nx_board_contract_gate.nx source
↩ module page · 850 lines · 48073 B
1// nx_board_contract_gate.nx -- THE REFEREE FOR BUILD CONTRACTS ON THE COMPARE BOARDS (2026-09-03).
2//
3// THE DEFECT THIS GUARDS, measured on /compare/lang the day this shipped. A matrix row declares a build
4// contract in its symbol field as _ABSENT_:<symbol>, and the emitter flips that cell the moment the symbol
5// exists in the organ named by field 2. That is the hive's completion signal. But NOTHING checks that the
6// named organ is even CAPABLE of carrying the symbol -- so a row whose field 2 points at the wrong file is a
7// contract that can NEVER flip, and it reads exactly like honest work-in-progress forever.
8//
9// LR7 on the lang board sat in that state and cost a full re-derivation: its field 2 named
10// runtime/nx_boundscheck.nx while bck_elide_dominated is declared in runtime/nx_bck_elide.nx. The capability
11// had shipped; the cell still said WATCHING; the note still said the compiler lacked it.
12//
13// WHY A SUBSTRING TEST WOULD BE WORSE THAN NOTHING HERE. nx_boundscheck.nx DOES contain the characters
14// bck_elide_dominated -- inside the DISTINCT symbol bck_elide_dominated_witness, and in a comment. A naive
15// substring probe therefore reports that row as perfectly resolvable and the whole class stays invisible.
16// This gate looks for a DECLARATION (func <symbol> followed by an open paren) and reports a bare textual hit
17// as its own class, SUBSTRING-ONLY, because that is the shape the trap actually takes.
18//
19// CLASSES, and every one of them is NAMED, never merely counted:
20// DECLARED the named organ declares the symbol -- the contract CAN flip. Healthy.
21// MISPOINTED-CANDIDATE the symbol TEXT occurs in the named organ but no DECLARATION does. This is the LR7
22// shape and the ONLY class this gate treats as a defect.
23// PENDING-IN-FILE the organ exists and does not carry the symbol yet -- a normal OPEN contract.
24// PENDING-NO-ORGAN the named organ is not written yet -- also a normal OPEN contract.
25//
26// THE RATCHET COUNTS MISPOINTED-CANDIDATE ALONE, AND THAT WAS A CORRECTION MADE ON THE FIRST LIVE RUN.
27// v1 called all three non-DECLARED classes "unflippable" and reported 1052 of 1169 contracts as defects.
28// That is a false-positive machine: an _ABSENT_ contract naming an organ nobody has written yet is EXACTLY
29// what an open build contract IS. Measured live: 468 PENDING-NO-ORGAN + 573 PENDING-IN-FILE are ordinary
30// work in flight, and only 11 rows carry the shape that can never flip.
31// ⇒ A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE, and its own first census is where you find them.
32//
33// KNOWN LIMIT, DECLARED RATHER THAN HIDDEN. PENDING-IN-FILE cannot be split into "not written yet" versus
34// "declared somewhere ELSE while this row points here" without a tree-wide declaration index. That index is
35// a named next leg; this gate does NOT guess at it, and its absence is why PENDING-IN-FILE is reported as
36// its own axis instead of being folded into the defect count.
37// The partition SUMS over all four classes, and the sum is printed, because a partition you cannot reconcile
38// is a leak.
39//
40// ADVISORY BY CONSTRUCTION ON THE RISE, RATCHETED ON THE FALL. A deliberate hold is legitimate (LR7 held its
41// pointer wrong ON PURPOSE so the cell would not flip over a capability the shipped compiler lacked), so this
42// gate must not refuse a board for having one. It NAMES every offender and refuses only a RISE above the
43// recorded baseline, and it self-baselines on first sight so adopting it can break nothing.
44//
45// FIXTURE IS PER-RUN, NOT PER-GATE. The dir carries a microsecond clock reading taken at entry (sys_getpid
46// is not in this tree's syscall shim, and nx_getpid_const_probe exists precisely because a pid here has been
47// seen to read as a constant -- a discriminator that can silently collapse is worse than none). Two runs
48// against different trees cannot clobber each other into a false SKIP -- the exact defect measured on
49// nx_bck_elide_gate the same day (14 hardcoded /tmp/nx_bck_elide_gate/ literals, two concurrent runs, both
50// returning a SKIP that proved nothing). This organ is the reference implementation for that fix.
51//
52// exit: 0 GREEN . 1 RED . 3 SKIP (no board tree readable) license_tier: ORIGINAL No hw writes.
53import "nx_syscalls.nx"
54import "nx_gate_verdict.nx"
55import "nx_comparetree_lib.nx"
56import "nx_gatekit_lib.nx"
57
58const BC_PATH: i64 = 1024
59const BC_CAP: i64 = 1048576
60const BC_LIST: i64 = 65536
61const BC_MODE_RWX: i64 = 493
62const BC_MODE_RW: i64 = 420
63const BC_NL: i64 = 10
64const BC_BAR: i64 = 124
65const BC_ZERO: i64 = 48
66const BC_NINE: i64 = 57
67const BC_MINUS: i64 = 45
68const BC_HASH: i64 = 35
69const BC_AT: i64 = 64
70const BC_MARKLEN: i64 = 9
71const BC_FLD_ORGAN: i64 = 1
72const BC_FLD_SYM: i64 = 2
73const BC_NAMECAP: i64 = 40
74const BC_SYMCAP: i64 = 256
75
76// counter slots, declared so the partition is readable from one place
77const BC_C_CONTRACTS: i64 = 0
78const BC_C_DECLARED: i64 = 1
79const BC_C_SUBSTR: i64 = 2
80const BC_C_ABSENT: i64 = 3
81const BC_C_UNREAD: i64 = 4
82const BC_C_DOMAINS: i64 = 5
83const BC_C_ROWS: i64 = 6
84// ---- THE PROSE AXIS (third leg, 2026-09-04) -------------------------------------
85// EVERY INSTRUMENT ON THIS SURFACE READS FIELD 2 AND FIELD 3. NOTHING READS THE NOTE, and that is where
86// the defect actually lived when it was measured. /compare/procgen logged nx_gi_path as ABSENT with no
87// source existing while nx_gi_path.nx, nx_gi_path_lib.nx and nx_gi_path_gate.nx were 33,426 bytes on disk
88// including a bite-proven gate -- and /compare/graphics had logged the same organ BUILT, PROMOTED and
89// REGISTERED 6,600 seconds later THE SAME DAY. No generator, gate or census could catch it, because a
90// watch cell is measured on every emit and a SENTENCE is measured by nobody.
