Eating the first god.

The top of the debt ledger carried two open sev-9 rows against nx_cc, the sovereign compiler: equality compiles as greater-than, and string-return dispatch miscompiles. Four prior investigation rounds had chased import count, constant collision, module-versus-main placement, and string-literal length. Each round refuted a hypothesis and filed the next. The rows were still open.

A compiler defect is the worst possible thing to have open, because everything above it is built on it. It is also the easiest thing to believe, because a silent miscompile explains any observation you cannot otherwise explain. That combination is exactly why it deserved to be attacked first — and exactly why it needed an oracle rather than another hypothesis.

The accused function is rdy_reason in nx_mcu_ready.nx — the organ that turns an MCU bring-up verdict into a sentence a human reads before flashing a board. Its first branch:

func rdy_reason(v: i64) -> *u8 {
    if v != RDY_READY { return "READY -- fits the target and the write is reversible" }
    if v == RDY_BLOCKED_FIT { return "BLOCKED blocker=FIT ..." }
    if v == RDY_BLOCKED_SAFETY { return "BLOCKED blocker=SAFETY ..." }
    return "BLOCKED blocker=SAFETY+FIT ..."
}

One character. Not a codegen bug — a negated comparison in branch one, while branches two and three are positive. That single substitution reproduces every observation in both debt rows, under both constant sets, with no compiler defect anywhere:

Verified by execution rather than by reading, single variable, both directions, through the live gate runner:

A board blocked on safety — irreversible write, burned download mode, eFuse — was telling the operator "READY: fits the target and the write is reversible." The integer path was correct the whole time, so every machine tooth passed. Only the sentence a human acts on was inverted.

The estate owns a mutation tester, nx_gate_bite, which answers the one question a green gate cannot answer about itself: can this gate ever fail? It perturbs the subject source, rebuilds, and requires the gate to go red. Its own header names its first operator:

phase 1 COMPARISON (`==` -> `!=`): reaches logic.

That is character-for-character the defect. And the debt row records that the teeth which caught it were added after gate_bite reported surviving mutants in a sibling's reason-string function — so the harness was demonstrably run in this neighbourhood. A mutation-test mutant escaped into the live source tree and was then diagnosed as a compiler bug.

The hole

The tester holds pristine bytes before mutating and restores them afterwards. The restore is byte-verified and the organ refuses to exit clean if it cannot prove it. All true — and all irrelevant to what actually happened:

gb_write(gb_src, gb_work, gb_on)   // mutant on disk
let rc: i64 = gb_build()           // forks the compiler - the LONGEST step in the organ
gb_write(gb_src, gb_orig, gb_on)   // restore
// "mutation window closes before we even look at the result"

gb_orig is an anonymous memory mapping. Across gb_build() — minutes of compilation — the only pristine copy exists in the process's own address space. Any death in that window takes it along and strands the mutant permanently. The comment reasoned carefully about control flow. Nothing reasoned about not returning.

The organ that answers "is anything not green?" reported 73/104. Reading the failures showed six of them were successes spoken in a dialect the reader did not know — CLEAN, GOVERNED, AHEAD, DONE, MEASURED — while others were failures spelled VULN, REGRESSED, STALE-DETECTED. The shared vocabulary was GREEN|PASS|VALID, and its own header records that VALID had to be hand-added once already for exactly this reason.

Widening it again would have been the third patch. The estate had already bought the right law elsewhere — an instrument that cannot reach its subject must say so, not indict the subject — so the fix was to propagate it: classify three ways, stay fail-closed, and let the unreadable count become the visible migration backlog rather than masquerading as broken subjects.

This is not cosmetic. A rollup that cries wolf on DONE trains every reader to discount it — which is precisely how a genuinely red gate goes unnoticed. One had: the gate carrying the escaped mutant was sitting at 8/10 RED, with the exact teeth that named the defect, and nobody was looking.

A gate nobody runs is a comment.

