code wiki / _hdl_build / nx_atomic_publish_gate.nx
nx_atomic_publish_gate.nx source
↩ module page · 710 lines · 43176 B
1// nx_atomic_publish_gate.nx -- END-TO-END gate for `nx_atomic_publish landed` (ap_landed, DM4).
2//
3// THE CORPUS IS THE ESTATE'S OWN RECORD. Every REAL row below reproduces an ambiguous write from
4// 2026-08-15 to 2026-08-20 whose landed-or-not was settled BY HAND at the time, mined out of the lane
5// memories and CLAUDE.md; the hand answer travels beside it as ground truth. Three rows are labelled
6// CONSTRUCTED and counted separately: two are grammar guards, and one is the double-insert the CAS guard
7// AVERTED on 2026-08-20 -- the record describes the outcome it prevented, so the artifact never existed
8// and claiming it as observed would be a fabrication.
9//
10// THE BAR, pre-declared in devmgmt.plan: "emits LANDED or NOT per row matching the hand adjudication
11// with ZERO FALSE LANDED -- wrong only toward NOT". A false LANDED is a lost edit nobody re-applies; a
12// false NOT-LANDED costs one idempotent retry. false_landed is therefore counted as its own number and
13// asserted at zero, separately from the overall diff.
14//
15// THE TWO CONTROLLED PAIRS ARE THE SHARPEST ROWS, and they come straight out of the record:
16// the SAME 503 reply over a write that HAD landed and three that had NOT, in the same hour;
17// the SAME bare empty-object reply over a write that had landed and one that had not.
18// An organ that consults the transport reply gets one of each pair wrong by construction.
19// The third discriminator is one ARTIFACT adjudicated twice: from a size-only row it must ABSTAIN, from
20// a content-hash row it must say LANDED. An organ answering from the file rather than from the declared
21// evidence cannot separate those two.
22//
23// TEETH THE TRIVIAL WRONG IMPLEMENTATIONS CANNOT PASS, all in ONE run: an always-LANDED organ loses the
24// NOT-LANDED rows and trips the false-landed bar; an always-NOT-LANDED organ loses the LANDED rows; an
25// always-UNKNOWN organ -- the guard that refuses everything and thereby passes every negative test --
26// loses both and cannot reach DECIDED-ALL.
27//
28// Fixtures are assembled at RUNTIME under /tmp/nx_ap_landed_gate/<epoch>/ -- never beside a production
29// beat. Idempotent: the epoch-suffixed directory means a second run cannot inherit the first run's state.
30//
31// usage: nx_atomic_publish_gate [subject-elf]
32// SUBJECT RESOLUTION, announced on every run because the answer depends on it: argv[1] if given, else
33// the freshly BUILT candidate buildroot/_build/nx_atomic_publish.sov.elf, else the deployed twin
34// _offc/nx_atomic_publish.elf, else the serving root, else SKIP. The build-first order is what makes
35// this gate usable as nx_organ_ship's PROVE stage, which runs seconds after /api/build and is asking
36// about the CANDIDATE. ★A GATE THAT DOES NOT SAY WHICH COPY IT JUDGED CAN BE READ AS A VERDICT ABOUT
37// THE WRONG BINARY -- so the resolved path AND its byte count are printed before any tooth runs.
38// Sovereign: imports nx_gatekit_lib + nx_gate_verdict. license_tier: ORIGINAL expect_exit: 0
39import "nx_gatekit_lib.nx"
40import "nx_gate_verdict.nx"
41import "nx_sha256.nx"
42
43const APG_NAME: *u8 = "ATOMIC-PUBLISH-GATE"
44const APG_BUILT_ELF: *u8 = "buildroot/_build/nx_atomic_publish.sov.elf"
45const APG_OFFC_ELF: *u8 = "_offc/nx_atomic_publish.elf"
46const APG_ROOT_ELF: *u8 = "./nx_atomic_publish.elf"
47const APG_ROOT: *u8 = "/tmp/nx_atomic_publish_gate"
48const APG_CAP: i64 = 262144
49const APG_WLCAP: i64 = 65536
50const APG_PATHCAP: i64 = 1024
51const APG_TAB: i64 = 9
52const APG_NL: i64 = 10
53const APG_SPACE: i64 = 32
54const APG_D0: i64 = 48 // ASCII '0'
55const APG_D9: i64 = 57
56const APG_DEC_BASE: i64 = 10
57const APG_MAXCASE: i64 = 64
58const APG_PTRW: i64 = 8
59const APG_HEX: i64 = 80
60const APG_REAL: i64 = 1
61const APG_CONSTRUCTED: i64 = 0
62// A concurrent writer must land BETWEEN the subject's two passes. Half the subject's OWN announced
63// settle window is the only defensible schedule: it is derived from the subject at run time, so a conf
64// change cannot silently make this tooth vacuous. Below the floor there is no reliable schedule at all
65// and the tooth ABSTAINS (gv_need) rather than reporting a flake as a defect.
66const APG_RACE_DIVISOR: i64 = 2
67const APG_RACE_FLOOR_MS: i64 = 100
68
69func apg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
70func apg_gt(a: i64, b: i64) -> i64 { if a > b { return 1 } return 0 }
71func apg_zero(a: i64) -> i64 { if a == 0 { return 1 } return 0 }
72
73func apg_hex(dig: *u8, out: *u8) -> i64 {
74 let d: *u8 = "0123456789abcdef" as *u8
75 var i: i64 = 0
76 while i < 32 {
77 let v: i64 = dig[i] as i64
78 out[i * 2] = d[(v / 16) % 16]
79 out[i * 2 + 1] = d[v % 16]
80 i = i + 1
81 }
82 out[64] = 0 as u8
83 return 64
84}
85
86func apg_hash_text(t: *u8, out: *u8) -> i64 {
87 let n: i64 = gk_len(t)
88 let dig: *u8 = sys_mmap(32)
89 sha256_digest(t, n, dig)
90 apg_hex(dig, out)
91 return n
92}
93
94// hash of what is ACTUALLY on disk, so a fixture that failed to write can never masquerade as one that
95// wrote the intended bytes
96func apg_hash_file(path: *u8, out: *u8) -> i64 {
97 let szp: *i64 = sys_mmap(16) as *i64
98 let b: *u8 = sys_read_file(path, szp)
99 if (b as i64) == 0 { out[0] = 0 as u8; return 0 - 1 }
100 let dig: *u8 = sys_mmap(32)
101 sha256_digest(b, szp[0], dig)
102 apg_hex(dig, out)
103 return szp[0]
104}
105
106func apg_tab(b: *u8, o: i64) -> i64 { b[o] = APG_TAB as u8; return o + 1 }
107
108// Extract the verdict token the subject printed for <id>. Anchored on the FULL row prefix
109// "APL row=<id> verdict=" so a verdict word appearing anywhere else in the output -- in advice prose,
110// inside a reason name, in a partition line -- can never be read as the answer.