91// THE SHAPE, and it is why this rides HERE rather than in a new organ: both live instances are rows this
92// gate ALREADY classifies as DECLARED. Their symbol exists, so their cell is correct or about to flip --
93// while the note beside it still says the capability is absent. A BOARD CAN BE MECHANICALLY GREEN AND
94// EDITORIALLY FALSE AT THE SAME CELL, and the prose is the half a human actually reads.
95// Measured 2026-09-04, both on procgen: gs_from_mesh is declared at nx_gsplat.nx:833 while its note says
96// NO organ turns an ingested mesh into gaussians; gb_bind is declared at nx_gsplatbind.nx:63 while its
97// note says SOURCE-ONLY, never compiled.
98const BC_C_PROSE: i64 = 7
99// ---- THE BINARY-ABSENCE AXIS (fourth leg, 2026-09-04) ----------------------------
100// THE PROSE AXIS DELIBERATELY REFUSED THIS CLASS AND NAMED IT AS OWED. Its witness -- the symbol is
101// DECLARED -- can only contradict a claim about the SOURCE. A note saying SOURCE-ONLY or never compiled
102// is a claim about the BINARY, and a declaration is exactly what SOURCE-ONLY already concedes, so scoring
103// it there produced a 700-permil false-positive rate on real data. This leg supplies the RIGHT WITNESS:
104// does a built artifact exist for the organ this row names.
105const BC_C_BINSTALE: i64 = 8
106const BC_NOTECAP: i64 = 8192
107// Lines already emitted by the offender worklists. NOT a partition member -- it counts OUTPUT, not
108// subjects, and folding it into the census sum would break the reconciliation.
109const BC_C_EMITTED: i64 = 9
110const BC_C_SLOTS: i64 = 10
111// AN UNBOUNDED WORKLIST TURNS A GREEN GATE RED, AND IT DID. MEASURED 2026-09-04 on the first NAS run
112// after the naming worklists were added: /api/gate_run captures 16384 bytes, the census overran it, and
113// the gate was KILLED MID-WRITE -- exit 141 is SIGPIPE, reported as verdict=RED while every tooth shown
114// had PASSED. A gate that cannot fit inside its own caller is indistinguishable from a failing gate.
115// So the list is capped and SAYS SO, on the estate's own prefix idiom: a shown list that is a prefix of
116// its count must announce that, or a reader takes the prefix for the population.
117const BC_LIST_CAP: i64 = 20
118// ---- THE DECLARATION INDEX (second leg, 2026-09-03) ---------------------------------------------
119// v1 could say "the named organ does not declare this symbol" but NOT "so where IS it declared?", so
120// PENDING (nobody has written it yet) and MISPOINTED (it IS written, this row points at the wrong file)
121// sat in one bucket with two OPPOSITE remedies -- 573 rows of it. This leg resolves every unresolved
122// symbol against the WHOLE COMPILE CORPUS, enumerated by gk_corpus_scan so the overlay rule
123// (_hdl_build shadows runtime) is the BUILDER's rule and not a second one that can drift from it.
124// NO GUESSED CEILINGS HERE, AND THAT IS THE POINT. v2 of this gate hit gk_corpus_scan's cap at 12000 and
125// RAISED it to 40000 -- which is the exact defect the estate has already paid for: a ceiling that has to be
126// guessed is a defect generator in both directions, and raising it only moves the guess. The corpus size
127// and the longest path are now MEASURED by gk_corpus_count before a byte is allocated, the contract tables
128// are sized by counting the contracts first, and the hash table is derived from that count. There is no
129// number to tune, so the scan's refusal is unreachable BY CONSTRUCTION rather than avoided by luck.
130const BC_HASH_MINSLOTS: i64 = 16 // the smallest useful table, not a ceiling: it only ever grows
131const BC_HASH_LOAD_NUM: i64 = 2 // slots per record before rounding up to a power of two
132const BC_LOWA: i64 = 97
133const BC_LOWZ: i64 = 122
134const BC_UPA: i64 = 65
135const BC_UPZ: i64 = 90
136const BC_US: i64 = 95
137const BC_LPAREN: i64 = 40
138const BC_HASH_SEED: i64 = 5381
139const BC_HASH_MUL: i64 = 33
140const BC_HASH_MOD: i64 = 1000000007
141func bc_isident(ch: i64) -> i64 {
142 if ch >= BC_LOWA { if ch <= BC_LOWZ { return 1 } }
143 if ch >= BC_UPA { if ch <= BC_UPZ { return 1 } }
144 if ch >= BC_ZERO { if ch <= BC_NINE { return 1 } }
145 if ch == BC_US { return 1 }
146 return 0
147}
148func bc_streq_p(a: *u8, b: *u8) -> i64 {
149 var i: i64 = 0
150 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
151 if b[i] != (0 as u8) { return 0 }
152 return 1
153}
154func bc_hash(t: *u8, slots: i64) -> i64 {
155 var h: i64 = BC_HASH_SEED
156 var i: i64 = 0
157 while t[i] != (0 as u8) { h = ((h * BC_HASH_MUL) + (t[i] as i64)) % BC_HASH_MOD; i = i + 1 }
158 return h % slots
159}
160func bc_find_from(buf: *u8, n: i64, needle: *u8, from: i64) -> i64 {
161 let m: i64 = bc_slen(needle)
162 if m == 0 { return 0 - 1 }
163 var i: i64 = from
164 while i + m <= n {
165 var j: i64 = 0
166 var ok: i64 = 1
167 while j < m { if buf[i + j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
168 if ok == 1 { return i }
169 i = i + 1
170 }
171 return 0 - 1
172}
173
174func bc_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
175func bc_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var i: i64 = 0; while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 } dst[o] = 0 as u8; return o }
176func bc_put(dst: *u8, off: i64, c: i64) -> i64 { dst[off] = c as u8; dst[off + 1] = 0 as u8; return off + 1 }
177func bc_catn(dst: *u8, off: i64, v: i64) -> i64 {
178 var o: i64 = off
179 var m: i64 = v
180 if m < 0 { o = bc_put(dst, o, BC_MINUS); m = 0 - m }
181 let t: *u8 = sys_mmap(32)
182 var k: i64 = 0
183 if m == 0 { t[0] = BC_ZERO as u8; k = 1 }
184 while m > 0 { t[k] = (BC_ZERO + (m % 10)) as u8; m = m / 10; k = k + 1 }
185 var j: i64 = 0
186 while j < k { dst[o] = t[k - 1 - j]; o = o + 1; j = j + 1 }
187 dst[o] = 0 as u8
188 return o
189}
190func bc_find(buf: *u8, n: i64, needle: *u8) -> i64 {
191 let m: i64 = bc_slen(needle)
192 if m == 0 { return 0 - 1 }
193 var i: i64 = 0
194 while i + m <= n {
195 var j: i64 = 0
196 var ok: i64 = 1
197 while j < m { if buf[i + j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
198 if ok == 1 { return i }
199 i = i + 1
200 }
201 return 0 - 1
202}
203func bc_has(buf: *u8, n: i64, needle: *u8) -> i64 { if bc_find(buf, n, needle) >= 0 { return 1 } return 0 }
204// Is this note ASSERTING that the capability is absent? The vocabulary is calibrated on the two live
205// instances measured 2026-09-04 and is DELIBERATELY NARROW. A marker list keyed on the vocabulary of the
206// thing being detected cannot see an instance expressed in other words, so this count is a FLOOR and must
207// be read as one -- never as a population.
