Interview Review Checklist

// ROBUST ANSWERING PROCESS: every claim carries its class, and the
// class is established by whether a reconstruction exists.
package knowledge_provenance_pkg;
  typedef enum int { K_RECOGNISED, K_RECALLED, K_DERIVED } kclass_e;

  typedef struct {
    string   claim;
    kclass_e kclass;
    string   rebuild_from;   // empty unless K_DERIVED
    string   source;         // empty unless K_RECALLED or K_DERIVED
  } claim_t;

  // ILLUSTRATIVE, twelve claims spanning the three classes.
  claim_t CLAIMS[] = '{
    '{"BL8 on a 64-bit bus moves 64 bytes", K_DERIVED,
      "8 beats x 8 bytes", "12.x burst arithmetic"},
    '{"a row must stay open tRAS before precharge", K_RECALLED,
      "", "14.x tRAS"},
    '{"tRCD is the activate-to-column delay", K_RECALLED, "", "14.x tRCD"},
    '{"peak BW = rate x width", K_DERIVED, "MT/s x bytes", "23.2"},
    '{"a conflict costs tRP + tRCD and a miss costs tRCD", K_DERIVED,
      "the row-state transition", "23.3"},
    '{"refresh costs a few percent of bandwidth", K_RECALLED,
      "", "15.x refresh"},
    '{"open-page wins above a 50% hit rate", K_RECOGNISED, "", ""},
    '{"DDR5 is faster because of bank groups", K_RECOGNISED, "", ""},
    '{"training runs once at boot", K_RECOGNISED, "", ""},
    '{"the count needs clog2(N+1) bits", K_DERIVED,
      "N+1 distinct values", "33.2 section 6"},
    '{"a done flag can mean five things", K_RECALLED, "", "28.4 section 2"},
    '{"costs compose multiplicatively", K_DERIVED,
      "efficiency factors multiply", "23.2"}
  };
endpackage

module knowledge_provenance (
    input  logic       clk,
    input  logic       rst_n,
    input  logic       audit,
    input  logic       ask_why,
    input  logic [3:0] claim_id,
    output logic       survives_why,
    output logic [3:0] derived_count,
    output logic [3:0] recalled_count,
    output logic [3:0] recognised_count,
    output logic [3:0] survives_one_why,
    output logic       answer_sound
);
  import knowledge_provenance_pkg::*;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      survives_why <= 1'b0; derived_count <= '0; recalled_count <= '0;
      recognised_count <= '0; survives_one_why <= '0; answer_sound <= 1'b0;
    end else begin
      // The follow-up test, mechanised: a claim survives one `why` iff
      // it has a rebuild or a source. Recognition has neither.
      if (ask_why)
        survives_why <= (CLAIMS[claim_id].kclass != K_RECOGNISED);

      if (audit) begin
        automatic int d = 0, r = 0, g = 0, s = 0;
        foreach (CLAIMS[i]) begin
          case (CLAIMS[i].kclass)
            K_DERIVED:    begin d++; s++; end
            K_RECALLED:   begin r++; s++; end
            default:      g++;
          endcase
        end
        derived_count    <= 4'(d);
        recalled_count   <= 4'(r);
        recognised_count <= 4'(g);
        survives_one_why <= 4'(s);
        // An answer is sound when nothing in it is RECOGNISED, or when
        // the recognised parts are LABELLED -- which is section 12's item.
        answer_sound     <= (g == 0);
      end
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: confidence instead of class.
//
//   // the only field tracked is how sure it feels
//   typedef struct { string claim; int confidence_pct; } claim_t;
//   ...
//   answer_sound <= (min_confidence >= 80);      // <-- the defect
//
// CONTRACT VIOLATED: nothing anybody states as a rule. Confidence is
// what an engineer actually has access to, which is the problem.
//
// WHY IT SURVIVES: confidence correlates with correctness well enough
// to be useful most of the time. The three recognised claims above are
// all things a working DDR engineer would state at high confidence,
// and two of the three are wrong.
//
// TRACE (ILLUSTRATIVE, the twelve claims above, each given a
// self-reported confidence):
//   derived    5 claims, confidence 90-95%
//   recalled   4 claims, confidence 85-95%
//   recognised 3 claims, confidence 85-90%   <-- indistinguishable
//
//   robust: derived 5, recalled 4, RECOGNISED 3, survives_one_why 9,
//           answer_sound 0 -- and it NAMES the three.
//   weak:   min_confidence 85 >= 80 -> answer_sound 1, all twelve.
//
//   and what the three recognised claims are worth:
//     "open-page wins above a 50% hit rate"
//        -- 33.5 section 12 measured close-page winning by 22.5% AT a 62%
//           hit rate. The crossover is not at a hit rate at all.
//     "DDR5 is faster because of bank groups"
//        -- bank groups are DDR4's; 34.x is the module that takes this
//           one apart. The claim conflates two generations.
//     "training runs once at boot"
//        -- 19.5 section 4 owns the one-time versus continuous split, and
//           33.3 section 10 is a whole review item about the continuous side.
//
//   gap: three claims at 85-90% self-reported confidence, two of them
//   flatly wrong and one wrong in a way that inverts a design decision.
//   Confidence did not separate them from the nine that survive a `why`.