111func apg_verdict_of(buf: *u8, n: i64, id: *u8, out: *u8) -> i64 {
112 let ned: *u8 = sys_mmap(APG_PATHCAP)
113 var o: i64 = gk_cat(ned, 0, "APL row=" as *u8)
114 o = gk_cat(ned, o, id)
115 o = gk_cat(ned, o, " verdict=" as *u8)
116 ned[o] = 0 as u8
117 let pp: i64 = gk_out_pos(buf, n, ned)
118 if pp < 0 { out[0] = 0 as u8; return 0 }
119 var s: i64 = pp + o
120 var k: i64 = 0
121 var sc: i64 = 1
122 while sc == 1 {
123 if s >= n { sc = 0 } else {
124 let c: i64 = buf[s] as i64
125 if c == APG_SPACE { sc = 0 } else {
126 if c == APG_NL { sc = 0 } else { out[k] = buf[s]; k = k + 1; s = s + 1 }
127 }
128 }
129 }
130 out[k] = 0 as u8
131 return k
132}
133
134// first integer following <key> in the subject's output, or -1
135func apg_int_after(buf: *u8, n: i64, key: *u8) -> i64 {
136 let pp: i64 = gk_out_pos(buf, n, key)
137 if pp < 0 { return 0 - 1 }
138 var s: i64 = pp + gk_len(key)
139 var v: i64 = 0
140 var got: i64 = 0
141 var sc: i64 = 1
142 while sc == 1 {
143 if s >= n { sc = 0 } else {
144 let c: i64 = buf[s] as i64
145 if c < APG_D0 { sc = 0 } else {
146 if c > APG_D9 { sc = 0 } else { v = v * APG_DEC_BASE + (c - APG_D0); got = 1; s = s + 1 }
147 }
148 }
149 }
150 if got == 0 { return 0 - 1 }
151 return v
152}
153
154func apg_push(ids: *i64, hands: *i64, real: *i64, n: *i64, id: *u8, hand: *u8, isreal: i64) -> i64 {
155 ids[n[0]] = id as i64
156 hands[n[0]] = hand as i64
157 real[n[0]] = isreal
158 n[0] = n[0] + 1
159 return 0
160}
161
162func main(argc: i64, argv: *i64) -> i64 {
163 gv_head("nx_atomic_publish_gate -- ap_landed against the 2026-08 hand adjudications, per-row diff below" as *u8)
164 let ctr: *i64 = gv_ctr()
165
166 var subj: *u8 = 0 as *u8
167 var subj_src: *u8 = "none" as *u8
168 if argc >= 2 { subj = argv[1] as *u8; subj_src = "argv" as *u8 }
169 if (subj as i64) == 0 { if gk_exists(APG_BUILT_ELF) == 1 { subj = APG_BUILT_ELF; subj_src = "freshly-built-candidate" as *u8 } }
170 if (subj as i64) == 0 { if gk_exists(APG_OFFC_ELF) == 1 { subj = APG_OFFC_ELF; subj_src = "deployed-offc-twin" as *u8 } }
171 if (subj as i64) == 0 { if gk_exists(APG_ROOT_ELF) == 1 { subj = APG_ROOT_ELF; subj_src = "serving-root" as *u8 } }
172 var have: i64 = 0
173 if (subj as i64) != 0 { have = 1 }
174 if gv_need("a nx_atomic_publish binary to judge (argv, _build, _offc or serving root)" as *u8, have, ctr) == 0 {
175 return gv_verdict(APG_NAME, ctr, "subject not found in any known root" as *u8)
176 }
177 // WHICH COPY WAS JUDGED IS PART OF THE VERDICT, so it is printed before any tooth runs.
178 gv_puts(" SUBJECT " as *u8); gv_puts(subj); gv_puts(" via=" as *u8); gv_puts(subj_src)
179 gv_puts(" bytes=" as *u8); gv_num(gk_size(subj)); gv_puts("
180" as *u8)
181
182 gk_mkdir(APG_ROOT)
183 let dir: *u8 = sys_mmap(APG_PATHCAP)
184 var d: i64 = gk_cat(dir, 0, APG_ROOT)
185 d = gk_cat(dir, d, "/" as *u8)
186 d = gk_catn(dir, d, sys_now_realtime_sec())
187 dir[d] = 0 as u8
188 gk_mkdir(dir)
189
190 let p: *u8 = sys_mmap(APG_PATHCAP)
191 let hx: *u8 = sys_mmap(APG_HEX)
192 let wl: *u8 = sys_mmap(APG_WLCAP)
193 let ids: *i64 = sys_mmap(APG_MAXCASE * APG_PTRW) as *i64
194 let hands: *i64 = sys_mmap(APG_MAXCASE * APG_PTRW) as *i64
195 let real: *i64 = sys_mmap(APG_MAXCASE * APG_PTRW) as *i64
196 let nc: *i64 = sys_mmap(16) as *i64
197 nc[0] = 0
198 var o: i64 = 0
199
200 // OLD/NEW stand in for the real pre- and post-write content. What the corpus reproduces is the SHAPE
201 // of each case: which evidence the seat held, and what was on disk when it looked.
202 let t_old: *u8 = "compare matrix rows -- the pre-write state\n" as *u8
203 let t_new: *u8 = "compare matrix rows -- the post-write state the seat intended\n" as *u8
204
205 o = gk_cat(wl, o, "// runtime corpus -- 2026-08 ambiguous writes, hand answers held by the gate\n" as *u8)
206
207 // -- 1. connect.refs, crash 1 (seat a1c8e539). The receipt was never read; the artifact turned out
208 // byte-identical to the staged file. HAND = LANDED.
209 gk_join(p, dir, "connect.refs" as *u8)
210 gk_write(p, t_new)
211 o = gk_cat(wl, o, "id=connect-refs-crash1-publish"); o = apg_tab(wl, o)
212 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
213 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
214 apg_hash_file(p, hx)
215 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
216 apg_hash_text(t_old, hx)
217 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
218 o = gk_cat(wl, o, "reply=crash-no-response"); o = gk_cat(wl, o, "\n" as *u8)
219 apg_push(ids, hands, real, nc, "connect-refs-crash1-publish" as *u8, "LANDED" as *u8, APG_REAL)
220
221 // -- 2. connect.plan, same lane, same shape, bare empty-object reply: a TRUE no-land. Pair with 9.
