test(node): cover the RSS readers, including the Linux one that never ran

`process_rss_bytes` had no test at all, and its Linux branch had never
executed: `/proc/self/status` parsing is `cfg`-compiled out on the macOS
development host, so it would have run for the first time in production — on
the one number the UTXO memory attribution divides against. A wrong denominator
there silently misprices every encoding decision made from it.

Splits the two parsers out of the platform `cfg` so both are compiled and
tested everywhere, and covers them with the kernel's actual format:
kibibytes with variable leading whitespace, `VmHWM`/`VmSize` sitting adjacent
with the same prefix shape, the field absent entirely for a kernel thread, and
non-numeric or overflowing values.

Adds an end-to-end assertion too, because a parser test cannot catch a reader
that returns a plausible constant: allocate 128 MB, touch every page so it is
resident rather than merely reserved, and require the reading to move by at
least half of it.

`allow(dead_code)` rather than `expect`, deliberately: each parser is live in
one platform's library build and dead in the other's, but *both* are live in
every test build, so an `expect` would itself be unfulfilled half the time.

Author: rabbitson87

crates/node/src/metrics.rs

@@ -181,16 +181,7 @@ impl HistogramFn for HistogramHandle {
 pub fn process_rss_bytes() -> Option<u64> {
     #[cfg(target_os = "linux")]
     {
-        let status = std::fs::read_to_string("/proc/self/status").ok()?;
-        status.lines().find_map(|line| {
-            let value = line.strip_prefix("VmRSS:")?;
-            value
-                .split_whitespace()
-                .next()?
-                .parse::<u64>()
-                .ok()?
-                .checked_mul(1024)
-        })
+        parse_proc_status_rss(&std::fs::read_to_string("/proc/self/status").ok()?)
     }
     #[cfg(not(target_os = "linux"))]
     {
@@ -200,13 +191,46 @@ pub fn process_rss_bytes() -> Option<u64> {
             .args(["-o", "rss=", "-p", &std::process::id().to_string()])
             .output()
             .ok()?;
-        String::from_utf8(output.stdout)
-            .ok()?
-            .trim()
+        parse_ps_rss(&String::from_utf8(output.stdout).ok()?)
+    }
+}
+
+/// Extracts `VmRSS` from `/proc/{pid}/status` content, in bytes.
+///
+/// Split out from the read so it is testable off Linux. Without this the parser
+/// is `cfg`-compiled out of every run on a macOS development host and first
+/// executes in production, on the one path whose output the memory attribution
+/// divides by.
+///
+/// The kernel reports `VmRSS:` in kibibytes with variable leading whitespace,
+/// and the field is absent for a kernel thread.
+// Unreachable off Linux, and deliberately still compiled there: the point of
+// splitting it out is that its tests run everywhere, which they cannot do if
+// the function is `cfg`-ed away with its caller.
+#[cfg_attr(
+    not(target_os = "linux"),
+    allow(dead_code, reason = "tested on every host, called only on Linux")
+)]
+fn parse_proc_status_rss(status: &str) -> Option<u64> {
+    status.lines().find_map(|line| {
+        line.strip_prefix("VmRSS:")?
+            .split_whitespace()
+            .next()?
             .parse::<u64>()
             .ok()?
             .checked_mul(1024)
-    }
+    })
+}
+
+/// Extracts the kibibyte count `ps -o rss=` prints, in bytes.
+// Mirror of the note on `parse_proc_status_rss`: unreachable on Linux, still
+// compiled and still tested there.
+#[cfg_attr(
+    target_os = "linux",
+    allow(dead_code, reason = "tested on every host, called only off Linux")
+)]
+fn parse_ps_rss(output: &str) -> Option<u64> {
+    output.trim().parse::<u64>().ok()?.checked_mul(1024)
 }
 
 /// Installs in-memory process metrics and returns its handle when configured.
@@ -258,6 +282,107 @@ mod tests {
 
     use super::*;
 