// ROBUST PROCESS: numbers are computed from inputs, so changing an
// input changes the answer.
module number_reconstruction #(
    parameter int BUS_BYTES = 8       // STRUCTURAL: 64-bit bus
)(
    input  logic        clk,
    input  logic        rst_n,
    input  logic        ask,
    input  logic [2:0]  which,
    // the inputs a speaker must also know
    input  logic [15:0] mt_per_s_x100,   // ILLUSTRATIVE: MT/s / 100
    input  logic [15:0] burst_len,
    input  logic [15:0] trcd_cyc,
    input  logic [15:0] trp_cyc,
    input  logic [15:0] hit_pct,
    output logic        answer_valid,
    output logic [31:0] answer,
    output logic        reconstructible
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      answer_valid <= 1'b0; answer <= '0; reconstructible <= 1'b0;
    end else if (ask) begin
      answer_valid    <= 1'b1;
      reconstructible <= 1'b1;
      case (which)
        // STRUCTURAL identities, each rebuilt rather than stored.
        3'd0: answer <= 32'(burst_len) * 32'(BUS_BYTES);           // bytes/burst
        3'd1: answer <= 32'(mt_per_s_x100) * 32'(BUS_BYTES) / 32'd100; // MB/s
        3'd2: answer <= 32'(trcd_cyc) + 32'(trp_cyc);              // conflict cost
        3'd3: answer <= 32'(trcd_cyc);                             // miss cost
        // a weighted mean: the row-work cost per access, which is what
        // 23.3's comparison actually turns on.
        3'd4: answer <= ((32'(hit_pct) * 32'(trcd_cyc))
                       + ((32'd100 - 32'(hit_pct))
                          * (32'(trcd_cyc) + 32'(trp_cyc)))) / 32'd100;
        default: begin answer <= '0; reconstructible <= 1'b0; end
      endcase
    end else begin
      answer_valid <= 1'b0;
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: a lookup table of remembered
// numbers.
//
//   localparam int REMEMBERED [0:4] = '{64, 12800, 28, 14, 18};
//   ...
//   answer <= REMEMBERED[which];          // <-- the defect
//
// CONTRACT VIOLATED: 33.3 section 6's calculated/measured line, applied to
// a speaker. Every remembered number is a MEASURED quantity of one
// configuration, quoted as a calculated one.
//
// WHY IT SURVIVES: every value in the table is correct -- at
// DDR4-1600, 64-bit, tRCD 14, tRP 14, 71% hits. They were learned on a
// real system and they are exactly right there. And precision sounds
// like knowledge: "28 cycles" is more convincing than "tRP plus tRCD".
//
// TRACE (ILLUSTRATIVE, the follow-up is "and at DDR5-6400, tRCD 24,
// tRP 24, 45% hits?"):
//   which=0  bytes per burst, BL8, 64-bit
//     robust: 8 * 8 = 64.   weak: 64.        AGREE
//   which=1  peak MB/s
//     robust: 6400 * 8 = 51200.  weak: 12800.   WRONG by 4x
//   which=2  conflict cost
//     robust: 24 + 24 = 48.      weak: 28.      WRONG by 1.7x
//   which=3  miss cost
//     robust: 24.                weak: 14.      WRONG by 1.7x
//   which=4  row-work per access
//     robust: (45*24 + 55*48)/100 = (1080 + 2640)/100 = 37.2 -> 37
//     weak:   18.                                WRONG by 2.1x
//
//   robust: 5 of 5 reconstructible, 5 of 5 correct at the new config
//   weak:   1 of 5 correct -- and the one it gets right is the one
//           that does not depend on any of the changed inputs
//
//   gap: 4 of 5 numbers wrong by factors of 1.7x to 4x, all quoted at
//   full confidence, and the single agreement is the identity that has
//   no configuration in it.