222 gk_join(p, dir, "connect.plan" as *u8)
223 gk_write(p, t_old)
224 o = gk_cat(wl, o, "id=connect-plan-emptyreply-true-noland"); o = apg_tab(wl, o)
225 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
226 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
227 apg_hash_text(t_new, hx)
228 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
229 apg_hash_text(t_old, hx)
230 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
231 o = gk_cat(wl, o, "reply=empty-object-body"); o = gk_cat(wl, o, "\n" as *u8)
232 apg_push(ids, hands, real, nc, "connect-plan-emptyreply-true-noland" as *u8, "NOT-LANDED" as *u8, APG_REAL)
233
234 // -- 3. legal plan edit, crash 2. The async job completed AFTER the session died. HAND = LANDED.
235 gk_join(p, dir, "legalpractice.plan" as *u8)
236 gk_write(p, "rung|LP3|opaque session|od_session|shipped\nrung|LP4|closed gate wrinkle|lg_closed|shipped\n" as *u8)
237 o = gk_cat(wl, o, "id=legal-plan-edit-crash2"); o = apg_tab(wl, o)
238 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
239 o = gk_cat(wl, o, "kind=insert"); o = apg_tab(wl, o)
240 o = gk_cat(wl, o, "mark=rung|LP4|closed gate wrinkle"); o = apg_tab(wl, o)
241 o = gk_cat(wl, o, "mark_pre=0"); o = apg_tab(wl, o)
242 o = gk_cat(wl, o, "reply=job-artifact-read-ABSENT-twice"); o = gk_cat(wl, o, "\n" as *u8)
243 apg_push(ids, hands, real, nc, "legal-plan-edit-crash2" as *u8, "LANDED" as *u8, APG_REAL)
244
245 // -- 4/5. legal incident debts, crash 2: zero debt calls in the whole predecessor transcript, and
246 // both rows were re-filed afterwards as 1787175151 / 1787175165. HAND = NOT-LANDED.
247 gk_join(p, dir, "debt.jrnl" as *u8)
248 gk_write(p, "1787174000\topen\tsome other row\n1787174900\topen\tanother row\n" as *u8)
249 o = gk_cat(wl, o, "id=legal-incident-debt-1"); o = apg_tab(wl, o)
250 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
251 o = gk_cat(wl, o, "kind=append"); o = apg_tab(wl, o)
252 o = gk_cat(wl, o, "mark=1787175151"); o = apg_tab(wl, o)
253 o = gk_cat(wl, o, "mark_pre=0"); o = apg_tab(wl, o)
254 o = gk_cat(wl, o, "reply=crash-mid-write"); o = gk_cat(wl, o, "\n" as *u8)
255 apg_push(ids, hands, real, nc, "legal-incident-debt-1" as *u8, "NOT-LANDED" as *u8, APG_REAL)
256 o = gk_cat(wl, o, "id=legal-incident-debt-2"); o = apg_tab(wl, o)
257 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
258 o = gk_cat(wl, o, "kind=append"); o = apg_tab(wl, o)
259 o = gk_cat(wl, o, "mark=1787175165"); o = apg_tab(wl, o)
260 o = gk_cat(wl, o, "mark_pre=0"); o = gk_cat(wl, o, "\n" as *u8)
261 apg_push(ids, hands, real, nc, "legal-incident-debt-2" as *u8, "NOT-LANDED" as *u8, APG_REAL)
262
263 // -- 6. devmgmt admission: the sync 503s that did NOT land; both files checked ABSENT. A CREATE.
264 gk_join(p, dir, "devmgmt.refs" as *u8)
265 gk_rm(p)
266 o = gk_cat(wl, o, "id=devmgmt-refs-503-create"); o = apg_tab(wl, o)
267 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
268 o = gk_cat(wl, o, "kind=create"); o = apg_tab(wl, o)
269 o = gk_cat(wl, o, "pre=absent"); o = apg_tab(wl, o)
270 o = gk_cat(wl, o, "reply=503"); o = gk_cat(wl, o, "\n" as *u8)
271 apg_push(ids, hands, real, nc, "devmgmt-refs-503-create" as *u8, "NOT-LANDED" as *u8, APG_REAL)
272
273 // -- 7/8. THE 503 CONTROLLED PAIR, same hour, opposite truths. Lane H's 503'd edit HAD landed (the
274 // CAS guard refused the duplicate retry); lane A's three 503s had NOT. Same reply text both ways.
275 gk_join(p, dir, "ecosysdesign.matrix" as *u8)
276 gk_write(p, t_new)
277 apg_hash_file(p, hx)
278 o = gk_cat(wl, o, "id=laneH-503-had-landed"); o = apg_tab(wl, o)
279 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
280 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
281 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
282 o = gk_cat(wl, o, "reply=503"); o = apg_tab(wl, o)
283 o = gk_cat(wl, o, "size=8225"); o = gk_cat(wl, o, "\n" as *u8)
284 apg_push(ids, hands, real, nc, "laneH-503-had-landed" as *u8, "LANDED" as *u8, APG_REAL)
285 gk_join(p, dir, "laneA_source.nx" as *u8)
286 gk_write(p, t_old)
287 o = gk_cat(wl, o, "id=laneA-503-not-landed"); o = apg_tab(wl, o)
288 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
289 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
290 apg_hash_text(t_new, hx)
291 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
292 apg_hash_text(t_old, hx)
293 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
294 o = gk_cat(wl, o, "reply=503"); o = gk_cat(wl, o, "\n" as *u8)
295 apg_push(ids, hands, real, nc, "laneA-503-not-landed" as *u8, "NOT-LANDED" as *u8, APG_REAL)
296
297 // -- 9. THE EMPTY-REPLY PAIR PARTNER (row 2 is the other half). Lane B's 5,165 B insert returned a
298 // bare empty object; the CAS retry proved it had landed EXACTLY ONCE and stopped the double-insert.
299 gk_join(p, dir, "toolreg_lib.nx" as *u8)
300 gk_write(p, "func trr_head() -> i64 { return 0 }\nfunc trr_reconcile() -> i64 { return 1 }\n" as *u8)
301 o = gk_cat(wl, o, "id=laneB-emptyreply-had-landed"); o = apg_tab(wl, o)
302 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
303 o = gk_cat(wl, o, "kind=insert"); o = apg_tab(wl, o)
304 o = gk_cat(wl, o, "mark=func trr_reconcile() -> i64 { return 1 }"); o = apg_tab(wl, o)
305 o = gk_cat(wl, o, "mark_pre=0"); o = apg_tab(wl, o)
306 o = gk_cat(wl, o, "reply=empty-object-body"); o = apg_tab(wl, o)
307 o = gk_cat(wl, o, "size=25850"); o = gk_cat(wl, o, "\n" as *u8)
308 apg_push(ids, hands, real, nc, "laneB-emptyreply-had-landed" as *u8, "LANDED" as *u8, APG_REAL)
309
310 // -- 10. /api/promote nx_seat: first call dropped, retry answered NOTHING-STAGED with live_sha equal
311 // to the build sha. HAND = LANDED.