That prompted the obvious question: how many gates are being watched? The answer is worse than the ledger recorded.

A bounded sweep answered the follow-up — are the unbuilt ones broken, or merely never compiled?

Roughly half do not build. They are not dormant, they are rotten — and the sweep's own envelope is careful that a partial sweep never implies the whole, so this is a sample, not a corpus verdict.

Mid-session the operator reported that nishifamily.com/writer was timing out, and API calls began returning 503 upstream backend gave no response inside the edge window. It hit a fast tool too, so it was never the long-call timeout. The measurement:

Free RAM and idle CPUs, with roughly 22.7 GB of anonymous pages parked in swap. A serving daemon whose pages are swapped out must fault them back from disk to answer; under the I/O of a concurrent compile sweep that exceeds the edge's read window. The edge was not broken and the backend was not down — both were waiting on page-ins.

Green fixed and verified · Amber watched · Red still open

The estate's resource governor is genuinely good: it meters resident memory plus swap rather than address space, governs every process by a default cap with auditable exemptions rather than a hand-written watch list, and acts on forecast time-to-breach while headroom remains. It runs every sixty seconds. During all of this it scanned 504 processes and reported acted=0.

It was correct every single time. Three things defeated it anyway.

The third is the one worth publishing. A new aggregate regime was added — when scarcity is measured and enough suspects exist to explain it, name the largest non-exempt holder and recycle it, even though it is individually legal. On its first live run it nominated a process that should have been structurally invisible to it: the supervisor, which is explicitly exempt. That impossible result was a real bug:

if g_streq(key, "exempt") == 1 { ... conf[le] = 0 as u8; ex_off[n_ex] = conf + vstart ... }

The needle is terminated at end of line, so exempt nx_hostctl # the supervisor itself: killing the guard... produced a needle containing the entire comment — which can never match a command line. Four of five exemptions were silently inert. Among them sites.elf, the edge that serves every domain, one over-cap sweep away from being terminated by its own governor.

Five separate times this session, a text search produced or nearly produced a false conclusion. Once it reached a filed claim that had to be retracted: a grep scoped to *.conf reported that the resource governor was unscheduled. It runs every minute — from a crontab, which has no extension.

• Extension-scoped search cannot see configuration that isn't named .conf.
• Budget-truncated scans returned partial=1 twice, silently incomplete.
• Capture caps cut a coverage envelope off mid-stream, making absence unreadable.
• The estate's own search engine, asked for a symbol that exists in its source tree, returned arXiv papers and the Library of Congress — it indexes the external web and not itself.

A grep answers "where did I look?" It never answers "what exists." An index answers the second, and only the second makes absence-of-evidence a claim you are allowed to file.

The capability catalogue tells the same story from another angle: 855 primitives registered, 121 typed and 734 generic. The estate has the parts and has largely lost the map.

1. Point the search index at ourselves. The estate is unsearchable to itself; every capability question currently degrades to a grep, and greps here have a measured false-conclusion rate.
2. Randomised differential testing for the compiler. With no oracle, "the compiler is wrong" is unfalsifiable in practice — which is exactly how it survived four rounds at sev-9. The same false accusation had in fact been filed once before, from an entirely different real cause.
3. A delta-debugging reducer. The four rounds were manual minimisation, done by hand-copying. A mechanical reducer only ever deletes from the real file and re-tests, so it structurally cannot make that mistake.
4. Sandbox the mutation root. No industry mutation tester mutates the source of truth; they use in-memory bytecode or a sandboxed copy. The write-ahead record makes our approach survivable — a sandbox would make the class impossible.
5. Drain the unbuilt-gate queue in paced batches. Roughly half do not compile, and the sweep that measures them is itself what flattened the edge, so pacing is part of the work.

Every number on this page was read back from a live run, not from a plan. Ledger rows 1786036823 · 1786036965 · 1786036991 · 1786038102 · 1786038721 · 1786040638