// ROBUST PROCESS: an answer carries its omissions, and a claimed scope
// is compared against what was covered.
module omission_awareness #(
    parameter int NDIM = 8
)(
    input  logic       clk,
    input  logic       rst_n,
    input  logic       answer,
    input  logic [NDIM-1:0] dims_relevant,   // what the question touches
    input  logic [NDIM-1:0] dims_covered,    // what the answer addressed
    input  logic [NDIM-1:0] dims_named,      // what the answer said it omits
    output logic [NDIM-1:0] omitted,
    output logic [NDIM-1:0] unnamed_omissions,
    output logic [3:0] omitted_count,
    output logic [3:0] unnamed_count,
    output logic       scope_honest
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      omitted <= '0; unnamed_omissions <= '0;
      omitted_count <= '0; unnamed_count <= '0; scope_honest <= 1'b0;
    end else if (answer) begin
      automatic logic [NDIM-1:0] om = dims_relevant & ~dims_covered;
      automatic logic [NDIM-1:0] un = om & ~dims_named;
      omitted           <= om;
      unnamed_omissions <= un;
      omitted_count     <= 4'($countones(om));
      unnamed_count     <= 4'($countones(un));
      // Honesty is not completeness. An answer may omit anything as
      // long as it says so -- which is exactly 33.7 section 10's rule about
      // eliminated versus never examined.
      scope_honest      <= ($countones(un) == 0);
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: cover what you know.
//
//   scope_honest <= ($countones(dims_covered) != 0);   // <-- the defect
//   // and `dims_named` does not exist
//
// CONTRACT VIOLATED: nothing. The answer is correct about everything it
// addresses.
//
// WHY IT SURVIVES: an answer that addresses four of eight relevant
// dimensions, correctly and in detail, is a good answer. Nothing in it
// is wrong. And adding "I have not addressed refresh or thermals" reads
// as weakness to a speaker and as scope to a listener -- so the
// incentive runs the wrong way.
//
// TRACE (ILLUSTRATIVE, the question is "how would you improve this
// controller's memory bandwidth?"; eight relevant dimensions:
// 0 scheduling  1 page policy  2 address mapping  3 burst size
// 4 refresh  5 turnaround  6 requester mix  7 thermals):
//   an answer covering scheduling, page policy, address mapping and
//   burst size -- the four a controller engineer owns:
//   robust: omitted = {refresh, turnaround, requester mix, thermals}
//           dims_named = {} -> unnamed_count 4, scope_honest 0
//           With one sentence -- "I have not covered refresh,
//           turnaround, the requester mix or thermals; the first two
//           are device-bounded and the last two are outside the
//           controller" -- unnamed_count 0, scope_honest 1.
//   weak:   four dimensions covered, answer complete.
//
//   and the cost of the omission, measured against this module:
//     requester mix   -- 33.5 section 9 found the requester owns 1116 of
//                        4096 cycles, larger than any controller lever
//     turnaround      -- 33.5 section 9's rejected proposal: ceiling 180
//                        cycles against a 700-cycle gap
//   gap: 4 unnamed omissions, and one of them contains the largest
//   available lever. The answer is not wrong; its scope is claimed
//   rather than stated, and the claimed scope excludes the answer.

// ROBUST PROCESS: a conditional answer is three fields, and fewer than
// three is not an answer.
module it_depends_structure #(
    parameter int NCOND = 6
)(
    input  logic       clk,
    input  logic       rst_n,
    input  logic       state_conditional,
    input  logic       names_variable,
    input  logic       names_direction,
    input  logic [7:0] magnitude_x10,     // 0 = not given
    output logic       conditional_complete,
    output logic [3:0] complete_count,
    output logic [3:0] hedge_count,
    output logic [3:0] partial_count
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      conditional_complete <= 1'b0; complete_count <= '0;
      hedge_count <= '0; partial_count <= '0;
    end else if (state_conditional) begin
      automatic bit all3 = names_variable && names_direction
                        && (magnitude_x10 != 8'd0);
      conditional_complete <= all3;
      if (all3)
        complete_count <= complete_count + 1'b1;
      else if (!names_variable)
        // No variable: this is a hedge, and it is the only case that
        // carries no information at all.
        hedge_count <= hedge_count + 1'b1;
      else
        partial_count <= partial_count + 1'b1;
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: the variable is enough.
//
//   conditional_complete <= names_variable;      // <-- the defect
//
// CONTRACT VIOLATED: nothing stated. Naming the variable is already
// better than a bare hedge, and most engineers stop there.
//
// WHY IT SURVIVES: "it depends on the access pattern" is true,
// specific, and sounds like an answer. It is one part of three.
//
// TRACE (ILLUSTRATIVE, six conditional answers):
//   1 "depends on the access pattern"
//       variable yes, direction no, magnitude no  -> PARTIAL
//   2 "depends on the row-hit rate -- below about 50% close-page wins,
//      and the gap is around 20% of row-work cycles"
//       all three  -> COMPLETE.  (And 33.5 section 12 is the qualification:
//       the crossover is in row-work CYCLES, not at a hit rate.)
//   3 "it varies by implementation"
//       variable no  -> HEDGE
//   4 "depends on whether the PHY or the controller owns gate
//      placement; if the controller computes it, a board change breaks
//      it, and 33.3 section 6 measured that as working on exactly one board"
//       all three  -> COMPLETE
//   5 "depends on the workload"
//       variable named but at a uselessly coarse grain, no direction,
//       no magnitude -> PARTIAL
//   6 "depends on the requester mix -- more deadline-bearing requesters
//      moves the binding constraint from bandwidth to latency, and
//      33.5 section 8 measured two workloads at identical occupancy with
//      opposite bounds"
//       all three  -> COMPLETE
//
//   robust: complete 3, partial 2, HEDGE 1
//   weak:   5 of 6 "complete" -- it counts answers 1 and 5 as complete
//           because both name a variable.
//
//   gap: two answers that name a variable and say nothing about how the
//   answer moves, counted as informative. And answer 5 is the more
//   damaging of the two, because "the workload" is a variable name so
//   coarse that naming it eliminates nothing -- which is 33.7 section 7's
//   finding about experiments that perturb a shared condition.