312 gk_join(p, dir, "nx_seat.elf" as *u8)
313 gk_write(p, "ELF-STANDIN promoted artifact bytes\n" as *u8)
314 apg_hash_file(p, hx)
315 o = gk_cat(wl, o, "id=promote-nxseat-dropped-had-landed"); o = apg_tab(wl, o)
316 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
317 o = gk_cat(wl, o, "kind=promote"); o = apg_tab(wl, o)
318 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
319 o = gk_cat(wl, o, "reply=dropped-no-response"); o = gk_cat(wl, o, "\n" as *u8)
320 apg_push(ids, hands, real, nc, "promote-nxseat-dropped-had-landed" as *u8, "LANDED" as *u8, APG_REAL)
321
322 // -- 11. /api/ship session-expired: live == staged, so it HAD landed.
323 gk_join(p, dir, "shipped.elf" as *u8)
324 gk_write(p, "ELF-STANDIN shipped bytes, live equals staged\n" as *u8)
325 apg_hash_file(p, hx)
326 o = gk_cat(wl, o, "id=ship-session-expired-had-landed"); o = apg_tab(wl, o)
327 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
328 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
329 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
330 o = gk_cat(wl, o, "reply=session-expired"); o = gk_cat(wl, o, "\n" as *u8)
331 apg_push(ids, hands, real, nc, "ship-session-expired-had-landed" as *u8, "LANDED" as *u8, APG_REAL)
332
333 // -- 12. the certificate-verification error on nx_fs_write the SAME DAY as row 11: it had NOT landed.
334 // Two same-shaped transport errors, opposite answers -- the error text never tells you.
335 gk_join(p, dir, "certcase.nx" as *u8)
336 gk_write(p, t_old)
337 o = gk_cat(wl, o, "id=fswrite-cert-error-not-landed"); o = apg_tab(wl, o)
338 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
339 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
340 apg_hash_text(t_new, hx)
341 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
342 apg_hash_text(t_old, hx)
343 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
344 o = gk_cat(wl, o, "reply=certificate-verification-error"); o = gk_cat(wl, o, "\n" as *u8)
345 apg_push(ids, hands, real, nc, "fswrite-cert-error-not-landed" as *u8, "NOT-LANDED" as *u8, APG_REAL)
346
347 // -- 13. 2026-08-15: the edit returned OK bytes=6294 and the file still held the OLD content, because
348 // a sibling seat's write had landed over it. A SUCCESS RECEIPT IS NOT EVIDENCE EITHER.
349 gk_join(p, dir, "shared_organ.nx" as *u8)
350 gk_write(p, t_old)
351 o = gk_cat(wl, o, "id=concurrent-ok-receipt-old-content"); o = apg_tab(wl, o)
352 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
353 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
354 apg_hash_text(t_new, hx)
355 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
356 apg_hash_text(t_old, hx)
357 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
358 o = gk_cat(wl, o, "reply=OK-bytes-6294"); o = gk_cat(wl, o, "\n" as *u8)
359 apg_push(ids, hands, real, nc, "concurrent-ok-receipt-old-content" as *u8, "NOT-LANDED" as *u8, APG_REAL)
360
361 // -- 14. lane D: the file-size tool reported ABSENT three times for a file that had landed every
362 // time. A tool's absence report is not evidence any more than its size report is.
363 gk_join(p, dir, "toolhealth.nx" as *u8)
364 gk_write(p, "func th_scan() -> i64 { return 0 }\n" as *u8)
365 apg_hash_file(p, hx)
366 o = gk_cat(wl, o, "id=laneD-tool-said-absent-had-landed"); o = apg_tab(wl, o)
367 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
368 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
369 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
370 o = gk_cat(wl, o, "reply=fs-size-reported-ABSENT"); o = gk_cat(wl, o, "\n" as *u8)
371 apg_push(ids, hands, real, nc, "laneD-tool-said-absent-had-landed" as *u8, "LANDED" as *u8, APG_REAL)
372
373 // -- 15. the near-duplicate debt filing: one journal search returned zero, the seat re-issued, and
374 // the FIRST add had landed all along. The row is present exactly once.
375 gk_join(p, dir, "debt_once.jrnl" as *u8)
376 gk_write(p, "1787200000\topen\tsome row\n1787241079\topen\tthe filed row\n" as *u8)
377 o = gk_cat(wl, o, "id=debt-add-landed-after-zero-find"); o = apg_tab(wl, o)
378 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
379 o = gk_cat(wl, o, "kind=append"); o = apg_tab(wl, o)
380 o = gk_cat(wl, o, "mark=1787241079"); o = apg_tab(wl, o)
381 o = gk_cat(wl, o, "mark_pre=0"); o = apg_tab(wl, o)
382 o = gk_cat(wl, o, "reply=nothing"); o = gk_cat(wl, o, "\n" as *u8)
383 apg_push(ids, hands, real, nc, "debt-add-landed-after-zero-find" as *u8, "LANDED" as *u8, APG_REAL)
384
385 // -- 16. THE ONE OBSERVED DOUBLE-APPLY IN THE WHOLE RECORD: a clock-job put whose 503'd call landed
386 // late, so `autonomybeat` is DECLARED TWICE in the desired plane. There is no row-delete primitive,
387 // which is exactly why detecting it matters -- and only the marker tier can see it.
388 gk_join(p, dir, "clockjobs.plane" as *u8)
389 gk_write(p, "compare-beat 46800 _offc/nx_compare_beat.elf\nautonomybeat 86400 _offc/nx_autonomy_meter.elf\nautonomybeat 86400 _offc/nx_autonomy_meter.elf\n" as *u8)
390 o = gk_cat(wl, o, "id=clockjob-autonomybeat-double-declared"); o = apg_tab(wl, o)
391 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
392 o = gk_cat(wl, o, "kind=put"); o = apg_tab(wl, o)
393 o = gk_cat(wl, o, "mark=autonomybeat 86400"); o = apg_tab(wl, o)
394 o = gk_cat(wl, o, "mark_pre=0"); o = apg_tab(wl, o)
395 o = gk_cat(wl, o, "reply=no-output"); o = gk_cat(wl, o, "\n" as *u8)
396 apg_push(ids, hands, real, nc, "clockjob-autonomybeat-double-declared" as *u8, "DOUBLE-APPLIED" as *u8, APG_REAL)
397
398 // -- 17. the MCP body cap silently drops writes over roughly 64 KiB. Deterministic, not probabilistic,
399 // and the artifact stayed at its pre-image.