208// CALIBRATED ON REAL DATA BEFORE SHIPPING, AND THE FIRST VOCABULARY WAS A 700-PERMIL FALSE-POSITIVE
209// MACHINE. Run over two live boards (lang 72 rows, procgen 85 rows) the first cut fired 10 times and SEVEN
210// were healthy rows correctly saying SOURCE-ONLY: nx_worley_noise, nx_water_erosion_tick, nx_wind_erosion_at,
211// nx_river_generate_path, nx_forest_layout_generate_poisson, nx_weather_kind_at_biome and gb_bind.
212// THE ROOT CAUSE IS A SUBJECT MISMATCH, NOT A BAD WORD LIST. SOURCE-ONLY and never-compiled are claims about
213// THE BINARY. The conjunct this predicate rides on -- cls == 1 -- proves only that the SOURCE DECLARES the
214// symbol, which is exactly what SOURCE-ONLY already concedes. So those markers can never be refuted by the
215// evidence available here, and convicting on them would punish the estate's most honest rows.
216// ONLY CLAIMS ABOUT THE SOURCE ITSELF SURVIVE, because only those does a declaration contradict. The
217// binary-absence class needs a DIFFERENT witness (does the artifact exist?) and is a NAMED NEXT LEG,
218// deliberately not guessed at here. Re-measured after narrowing: 3 text hits across both boards, and only
219// gs_from_mesh is verified-declared -- the other two are open contracts that cls == 1 filters out.
220func bc_note_absence(note: *u8, n: i64) -> i64 {
221 if bc_has(note, n, "no source exists" as *u8) == 1 { return 1 }
222 if bc_has(note, n, "does not exist" as *u8) == 1 { return 1 }
223 if bc_has(note, n, "a real hole" as *u8) == 1 { return 1 }
224 if bc_has(note, n, "NO organ" as *u8) == 1 { return 1 }
225 return 0
226}
227// THE EXEMPTION THAT MAKES THIS SAFE TO SHIP, and it is load-bearing rather than a nicety. A row that
228// RETRACTS or CORRECTS an earlier claim must QUOTE the wording it is withdrawing -- that is exactly what
229// an honest correction looks like, and this estate writes them deliberately. Without this test every such
230// row would be convicted by the very words it exists to withdraw, and the detector would punish the one
231// behaviour it is meant to encourage.
232// SCOPED TO THE SENTENCE, NOT THE NOTE -- and the whole-note version was PROVEN over-broad by its own
233// anti-vacuity bite before this replaced it. A note that RETRACTS one claim while still ASSERTING another
234// absence escaped entirely, because a single retraction word anywhere silenced every marker in the row.
235// That is a false negative, and an over-broad guard fails in the QUIET direction: it raises no alarm
236// anywhere, so nothing surfaces it except a bite that goes looking. Bites 1 to 3 all passed and would
237// have shipped this limit unnoticed.
238// A SENTENCE ENDS AT A PERIOD FOLLOWED BY A SPACE, or at the end of the note. That rule is deliberately
239// crude and is DECLARED so rather than discovered: it will split on an abbreviation and on a decimal
240// followed by a space, which widens the tested span in the SAFE direction (a wider span can only ADD a
241// retraction word, i.e. silence a hit, which is the direction that under-reports rather than accuses).
242func bc_is_stop(b: *u8, i: i64, n: i64) -> i64 {
243 if (b[i] as i64) != 46 { return 0 }
244 if i + 1 >= n { return 1 }
245 if (b[i + 1] as i64) == 32 { return 1 }
246 return 0
247}
248func bc_span_retracted(b: *u8, s: i64, e: i64, tmp: *u8, cap: i64) -> i64 {
249 var m: i64 = e - s
250 if m <= 0 { return 0 }
251 if m >= cap { m = cap - 1 }
252 var k: i64 = 0
253 while k < m { tmp[k] = b[s + k]; k = k + 1 }
254 tmp[m] = 0 as u8
255 if bc_has(tmp, m, "CORRECTED" as *u8) == 1 { return 1 }
256 if bc_has(tmp, m, "CORRECTION" as *u8) == 1 { return 1 }
257 if bc_has(tmp, m, "RETRACT" as *u8) == 1 { return 1 }
258 if bc_has(tmp, m, "REFUTED" as *u8) == 1 { return 1 }
259 if bc_has(tmp, m, "MEASURED FALSE" as *u8) == 1 { return 1 }
260 return 0
261}
262const BC_NBINMARK: i64 = 3
263func bc_binmarker(i: i64) -> *u8 {
264 if i == 0 { return "SOURCE-ONLY" as *u8 }
265 if i == 1 { return "never compiled" as *u8 }
266 if i == 2 { return "never built" as *u8 }
267 return "" as *u8
268}
269// 1 iff SOME binary-absence claim stands UNRETRACTED IN ITS OWN SENTENCE. Same sentence discipline as the
270// source axis, because the same over-breadth defect would otherwise be reintroduced here verbatim.
271func bc_note_binary_claim(note: *u8, n: i64, tmp: *u8, cap: i64) -> i64 {
272 var mi: i64 = 0
273 while mi < BC_NBINMARK {
274 let mk: *u8 = bc_binmarker(mi)
275 var at: i64 = bc_find_from(note, n, mk, 0)
276 while at >= 0 {
277 var s: i64 = 0
278 var i: i64 = 0
279 while i < at { if bc_is_stop(note, i, n) == 1 { s = i + 1 } i = i + 1 }
280 var e: i64 = n
281 i = at
282 while i < n { if bc_is_stop(note, i, n) == 1 { e = i; i = n } else { i = i + 1 } }
283 if bc_span_retracted(note, s, e, tmp, cap) == 0 { return 1 }
284 at = bc_find_from(note, n, mk, at + 1)
285 }
286 mi = mi + 1
287 }
288 return 0
289}
290const BC_NMARK: i64 = 4
291func bc_marker(i: i64) -> *u8 {
292 if i == 0 { return "no source exists" as *u8 }
293 if i == 1 { return "does not exist" as *u8 }
294 if i == 2 { return "a real hole" as *u8 }
295 if i == 3 { return "NO organ" as *u8 }
296 return "" as *u8
297}
298// 1 iff SOME absence claim in this note stands UNRETRACTED IN ITS OWN SENTENCE.