// ROBUST PROCESS: a recommendation carries a cost in a named currency.
package recommendation_cost_pkg;
  typedef enum int { CUR_LATENCY, CUR_BANDWIDTH, CUR_POWER, CUR_AREA,
                     CUR_BOOT_TIME, CUR_COMPLEXITY, CUR_NONE } cur_e;

  typedef struct {
    string rec;
    cur_e  cost_currency;
    int    cost_x10;        // magnitude, x10, in that currency's units
    string owner;           // who pays
  } rec_t;

  // ILLUSTRATIVE, six recommendations this track has the numbers for.
  rec_t RECS[] = '{
    '{"reorder to favour row hits",  CUR_LATENCY,    250, "tail requesters"},
    '{"switch to close-page",        CUR_BANDWIDTH,  120, "hit-heavy streams"},
    '{"widen the burst",             CUR_BANDWIDTH,  500, "scatter traffic"},
    '{"raise the refresh rate",      CUR_BANDWIDTH,   40, "everyone"},
    '{"widen the training sweep",    CUR_BOOT_TIME,  330, "boot"},
    '{"add a second channel",        CUR_AREA,       100, "the floorplan"}
  };
endpackage

module recommendation_cost (
    input  logic       clk,
    input  logic       rst_n,
    input  logic       audit,
    output logic [3:0] with_cost,
    output logic [3:0] without_cost,
    output logic [3:0] with_owner,
    output logic       recommendations_weighable
);
  import recommendation_cost_pkg::*;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      with_cost <= '0; without_cost <= '0; with_owner <= '0;
      recommendations_weighable <= 1'b0;
    end else if (audit) begin
      automatic int c = 0, n = 0, o = 0;
      foreach (RECS[i]) begin
        if ((RECS[i].cost_currency != CUR_NONE) && (RECS[i].cost_x10 != 0)) begin
          c++;
          // The owner is the field that makes a cost weighable. A cost
          // nobody is named as paying is a cost nobody objects to --
          // 33.5 section 9's `owner_cycles` finding, in a sentence.
          if (RECS[i].owner != "") o++;
        end else begin
          n++;
        end
      end
      with_cost    <= 4'(c);
      without_cost <= 4'(n);
      with_owner   <= 4'(o);
      recommendations_weighable <= (n == 0) && (o == c);
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: the benefit alone.
//
//   typedef struct { string rec; int benefit_pct; } rec_t;
//   recommendations_weighable <= 1'b1;        // <-- the defect
//
// CONTRACT VIOLATED: 23.4's gain/cost pairing and 23.5's result that
// neither fixed policy wins across workloads.
//
// WHY IT SURVIVES: the benefits are real and measured. Reordering does
// improve throughput. Close-page does help conflict-heavy streams.
// Every recommendation in the list works.
//
// TRACE (ILLUSTRATIVE, the six recommendations above):
//   robust: with_cost 6, with_owner 6, without_cost 0,
//           recommendations_weighable 1
//     -- and two of the six become obviously wrong once the cost is
//        stated:
//        "widen the burst" costs 50% of payload efficiency on scatter
//          traffic -- 33.5 section 6's BC4 trace in reverse
//        "widen the training sweep" costs 33% more boot time --
//          33.4 section 18's M14, which every gate in this module passed
//   weak:   six benefits, no costs, all weighable
//
//   gap: six recommendations with no cost and no payer. Two of the six
//   are net-negative for the traffic they were proposed for, and
//   neither is wrong about its benefit.

// ROBUST PROCESS: every claim carries a validity region and the
// mechanism that bounds it.
module claim_boundary #(
    parameter int NCLAIM = 6
)(
    input  logic       clk,
    input  logic       rst_n,
    input  logic       audit,
    input  logic [5:0] has_boundary,     // per claim
    input  logic [5:0] boundary_is_mechanism,  // vs "I have not seen it fail"
    output logic [3:0] bounded_count,
    output logic [3:0] mechanism_count,
    output logic [3:0] unbounded_count,
    output logic       claims_scoped
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      bounded_count <= '0; mechanism_count <= '0;
      unbounded_count <= '0; claims_scoped <= 1'b0;
    end else if (audit) begin
      bounded_count   <= 4'($countones(has_boundary));
      // A boundary given as a MECHANISM is a claim about why; one given
      // as experience is a claim about the speaker's history, which is
      // 33.6 section 7's "the order has always worked" in a sentence.
      mechanism_count <= 4'($countones(has_boundary & boundary_is_mechanism));
      unbounded_count <= 4'(NCLAIM - $countones(has_boundary));
      claims_scoped   <= (has_boundary == 6'b111111)
                      && (boundary_is_mechanism == 6'b111111);
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: state the claim.
//
//   claims_scoped <= 1'b1;        // <-- the defect
//
// CONTRACT VIOLATED: 18.4 section 1's grades. Every claim below is grade A
// or C -- true for a named configuration or recovered by measurement --
// and stating it unbounded consumes it as grade B.
//
// TRACE (ILLUSTRATIVE, six general claims, with their real boundaries):
//   1 "open-page is the right default"
//       boundary: fails below the row-work crossover -- 23.5 owns the
//       closed form, and 33.5 section 12 measured close-page winning at a
//       62% hit rate.  MECHANISM: conflict costs tRP + tRCD.
//   2 "refresh costs a few percent"
//       boundary: fails at high temperature, where the refresh rate
//       doubles -- 15.x owns the mechanism.  MECHANISM: retention.
//   3 "more banks means more parallelism"
//       boundary: fails once tFAW binds -- 14.8 owns the rolling
//       activate window.  MECHANISM: four activates per window.
//   4 "wider bursts are more efficient"
//       boundary: fails on scatter traffic -- 12.4 owns the payload
//       measure.  MECHANISM: discarded bytes.
//   5 "the controller is the bottleneck"
//       boundary: fails when the requester mix is the variable --
//       Module 32's spine.  MECHANISM: 33.5 section 9's owner_cycles.
//   6 "training establishes margin"
//       boundary: false as stated -- training establishes that a
//       setting was COMMITTED.  MECHANISM: 28.1 section 5's one-tap window.
//
//   robust: bounded 6, mechanism 6, unbounded 0, claims_scoped 1
//   weak:   six claims, all unbounded, all "scoped"
//
//   gap: six claims, each true inside a region and stated as universal.
//   And claim 6 is the one to notice: it is not a claim with a boundary,
//   it is a claim that is FALSE as stated -- 33.6 section 14 found it as one
//   of three unlicensed margin assumptions in a bring-up plan.