400 gk_join(p, dir, "bigpayload.nx" as *u8)
401 gk_write(p, t_old)
402 o = gk_cat(wl, o, "id=mcp-bodycap-silent-drop"); o = apg_tab(wl, o)
403 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
404 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
405 apg_hash_text(t_new, hx)
406 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
407 apg_hash_text(t_old, hx)
408 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
409 o = gk_cat(wl, o, "reply=empty-object-body"); o = gk_cat(wl, o, "\n" as *u8)
410 apg_push(ids, hands, real, nc, "mcp-bodycap-silent-drop" as *u8, "NOT-LANDED" as *u8, APG_REAL)
411
412 // -- 18/19. THE DISCRIMINATOR PAIR: ONE ARTIFACT, ADJUDICATED TWICE. The seat's size read reported
413 // the PRE-write size while the write had landed -- so a size-only row must ABSTAIN. Given the hash of
414 // the SAME file the answer is LANDED. An organ answering from the file cannot separate these.
415 gk_join(p, dir, "sizecase.nx" as *u8)
416 gk_write(p, "the write that had landed while the size read said otherwise\n" as *u8)
417 o = gk_cat(wl, o, "id=size-only-misleading"); o = apg_tab(wl, o)
418 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
419 o = gk_cat(wl, o, "kind=insert"); o = apg_tab(wl, o)
420 o = gk_cat(wl, o, "size=48184"); o = gk_cat(wl, o, "\n" as *u8)
421 apg_push(ids, hands, real, nc, "size-only-misleading" as *u8, "UNKNOWN" as *u8, APG_REAL)
422 apg_hash_file(p, hx)
423 o = gk_cat(wl, o, "id=size-plus-hash-same-file"); o = apg_tab(wl, o)
424 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
425 o = gk_cat(wl, o, "kind=insert"); o = apg_tab(wl, o)
426 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
427 o = gk_cat(wl, o, "size=48184"); o = gk_cat(wl, o, "\n" as *u8)
428 apg_push(ids, hands, real, nc, "size-plus-hash-same-file" as *u8, "LANDED" as *u8, APG_REAL)
429
430 // -- 20. toolchain seat e1366641, crash 1, stopped MID-APPLY: the live artifact was byte-unchanged
431 // from the pre-state, so nothing had applied. Pre-image only, and it can only ever say NOT.
432 gk_join(p, dir, "rebuild_drain.elf" as *u8)
433 gk_write(p, t_old)
434 apg_hash_text(t_old, hx)
435 o = gk_cat(wl, o, "id=toolchain-midapply-crash1"); o = apg_tab(wl, o)
436 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
437 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
438 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
439 o = gk_cat(wl, o, "reply=crash-mid-apply"); o = gk_cat(wl, o, "\n" as *u8)
440 apg_push(ids, hands, real, nc, "toolchain-midapply-crash1" as *u8, "NOT-LANDED" as *u8, APG_REAL)
441
442 // -- 21. the 21-region CAS ladder whose region 20 came back NOMATCH because an EARLIER edit in the
443 // same run had invalidated its anchor. The file changed -- but not by this write, and a pre-image is
444 // structurally unable to tell those apart. HAND: adjudicate by re-diffing, i.e. it could not be
445 // decided from the evidence held.
446 gk_join(p, dir, "ladder_region20.nx" as *u8)
447 gk_write(p, "content rewritten by the earlier regions of the same ladder\n" as *u8)
448 apg_hash_text(t_old, hx)
449 o = gk_cat(wl, o, "id=dm2-region20-stale-anchor"); o = apg_tab(wl, o)
450 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
451 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
452 o = gk_cat(wl, o, "pre=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
453 o = gk_cat(wl, o, "reply=NOMATCH"); o = gk_cat(wl, o, "\n" as *u8)
454 apg_push(ids, hands, real, nc, "dm2-region20-stale-anchor" as *u8, "UNKNOWN" as *u8, APG_REAL)
455
456 // -- 22. lane F's stage-1 run, issued one second before the crash. The record's own word is
457 // UNRESOLVED: no expectation was ever recorded, so there is nothing to adjudicate against. An organ
458 // that answers anything but UNKNOWN here is inventing evidence.
459 gk_join(p, dir, "exec_gate_patched.nx" as *u8)
460 gk_write(p, "any content at all\n" as *u8)
461 o = gk_cat(wl, o, "id=laneF-stage1-unresolved"); o = apg_tab(wl, o)
462 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
463 o = gk_cat(wl, o, "kind=replace"); o = apg_tab(wl, o)
464 o = gk_cat(wl, o, "reply=crash-one-second-after-issue"); o = gk_cat(wl, o, "\n" as *u8)
465 apg_push(ids, hands, real, nc, "laneF-stage1-unresolved" as *u8, "UNKNOWN" as *u8, APG_REAL)
466
467 // -- 23. the Elara crash-2 final command: the record says only that it "may not have run", and the
468 // lane closed on a different finding. NOTHING was recorded about it -- not an expected hash, not a
469 // marker, not even a transport reply. This is a DIFFERENT abstain-reason from row 22 and its remedy
470 // is different too (record any expectation at all, versus record a hash rather than a reply), so the
471 // two must never share a counter.
472 gk_join(p, dir, "repro_attempt3.png" as *u8)
473 gk_write(p, "some rendered bytes\n" as *u8)
474 o = gk_cat(wl, o, "id=elara-crash2-nothing-recorded"); o = apg_tab(wl, o)
475 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
476 o = gk_cat(wl, o, "kind=create"); o = gk_cat(wl, o, "\n" as *u8)
477 apg_push(ids, hands, real, nc, "elara-crash2-nothing-recorded" as *u8, "UNKNOWN" as *u8, APG_REAL)
478
479 // ---- CONSTRUCTED ROWS. Counted separately because they were never observed as artifacts. --------
480 // -- C1. the double-insert the CAS guard AVERTED on 2026-08-20: the record describes exactly what a
481 // blind retry would have produced. This is the outcome, built deliberately, so the marker tier can be
482 // shown to catch it on an INSERT as well as on a plane put.
