render: give the readout one grammar and state entropy once

The compact readout, the evidence list and the verbose Memory KASLR block
each described the same kinds of thing their own way: three range
notations, three vocabularies for a grade, and a label column that the
longest quantity name filled exactly, so "Physical image base not
derandomized" read as a sentence rather than two columns.

Quantity names now head their own block with a bracketed verdict, every
value row states its grade, windows print first and last candidate over
".." with the count and pitch beside them, and addresses are right-aligned
without zero padding so a 16 MiB physical address is not dressed as a
64-bit pointer. Window edges snap to the candidate grid: an edge off the
grid is a bound, not a value the quantity can take. Residual entropy is
stated once per quantity, against the entropy the KASLR window started
with where that is a randomization window rather than an addressable
range -- true for the virtual base, not for the physical or direct-map
tops.

The leak list becomes "Evidence": it carries side-channel measurements
alongside disclosures, and only the latter are leaks. The extent-position
tag precedes the value it qualifies, provenance moves to its own line
introduced by "from" so component names cannot be read as kernel symbols,
and the heading counts findings and contributing components separately.

The Memory KASLR block gets the same notation, and its direct-map row is
now named and formatted exactly as the readout names it -- previously one
quantity appeared as "Direct map base" in one view and
"virt_page_offset_base" in the other with nothing relating them. Its
residual entropy comes from the summary rather than a renderer-local
ceil-log2 that duplicated the orchestrator's.

Every readout line now fits 80 columns.

Author: bcoles

README.md

@@ -78,18 +78,31 @@ Target: x86_64 / 6.15.6
 Running 94 of 97 components (3 experimental skipped; use -x to enable)...
 [####################] 100%  94/94  13.9s
 
-  Virtual image base  0xffffffff8fe00000   slide +0xee00000
-  Physical image base 0x0000000034600000   slide +0x33600000
-  Direct map base     >= 0xffff800000000000
-  Phys/Virt coupling  physical and virtual text randomize independently
-
-Leaks (6):
-  virt kernel text    0xffffffff8ff04104 [interior]   (perf_event_open, proc_kallsyms)
-  virt kernel image   0xffffffff8fe00000 [base]       (perf_event_open, prefetch, proc_kallsyms)
-  virt directmap      0xffff9eeb80000000 [base]       (prefetch_directmap)
-  phys kernel image   0x0000000034600000 [base]       (proc_iomem_kernel)
-  phys kernel data    0x0000000036000000 [base]       (proc_iomem_kernel)
-  phys kernel BSS     0x0000000036b34000 [base]       (proc_iomem_kernel)
+Layout
+  Virtual image base     (pinned)
+    guaranteed           0xffffffff8fe00000 slide +0xee00000
+
+  Physical image base    (pinned)
+    guaranteed                   0x34600000 slide +0x33600000
+
+  Direct map base        (narrowed to ~9 bits)
+    guaranteed           >= 0xffff800000000000
+
+  Note: physical and virtual text randomize independently
+
+Evidence  (6 findings, 5 components)
+  virt kernel text    [interior] 0xffffffff8ff04104
+                                 from perf_event_open, proc_kallsyms
+  virt kernel image   [base]     0xffffffff8fe00000
+                                 from perf_event_open, prefetch, proc_kallsyms
+  virt directmap      [base]     0xffff9eeb80000000
+                                 from prefetch_directmap
+  phys kernel image   [base]             0x34600000
+                                 from proc_iomem_kernel
+  phys kernel data    [base]             0x36000000
+                                 from proc_iomem_kernel
+  phys kernel BSS     [base]             0x36b34000
+                                 from proc_iomem_kernel
 
 [-v: detailed results, memory map, system info]  [-H: hardening assessment]
 ```

docs/architecture.md

@@ -98,8 +98,9 @@ raise the floor (DRAM bounds) and the 2 MiB `IMAGE_ALIGN` slot grid is applied.
 With only this one leak the result is still a window — several slots wide:
 
