nx_io_envelope_census.nx

nx_io_envelope_census.nx -- EVERY CAPPED READER ANNOUNCES OR DERIVES (/compare/dataio DI2, 2026-09-05). THE CLASS: a read into a buffer whose length is a CONSTANT silently returns a PREFIX of anything larger, and the caller reports success. Measured on the day this was written: the literal 4194304 appears 1,430 times in 717 source files; the action miner's mine/freq/harden verbs read a 54 MB journal through a 4 MiB head for weeks; the ledger lib behind the estate's idempotency keys read its ledger through 262,144 bytes. Each was a correct program reading the wrong amount and saying nothing. The fix for a file read is sys_read_file (it sizes from the file and cannot short- read); the fix for a genuinely unknowable size (a stream) is a NAMED cap whose truncation ANNOUNCES itself. THIS ORGAN MEASURES WHERE THE ESTATE STANDS ON THAT, whole population, and makes SILENT the worklist: sys_read( fd, buf, LEN ) call sites, LEN classified as LITERAL a decimal literal -> FIXED NAMED an ALL-CAPS identifier declared `const NAME: i64 = <decimal>` in the same file -> FIXED DYNAMIC anything else (a computed remainder, a variable, an unresolved name) -> NOT JUDGED here a FIXED site is ANNOUNCING when its file carries an envelope token that tells the reader the read may be partial (TRUNCATED, OUTPUT-IS-PARTIAL, coverage_complete, capture_cap, scan_cap, truncated=, partial=), else SILENT. sys_read_file( call sites are counted on a SEPARATE axis as DERIVED (the remedy, adopted). COMPOSES, NEVER DUPLICATES: the walk is nx_shelltool grep (the estate's budgeted, envelope-honest walker -- its own coverage_complete / corpus_complete are read and PROPAGATED, so a partial walk yields UNPROVEN, never a smaller number that reads as better news); code-vs-prose is jc_strip_noncode from nx_cap_detect_lib (the same stripper the silent-cap detector uses), so a `sys_read(` inside a string or a comment is never a site. LOOPED (DI12, 2026-09-06) a read INSIDE a while block, or one whose result variable is the subject of a `while <v> > 0` / `while <v> != 0` in the same file: the streaming idiom that consumes to EOF -> NOT JUDGED. The first census put nx_sizeguard's own read loop on the SILENT worklist -- a correct streaming reader named as a capped one -- so the class is separated and counted, never acquitted (a loop that breaks early is still a cap; the loop's exit is not inspected here). RATCHET (DI12 ie_ratchet): the SILENT set is a NAMED SET in knowledge/status/io_envelope_silent.baseline, one row per site, keyed `path<TAB>k<TAB>text<TAB>line` where text is the stripped, whitespace-collapsed source line and k its ordinal among identical lines in that file -- so an edit ABOVE a site does not change its identity (a file:line key turned every conversion into a spurious rise plus a spurious fall; the line number is carried for humans only). A RISE (a silent site not in the baseline) is RED and NAMED, and the baseline is NOT rewritten (a ratchet that rewrites its baseline on a rise launders itself green); a FALL (a baseline site no longer silent) is NAMED with what it became now (converted / announced / dynamic / looped), journaled to knowledge/status/io_envelope_ratchet.jrnl, and the baseline is TIGHTENED to the rows that remain (a ratchet that does not tighten when you improve is a threshold). --accept rewrites the baseline to the current set deliberately. A legacy `path:line` baseline is matched by line once and MIGRATED to the keyed form. A count-only ratchet on a shared tree reports a regression without saying whose. FALSE-POSITIVE RATE (DI12): derived from the ledger, never asserted. A site that LEFT the set as converted/announced/ dynamic was a true positive (a real capped reader got fixed); one that left as `looped` was the OLD ruler's false positive; a hand row `kind=false site=<path:line> reason=<why>` adjudicates a standing site as bounded by construction. false_positive_permil = fp * 1000 / (tp + fp), printed UNMEASURED while nothing is adjudicated.