483 gk_join(p, dir, "averted_double.nx" as *u8)
484 gk_write(p, "func ps_owner_scan() -> i64 { return 0 }\nfunc other() -> i64 { return 1 }\nfunc ps_owner_scan() -> i64 { return 0 }\n" as *u8)
485 o = gk_cat(wl, o, "id=laneC-double-insert-counterfactual"); o = apg_tab(wl, o)
486 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
487 o = gk_cat(wl, o, "kind=insert"); o = apg_tab(wl, o)
488 o = gk_cat(wl, o, "mark=func ps_owner_scan() -> i64 { return 0 }"); o = apg_tab(wl, o)
489 o = gk_cat(wl, o, "mark_pre=0"); o = gk_cat(wl, o, "\n" as *u8)
490 apg_push(ids, hands, real, nc, "laneC-double-insert-counterfactual" as *u8, "DOUBLE-APPLIED" as *u8, APG_CONSTRUCTED)
491
492 // -- C2/C3. grammar guards: a row we cannot parse and a marker with no pre-count are both rows we
493 // must not judge, and their reasons must not share a counter because their remedies differ.
494 gk_join(p, dir, "grammar.nx" as *u8)
495 gk_write(p, "any content at all\n" as *u8)
496 apg_hash_file(p, hx)
497 o = gk_cat(wl, o, "id=malformed-unknown-token"); o = apg_tab(wl, o)
498 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
499 o = gk_cat(wl, o, "kind=publish"); o = apg_tab(wl, o)
500 o = gk_cat(wl, o, "want=h"); o = gk_cat(wl, o, hx); o = apg_tab(wl, o)
501 o = gk_cat(wl, o, "bogus=1"); o = gk_cat(wl, o, "\n" as *u8)
502 apg_push(ids, hands, real, nc, "malformed-unknown-token" as *u8, "UNKNOWN" as *u8, APG_CONSTRUCTED)
503 o = gk_cat(wl, o, "id=mark-without-mark-pre"); o = apg_tab(wl, o)
504 o = gk_cat(wl, o, "path="); o = gk_cat(wl, o, p); o = apg_tab(wl, o)
505 o = gk_cat(wl, o, "kind=append"); o = apg_tab(wl, o)
506 o = gk_cat(wl, o, "mark=anything"); o = gk_cat(wl, o, "\n" as *u8)
507 apg_push(ids, hands, real, nc, "mark-without-mark-pre" as *u8, "UNKNOWN" as *u8, APG_CONSTRUCTED)
508
509 wl[o] = 0 as u8
510 let wlp: *u8 = sys_mmap(APG_PATHCAP)
511 gk_join(wlp, dir, "writelist.tsv" as *u8)
512 gk_write(wlp, wl)
513
514 // ---- RUN 1: the full corpus, no sampling -------------------------------------------------------
515 let buf: *u8 = sys_mmap(APG_CAP)
516 let olen: *i64 = sys_mmap(16) as *i64
517 olen[0] = 0
518 let rc1: i64 = gk_run_capture(subj, "landed" as *u8, wlp, 0 as *u8, 0 as *u8, buf, APG_CAP, olen)
519 let n1: i64 = olen[0]
520
521 // ---- THE VALIDATION DIFF, per row, hand answer beside organ answer -----------------------------
522 gv_puts("\n -- VALIDATION DIFF vs the hand adjudications (full corpus, no sampling) --\n" as *u8)
523 let got: *u8 = sys_mmap(APG_HEX)
524 var matches: i64 = 0
525 var mismatches: i64 = 0
526 var false_landed: i64 = 0
527 var false_not: i64 = 0
528 var correct_landed: i64 = 0
529 var correct_not: i64 = 0
530 var correct_double: i64 = 0
531 var correct_unknown: i64 = 0
532 var absent_rows: i64 = 0
533 var n_real: i64 = 0
534 var real_matches: i64 = 0
535 var i: i64 = 0
536 while i < nc[0] {
537 let id: *u8 = ids[i] as *u8
538 let hand: *u8 = hands[i] as *u8
539 apg_verdict_of(buf, n1, id, got)
540 var same: i64 = 0
541 if (got[0] as i64) != 0 { same = gk_streq(got, hand) }
542 if (got[0] as i64) == 0 { absent_rows = absent_rows + 1 }
543 gv_puts(" CORPUS " as *u8)
544 if real[i] == APG_REAL { gv_puts("[REAL] " as *u8) } else { gv_puts("[CONSTRUCTED] " as *u8) }
545 gv_puts(id)
546 gv_puts(" hand=" as *u8); gv_puts(hand)
547 gv_puts(" organ=" as *u8)
548 if (got[0] as i64) == 0 { gv_puts("(NO-ROW-EMITTED)" as *u8) } else { gv_puts(got) }
549 if same == 1 { gv_puts(" MATCH\n" as *u8); matches = matches + 1 } else { gv_puts(" MISMATCH\n" as *u8); mismatches = mismatches + 1 }
550 if real[i] == APG_REAL { n_real = n_real + 1 }
551 if real[i] == APG_REAL { if same == 1 { real_matches = real_matches + 1 } }
552 if same == 1 { if gk_streq(hand, "LANDED" as *u8) == 1 { correct_landed = correct_landed + 1 } }
553 if same == 1 { if gk_streq(hand, "NOT-LANDED" as *u8) == 1 { correct_not = correct_not + 1 } }
554 if same == 1 { if gk_streq(hand, "DOUBLE-APPLIED" as *u8) == 1 { correct_double = correct_double + 1 } }
555 if same == 1 { if gk_streq(hand, "UNKNOWN" as *u8) == 1 { correct_unknown = correct_unknown + 1 } }
556 // THE BAR: the organ said LANDED where the hand did not. This is the direction that loses work.
557 if same == 0 { if gk_streq(got, "LANDED" as *u8) == 1 { false_landed = false_landed + 1 } }
558 if same == 0 { if gk_streq(hand, "LANDED" as *u8) == 1 { false_not = false_not + 1 } }
559 i = i + 1
560 }
561 gv_puts(" DIFF-TOTALS rows=" as *u8); gv_num(nc[0])
562 gv_puts(" real=" as *u8); gv_num(n_real)
563 gv_puts(" constructed=" as *u8); gv_num(nc[0] - n_real)
564 gv_puts(" match=" as *u8); gv_num(matches)
565 gv_puts(" mismatch=" as *u8); gv_num(mismatches)
566 gv_puts(" real_match=" as *u8); gv_num(real_matches)
567 gv_puts(" FALSE_LANDED=" as *u8); gv_num(false_landed)
568 gv_puts(" false_not_landed=" as *u8); gv_num(false_not)
569 gv_puts(" no_row_emitted=" as *u8); gv_num(absent_rows)
570 gv_puts("\n DIFF-BY-CLASS correct_landed=" as *u8); gv_num(correct_landed)
571 gv_puts(" correct_not_landed=" as *u8); gv_num(correct_not)
572 gv_puts(" correct_double=" as *u8); gv_num(correct_double)
573 gv_puts(" correct_unknown=" as *u8); gv_num(correct_unknown)
574 gv_puts(" sum=" as *u8); gv_num(correct_landed + correct_not + correct_double + correct_unknown)
575 gv_puts(" (equals match when the partition holds)\n\n" as *u8)
576
577 // ---- teeth ------------------------------------------------------------------------------------
578 // ANTI-VACUITY FIRST, and it is one condition three trivial implementations each fail: always-LANDED
579 // loses correct_not, always-NOT loses correct_landed, always-UNKNOWN loses both.
