orchestrator: seed the arch's KASLR facts before components run

On a !KASLR_SUPPORTED arch the orchestrator synthesises
SF_VIRT_KASLR_DISABLED + SF_PHYS_KASLR_DISABLED so the engine takes the
arch-off signal the way it takes a detector's. They were appended at summary
time, after every component had had its turn at a 64-slot table, and a full
table dropped them with no record — the one evidence loss that never reached
the discard ledger. JSON then reported kaslr.disabled false on an arch where
KASLR cannot exist.

The facts depend on nothing observed, so they are seeded first, into an empty
table, where they cannot be crowded out. Any later overflow belongs to a
component, where capture_scalar() already caps and records it. This splits
inject_kaslr_defaults() at the seam between its two times: seeding what the
arch settles before anything is observed, and projecting the collected facts
onto the summary afterwards, which must still run last because its scan reads
the whole table.

The bounds test stays, now recording instead of returning quietly. It no
longer guards a full table — it guards a future caller moving this after
capture, where unconditional writes would run off the end of one.

Author: bcoles

Makefile

@@ -729,6 +729,7 @@ lint :
 	@$(TEST_DIR)/check-discard-ledger
 	@$(TEST_DIR)/check-discard-accounting
 	@$(TEST_DIR)/check-discard-report
+	@$(TEST_DIR)/check-scalar-seed-order
 	@$(TEST_DIR)/check-vantage-coverage
 	@$(TEST_DIR)/check-test-staging
 	@$(TEST_DIR)/check-truncation

docs/testing.md

@@ -132,6 +132,7 @@ and `make` halts on the first.
 | `check-extent-callers` | only reviewed whole-map components call `kasld_result_extent` (the covering-completeness contract; a partial map would carve a false gap) |
 | `check-discard-accounting` | the shipped binary, with its worker pool running, counts discards exactly — N components x M bad wire records must yield total N*M in N kinds, repeated. The unit tests are single-threaded and their build defines no `HAVE_PTHREAD`, so nothing else exercises the ledger's mutex; probabilistic, so a failure is conclusive and a pass is evidence |
 | `check-discard-report` | the ledger's two renderings agree with a store actually full — a component overflows `MAX_SCALAR_FACTS`, the ledger is driven past its own `MAX_DISCARDS`, and the component directory past `MAX_COMPONENTS`; `--verbose` and `-j` must name the same total, reason and source, the capacity detail sentence must be printed, and the total must keep counting after the breakdown caps. Counts are differential, since the absolute overflow depends on what else populated the store — which varies by build, not by tool |
+| `check-scalar-seed-order` | the arch's compile-time KASLR-off facts are seeded into `scalar_facts[]` before the phase loop, and only `capture_scalar()` and `seed_arch_kaslr_facts()` append to it — appended at summary time instead, the pair competed with components for a 64-slot table and a full table dropped it with no ledger entry; the ordering is invisible to the suite, which stays at full marks with the call moved |
 | `check-vantage-coverage` | every filesystem source `kasld_gather_vantage()` reads is staged by a test, the suite actually calls the gatherer, and the absent direction is asserted — the gatherer was once constrained by nothing at all, a `memset` stub leaving the suite green, because the tests named "vantage" asserted on the formatters over a hand-filled struct |
 | `check-test-staging` | every test binary stages its filesystem through `test_sysroot.h`, which names the root after the binary and registers its own removal — fifteen tests each carried a private `mkdtemp`, of which eleven removed nothing, so a passing suite left a tree per binary under `/tmp` to accumulate indefinitely, with nothing ever failing |
 | `check-discard-ledger` | every reason in the discard vocabulary has a wire name, no layer keeps a private drop-counter beside the ledger, and the renderers read it through its accessors — a run that discarded evidence resolved from a subset of what was available, so a consumer unable to see the discard reads a bounded answer as a complete one |

src/include/kasld/internal.h

@@ -903,7 +903,9 @@ extern int num_constraint_facts;
 const char *meta_get(const struct component_meta *m, const char *key);
 int meta_get_all(const struct component_meta *m, const char *key,
                  const char **values, int max_values);
-void inject_kaslr_defaults(struct summary *s);
+/* Seeded before any component runs; projected onto the summary after. */
+void seed_arch_kaslr_facts(void);
+void summarize_kaslr_state(struct summary *s);
 void compute_component_stats(struct summary *s);
 /* Declared at file scope: first naming these inside the parameter list below
  * would give them PROTOTYPE scope -- a distinct type from the definition in

src/orchestrator.c

@@ -1242,7 +1242,7 @@ int num_results;
 