299func bc_note_stale_claim(note: *u8, n: i64, tmp: *u8, cap: i64) -> i64 {
300 var mi: i64 = 0
301 while mi < BC_NMARK {
302 let mk: *u8 = bc_marker(mi)
303 var at: i64 = bc_find_from(note, n, mk, 0)
304 while at >= 0 {
305 var s: i64 = 0
306 var i: i64 = 0
307 while i < at { if bc_is_stop(note, i, n) == 1 { s = i + 1 } i = i + 1 }
308 var e: i64 = n
309 i = at
310 while i < n { if bc_is_stop(note, i, n) == 1 { e = i; i = n } else { i = i + 1 } }
311 if bc_span_retracted(note, s, e, tmp, cap) == 0 { return 1 }
312 at = bc_find_from(note, n, mk, at + 1)
313 }
314 mi = mi + 1
315 }
316 return 0
317}
318// The NOTE is the LAST bar-separated field, NEVER a fixed index. Boards declare different rival counts in
319// their @cols header, so a hardcoded field 8 reads the wrong field on any board carrying fewer than four
320// rivals -- and reads it SILENTLY, which is precisely the class of defect this gate exists to catch.
321func bc_field_last(buf: *u8, ls: i64, le: i64, out: *u8, cap: i64) -> i64 {
322 var start: i64 = ls
323 var i: i64 = ls
324 while i < le { if (buf[i] as i64) == BC_BAR { start = i + 1 } i = i + 1 }
325 var n: i64 = le - start
326 if n >= cap { n = cap - 1 }
327 var k: i64 = 0
328 while k < n { out[k] = buf[start + k]; k = k + 1 }
329 out[n] = 0 as u8
330 return n
331}
332func bc_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
333// TARGET NAME from an organ path: the basename with its .nx stripped. runtime/_hdl_build/nx_foo.nx -> nx_foo
334func bc_target_of(organ: *u8, out: *u8, cap: i64) -> i64 {
335 let L: i64 = bc_slen(organ)
336 var s: i64 = 0
337 var i: i64 = 0
338 while i < L { if (organ[i] as i64) == 47 { s = i + 1 } i = i + 1 }
339 var e: i64 = L
340 if L > 3 { if (organ[L - 3] as i64) == 46 { e = L - 3 } }
341 var m: i64 = e - s
342 if m < 0 { m = 0 }
343 if m >= cap { m = cap - 1 }
344 var k: i64 = 0
345 while k < m { out[k] = organ[s + k]; k = k + 1 }
346 out[m] = 0 as u8
347 return m
348}
349// THE WITNESS FOR THE BINARY CLAIM: does a built artifact exist in ANY root this estate uses. Four roots
350// are probed BECAUSE THE ESTATE HAS FOUR and a check against one is how a partial deploy reads as complete
351// -- measured today, when nx_restage wrote buildroot/_offc while the serving root kept the old binary and
352// the receipt named a path relative to a CWD the reader did not share.
353// FAILS TOWARD SILENCE: if none of the four resolves, this returns 0 and the row is NOT accused. An absent
354// artifact is exactly what SOURCE-ONLY asserts, so the honest reading of a miss is agreement, not a defect.
355func bc_artifact_exists(tname: *u8, tmp: *u8) -> i64 {
356 var o: i64 = bc_cat(tmp, 0, "buildroot/_build/" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".sov.elf" as *u8)
357 if bc_exists(tmp) == 1 { return 1 }
358 o = bc_cat(tmp, 0, "_build/" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".sov.elf" as *u8)
359 if bc_exists(tmp) == 1 { return 1 }
360 o = bc_cat(tmp, 0, tname); o = bc_cat(tmp, o, ".elf" as *u8)
361 if bc_exists(tmp) == 1 { return 1 }
362 o = bc_cat(tmp, 0, "_offc/" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".elf" as *u8)
363 if bc_exists(tmp) == 1 { return 1 }
364 // PARENT-RELATIVE ROOTS. From CWD=buildroot the SERVING ROOT is ../ and nishihost/_offc is ../_offc/ --
365 // which is exactly how nx_compare_regen forks its generators, so this is the estate's own convention
366 // rather than a guess. ADDED AFTER THE FIRST RUN READ ZERO: the axis had failed toward SILENCE on a
367 // layout none of the four probes covered, which is the correct direction to fail but still a blind
368 // spot, and only running it on a real tree exposed which roots were missing.
369 o = bc_cat(tmp, 0, "../_build/" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".sov.elf" as *u8)
370 if bc_exists(tmp) == 1 { return 1 }
371 o = bc_cat(tmp, 0, "../" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".elf" as *u8)
372 if bc_exists(tmp) == 1 { return 1 }
373 o = bc_cat(tmp, 0, "../_offc/" as *u8); o = bc_cat(tmp, o, tname); o = bc_cat(tmp, o, ".elf" as *u8)
374 if bc_exists(tmp) == 1 { return 1 }
375 return 0
376}
377func bc_write(path: *u8, text: *u8) -> i64 {
378 let fd: i64 = sys_openat_wr(path, BC_MODE_RW)
379 if fd < 0 { return 0 - 1 }
380 let n: i64 = bc_slen(text)
381 var off: i64 = 0
382 while off < n { let r: i64 = sys_write(fd, (text as i64 + off) as *u8, n - off); if r <= 0 { sys_close(fd); return 0 - 2 } off = off + r }
383 sys_close(fd)
384 return 0
385}
386// copy field <idx> (0-based, bar-separated) of the line [ls,le) into out; returns its length, -1 if absent
387func bc_field(buf: *u8, ls: i64, le: i64, idx: i64, out: *u8, cap: i64) -> i64 {
388 var f: i64 = 0
389 var i: i64 = ls
390 var start: i64 = ls
391 while i <= le {
392 var atend: i64 = 0
393 if i == le { atend = 1 }
394 if atend == 0 { if (buf[i] as i64) == BC_BAR { atend = 1 } }
395 if atend == 1 {
396 if f == idx {
397 var n: i64 = i - start
398 if n >= cap { n = cap - 1 }
399 var k: i64 = 0
400 while k < n { out[k] = buf[start + k]; k = k + 1 }
401 out[n] = 0 as u8
402 return n
403 }
404 f = f + 1
405 start = i + 1
406 }
407 i = i + 1
408 }
409 out[0] = 0 as u8
410 return 0 - 1
411}
412// resolve an organ path recorded relative to buildroot, from either CWD; 1 on success with abs path in out
413func bc_resolve_organ(rel: *u8, out: *u8) -> i64 {
414 var k: i64 = 0
415 while k < 2 {
416 var o: i64 = 0
417 if k == 0 { o = bc_cat(out, 0, "buildroot/" as *u8) }
418 if k == 1 { o = 0 }
419 o = bc_cat(out, o, rel)
420 if bc_exists(out) == 1 { return 1 }
421 k = k + 1
422 }
423 out[0] = 0 as u8
424 return 0
425}
426// THE CLASSIFIER, and it is the only place a class is decided.