580 var av: i64 = 0
581 if correct_landed > 0 { if correct_not > 0 { if correct_double > 0 { if correct_unknown > 0 { av = 1 } } } }
582 gv_check("anti-vacuity-all-four-classes-answered-correctly-in-one-run" as *u8, av, ctr)
583 gv_check("THE-BAR-zero-false-LANDED-across-the-whole-corpus" as *u8, apg_zero(false_landed), ctr)
584 gv_check("full-corpus-diff-has-zero-mismatches" as *u8, apg_zero(mismatches), ctr)
585 gv_check("every-real-hand-adjudicated-row-matched" as *u8, apg_eq(real_matches, n_real), ctr)
586 gv_check("every-corpus-row-emitted-a-verdict-row" as *u8, apg_zero(absent_rows), ctr)
587 gv_check("diff-class-partition-sums-to-the-match-count" as *u8, apg_eq(correct_landed + correct_not + correct_double + correct_unknown, matches), ctr)
588
589 // the CONTROLLED PAIRS: identical transport reply, opposite truth. These are the teeth an organ that
590 // consults the reply text cannot pass, and they are the reason the corpus is real rather than made up.
591 let v503a: *u8 = sys_mmap(APG_HEX)
592 let v503b: *u8 = sys_mmap(APG_HEX)
593 apg_verdict_of(buf, n1, "laneH-503-had-landed" as *u8, v503a)
594 apg_verdict_of(buf, n1, "laneA-503-not-landed" as *u8, v503b)
595 var pair503: i64 = 0
596 if gk_streq(v503a, "LANDED" as *u8) == 1 { if gk_streq(v503b, "NOT-LANDED" as *u8) == 1 { pair503 = 1 } }
597 gv_check("controlled-pair-same-503-reply-opposite-verdicts" as *u8, pair503, ctr)
598 apg_verdict_of(buf, n1, "laneB-emptyreply-had-landed" as *u8, v503a)
599 apg_verdict_of(buf, n1, "connect-plan-emptyreply-true-noland" as *u8, v503b)
600 var pairempty: i64 = 0
601 if gk_streq(v503a, "LANDED" as *u8) == 1 { if gk_streq(v503b, "NOT-LANDED" as *u8) == 1 { pairempty = 1 } }
602 gv_check("controlled-pair-same-empty-reply-opposite-verdicts" as *u8, pairempty, ctr)
603 // one artifact, two rows, two correct and DIFFERENT answers
604 apg_verdict_of(buf, n1, "size-only-misleading" as *u8, v503a)
605 apg_verdict_of(buf, n1, "size-plus-hash-same-file" as *u8, v503b)
606 var pairdisc: i64 = 0
607 if gk_streq(v503a, "UNKNOWN" as *u8) == 1 { if gk_streq(v503b, "LANDED" as *u8) == 1 { pairdisc = 1 } }
608 gv_check("discriminator-one-artifact-abstains-on-size-and-lands-on-hash" as *u8, pairdisc, ctr)
609
610 let prows: i64 = apg_int_after(buf, n1, "APL-PARTITION rows=" as *u8)
611 gv_check("partition-row-count-equals-the-corpus" as *u8, apg_eq(prows, nc[0]), ctr)
612 gv_check("partition-reconciles" as *u8, gk_out_has(buf, n1, "partition=RECONCILES" as *u8), ctr)
613 gv_check("run-with-UNKNOWN-rows-exits-1-needs-adjudication" as *u8, apg_eq(rc1, 1), ctr)
614 gv_check("abstains-rather-than-acquits-verdict-says-NEEDS-ADJUDICATION" as *u8, gk_out_has(buf, n1, "verdict=NEEDS-ADJUDICATION" as *u8), ctr)
615
616 // the non-evidence contract, asserted on the OUTPUT and not merely on the verdicts
617 gv_check("size-is-echoed-and-named-as-non-evidence" as *u8, gk_out_has(buf, n1, "NON-EVIDENCE-ECHO size=" as *u8), ctr)
618 gv_check("reply-is-echoed-and-named-as-non-evidence" as *u8, gk_out_has(buf, n1, "NON-EVIDENCE-ECHO reply=" as *u8), ctr)
619 gv_check("UNKNOWN-reason-size-only-is-named-in-a-worklist-line" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON size-only-not-evidence" as *u8), ctr)
620 gv_check("UNKNOWN-reason-mark-without-mark-pre-has-its-own-counter" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON mark-without-mark-pre" as *u8), ctr)
621 gv_check("UNKNOWN-reason-malformed-row-has-its-own-counter" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON malformed-row-unrecognised-or-missing-token" as *u8), ctr)
622 gv_check("UNKNOWN-reason-changed-but-undeclared-has-its-own-counter" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON changed-but-target-content-undeclared" as *u8), ctr)
623 gv_check("UNKNOWN-reason-no-expectation-has-its-own-counter" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON no-expectation-recorded" as *u8), ctr)
624 gv_check("UNKNOWN-reason-reply-only-has-its-own-counter-not-folded-into-no-expectation" as *u8, gk_out_has(buf, n1, "APL-UNKNOWN-REASON reply-text-not-evidence" as *u8), ctr)
625
626 // retry advice is a property of the EDIT KIND, and getting it backwards turns a lost edit into a
627 // double-applied one
628 gv_check("advice-for-insert-says-RE-DIFF-not-retry" as *u8, gk_out_has(buf, n1, "RE-DIFF do NOT re-issue -- an insert is not idempotent" as *u8), ctr)
629 gv_check("advice-for-publish-says-RETRY-SAFE" as *u8, gk_out_has(buf, n1, "RETRY-SAFE re-issue the whole-file publish" as *u8), ctr)
630 gv_check("advice-for-promote-is-self-adjudicating" as *u8, gk_out_has(buf, n1, "RETRY-SELF-ADJUDICATING" as *u8), ctr)
631 gv_check("advice-for-plane-put-warns-there-is-no-row-delete" as *u8, gk_out_has(buf, n1, "no row-delete primitive" as *u8), ctr)