 /* scalar_fact_record + scalar_facts[]/num_scalar_facts declared in
  * include/kasld/internal.h; the engine bridge copies these to OBS_SCALAR
- * observations and inject_kaslr_defaults / render also read them directly. */
+ * observations and summarize_kaslr_state / render also read them directly. */
 struct scalar_fact_record scalar_facts[MAX_SCALAR_FACTS];
 int num_scalar_facts;
 
@@ -3664,17 +3664,20 @@ void compute_component_stats(struct summary *s) {
 }
 
 /* -------------------------------------------------------------------------
- * Pre-computation: detect KASLR state and inject default address
+ * Pre-computation: what the arch settles before anything is observed
  * -------------------------------------------------------------------------
  */
-void inject_kaslr_defaults(struct summary *s) {
-  /* "Unsupported" is a compile-time property of the arch; no runtime signal
-   * needed. Surface it for the renderer banner, and seed the informational
-   * default address from the statically-initialised layout
-   * (= KERNEL_VIRT_TEXT_DEFAULT). */
-  s->kaslr.unsupported = !KASLR_SUPPORTED;
-  s->kaslr.default_addr = layout.virt_image_base_default;
 
+/* Seed the facts the architecture settles at compile time, before any
+ * component runs.
+ *
+ * Called first because these depend on nothing observed: a component's output
+ * cannot change whether the arch supports KASLR. Seeding into an empty table
+ * also means they cannot be crowded out of it — appended last, they competed
+ * for whatever room components had left, and a full table dropped them with no
+ * record, the one evidence loss that did not reach the ledger. Any overflow
+ * now belongs to a component, where capture_scalar() caps and records it. */
+void seed_arch_kaslr_facts(void) {
 #if !KASLR_SUPPORTED
   /* Surface the compile-time arch-off as SF_VIRT_KASLR_DISABLED +
    * SF_PHYS_KASLR_DISABLED so the engine sees it like any runtime detector
@@ -3686,20 +3689,50 @@ void inject_kaslr_defaults(struct summary *s) {
    * states the contract and what obliges an arch to stay at the default. An
    * arch at the default gets the renderer's "KASLR not supported" banner and
    * default-addr line while the engine refuses to pin; an arch that raises one
-   * pins through the same rule path a runtime detector uses. */
-  if (num_scalar_facts + 1 < MAX_SCALAR_FACTS) {
-    struct scalar_fact_record *fv = &scalar_facts[num_scalar_facts++];
-    fv->fact = SF_VIRT_KASLR_DISABLED;
-    fv->value = 1;
-    fv->conf = CONF_PARSED;
-    fv->origin = ORIGIN_ARCH_SYNTH;
-    struct scalar_fact_record *fp = &scalar_facts[num_scalar_facts++];
-    fp->fact = SF_PHYS_KASLR_DISABLED;
-    fp->value = 1;
-    fp->conf = CONF_PARSED;
-    fp->origin = ORIGIN_ARCH_SYNTH;
+   * pins through the same rule path a runtime detector uses.
+   *
+   * The pair is a single claim -- a virt disable without its phys partner says
+   * something else -- so both slots are taken together or neither is.
+   *
+   * Room is settled by the call ordering, not by the test below: seeded into an
+   * empty table, the pair always fits. The test is kept for what it protects
+   * against, which is not a full table but a future caller moving this after
+   * capture -- unconditional writes would then run off the end of one. It
+   * records rather than returns quietly, so a broken ordering shows up in the
+   * ledger instead of corrupting memory.
+   *
+   * __extension__ silences -Wpedantic: _Static_assert is a C11 keyword gcc
+   * accepts under -std=c99 as an extension, matching REGION_FIELD_CAP above. */
+  __extension__ _Static_assert(MAX_SCALAR_FACTS >= 2,
+                               "the arch-off pair is seeded into an empty "
+                               "scalar_facts[] and must always fit");
+  if (num_scalar_facts + 1 >= MAX_SCALAR_FACTS) {
+    kasld_discard_record(DISCARD_CAPACITY, DSRC_SCALARS);
+    return;
   }
+  struct scalar_fact_record *fv = &scalar_facts[num_scalar_facts++];
+  fv->fact = SF_VIRT_KASLR_DISABLED;
+  fv->value = 1;
+  fv->conf = CONF_PARSED;
+  fv->origin = ORIGIN_ARCH_SYNTH;
+  struct scalar_fact_record *fp = &scalar_facts[num_scalar_facts++];
+  fp->fact = SF_PHYS_KASLR_DISABLED;
+  fp->value = 1;
+  fp->conf = CONF_PARSED;
+  fp->origin = ORIGIN_ARCH_SYNTH;
 #endif
+}
+
+/* Project the collected facts onto the summary's KASLR state. Runs at summary
+ * time, after components: the scan below reads the whole table, so running it
+ * earlier would see only what the arch seeded and miss every detector. */
+void summarize_kaslr_state(struct summary *s) {
+  /* "Unsupported" is a compile-time property of the arch; no runtime signal
+   * needed. Surface it for the renderer banner, and seed the informational
+   * default address from the statically-initialised layout
+   * (= KERNEL_VIRT_TEXT_DEFAULT). */
+  s->kaslr.unsupported = !KASLR_SUPPORTED;
+  s->kaslr.default_addr = layout.virt_image_base_default;
 
