code wiki / _hdl_build / nx_jobhealth_gate.nx

nx_jobhealth_gate.nx

buildroot/runtime/_hdl_build/nx_jobhealth_gate.nx

5016 B105 linesdepth 5pulls 7 transitivereach 0 importersview sourcekind gate/proof
docsdependenciesstructsconstsfunctions

about

nx_jobhealth_gate.nx -- DOES EVERY REGISTERED CLOCK JOB HAVE AN ORGAN THAT CAN ACTUALLY BE EXECUTED? WHY THIS EXISTS. Measured 2026-08-01: four clock jobs (p384kat, tls12prf, gaterollup, feedgate) had not written a verdict in 6.1 DAYS. The scheduler was healthy the whole time -- proven by registering a fresh job with an ABSOLUTE organ path and watching it dispatch within ~120s. The real cause is that those rows carry BARE-NAME organ paths (nx_p384_ecdh_gate.elf, ...) and no such file exists at the dispatcher's cwd. clk_dispatch_run chmods, forks, execs, and treats a child exit of 127 as "did not run" -- deliberately NOT counting it as dispatched. That is honest accounting AND a silent failure: the job dies on every single tick, the plane still lists it, and the health snapshot still reports the scheduler UP. I ALMOST FILED THAT AS "THE SCHEDULER IS DEAD" (sev-8, retracted within minutes). Four jobs stopping within 40 seconds of each other looked like one dispatcher failure; it was four identical exec failures. AN INFERENCE FROM CORRELATED TIMESTAMPS IS A HYPOTHESIS, NOT A DIAGNOSIS -- this gate is the cheap discriminator I should have had, made standing so nobody has to re-derive it. THE 2026 JOB-QUEUE RULE THIS IMPLEMENTS: "if a job can fail without showing up somewhere you look, it will -- make lost work impossible to ignore." Mature queues answer with a dead-letter queue plus staleness alerting; this substrate has neither, so a registration that can NEVER execute is indistinguishable from one that simply has not come due yet. WHY STAT AND NOT EXEC: a health check must never become an arbitrary-code trigger. Readability is exactly the predicate execve fails on with 127, so this catches the real class without running anything. Rides nx_gate_verdict (migrate-on-touch law D001/L009 -- a new gate must inherit the base class rather than hand-roll its verdict, so the verdict is emitted in ONE place and cannot be written before the work). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0

dependencies 2 imports · 0 importers

nx_store_seed_lib.nx nx_gate_verdict.nx nx_jobhealth_gate.nx

imports: nx_store_seed_lib.nxnx_gate_verdict.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gv_head gv_puts sys_write gv_ctr sys_mmap sts_load ss_open_cached ssc_init sys_mmap ↻ ssc_sig_of ss_cat sys_fstatat ssc_streq ss_open ss_open2 sys_mmap ↻ ss_manifest_dyn ss_manifest_file_dyn ss_cat ↻ ss_loadfile sys_map_file ss_readall ss_load_aux2 sys_mmap ↻ ss_cat ↻ ss_loadfile ↻ ss_r32 sys_munmap ssl_total_keys ss_r32 ↻ ssl_pow2 ssl_build ss_r32 ↻ ssl_hash_entry ssl_key_eq ss_r32 ↻ ssl_lookup ssl_hash_entry ↻ ssl_key_eq ↻

structs

none

consts

30const JH_PLANE: *u8 = "knowledge/store/clockjobs-"
31const JH_CAP: i64 = 65536

functions

34func jh_resolves(path: *u8) -> i64
called by 1: main
41func main() -> i64