427// 1 DECLARED . 2 SUBSTRING-ONLY . 3 ABSENT . 4 UNREADABLE
428func bc_classify(organrel: *u8, sym: *u8, scratch: *u8, srcbuf: *u8) -> i64 {
429 if bc_resolve_organ(organrel, scratch) == 0 { return 4 }
430 let n: i64 = ct_read(scratch, srcbuf, BC_CAP)
431 if n <= 0 { return 4 }
432 let needle: *u8 = sys_mmap(BC_SYMCAP + 16)
433 var o: i64 = bc_cat(needle, 0, "func " as *u8)
434 o = bc_cat(needle, o, sym)
435 o = bc_cat(needle, o, "(" as *u8)
436 if bc_has(srcbuf, n, needle) == 1 { return 1 }
437 if bc_has(srcbuf, n, sym) == 1 { return 2 }
438 return 3
439}
440// NAME EVERY OFFENDER AS IT IS FOUND. A count without a worklist is not actionable, and this gate's own
441// first leg shipped a bare number and had to be given its names afterwards -- so the third leg carries
442// them from the first run.
443func bc_say(s: *u8) -> i64 { sys_write(1, s, bc_slen(s)); return 0 }
444// census one domain's .matrix; adds to ctr and names every unflippable row
445func bc_census_domain(dom: *u8, ctr: *i64, mbuf: *u8, srcbuf: *u8, scratch: *u8, collect: i64, t_dom: *i64, t_org: *i64, t_sym: *i64, t_cls: *i64, nrec: *i64) -> i64 {
446 let which: *i64 = sys_mmap(16) as *i64
447 let n: i64 = ct_compare_read_published(dom, ".matrix" as *u8, mbuf, BC_CAP, which)
448 if n <= 0 { return 0 }
449 ctr[BC_C_DOMAINS] = ctr[BC_C_DOMAINS] + 1
450 let organ: *u8 = sys_mmap(BC_PATH)
451 let symf: *u8 = sys_mmap(BC_SYMCAP)
452 let notef: *u8 = sys_mmap(BC_NOTECAP)
453 let sentbuf: *u8 = sys_mmap(BC_NOTECAP)
454 var ls: i64 = 0
455 while ls < n {
456 var le: i64 = ls
457 while le < n { if (mbuf[le] as i64) == BC_NL { break } le = le + 1 }
458 var iscomment: i64 = 0
459 if le > ls { if (mbuf[ls] as i64) == BC_HASH { iscomment = 1 } }
460 if le > ls { if (mbuf[ls] as i64) == BC_AT { iscomment = 1 } }
461 if iscomment == 1 { ls = le + 1; continue }
462 if le > ls {
463 ctr[BC_C_ROWS] = ctr[BC_C_ROWS] + 1
464 if bc_field(mbuf, ls, le, BC_FLD_SYM, symf, BC_SYMCAP) > 0 {
465 if bc_has(symf, bc_slen(symf), "_ABSENT_:" as *u8) == 1 {
466 let sym: *u8 = (symf as i64 + BC_MARKLEN) as *u8
467 if bc_field(mbuf, ls, le, BC_FLD_ORGAN, organ, BC_PATH) > 0 {
468 ctr[BC_C_CONTRACTS] = ctr[BC_C_CONTRACTS] + 1
469 let cls: i64 = bc_classify(organ, sym, scratch, srcbuf)
470 if cls == 1 {
471 ctr[BC_C_DECLARED] = ctr[BC_C_DECLARED] + 1
472 // THE PROSE AXIS, and it is DECLARED A SEPARATE AXIS rather than folded into
473 // the partition above ON PURPOSE: a row can be DECLARED and prose-stale AT THE
474 // SAME TIME, so adding it to that sum would silently break a reconciliation
475 // this gate already prints. The cell is right; the sentence beside it is not.
476 let nn: i64 = bc_field_last(mbuf, ls, le, notef, BC_NOTECAP)
477 if nn > 0 {
478 // BINARY-ABSENCE AXIS: a claim about the ARTIFACT, judged by the ARTIFACT.
479 if bc_note_binary_claim(notef, nn, sentbuf, BC_NOTECAP) == 1 {
480 let tn: *u8 = sys_mmap(BC_NAMECAP)
481 bc_target_of(organ, tn, BC_NAMECAP)
482 let ap: *u8 = sys_mmap(BC_PATH)
483 if bc_artifact_exists(tn, ap) == 1 {
484 ctr[BC_C_BINSTALE] = ctr[BC_C_BINSTALE] + 1
485 if collect == 1 { if ctr[BC_C_EMITTED] < BC_LIST_CAP {
486 ctr[BC_C_EMITTED] = ctr[BC_C_EMITTED] + 1
487 bc_say("BINARY-STALE domain=" as *u8); bc_say(dom)
488 bc_say(" symbol=" as *u8); bc_say(sym)
489 bc_say(" target=" as *u8); bc_say(tn)
490 bc_say(" -- the note says it is unbuilt while a built artifact EXISTS for that organ
491" as *u8)
492 } }
493 }
494 }
495 if bc_note_stale_claim(notef, nn, sentbuf, BC_NOTECAP) == 1 {
496 if 1 == 1 {
497 ctr[BC_C_PROSE] = ctr[BC_C_PROSE] + 1
498 // PRINT ONLY ON THE FILL PASS. bc_scan_all runs TWICE -- once to
499 // COUNT so the tables can be sized by measurement, once to FILL --
500 // so an unguarded emit names every offender twice. FOUND BY RUNNING
501 // IT, never by reading it: the COUNTER was already correct because
502 // c is zeroed between passes, so the arithmetic hid the defect and
503 // only the OUTPUT showed it. A worklist that repeats itself is how
504 // a reader learns to distrust a worklist.
505 if collect == 1 { if ctr[BC_C_EMITTED] < BC_LIST_CAP {
506 ctr[BC_C_EMITTED] = ctr[BC_C_EMITTED] + 1
507 bc_say("PROSE-STALE domain=" as *u8); bc_say(dom)
508 bc_say(" symbol=" as *u8); bc_say(sym)
509 bc_say(" -- DECLARED in the named organ while this row's own note still asserts it is absent
510" as *u8)
511 } }
512 }
513 }
514 }
515 }
516 if cls != 1 {
517 if cls == 2 { ctr[BC_C_SUBSTR] = ctr[BC_C_SUBSTR] + 1 }
518 if cls == 3 { ctr[BC_C_ABSENT] = ctr[BC_C_ABSENT] + 1 }
519 if cls == 4 { ctr[BC_C_UNREAD] = ctr[BC_C_UNREAD] + 1 }
520 // RECORD, do not judge yet: the declaration index runs after the whole
521 // census, and only then can pending be told apart from mispointed.