   /* "Disabled" is a runtime signal from any detector that observed virtual
    * KASLR off (nokaslr cmdline, no CONFIG_RANDOMIZE_BASE, dmesg "KASLR
@@ -5003,7 +5036,7 @@ static void report_killed_components(void) {
 static void emit_summary(void) {
   struct summary s = {0};
   compute_component_stats(&s);
-  inject_kaslr_defaults(&s);
+  summarize_kaslr_state(&s);
   /* Resolution runs HERE, at the single caller, not inside the summary builder:
    * a function named for building a summary should not also own when the engine
    * runs. compute_kaslr_info() is then a pure layout+snapshot -> summary
@@ -5373,6 +5406,10 @@ int main(int argc, char *argv[]) {
 #endif
   }
 
+  /* Before the first component: what the arch settles at compile time goes in
+   * while the table is empty and cannot be crowded out of it. */
+  seed_arch_kaslr_facts();
+
   for (int p = 0; p < (int)(sizeof(phases) / sizeof(phases[0])); p++)
     run_phase(&phases[p]); /* merges results after each phase */
 

tests/check-discard-report

@@ -34,11 +34,11 @@
 # THE COUNTS ARE DIFFERENTIAL, and deliberately. The absolute overflow is
 # (emitted - MAX_SCALAR_FACTS) only when nothing else populated the store, which
 # is true of this host's build and NOT a property of the tool:
-# inject_kaslr_defaults() adds two facts under #if !KASLR_SUPPORTED. Asserting
-# the absolute count would be asserting what this build happens to lack. Two
-# runs differing by a known delta must differ in discards by exactly that delta,
-# whatever the store already held -- which is the claim worth making anyway,
-# that the counter keeps counting past the cap.
+# seed_arch_kaslr_facts() fills two slots before any component runs on a
+# !KASLR_SUPPORTED build. Asserting the absolute count would be asserting what
+# this build happens to lack. Two runs differing by a known delta must differ in
+# discards by exactly that delta, whatever the store already held -- which is
+# the claim worth making anyway, that the counter keeps counting past the cap.
 #
 # WHAT THIS DOES NOT COVER: eight of the eleven capacity sources. The engine's
 # seven arrive through discard_project_engine() from saturation bits that no