// ROBUST PROCESS: reaching the edge produces a named experiment with
// interpreted outcomes.
module unknown_protocol (
    input  logic       clk,
    input  logic       rst_n,
    input  logic       reach_edge,
    input  logic       admits,
    input  logic       names_experiment,
    input  logic       interprets_outcomes,   // what each result would mean
    input  logic       names_bound,           // what you DO know around it
    output logic [2:0] continuation,          // 0 guess 1 stop 2 experiment
    output logic [3:0] edges_reached,
    output logic [3:0] edges_productive,
    output logic [3:0] edges_guessed
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      continuation <= '0; edges_reached <= '0;
      edges_productive <= '0; edges_guessed <= '0;
    end else if (reach_edge) begin
      edges_reached <= edges_reached + 1'b1;
      if (!admits) begin
        continuation  <= 3'd0;
        edges_guessed <= edges_guessed + 1'b1;
      end else if (names_experiment && interprets_outcomes) begin
        continuation     <= 3'd2;
        edges_productive <= edges_productive + 1'b1;
      end else begin
        continuation <= 3'd1;
      end
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: fill the gap.
//
//   // there is no `admits` path at all; every edge produces an answer
//   continuation <= 3'd0;
//
// CONTRACT VIOLATED: nothing stated. And note the incentive: in most
// rooms, a plausible answer is rewarded over an admission.
//
// WHY IT SURVIVES: the guesses are usually reasonable, because they are
// produced by the same intuition that produces the correct answers.
// They are right often enough that the strategy has a positive record.
//
// TRACE (ILLUSTRATIVE, four questions reaching the speaker's edge):
//   Q1 "what is tRFC on this part?"
//     robust: admits; experiment = "read it from the datasheet's speed
//       bin table"; outcomes: any value, and the bound I do know is
//       that it scales with density.  -> PRODUCTIVE
//     weak:   "about 350 nanoseconds" -- a figure for a different
//       density, stated with no bin.  33.5 section 14's defect, spoken.
//   Q2 "does this controller reorder across bank groups?"
//     robust: admits; experiment = "read the scheduler's legality mask
//       and check whether bank group is in it"; outcomes: in the mask
//       means no reorder, absent means it may.  -> PRODUCTIVE
//     weak:   "it should" -- a guess about a design choice.
//   Q3 "why did the training bitmap come back all zeros?"
//     robust: admits that the bitmap does not say; experiment =
//       33.7 section 6's discriminator with the highest yield; outcomes
//       eliminate two of six causes.  -> PRODUCTIVE
//     weak:   "marginal read margin" -- one of six, and 33.7 section 6's
//       trace has the planted cause elsewhere.
//   Q4 "will this pass at the top bin?"
//     robust: admits; experiment = "measure the window width at the
//       top bin"; outcomes: a width above the drift budget passes.
//       -> PRODUCTIVE, and it is 33.6 section 14's missing bring-up stage.
//     weak:   "it should be fine" -- unfalsifiable, which is
//       33.7 section 13's defect.
//
//   robust: edges_reached 4, productive 4, guessed 0
//   weak:   edges_reached 4, guessed 4
//
//   gap: four guesses, three of which reproduce a defect this module
//   already documented -- an operating point dropped, a cause named
//   from a set of six, and an unfalsifiable prediction.