522 if collect == 1 {
523 let kk: i64 = nrec[0]
524 let dcp: *u8 = sys_mmap(BC_NAMECAP)
525 bc_cat(dcp, 0, dom)
526 let ocp: *u8 = sys_mmap(BC_PATH)
527 bc_cat(ocp, 0, organ)
528 let scp: *u8 = sys_mmap(BC_SYMCAP)
529 bc_cat(scp, 0, sym)
530 t_dom[kk] = dcp as i64
531 t_org[kk] = ocp as i64
532 t_sym[kk] = scp as i64
533 t_cls[kk] = cls
534 nrec[0] = kk + 1
535 }
536 }
537 }
538 }
539 }
540 }
541 ls = le + 1
542 }
543 return 1
544}
545func bc_zero(ctr: *i64) -> i64 { var i: i64 = 0; while i < BC_C_SLOTS { ctr[i] = 0; i = i + 1 } return 0 }
546// THE DEFECT NUMBER IS THE MISPOINTED CLASS ALONE. An _ABSENT_ contract naming an organ that does not
547// exist yet, or an organ that does not carry the symbol yet, is EXACTLY what an open build contract IS --
548// counting those as defects would make this detector a false-positive machine on its first live run
549// (measured: 468 + 573 of 1169 contracts). Only a row whose named organ CONTAINS the symbol text but
550// DECLARES no such function is the LR7 shape: the pointer looks right, something matches, and the cell can
551// never flip. Splitting the PENDING-IN-FILE class into pending-vs-mispointed needs a tree-wide declaration
552// index (the symbol is declared SOMEWHERE ELSE) -- that is a named next leg, not a guess made here.
553func bc_unflippable(ctr: *i64) -> i64 { return ctr[BC_C_SUBSTR] }
554
555// Walk every domain on the list. Run it once with collect=0 to COUNT, size the tables to exactly that,
556// then run it again with collect=1 to FILL them. Two cheap passes over already-read matrices beat one pass
557// against a guessed ceiling.
558func bc_scan_all(lst: *u8, ln: i64, c: *i64, mbuf: *u8, srcbuf: *u8, scratch: *u8, collect: i64, t_dom: *i64, t_org: *i64, t_sym: *i64, t_cls: *i64, nrec: *i64) -> i64 {
559 let dom: *u8 = sys_mmap(BC_NAMECAP)
560 var ds: i64 = 0
561 while ds < ln {
562 var de: i64 = ds
563 while de < ln { if (lst[de] as i64) == BC_NL { break } de = de + 1 }
564 var dl: i64 = de - ds
565 if dl > 0 {
566 if dl >= BC_NAMECAP { dl = BC_NAMECAP - 1 }
567 var i: i64 = 0
568 while i < dl { dom[i] = lst[ds + i]; i = i + 1 }
569 dom[dl] = 0 as u8
570 bc_census_domain(dom, c, mbuf, srcbuf, scratch, collect, t_dom, t_org, t_sym, t_cls, nrec)
571 }
572 ds = de + 1
573 }
574 return 1
575}
576
577func main(argc: i64, argv: *i64) -> i64 {
578 let ctr: *i64 = gv_ctr()
579 gv_head("NX-BOARD-CONTRACT-GATE: a build contract whose named organ cannot carry its symbol can never flip, and is NAMED" as *u8)
580
581 let mbuf: *u8 = sys_mmap(BC_CAP)
582 let srcbuf: *u8 = sys_mmap(BC_CAP)
583 let scratch: *u8 = sys_mmap(BC_PATH)
584 let c: *i64 = sys_mmap(BC_C_SLOTS * 8) as *i64
585
586 // ---------- PART 1: the planted fixture, per-RUN so concurrent runs cannot collide ----------
587 let root: *u8 = sys_mmap(BC_PATH)
588 var o: i64 = bc_cat(root, 0, "/tmp/nx_board_contract_gate_" as *u8)
589 o = bc_catn(root, o, sys_clock_now_us())
590 sys_mkdir(root, BC_MODE_RWX)
591 let p: *u8 = sys_mmap(BC_PATH)
592 o = bc_cat(p, 0, root); o = bc_cat(p, o, "/runtime" as *u8); sys_mkdir(p, BC_MODE_RWX)
593 let fxorgan: *u8 = sys_mmap(BC_PATH)
594 o = bc_cat(fxorgan, 0, root); o = bc_cat(fxorgan, o, "/runtime/fx_board.nx" as *u8)
595 // the fixture organ carries a DECLARATION of fx_declared, and the LR7 trap: the text fx_trapped occurs
596 // ONLY inside a longer symbol and a comment, never as its own declaration.
597 bc_write(fxorgan, "// fixture organ: fx_trapped appears here only as a comment word\nfunc fx_declared() -> i64 { return 1 }\nfunc fx_trapped_witness() -> i64 { return 2 }\n" as *u8)
598 gv_check("fixture-organ-written-under-a-per-run-dir" as *u8, bc_exists(fxorgan), ctr)
599
600 // classify the four shapes directly through the one classifier
601 let cwd: *u8 = sys_mmap(BC_PATH)
602 sys_getcwd(cwd, BC_PATH)
603 sys_chdir(root)
604 let k1: i64 = bc_classify("runtime/fx_board.nx" as *u8, "fx_declared" as *u8, scratch, srcbuf)
605 let k2: i64 = bc_classify("runtime/fx_board.nx" as *u8, "fx_trapped" as *u8, scratch, srcbuf)
606 let k3: i64 = bc_classify("runtime/fx_board.nx" as *u8, "fx_nowhere" as *u8, scratch, srcbuf)
607 let k4: i64 = bc_classify("runtime/fx_missing.nx" as *u8, "fx_declared" as *u8, scratch, srcbuf)
608 sys_chdir(cwd)
609 gv_check_eq("fixture-DECLARED-is-class-1" as *u8, k1, 1, ctr)
610 gv_check_eq("fixture-SUBSTRING-ONLY-is-class-2-the-LR7-trap-a-substring-probe-would-miss" as *u8, k2, 2, ctr)
611 gv_check_eq("fixture-ABSENT-is-class-3" as *u8, k3, 3, ctr)
612 gv_check_eq("fixture-UNREADABLE-is-class-4" as *u8, k4, 4, ctr)
613 gv_bite("neg-control-the-classifier-separates-a-declaration-from-a-bare-textual-hit" as *u8, (k2 != 1) as i64, (k1 != 1) as i64, ctr)
614
615 // ---------- PART 2: the live census over every board the regen publishes ----------
616 bc_zero(c)
617 let lst: *u8 = sys_mmap(BC_LIST)
618 let lwhich: *i64 = sys_mmap(16) as *i64
619 // the RESOLVER decides which tree, never a hand-rolled compare path
620 let ln: i64 = ct_compare_read_published("regen" as *u8, ".list" as *u8, lst, BC_LIST, lwhich)
621 if gv_need("regen.list readable from this CWD" as *u8, (ln > 0) as i64, ctr) == 0 {
622 return gv_verdict("nx_board_contract_gate" as *u8, ctr, "no board list to census" as *u8)
623 }
624 // PASS 1 -- COUNT ONLY, so the tables below are sized by measurement and never by a guess.
