char mbuf[64];
+        kasld_method_set_str(r->method_set, mbuf, sizeof mbuf);
         printf("  %s0x%016lx%s  %s %s(", c(C_RED), a, c(C_RESET), rn, c(C_DIM));
         for (int j = 0; j < r->provenance_count; j++)
           printf("%s%s", j ? ", " : "", r->origins[j]);
-        printf(", %s, stale)%s\n", result_method(r), c(C_RESET));
+        printf(", %s, stale)%s\n", mbuf, c(C_RESET));
       } else
         printf("  %s0x%016lx%s  %s %s(stale)%s\n", c(C_RED), a, c(C_RESET), rn,
                c(C_DIM), c(C_RESET));
       continue;
     }
 
     if (verbose) {
+      char mbuf[64];
+      kasld_method_set_str(r->method_set, mbuf, sizeof mbuf);
       printf("  %s0x%016lx%s  %s %s(", c(C_GREEN), a, c(C_RESET), rn, c(C_DIM));
       for (int j = 0; j < r->provenance_count; j++)
         printf("%s%s", j ? ", " : "", r->origins[j]);
-      printf(", %s)%s\n", result_method(r), c(C_RESET));
+      printf(", %s)%s\n", mbuf, c(C_RESET));
     } else
       printf("  %s0x%016lx%s  %s\n", c(C_GREEN), a, c(C_RESET), rn);
 
@@ -1158,9 +1162,11 @@ static int readout_print_leaks(void) {
      * same address tagged under different symbol names (e.g. _stext from
      * proc_kallsyms vs an unnamed text leak) lands in separate merged records.
      * Aggregate provenance across all in-bounds records of this (type, region),
-     * de-duplicated, so the bracket lists the full set of contributors. */
-    char seen[24][ORIGIN_LEN];
-    int ns = 0, more = 0;
+     * de-duplicated. seen[] is sized to the structural max so the distinct
+     * count is exact; the line shows the first few and folds the rest into
+     * "+N more" (verbose lists them all). */
+    char seen[MAX_COMPONENTS][ORIGIN_LEN];
+    int ns = 0;
     for (int j = 0; j < num_results; j++) {
       const struct result *r = &results[j];
       if (r->type != found[i].r->type || r->region != found[i].r->region ||
@@ -1173,25 +1179,23 @@ static int readout_print_leaks(void) {
             dup = 1;
             break;
           }
-        if (dup)
-          continue;
-        if (ns < (int)(sizeof(seen) / sizeof(seen[0])))
+        if (!dup && ns < (int)(sizeof(seen) / sizeof(seen[0])))
           snprintf(seen[ns++], ORIGIN_LEN, "%s", r->origins[p]);
-        else
-          more++;
       }
     }
     if (ns == 0) {
       printf("  %-19s %s0x%016lx%s\n", found[i].label, c(C_GREEN),
              found[i].addr, c(C_RESET));
       continue;
     }
+    /* Names that fit a default ~80-col line; the rest fold into "+N more". */
+    const int shown = ns < 3 ? ns : 3;
     printf("  %-19s %s0x%016lx%s   %s(", found[i].label, c(C_GREEN),
            found[i].addr, c(C_RESET), c(C_DIM));
-    for (int idx = 0; idx < ns; idx++)
+    for (int idx = 0; idx < shown; idx++)
       printf("%s%s", idx ? ", " : "", seen[idx]);
-    if (more)
-      printf(", +%d more", more);
+    if (ns > shown)
+      printf(", +%d more", ns - shown);
     printf(")%s\n", c(C_RESET));
   }
   return nf;