tests/check-scalar-seed-order

@@ -0,0 +1,104 @@
+#!/bin/sh
+# This file is part of KASLD - https://github.com/bcoles/kasld
+#
+# check-scalar-seed-order — the arch's compile-time facts are seeded into
+# scalar_facts[] before any component can fill it.
+#
+# On a !KASLR_SUPPORTED arch the orchestrator synthesises SF_VIRT_KASLR_DISABLED
+# and SF_PHYS_KASLR_DISABLED, because the engine takes the arch-off signal the
+# same way it takes a detector's. Those two facts used to be appended at summary
+# time, after every component had had its turn at a 64-slot table, and a full
+# table dropped them with no record -- the one evidence loss that never reached
+# the discard ledger.
+#
+# The fix is ordering, not accounting: seeded first, into an empty table, they
+# cannot be crowded out, and any later overflow belongs to a component where
+# capture_scalar() already caps and records it.
+#
+# Ordering is invisible to the suite. Moving the call back after the phase loop
+# leaves `make test` at full marks and `make lint` clean -- measured, not
+# assumed -- because the affected arches are the three that compile
+# !KASLR_SUPPORTED, and nothing in the suite runs a component flood on one. So
+# the invariant is checked where it is legible: in the source.
+#
+#   1. seed_arch_kaslr_facts() is called exactly once, and before the first
+#      run_phase() call. After it, the drop returns.
+#   2. Only capture_scalar() and seed_arch_kaslr_facts() append to the table. A
+#      third appender is how the divergence started -- two writers with
+#      different capacity behaviour, one of them silent.
+#
+# WHAT THIS DOES NOT PROVE: that seeding works. It proves nothing moved the call
+# or added a writer. The behaviour is verified by running a !KASLR_SUPPORTED
+# build against a flooded component directory, which needs qemu and a staged
+# sysroot and is not something grep can do.
+#
+# Pure text, so it needs no build.
+# ---
+# <bcoles@gmail.com>
+
+set -u
+ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+ORCH="$ROOT/src/orchestrator.c"
+
+if [ -t 1 ]; then
+  RED=$(printf '\033[31m')
+  GREEN=$(printf '\033[32m')
+  RESET=$(printf '\033[0m')
+else
+  RED=
+  GREEN=
+  RESET=
+fi
+
+fail=0
+note() {
+  printf '%scheck-scalar-seed-order: FAIL%s — %s\n' "$RED" "$RESET" "$1" >&2
+  fail=1
+}
+
+[ -f "$ORCH" ] || {
+  note "orchestrator.c is missing"
+  exit 1
+}
+
+# --- 1. seeded before the first phase runs -----------------------------------
+# The definition line is excluded so only the call site counts.
+calls=$(grep -n 'seed_arch_kaslr_facts()' "$ORCH" | grep -cv '^\([0-9]*\):void ')
+if [ "$calls" -ne 1 ]; then
+  note "seed_arch_kaslr_facts() is called $calls times; expected exactly once"
+fi
+
+seed_ln=$(grep -n '^  seed_arch_kaslr_facts();' "$ORCH" | head -1 | cut -d: -f1)
+phase_ln=$(grep -n 'run_phase(&phases\[p\]);' "$ORCH" | head -1 | cut -d: -f1)
+
+if [ -z "$seed_ln" ]; then
+  note "no top-level call to seed_arch_kaslr_facts() in main()"
+elif [ -z "$phase_ln" ]; then
+  note "could not find the run_phase() loop; the ordering cannot be checked"
+elif [ "$seed_ln" -ge "$phase_ln" ]; then
+  note "seed_arch_kaslr_facts() (line $seed_ln) runs at or after the phase loop (line $phase_ln)"
+  printf '  Seeded after capture, the arch-off pair competes with components for\n' >&2
+  printf '  slots and a full table drops it -- the loss this ordering removes.\n' >&2
+fi
+
+# --- 2. only the two known writers append ------------------------------------
+# awk tracks the enclosing top-level function so an append is attributed rather
+# than merely counted.
+bad=$(awk '
+  /^[a-z_].*\(.*\)[ ]*\{[ ]*$/ { fn = $0; sub(/\(.*/, "", fn); sub(/.* /, "", fn) }
+  /^(static )?[a-z_].*[a-z_]+\(/ && /\{[ ]*$/ { fn2 = $0 }
+  /scalar_facts\[num_scalar_facts\+\+\]/ {
+    if (fn != "capture_scalar" && fn != "seed_arch_kaslr_facts")
+      print NR ": " fn
+  }' "$ORCH")
+
+if [ -n "$bad" ]; then
+  note "scalar_facts[] is appended outside capture_scalar() and seed_arch_kaslr_facts():"
+  printf '%s\n' "$bad" | sed 's/^/    /' >&2
+fi
+
+if [ "$fail" -ne 0 ]; then
+  exit 1
+fi
+printf '%scheck-scalar-seed-order: OK%s (seeded at line %s, before the phase loop at %s; two known writers)\n' \
+  "$GREEN" "$RESET" "$seed_ln" "$phase_ln"