+    /// Real `/proc/{pid}/status` content, so the Linux parser is exercised on
+    /// every host rather than only wherever CI happens to run Linux.
+    ///
+    /// The field is kibibytes with variable leading whitespace, sits between
+    /// other `Vm*` keys that share its prefix shape, and is absent for a kernel
+    /// thread.
+    #[test]
+    fn proc_status_rss_is_parsed_from_the_kernel_format() {
+        const STATUS: &str = "\
+Name:\tbitcoin-rs
+Umask:\t0022
+State:\tS (sleeping)
+VmPeak:\t14680064 kB
+VmSize:\t14680064 kB
+VmLck:\t       0 kB
+VmHWM:\t 3019751 kB
+VmRSS:\t 2949952 kB
+RssAnon:\t 2900000 kB
+Threads:\t17
+";
+        assert_eq!(
+            super::parse_proc_status_rss(STATUS),
+            Some(2_949_952 * 1024),
+            "VmRSS must be read in kibibytes and returned in bytes"
+        );
+
+        // `VmHWM` and `VmSize` share the prefix shape and must not be taken.
+        assert_ne!(super::parse_proc_status_rss(STATUS), Some(3_019_751 * 1024));
+
+        // A kernel thread has no `VmRSS` at all.
+        assert_eq!(
+            super::parse_proc_status_rss("Name:\tkthreadd\nThreads:\t1\n"),
+            None
+        );
+        assert_eq!(super::parse_proc_status_rss(""), None);
+        assert_eq!(
+            super::parse_proc_status_rss("VmRSS:\tnot-a-number kB"),
+            None
+        );
+        assert_eq!(super::parse_proc_status_rss("VmRSS:\t"), None);
+    }
+
+    #[test]
+    fn ps_rss_output_is_parsed_in_kibibytes() {
+        assert_eq!(super::parse_ps_rss(" 2949952\n"), Some(2_949_952 * 1024));
+        assert_eq!(super::parse_ps_rss(""), None);
+        assert_eq!(super::parse_ps_rss("  "), None);
+        assert_eq!(super::parse_ps_rss("garbage"), None);
+        // A value large enough to overflow the kibibyte conversion.
+        assert_eq!(super::parse_ps_rss(&u64::MAX.to_string()), None);
+    }
+
+    /// The reading must track real resident memory, not merely return a number.
+    ///
+    /// Asserting only `is_some()` would pass for a stub returning a constant,
+    /// and this figure is what the memory-attribution reporting divides the
+    /// UTXO set against — a wrong denominator silently misprices every
+    /// encoding decision made from it. So the test allocates, touches every
+    /// page to make it resident rather than merely reserved, and requires the
+    /// reading to move.
+    ///
+    /// It is also the only coverage the Linux branch has: `/proc/self/status`
+    /// is `cfg`-compiled out on the development host, so this parser runs for
+    /// the first time wherever CI runs Linux.
+    #[test]
+    fn process_rss_bytes_tracks_a_real_allocation() {
+        const BALLAST_BYTES: u64 = 128 << 20;
+        const PAGE: usize = 4096;
+
+        let Some(before) = process_rss_bytes() else {
+            // A platform with neither `/proc` nor `ps` is a legitimate `None`.
+            return;
+        };
+        assert!(
+            before > (1 << 20),
+            "implausibly small RSS before allocating: {before} bytes"
+        );
+
+        let mut ballast = vec![0_u8; usize::try_from(BALLAST_BYTES).unwrap_or(0)];
+        for page in ballast.chunks_mut(PAGE) {
+            if let Some(first) = page.first_mut() {
+                *first = 1;
+            }
+        }
+
+        // `unwrap_or(0)` rather than `expect`: a `None` here fails the
+        // assertion below with the reading it produced, which says more than a
+        // panic message would.
+        let after = process_rss_bytes().unwrap_or(0);
+        assert!(
+            after >= before + (BALLAST_BYTES / 2),
+            "RSS did not track a {BALLAST_BYTES}-byte resident allocation: {before} -> {after}"
+        );
+
+        // Keep the ballast alive across the second reading.
+        assert_eq!(
+            u64::try_from(std::hint::black_box(&ballast).len()).unwrap_or(0),
+            BALLAST_BYTES
+        );
+    }
+
     #[test]
     fn install_metrics_returns_error_when_global_recorder_install_fails() {
         let bind = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);