// ROBUST PROCESS: the seven questions, applied and scored.
module self_gate_audit (
    input  logic       clk,
    input  logic       rst_n,
    input  logic       audit,
    input  logic [6:0] gate_asked,     // did you ask it?
    input  logic [6:0] gate_passed,    // did the answer survive?
    output logic [3:0] asked_count,
    output logic [3:0] passed_count,
    output logic [3:0] unasked_count,
    output logic [2:0] first_unasked,
    output logic       answer_reviewed
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      asked_count <= '0; passed_count <= '0; unasked_count <= '0;
      first_unasked <= 3'd7; answer_reviewed <= 1'b0;
    end else if (audit) begin
      automatic int firstu = 7;
      for (int g = 0; g < 7; g++)
        if (!gate_asked[g] && (firstu == 7)) firstu = g;
      asked_count   <= 4'($countones(gate_asked));
      // A gate can only be passed if it was asked. Counting a pass on
      // an unasked gate is the defect, and it is the same shape as
      // 33.7 section 10's omission recorded as an elimination.
      passed_count  <= 4'($countones(gate_asked & gate_passed));
      unasked_count <= 4'(7 - $countones(gate_asked));
      first_unasked <= 3'(firstu);
      answer_reviewed <= (gate_asked == 7'b1111111);
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: knowing the checklists.
//
//   answer_reviewed <= 1'b1;      // I have read all eight chapters
//
// CONTRACT VIOLATED: nothing. And the failure is not ignorance -- the
// speaker knows every question in the table above.
//
// WHY IT SURVIVES: knowing a checklist and applying it to yourself are
// different acts, and the first feels like the second. 33.7 section 19 found
// five of eight debug items answerable without domain knowledge, and
// they still go unasked -- because asking requires stopping.
//
// TRACE (ILLUSTRATIVE, one answer: "the row-hit rate is 71%, so
// open-page is the right policy here"):
//   robust, seven questions asked:
//     33.1  what mechanism?  -- a page policy in the scheduler. ASKED, PASS
//     33.2  every input?     -- pictured a streaming workload only. FAIL
//     33.3  measured on what? -- 71% came from one trace. FAIL
//     33.4  obtainable?      -- the listener cannot check 71%. FAIL
//     33.5  divide by what?  -- hits over (hits+miss+conflict); and
//           33.5 section 12 says the comparison needs row-work CYCLES. FAIL
//     33.6  licenses what?   -- it licenses nothing about margin or
//           bandwidth, and the sentence implies both. FAIL
//     33.7  how many causes? -- not a cause question. ASKED, PASS
//     asked 7, passed 2, unasked 0 -> the sentence is revised before
//     it is spoken: "on this trace the hit rate is 71%; whether
//     open-page wins depends on row-work cycles, and at this conflict
//     rate it is close."
//   weak: asked 0, and the original sentence is spoken.
//
//   gap: five of seven gates fail on a sentence that is arithmetically
//   correct and would pass unchallenged in most rooms. And the revision
//   is one sentence longer.

// ROBUST PROCESS: a proposed property is classified against the twelve
// before it is offered.
package self_variety_pkg;
  typedef enum int {
    V1_NARROW_TIME, V2_NO_KEY_SIGNAL, V3_INEXPRESSIBLE,
    V4_SHARED_MODEL, V5_NO_RANGE, V6_VACUOUS,
    V7_NOT_INDEPENDENT, V8_NO_CONSERVATISM, V9_RESET_GUARD,
    V10_PARAM_CONDITIONAL, V11_EVIDENCE_GRADE, V12_NO_MAGNITUDE,
    V_NONE
  } variety_e;
endpackage

module self_variety_audit (
    input  logic       clk,
    input  logic       rst_n,
    input  logic       propose,
    // 30.9 section 7's three questions, as inputs
    input  logic       names_a_signal,
    input  logic       signal_is_shared_constant,
    input  logic       antecedent_reachable_known,
    input  logic       covers_a_window,
    input  logic       forbids_only,
    input  logic       obligation_comparative,
    input  logic       value_is_derived,
    input  logic       has_unbounded_parameter,
    output logic [3:0] variety_found,
    output logic       property_offerable,
    output logic [3:0] proposals_clean,
    output logic [3:0] proposals_flagged
);
  import self_variety_pkg::*;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      variety_found <= 4'(V_NONE); property_offerable <= 1'b0;
      proposals_clean <= '0; proposals_flagged <= '0;
    end else if (propose) begin
      automatic variety_e v = V_NONE;
      // The three questions, in 30.9 section 7's order, and the first match
      // wins -- because a property with two exposures has the cheaper
      // one fixed first.
      if (!names_a_signal)                  v = V2_NO_KEY_SIGNAL;
      else if (signal_is_shared_constant)   v = V4_SHARED_MODEL;
      else if (!antecedent_reachable_known) v = V6_VACUOUS;
      else if (!covers_a_window)            v = V1_NARROW_TIME;
      else if (forbids_only)                v = V8_NO_CONSERVATISM;
      else if (obligation_comparative)      v = V3_INEXPRESSIBLE;
      else if (value_is_derived)            v = V5_NO_RANGE;
      else if (has_unbounded_parameter)     v = V12_NO_MAGNITUDE;

      variety_found      <= 4'(v);
      property_offerable <= (v == V_NONE);
      if (v == V_NONE) proposals_clean   <= proposals_clean + 1'b1;
      else             proposals_flagged <= proposals_flagged + 1'b1;
    end
  end
endmodule

// INTENTIONALLY DEFECTIVE. WEAK PROCESS: correctness is the criterion.
//
//   property_offerable <= property_is_correct;     // <-- the defect
//
// CONTRACT VIOLATED: 30.9 section 6 -- eight reasons a green assertion
// proves nothing, none of which is incorrectness.
//
// WHY IT SURVIVES: every property offered is correct. That is the
// point of the taxonomy and the reason it needed twelve entries.
//
// TRACE (ILLUSTRATIVE, four properties proposed out loud in one
// conversation):
//   P1 "assert that a column command never arrives before act + tRCD"
//     names a signal, not shared, antecedent reachable, one cycle only
//     -> V1_NARROW_TIME. 30.4 section 8 owns the instance.
//   P2 "assert that the grant is one-hot"
//     names a signal -- but not `legal_mask`, so it is about the
//     grant's SHAPE -> V2_NO_KEY_SIGNAL. 30.5 section 11's defect exactly.
//   P3 "assert the scheduler picks the widest eligible run"
//     obligation is comparative -> V3_INEXPRESSIBLE. Needs a model,
//     per 30.6 section 11.
//   P4 "assert that utilisation stays under 100%"
//     value is derived and the property IS the range -> clean on
//     variety 5, but the parameter setting `WIN` is unbounded
//     -> V12_NO_MAGNITUDE. 33.4 section 15's variety.
//
//   robust: proposals_flagged 4, proposals_clean 0 -- and each is
//     named, with the chapter that owns the instance
//   weak:   all four correct, all four offerable
//
//   gap: four properties, four distinct varieties, zero incorrectness.
//   And P2 is the one to notice: it is the most natural property to
//   propose for an arbiter and it is variety 2, which 30.9 section 7 costs
//   at SECONDS to check -- "which signal, if corrupted, would make this
//   fail?" The answer is the grant, and the grant's legality is not
//   the grant's shape.