625 let nrec: *i64 = sys_mmap(16) as *i64
626 nrec[0] = 0
627 bc_scan_all(lst, ln, c, mbuf, srcbuf, scratch, 0, 0 as *i64, 0 as *i64, 0 as *i64, 0 as *i64, nrec)
628 var nslots_needed: i64 = c[BC_C_CONTRACTS]
629 if nslots_needed < 1 { nslots_needed = 1 }
630 let t_dom: *i64 = sys_mmap(nslots_needed * 8) as *i64
631 let t_org: *i64 = sys_mmap(nslots_needed * 8) as *i64
632 let t_sym: *i64 = sys_mmap(nslots_needed * 8) as *i64
633 let t_cls: *i64 = sys_mmap(nslots_needed * 8) as *i64
634 let t_found: *i64 = sys_mmap(nslots_needed * 8) as *i64
635 let t_ndecl: *i64 = sys_mmap(nslots_needed * 8) as *i64
636 // PASS 2 -- FILL. Counters are zeroed so the published numbers come from exactly one pass.
637 bc_zero(c)
638 nrec[0] = 0
639 bc_scan_all(lst, ln, c, mbuf, srcbuf, scratch, 1, t_dom, t_org, t_sym, t_cls, nrec)
640
641 // ---------- PHASE 2: resolve every unresolved symbol against the WHOLE compile corpus ----------
642 // gk_corpus_scan REFUSES (negative) rather than under-reporting, and a partial corpus would turn a
643 // MISPOINTED row into a PENDING one -- the flattering direction -- so a negative here must ABSTAIN,
644 // never be silently treated as "found nothing".
645 // MEASURE the corpus and its longest path FIRST, then allocate exactly that. No ceiling to hit.
646 let maxlen: *i64 = sys_mmap(16) as *i64
647 let ncount: i64 = gk_corpus_count(maxlen)
648 let stride: i64 = maxlen[0] + 1
649 var nalloc: i64 = ncount
650 if nalloc < 1 { nalloc = 1 }
651 let names: *u8 = sys_mmap(nalloc * stride)
652 var ncorp: i64 = 0 - 1
653 if ncount > 0 { ncorp = gk_corpus_scan(names, stride, ncount) }
654 var indexed: i64 = 0
655 var confirmed: i64 = 0
656 let nstrong: *i64 = sys_mmap(16) as *i64
657 nstrong[0] = 0
658 var pending: i64 = 0
659 if ncorp > 0 {
660 indexed = 1
661 // slots DERIVED from the load we actually have, never a declared table size
662 var slots: i64 = BC_HASH_MINSLOTS
663 while slots < nrec[0] * BC_HASH_LOAD_NUM { slots = slots * 2 }
664 let hs: *i64 = sys_mmap(slots * 8) as *i64
665 var i: i64 = 0
666 while i < nrec[0] {
667 t_found[i] = 0
668 t_ndecl[i] = 0
669 var slot: i64 = bc_hash(t_sym[i] as *u8, slots)
670 var placed: i64 = 0
671 while placed == 0 {
672 if hs[slot] == 0 { hs[slot] = i + 1; placed = 1 } else { slot = (slot + 1) % slots }
673 }
674 i = i + 1
675 }
676 let fbuf: *u8 = sys_mmap(BC_CAP)
677 let nm: *u8 = sys_mmap(BC_SYMCAP)
678 var fi: i64 = 0
679 while fi < ncorp {
680 let fpath: *u8 = ((names as i64) + fi * stride) as *u8
681 let fn: i64 = ct_read(fpath, fbuf, BC_CAP)
682 if fn > 0 {
683 var at: i64 = bc_find_from(fbuf, fn, "func " as *u8, 0)
684 while at >= 0 {
685 var q: i64 = at + 5
686 var k: i64 = 0
687 while q < fn { if bc_isident(fbuf[q] as i64) == 0 { q = fn } else { if k < BC_SYMCAP - 1 { nm[k] = fbuf[q]; k = k + 1 } q = q + 1 } }
688 nm[k] = 0 as u8
689 // a DECLARATION is the name immediately followed by an open paren
690 var isdecl: i64 = 0
691 let after: i64 = at + 5 + k
692 if k > 0 { if after < fn { if (fbuf[after] as i64) == BC_LPAREN { isdecl = 1 } } }
693 if isdecl == 1 {
694 var sl: i64 = bc_hash(nm, slots)
695 var go: i64 = 1
696 while go == 1 {
697 if hs[sl] == 0 { go = 0 } else {
698 let ci: i64 = hs[sl] - 1
699 if bc_streq_p(t_sym[ci] as *u8, nm) == 1 { t_ndecl[ci] = t_ndecl[ci] + 1
700 if t_found[ci] == 0 { t_found[ci] = fpath as i64 } }
701 sl = (sl + 1) % slots
702 }
703 }
704 }
705 at = bc_find_from(fbuf, fn, "func " as *u8, at + 5)
706 }
707 }
708 fi = fi + 1
709 }
710 // ---------- PHASE 3: the worklist, now carrying its own remedy ----------
711 i = 0
712 while i < nrec[0] {
713 if t_found[i] != 0 {
714 confirmed = confirmed + 1
715 // SUBJECT, NOT SPELLING. Two same-named functions are the same subject only if the file
716 // that declares it is ABOUT the domain owning the contract. Controls, measured: the file
717 // declaring extllm's xl_publish_guard names "extllm" 4x and its rung XL8 once; pe_load's
718 // declaring file is a CPU-PAGING MMU test that never names performersearch; ct_scan's is
719 // nx_ctxtop, which never names referee.
720 // AN IMPORT-EDGE TEST WAS TRIED FIRST AND REFUTED BY ITS OWN CONTROL: neither the genuine
721 // mispoint NOR the collision had an import edge in either direction, so module reachability
722 // -- the obvious answer -- discriminates nothing here and was discarded, not shipped.
