test(generate): lock in times(2) syscall classification

Audit of times(2) (clock_t times(struct tms *buf)) confirmed its
classification is correct and consistent with its time/clock siblings:

- sys_enter_times: KindNull (single userspace output struct tms *buf;
  no fd or pathname argument).
- sys_exit_times: ret_event UNCLASSIFIED — times() returns a clock_t
  tick count (or (clock_t)-1 on error), which is a tick tally, not a
  transferred byte count.
- family: FamilyTime, alongside gettimeofday/clock_gettime, and NOT
  FamilyProcess where getrusage lives.

No misclassification was found; docs/syscall-tracing-plan.md already
lists times under the Time family and the null kind. Add lock-in tests
so any stray reclassification trips a unit test:

- family_test.go: assert sys_enter/exit_times == FamilyTime.
- retclassify_test.go: assert sys_exit_times stays UNCLASSIFIED.

KindNull is already covered by TestClassifyM7NameOnlyKinds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 13 insertions, 0 deletions

diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go
index 944eed9..ba851c2 100644
--- a/internal/generate/family_test.go
+++ b/internal/generate/family_test.go
@@ -57,6 +57,14 @@ func TestClassifySyscallFamily(t *testing.T) {
 		// sibling clock_gettime/settimeofday/time syscalls.
 		{"sys_enter_gettimeofday", FamilyTime},
 		{"sys_exit_gettimeofday", FamilyTime},
+		// times(2) stores the calling process's CPU times (struct tms *buf) and
+		// returns a clock_t tick count. It is a time/clock syscall and shares
+		// FamilyTime with gettimeofday/clock_gettime — NOT FamilyProcess (where
+		// getrusage lives). Assert both enter and exit so a stray reclassification
+		// trips this test. Keep in sync with the Time list in
+		// docs/syscall-tracing-plan.md.
+		{"sys_enter_times", FamilyTime},
+		{"sys_exit_times", FamilyTime},
 		{"sys_enter_sched_yield", FamilySched},
 		{"sys_enter_openat", FamilyFS},
 		// access(2) checks the calling process's permissions for a file named by
diff --git a/internal/generate/retclassify_test.go b/internal/generate/retclassify_test.go
index f1c244d..c434b7d 100644
--- a/internal/generate/retclassify_test.go
+++ b/internal/generate/retclassify_test.go
@@ -51,6 +51,11 @@ func TestClassifyRetUnclassified(t *testing.T) {
 		// gettimeofday(2) returns int 0/-1 (no byte count); its exit carries a
 		// plain ret_event and must stay UNCLASSIFIED, not a read/write transfer.
 		"gettimeofday",
+		// times(2) returns a clock_t tick count (clock ticks since an arbitrary
+		// point in the past), or (clock_t)-1 on error. That is a tick count, NOT
+		// a transferred byte count, so its exit must stay UNCLASSIFIED (plain
+		// ret_event), like its time sibling gettimeofday.
+		"times",
 		// rseq(2) returns int 0/-1 on (un)registration of the restartable-
 		// sequences area; it transfers no bytes, so its exit must stay
 		// UNCLASSIFIED (plain ret_event), like its KindNull siblings.