 ```
-  Virtual image base   narrowed             ~3 of 9 bits
-                       0xffffffff81000000 - 0xffffffff81f41000   guaranteed  (8 x 2.0 MiB)
+Layout
+  Virtual image base     (narrowed to ~3 of 9 bits)
+    guaranteed           0xffffffff81000000 .. 0xffffffff81e00000  8 x 2 MiB
 ```
 
 A second observation — a `_stext` base witness, a DRAM floor, or the
@@ -112,7 +113,9 @@ narrowed window above, or, once the constraints collapse to one slot, the pinned
 base and its slide:
 
 ```
-  Virtual image base   0xffffffff81e00000   slide +0xe00000
+Layout
+  Virtual image base     (pinned)
+    guaranteed           0xffffffff81e00000 slide +0xe00000
 ```
 
 That is the whole path: a log line becomes an observation, a rule turns it into a

docs/usage.md

@@ -133,21 +133,34 @@ config, no memory-layout diagram.
 KASLD 0.3.1-dev  --  Kernel ASLR derandomization
 Target: x86_64 / 6.15.6
 
-Running 94 components (3 experimental skipped; use -x to enable)...
+Running 94 of 97 components (3 experimental skipped; use -x to enable)...
 [####################] 100%  94/94  13.9s
 
-  Virtual image base  0xffffffff8fe00000   slide +0xee00000
-  Physical image base 0x0000000034600000   slide +0x33600000
-  Direct map base     >= 0xffff800000000000
-  Phys/Virt coupling  physical and virtual text randomize independently
+Layout
+  Virtual image base     (pinned)
+    guaranteed           0xffffffff8fe00000 slide +0xee00000
 
-Leaks (6):
-  virt kernel text    0xffffffff8ff04104 [interior]   (perf_event_open, proc_kallsyms)
-  virt kernel image   0xffffffff8fe00000 [base]       (perf_event_open, prefetch, proc_kallsyms)
-  virt directmap      0xffff9eeb80000000 [base]       (prefetch_directmap)
-  phys kernel image   0x0000000034600000 [base]       (proc_iomem_kernel)
-  phys kernel data    0x0000000036000000 [base]       (proc_iomem_kernel)
-  phys kernel BSS     0x0000000036b34000 [base]       (proc_iomem_kernel)
+  Physical image base    (pinned)
+    guaranteed                   0x34600000 slide +0x33600000
+
+  Direct map base        (narrowed to ~9 bits)
+    guaranteed           >= 0xffff800000000000
+
+  Note: physical and virtual text randomize independently
+
+Evidence  (6 findings, 5 components)
+  virt kernel text    [interior] 0xffffffff8ff04104
+                                 from perf_event_open, proc_kallsyms
+  virt kernel image   [base]     0xffffffff8fe00000
+                                 from perf_event_open, prefetch, proc_kallsyms
+  virt directmap      [base]     0xffff9eeb80000000
+                                 from prefetch_directmap
+  phys kernel image   [base]             0x34600000
+                                 from proc_iomem_kernel
+  phys kernel data    [base]             0x36000000
+                                 from proc_iomem_kernel
+  phys kernel BSS     [base]             0x36b34000
+                                 from proc_iomem_kernel
 
 [-v: detailed results, memory map, system info]  [-H: hardening assessment]
 ```
@@ -300,9 +313,9 @@ KASLR analysis:
   Physical KASLR entropy: 0 bits (pinned)
 
 Memory KASLR (directmap / vmalloc / vmemmap):
-  virt_page_offset_base >= 0xffff800000000000
-  virt_vmalloc_base     0xffff810040000000 - 0xffffdcffc0000000  (94206 candidates, 17 bits)
-  virt_vmemmap_base     0xffffa10080000000 - 0xfffffd0000000000  (94206 candidates, 17 bits)
+  Direct map base   guaranteed  >= 0xffff800000000000
+  vmalloc base      guaranteed  0xffff810040000000 .. 0xffffdcffc0000000  94206 slots, ~17 bits
+  vmemmap base      guaranteed  0xffffa10080000000 .. 0xfffffd0000000000  94206 slots, ~17 bits
 