   BEFORE THE SENTENCE LEAVES:

   1  Could I rebuild this?            -- section 6, section 7
        no  -> say "I have heard" or "as I recall", and mean it
   2  Where does it stop being true?   -- section 11, section 9
        nowhere I can name -> it is grade A being spent as grade B
   3  What does it cost, and who pays? -- section 10, section 8
        no answer -> it is a benefit, not a recommendation

  // ---- Section 6: knowledge provenance. The obligation is that a claim's
  // delivered confidence matches its class, and the check is the
  // follow-up test.
  property p_recognised_does_not_survive_why;
    @(posedge clk) disable iff (!rst_n)
      (ask_why && (CLAIMS[claim_id].kclass == K_RECOGNISED)) |=> !survives_why;
  endproperty
  assert property (p_recognised_does_not_survive_why)
    else $error("a recognised claim was recorded as surviving a follow-up");

  property p_sound_answer_has_no_recognition;
    @(posedge clk) disable iff (!rst_n)
      answer_sound |-> (recognised_count == '0);
  endproperty
  assert property (p_sound_answer_has_no_recognition)
    else $error("an answer was called sound with a recognised claim in it");

  property p_classes_partition_the_claims;
    @(posedge clk) disable iff (!rst_n)
      audit |=> ((derived_count + recalled_count + recognised_count) == 4'd12);
  endproperty
  assert property (p_classes_partition_the_claims)
    else $error("the claim classes do not partition the answer");

  // ---- Section 7: the rebuild. The property that a number must MOVE when
  // its inputs move -- 33.3 section 6's calculated/measured line, as a check
  // on a speaker.
  property p_number_tracks_its_inputs;
    @(posedge clk) disable iff (!rst_n)
      (ask && (which == 3'd1)) |=> (answer == ($past(mt_per_s_x100)
                                               * BUS_BYTES) / 32'd100);
  endproperty
  assert property (p_number_tracks_its_inputs)
    else $error("a quoted number did not change when its inputs did");

  property p_reconstructible_means_answered;
    @(posedge clk) disable iff (!rst_n)
      (answer_valid && reconstructible) |-> (which <= 3'd4);
  endproperty
  assert property (p_reconstructible_means_answered)
    else $error("a number was called reconstructible with no rebuild rule");

  // ---- Section 8: omissions.
  property p_scope_honest_means_named;
    @(posedge clk) disable iff (!rst_n)
      scope_honest |-> (unnamed_count == '0);
  endproperty
  assert property (p_scope_honest_means_named)
    else $error("a scope was called honest with unnamed omissions");

  property p_omitted_is_relevant_minus_covered;
    @(posedge clk) disable iff (!rst_n)
      answer |=> ((omitted & $past(dims_covered)) == '0);
  endproperty
  assert property (p_omitted_is_relevant_minus_covered)
    else $error("a covered dimension was counted as omitted");

  // ---- Section 9: the conditional. Three parts, and the property names all
  // three because naming one is the defect.
  property p_conditional_needs_three_parts;
    @(posedge clk) disable iff (!rst_n)
      conditional_complete |-> ($past(names_variable) && $past(names_direction)
                                && ($past(magnitude_x10) != 8'd0));
  endproperty
  assert property (p_conditional_needs_three_parts)
    else $error("a conditional was called complete with fewer than three parts");

  property p_hedge_is_classified;
    @(posedge clk) disable iff (!rst_n)
      (state_conditional && !names_variable) |=> (hedge_count != '0);
  endproperty
  assert property (p_hedge_is_classified)
    else $error("a conditional naming no variable was not classified as a hedge");

  // ---- Section 10: the cost. And the OWNER, which is 33.5 section 9's finding.
  property p_weighable_needs_cost_and_owner;
    @(posedge clk) disable iff (!rst_n)
      recommendations_weighable |-> ((without_cost == '0)
                                     && (with_owner == with_cost));
  endproperty
  assert property (p_weighable_needs_cost_and_owner)
    else $error("a recommendation set was called weighable with an unowned cost");

  // ---- Section 11: the boundary. Two-sided, because a claim bounded by
  // experience is not bounded -- 33.6 section 7's "always worked".
  property p_scoped_needs_mechanism;
    @(posedge clk) disable iff (!rst_n)
      claims_scoped |-> (mechanism_count == bounded_count);
  endproperty
  assert property (p_scoped_needs_mechanism)
    else $error("a claim's boundary is experience rather than a mechanism");

  property p_unbounded_is_counted;
    @(posedge clk) disable iff (!rst_n)
      audit |=> ((bounded_count + unbounded_count) == 4'd6);
  endproperty
  assert property (p_unbounded_is_counted)
    else $error("the boundary audit does not account for every claim");

