nx_capcliff.nx

nx_capcliff.nx -- READER-CAP CLIFF DETECTOR for append-only ledgers, WITH THE REMEDY CENSUS (DI13). WHY THIS EXISTS (measured 2026-08-06). Several estate readers capture a ledger into a BOUNDED buffer -- 4 MiB is the recurring number (nx_debt_view declares capture_cap=4194304; nx_catalog reports actlog 4194304B exactly). When the ledger grows PAST that cap the reader keeps working and silently returns a TRUNCATED PREFIX. Two were already over on the day this was written: knowledge/status/actlog.jrnl -- read at offset 4194304 returns bytes and 'more remains', while nx_catalog reports exactly 4194304B. The boundary row is epoch 1785966081 (~21h before), so EVERY INVOCATION SINCE THEN IS INVISIBLE and nx_catalog calls freshly-run organs REGISTERED-DARK (S4) 'callable, authorised, NEVER RUN'. The estate's headline ADOPTION signal was being manufactured by a truncated buffer. knowledge/store/debt- -- nx_plane_check says rows=3326 GREEN bytes=4217666, while nx_debt page reports total=3311 and nx_debt show cannot find the ~15 newest rows. ***BECAUSE THESE LEDGERS ARE APPEND-ONLY, A PREFIX CAP ALWAYS EATS THE NEWEST ROWS FIRST.*** The instrument therefore degrades exactly as new work arrives, and every downstream metric drifts toward 'nothing happened lately'. That is the worst possible failure direction for an adoption or debt gauge, and nothing announced it. This organ makes the cliff PREDICTABLE instead of discovered: it measures each rostered ledger against the cap and reports headroom, so a crossing is forecast rather than found by accident. THE REMEDY CENSUS (DI13, 2026-09-06). An OVER row is a SIZE fact, not a proven reader defect: a TAIL-anchored or whole-file reader loses nothing, a HEAD-anchored one loses the newest rows. So every OVER ledger is now judged against knowledge/capcliff_remedy.conf, rows `ledger|kind|target|note`: reader target = <file:line> of the consumer's READ SITE. The organ READS THAT LINE and classifies it -- WHOLE (sys_read_file), TAIL (SEEK_END or a *_tail( helper), HEAD (a bare sys_read), UNVERIFIED (none of those: a declaration that did not point at a read). The conf declares WHERE to look; the classification is measured, never copied from the row. writer target = <file:line> of the appender (verified: the line must append). guard target = sizeguard:<byte-cliff>:<line-cliff>; nx_sizeguard is FORKED on the ledger with that budget and its exit code is the guard's verdict (0 GREEN 1 AMBER 2 RED 3 UNMEASURED). mention target = a file that names the ledger without reading it (comment, fixture); declared, not judged. Remedy states describe the DECLARED ROSTER, not a complete semantic census of all source consumers. GOVERNED: declared readers are WHOLE/TAIL or guarded GREEN/AMBER; BREACHED: a declared guard reads RED; UNGOVERNED: a declared HEAD/UNVERIFIED reader has no working guard. UNREGISTERED: a readable conf has no matching ledger rows. UNMEASURED: conf unreadable or zero declared readers, including writer-only rows. Zero declared readers cannot prove no actual readers. The legacy NO-READER state code/name is retained for compatibility but no current evidence contract establishes it. Output carries the roster truth scope and semantic_coverage=UNMEASURED. Unknown coverage abstains with exit 3 in remedy and OVER-ledger scan;