 ----------------------------------------
 Virtual memory layout (decoupled):

src/include/kasld/internal.h

@@ -450,6 +450,10 @@ struct kaslr_info {
    * are excluded, matching the headline vslots/pslots). Renderers derive bits
    * via ilog2. 0 when the region is unresolved / not a both-sided window. */
   unsigned long virt_page_offset_slots, virt_page_offset_likely_slots;
+  /* Residual entropy over each window, derived from the hole-aware slot counts
+   * at the engine boundary. Carried here rather than recomputed in a renderer:
+   * the same quantity must not be derived two ways. */
+  int virt_page_offset_bits, virt_vmalloc_bits, virt_vmemmap_bits;
   unsigned long virt_vmalloc_slots, virt_vmalloc_likely_slots;
   unsigned long virt_vmemmap_slots, virt_vmemmap_likely_slots;
 };

src/orchestrator.c

@@ -2782,6 +2782,13 @@ void compute_kaslr_info(struct summary *s) {
             : 0;
   }
 #endif
+  s->kaslr.virt_page_offset_bits = s->kaslr.virt_page_offset_slots > 0
+                                       ? ilog2(s->kaslr.virt_page_offset_slots)
+                                       : 0;
+  s->kaslr.virt_vmalloc_bits =
+      s->kaslr.virt_vmalloc_slots > 0 ? ilog2(s->kaslr.virt_vmalloc_slots) : 0;
+  s->kaslr.virt_vmemmap_bits =
+      s->kaslr.virt_vmemmap_slots > 0 ? ilog2(s->kaslr.virt_vmemmap_slots) : 0;
 
 #ifndef KASLD_TESTING
   /* Speculative "likely" sub-windows for the memory-KASLR regions: the engine's
@@ -4135,11 +4142,27 @@ int main(int argc, char *argv[]) {
         (sysroot && *sysroot) ? "skipped" : "skipped by --skip";
     /* "N of M" rather than a bare N: the skipped counts that follow are
      * excluded from N, so a bare count reads either way. */
-    if (num_active_components == 0)
-      /* Nothing to run (e.g. -s '*'): the result below is the engine's
-       * leak-free structural inference, not a scan. */
-      printf("Structural baseline - no components run\n");
-    else if (nf > 0 && ne > 0)
+    if (num_active_components == 0) {
+      /* Every discovered component was filtered out, so the result below is
+       * the engine's leak-free structural inference rather than a scan. Name
+       * which filter emptied the set: the three causes (--skip, experimental
+       * gating, KASLD_SYSROOT dropping live probes) need different responses.
+       * A component directory that is missing or empty cannot reach here --
+       * discover_components() fails the run before any output. */
+      if (nf > 0 && ne > 0)
+        printf("Structural baseline: no components ran (%d %s, %d experimental;"
+               " use -x to enable)\n",
+               nf, skipped_by, ne);
+      else if (nf > 0)
+        printf("Structural baseline: no components ran (all %d %s)\n", nf,
+               skipped_by);
+      else if (ne > 0)
+        printf("Structural baseline: no components ran (all %d experimental;"
+               " use -x to enable)\n",
+               ne);
+      else
+        printf("Structural baseline: no components ran\n");
+    } else if (nf > 0 && ne > 0)
       printf("Running %d of %d components (%d %s, %d experimental "
              "skipped; use -x to enable)...\n",
              num_active_components, num_components, nf, skipped_by, ne);

src/render/markdown.c

@@ -379,7 +379,10 @@ void render_markdown(const struct summary *s) {
   enum kasld_addr_type type_order[] = {KASLD_TYPE_PHYS, KASLD_TYPE_VIRT,
                                        KASLD_TYPE_UNKNOWN};
 
-  printf("## Leak Results\n\n");
+  /* "Evidence", matching the text readout: the block carries side-channel
+   * measurements alongside actual disclosures, and only the latter are leaks.
+   */
+  printf("## Evidence\n\n");
 
   if (verbose) {
     /* Verbose: individual result rows */