632 // the caveat the record earned: an anchored replace is only retry-safe if the replacement cannot
633 // re-match its own anchor, and advice that omits that condition is advice to double-apply
634 gv_check("advice-for-replace-carries-the-re-matching-anchor-caveat" as *u8, gk_out_has(buf, n1, "ONLY IF the replacement cannot re-match its own anchor" as *u8), ctr)
635
636 let settle: i64 = apg_int_after(buf, n1, "APL-SETTLE settle_ms=" as *u8)
637 gv_check("settle-window-and-its-source-are-announced" as *u8, apg_gt(settle, 0), ctr)
638
639 // ---- RUN 2: the decidable subset. An organ that abstains on everything cannot reach here. -------
640 let wl2: *u8 = sys_mmap(APG_WLCAP)
641 var o2: i64 = gk_cat(wl2, 0, "// decidable subset -- DECIDED-ALL must be reachable\n" as *u8)
642 gk_join(p, dir, "connect.refs" as *u8)
643 apg_hash_file(p, hx)
644 o2 = gk_cat(wl2, o2, "id=r2-landed"); o2 = apg_tab(wl2, o2)
645 o2 = gk_cat(wl2, o2, "path="); o2 = gk_cat(wl2, o2, p); o2 = apg_tab(wl2, o2)
646 o2 = gk_cat(wl2, o2, "kind=publish"); o2 = apg_tab(wl2, o2)
647 o2 = gk_cat(wl2, o2, "want=h"); o2 = gk_cat(wl2, o2, hx); o2 = gk_cat(wl2, o2, "\n" as *u8)
648 gk_join(p, dir, "certcase.nx" as *u8)
649 apg_hash_text(t_old, hx)
650 o2 = gk_cat(wl2, o2, "id=r2-not-landed"); o2 = apg_tab(wl2, o2)
651 o2 = gk_cat(wl2, o2, "path="); o2 = gk_cat(wl2, o2, p); o2 = apg_tab(wl2, o2)
652 o2 = gk_cat(wl2, o2, "kind=replace"); o2 = apg_tab(wl2, o2)
653 o2 = gk_cat(wl2, o2, "pre=h"); o2 = gk_cat(wl2, o2, hx); o2 = gk_cat(wl2, o2, "\n" as *u8)
654 wl2[o2] = 0 as u8
655 let wlp2: *u8 = sys_mmap(APG_PATHCAP)
656 gk_join(wlp2, dir, "writelist2.tsv" as *u8)
657 gk_write(wlp2, wl2)
658 olen[0] = 0
659 let rc2: i64 = gk_run_capture(subj, "landed" as *u8, wlp2, 0 as *u8, 0 as *u8, buf, APG_CAP, olen)
660 let n2: i64 = olen[0]
661 gv_check("neg-control-refuses-everything-would-fail-here-DECIDED-ALL-reachable" as *u8, gk_out_has(buf, n2, "verdict=DECIDED-ALL" as *u8), ctr)
662 gv_check("fully-decided-run-exits-0" as *u8, apg_zero(rc2), ctr)
663 gv_check("neg-control-decidable-subset-reports-zero-unknown" as *u8, gk_out_has(buf, n2, "unknown=0" as *u8), ctr)
664
665 // ---- RUN 3: an artifact still being written between the two passes must ABSTAIN -----------------
666 // The child's schedule is DERIVED from the subject's own announced settle window, so a conf change
667 // cannot quietly make this tooth vacuous; below the floor there is no reliable schedule at all and
668 // the tooth abstains instead of reporting a flake as a defect.
669 var race_ms: i64 = 0
670 if settle > 0 { race_ms = settle / APG_RACE_DIVISOR }
671 var raceable: i64 = 0
672 if race_ms >= APG_RACE_FLOOR_MS { raceable = 1 }
673 if gv_need("settle window wide enough to schedule a concurrent writer" as *u8, raceable, ctr) == 1 {
674 gk_join(p, dir, "racing.nx" as *u8)
675 gk_write(p, "first content\n" as *u8)
676 apg_hash_file(p, hx)
677 let wl3: *u8 = sys_mmap(APG_WLCAP)
678 var o3: i64 = gk_cat(wl3, 0, "id=r3-unsettled"); o3 = apg_tab(wl3, o3)
679 o3 = gk_cat(wl3, o3, "path="); o3 = gk_cat(wl3, o3, p); o3 = apg_tab(wl3, o3)
680 o3 = gk_cat(wl3, o3, "kind=publish"); o3 = apg_tab(wl3, o3)
681 o3 = gk_cat(wl3, o3, "want=h"); o3 = gk_cat(wl3, o3, hx); o3 = gk_cat(wl3, o3, "\n" as *u8)
682 wl3[o3] = 0 as u8
683 let wlp3: *u8 = sys_mmap(APG_PATHCAP)
684 gk_join(wlp3, dir, "writelist3.tsv" as *u8)
685 gk_write(wlp3, wl3)
686 let kid: i64 = sys_fork()
687 if kid == 0 {
688 sys_sleep_ms(race_ms)
689 gk_write(p, "second content, written between the subject's two passes\n" as *u8)
690 sys_exit(0)
691 }
692 olen[0] = 0
693 let rc3: i64 = gk_run_capture(subj, "landed" as *u8, wlp3, 0 as *u8, 0 as *u8, buf, APG_CAP, olen)
694 let n3: i64 = olen[0]
695 let st3: *i64 = sys_mmap(16) as *i64
696 st3[0] = 0
697 sys_wait4(kid, st3, 0)
698 // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME: the racing writer must
699 // actually have changed the file, or this tooth passes over a case it never created.
700 let hx3: *u8 = sys_mmap(APG_HEX)
701 apg_hash_file(p, hx3)
702 gv_check("neg-control-race-fixture-actually-changed-the-file" as *u8, apg_zero(gk_streq(hx3, hx)), ctr)
703 apg_verdict_of(buf, n3, "r3-unsettled" as *u8, got)
704 gv_check("artifact-written-between-the-two-passes-abstains-UNKNOWN" as *u8, gk_streq(got, "UNKNOWN" as *u8), ctr)
705 gv_check("unsettled-is-named-as-its-own-reason-not-folded-into-another" as *u8, gk_out_has(buf, n3, "reason=unsettled-two-reads-differ" as *u8), ctr)
706 gv_check("unsettled-row-exits-1-rather-than-acquitting" as *u8, apg_eq(rc3, 1), ctr)
707 }
708
709 return gv_verdict(APG_NAME, ctr, "ap_landed vs the hand answers; the per-row diff and the FALSE_LANDED count are printed above" as *u8)
710}