nx_planefit.nx

nx_planefit.nx -- READ-ONLY: does a plane FIT a caller's read cap, and by how much does it miss? WHY THIS EXISTS. sts_load silently drops bytes once its output buffer fills and returns a byte count that looks perfectly healthy, so an under-capped reader reports on a PARTIAL board and is indistinguishable from a healthy one. The truncation WARNING added 2026-08-06 makes that visible at the moment of the read -- but only for someone watching stderr of a run that already happened. This answers the question BEFORE the run, for any plane and any cap, without writing anything. MEASURED MOTIVATION (2026-08-06): knowledge/store/debt- loads to 4,396,892B while nx_sheriff (SHF_CAP), nx_pm_board (PB_CAP) and nx_dora (DCAP) each read it with a 1 MiB cap -- each losing 76% of the board, newest rows first. On-disk bytes are NOT the answer (they include superseded segment versions), so the only honest number is what sts_load actually returns. nx_planefit <plane-prefix> [cap] -- one plane; exit 1 if it truncates at that cap nx_planefit sweep [cap] -- EVERY plane under knowledge/store; exit 1 if any truncates ★THE SWEEP IS THE POINT. Checking four planes by hand is a spot check; the defect class is "which of my readers is silently blind RIGHT NOW", and that is a census question. This is the complement to nx_capcliff, which scans FLAT LEDGERS against ONE hardcoded cap and has no notion of seg-store planes. ⚠TWO DECLARED BOUNDS, NEITHER SILENT: (1) the probe ceiling PF_CEIL -- if true_bytes comes back EQUAL to it, the number is a FLOOR and the tool says so; (2) PF_SWEEP_ROWCAP -- a plane declaring more rows than this is REPORTED AND SKIPPED rather than walked, because sts_load walks q:0..q:n-1 and a multi-million-row plane would turn a census into an outage. A skipped plane is printed with its declared count, so the sweep can never pass off partial coverage as complete. license_tier: ORIGINAL No hw writes (Rule 26).