Module stats 

The accounting contract, as a type.

bench/V5-ACCOUNTING-CONTRACT.md §1 fixes these fields before this crate existed, because both v5 RFCs state their ceiling as a decomposition and a gate that cannot assert “these terms sum to the observed gap” cannot check the only claim that matters.

The identity

mapped == live + rounding + cache + span_free + virgin
        + hysteresis + segment_overhead

Exact, with no tolerance. Every mapped byte is in exactly one of those states by construction, so a mismatch means something is miscounted — and unexplained bytes are precisely where glibc’s 2.24× was hiding.

Two terms the contract did not have at T0

T0 fixed five terms. Building the geometry showed the partition was not a partition, so two were added — declared here with the reason, which is what the contract requires (silently widening it is what is banned, not changing it):

• virgin — spans hand out slots by bumping a cursor, so the region above the cursor is mapped but never touched, and therefore not resident. Folding it into slack would have made the slack term look like memory when it is only address space. This split is the difference between a number that predicts RSS and one that does not.
• segment_overhead — one span per segment holds the header. 1.6 % of every segment, structural and knowable, so it is named rather than absorbed into a neighbour.

Structs

Stats

A snapshot of where every mapped byte is.