  // ---- Section 12: reaching the edge. The productive continuation requires
  // BOTH an experiment and its interpretation.
  property p_productive_needs_interpreted_outcomes;
    @(posedge clk) disable iff (!rst_n)
      (reach_edge && (continuation == 3'd2))
        |-> (admits && names_experiment && interprets_outcomes);
  endproperty
  assert property (p_productive_needs_interpreted_outcomes)
    else $error("an edge was called productive without interpreted outcomes");

  property p_no_admission_is_a_guess;
    @(posedge clk) disable iff (!rst_n)
      (reach_edge && !admits) |=> (edges_guessed != '0);
  endproperty
  assert property (p_no_admission_is_a_guess)
    else $error("an unadmitted edge was not classified as a guess");

  // ---- Section 13: the seven gates. A pass requires the question to have
  // been ASKED -- 33.7 section 10's elimination-versus-omission rule, applied
  // to a self-review.
  property p_pass_requires_asking;
    @(posedge clk) disable iff (!rst_n)
      audit |=> (passed_count <= asked_count);
  endproperty
  assert property (p_pass_requires_asking)
    else $error("a gate was recorded as passed without being asked");

  property p_reviewed_means_all_seven;
    @(posedge clk) disable iff (!rst_n)
      answer_reviewed |-> (asked_count == 4'd7);
  endproperty
  assert property (p_reviewed_means_all_seven)
    else $error("an answer was called reviewed with a gate unasked");

  // ---- Section 14: the taxonomy, self-applied.
  property p_offerable_means_no_variety;
    @(posedge clk) disable iff (!rst_n)
      property_offerable |-> (variety_found == 4'(V_NONE));
  endproperty
  assert property (p_offerable_means_no_variety)
    else $error("a property was offerable with a variety found");

  property p_no_key_signal_is_first;
    @(posedge clk) disable iff (!rst_n)
      (propose && !names_a_signal) |=> (variety_found == 4'(V2_NO_KEY_SIGNAL));
  endproperty
  assert property (p_no_key_signal_is_first)
    else $error("the cheapest check did not run first");

  // And the two-sided companion: a process that flags everything
  // satisfies every property above -- 30.3 section 9's variety 8, one last
  // time and on this chapter's own instrument.
  property p_clean_property_is_offerable;
    @(posedge clk) disable iff (!rst_n)
      (propose && names_a_signal && !signal_is_shared_constant
       && antecedent_reachable_known && covers_a_window && !forbids_only
       && !obligation_comparative && !value_is_derived
       && !has_unbounded_parameter) |=> property_offerable;
  endproperty
  assert property (p_clean_property_is_offerable)
    else $error("a property with no exposure was refused");

  // ---- COVERS.
  // Section 6: a RECOGNISED claim actually reached by a follow-up. An answer
  // audited but never questioned never reaches it.
  cover property (@(posedge clk) disable iff (!rst_n)
                  ask_why && !survives_why);
  // Section 7: a configuration CHANGE. The dimension is the configuration,
  // and asking the same question twice never reaches it -- 31.2 section 14.
  cover property (@(posedge clk) disable iff (!rst_n)
                  ask && (mt_per_s_x100 != $past(mt_per_s_x100)));
  // Section 8: an answer with omissions NAMED, so p_scope_honest is not
  // satisfied by answers that omit nothing.
  cover property (@(posedge clk) disable iff (!rst_n)
                  answer && (omitted_count != '0) && (unnamed_count == '0));
  // Section 9: a bare HEDGE -- the case the item exists for.
  cover property (@(posedge clk) disable iff (!rst_n)
                  state_conditional && !names_variable);
  // And a COMPLETE conditional, so the property is not satisfied by a
  // speaker who never states one.
  cover property (@(posedge clk) disable iff (!rst_n) conditional_complete);
  // Section 10: a recommendation whose cost is named but UNOWNED -- the
  // half-fix, which is more common than no cost at all.
  cover property (@(posedge clk) disable iff (!rst_n)
                  audit && (with_cost != '0) && (with_owner != with_cost));
  // Section 11: a boundary given as EXPERIENCE rather than mechanism.
  cover property (@(posedge clk) disable iff (!rst_n)
                  audit && (bounded_count != mechanism_count));
  // Section 12: an edge reached and ADMITTED. A speaker who never admits
  // one makes p_productive_needs_interpreted_outcomes vacuous.
  cover property (@(posedge clk) disable iff (!rst_n) reach_edge && admits);
  // Section 13: a gate UNASKED. The dimension is the speaker's stopping
  // point, not their knowledge -- section 15's finding.
  cover property (@(posedge clk) disable iff (!rst_n)
                  audit && (unasked_count != '0));
  // Section 14: each of the four varieties this chapter's trace reaches,
  // so the first-match ordering is exercised rather than assumed.
  cover property (@(posedge clk) disable iff (!rst_n)
                  propose && (variety_found == 4'(V2_NO_KEY_SIGNAL)));
  cover property (@(posedge clk) disable iff (!rst_n)
                  propose && (variety_found == 4'(V3_INEXPRESSIBLE)));
  cover property (@(posedge clk) disable iff (!rst_n)
                  propose && (variety_found == 4'(V12_NO_MAGNITUDE)));