723 var strong: i64 = 0
724 let dvb: *u8 = sys_mmap(BC_CAP)
725 let dvn: i64 = ct_read(t_found[i] as *u8, dvb, BC_CAP)
726 if dvn > 0 { strong = bc_has(dvb, dvn, t_dom[i] as *u8) }
727 if t_ndecl[i] > 1 { strong = 0 }
728 if strong == 1 { nstrong[0] = nstrong[0] + 1 }
729 // CAPPED ON THE SHARED COUNTER. This loop runs once per CONTRACT and the boards carry
730 // over a thousand, so unbounded it overran /api/gate_run's 16384-byte capture and the
731 // gate was KILLED MID-WRITE -- exit 141 (SIGPIPE) reported as verdict=RED while every
732 // tooth had passed. The count below is unaffected; only the printing is bounded.
733 if c[BC_C_EMITTED] < BC_LIST_CAP {
734 c[BC_C_EMITTED] = c[BC_C_EMITTED] + 1
735 gv_puts(" DECLARED-ELSEWHERE domain=" as *u8); gv_puts(t_dom[i] as *u8)
736 gv_puts(" symbol=" as *u8); gv_puts(t_sym[i] as *u8)
737 gv_puts(" row_points_at=" as *u8); gv_puts(t_org[i] as *u8)
738 gv_puts(" declared_in=" as *u8); gv_puts(t_found[i] as *u8)
739 gv_puts(" declared_in_N_places=" as *u8); gv_num(t_ndecl[i])
740 if strong == 1 { gv_puts(" strength=ADVISORY-declaring-file-names-this-domain-VERIFY-BY-HAND" as *u8) }
741 if strong == 0 { gv_puts(" strength=WEAK-declaring-file-never-names-this-domain" as *u8) }
742 gv_puts("
743" as *u8)
744 }
745 }
746 if t_found[i] == 0 {
747 pending = pending + 1
748 if c[BC_C_EMITTED] < BC_LIST_CAP {
749 c[BC_C_EMITTED] = c[BC_C_EMITTED] + 1
750 gv_puts(" OPEN-CONTRACT domain=" as *u8); gv_puts(t_dom[i] as *u8)
751 gv_puts(" symbol=" as *u8); gv_puts(t_sym[i] as *u8)
752 gv_puts(" organ=" as *u8); gv_puts(t_org[i] as *u8)
753 gv_puts(" (not declared anywhere in the corpus -- genuinely unwritten)
754" as *u8)
755 }
756 }
757 i = i + 1
758 }
759 }
760 gv_puts(" NOTE: DECLARED-ELSEWHERE and declared_in_N_places are FACTS. strength is ADVISORY ONLY and
761" as *u8)
762 gv_puts(" MUST NOT be auto-applied: on the first live run BOTH advisory rows were refuted by hand --
763" as *u8)
764 gv_puts(" nx_roster_full names Racing as one of twenty ROLES, not as a test reporter, and dyna_bind_skin
765" as *u8)
766 gv_puts(" has a same-named organ of its own. Short prefixes collide here (pe_load is also a CPU-paging
767" as *u8)
768 gv_puts(" routine, tg_run a TLS gate test, ct_scan an nx_ctxtop helper), so THIS GATE REPORTS EVIDENCE
769" as *u8)
770 gv_puts(" AND A HUMAN DECIDES. N>1 forces WEAK, because the first declaration found is not the only one.
771" as *u8)
772 gv_kv("corpus_files" as *u8, ncorp)
773 gv_kv("recorded_unresolved" as *u8, nrec[0])
774 gv_kv("declared_elsewhere" as *u8, confirmed)
775 gv_kv("declared_elsewhere_STRONG" as *u8, nstrong[0])
776 gv_kv("pending_confirmed" as *u8, pending)
777 gv_check("corpus-index-was-readable-so-mispointed-and-pending-are-DISTINGUISHED" as *u8, indexed, ctr)
778 if indexed == 1 { gv_check_eq("index-partition-confirmed-plus-pending-sums-to-recorded" as *u8, confirmed + pending, nrec[0], ctr) }
779
780 let unflip: i64 = bc_unflippable(c)
781 gv_kv("domains" as *u8, c[BC_C_DOMAINS])
782 gv_kv("rows" as *u8, c[BC_C_ROWS])
783 gv_kv("contracts" as *u8, c[BC_C_CONTRACTS])
784 gv_kv("declared" as *u8, c[BC_C_DECLARED])
785 gv_kv("mispointed_candidates" as *u8, c[BC_C_SUBSTR])
786 gv_kv("pending_in_file" as *u8, c[BC_C_ABSENT])
787 gv_kv("pending_no_organ" as *u8, c[BC_C_UNREAD])
788 gv_kv("prose_stale_source_claims" as *u8, c[BC_C_PROSE])
789 gv_kv("prose_stale_binary_claims" as *u8, c[BC_C_BINSTALE])
790 // THE CAP ANNOUNCES ITSELF OR IT IS THE DEFECT IT WAS ADDED TO FIX. The worklists above print at
791 // most BC_LIST_CAP lines so the gate fits inside /api/gate_run's 16384-byte capture -- before this,
792 // the census overran it and the gate was killed mid-write, reported as verdict=RED on exit 141
793 // (SIGPIPE) with every shown tooth passing. A silent cap would trade that loud wrong answer for a
794 // quiet one: a reader would take the shown list for the population.
795 gv_kv("worklist_lines_shown" as *u8, c[BC_C_EMITTED])
796 gv_kv("worklist_lines_cap" as *u8, BC_LIST_CAP)
797 if c[BC_C_EMITTED] >= BC_LIST_CAP {
798 bc_say("<== THE WORKLIST ABOVE IS A PREFIX OF ITS OWN COUNT: it stopped at the cap so this gate stays inside its caller's capture. Read prose_stale_source_claims and prose_stale_binary_claims for the POPULATION, and run this organ directly for the whole list.\n" as *u8)
799 }
800 gv_kv("defects_ratcheted" as *u8, unflip)
801
802 // NON-VACUITY: a census that examined nothing must never read GREEN
803 gv_check("live-census-read-at-least-one-board" as *u8, (c[BC_C_DOMAINS] > 0) as i64, ctr)
804 gv_check("live-census-found-at-least-one-build-contract-to-judge" as *u8, (c[BC_C_CONTRACTS] > 0) as i64, ctr)
805 // THE PARTITION SUMS, and the sum is printed
806 gv_check_eq("partition-all-four-classes-sum-to-contracts" as *u8, c[BC_C_DECLARED] + c[BC_C_SUBSTR] + c[BC_C_ABSENT] + c[BC_C_UNREAD], c[BC_C_CONTRACTS], ctr)
807
808 // ---------- PART 3: the ratchet, self-baselining so adoption breaks nothing ----------
809 let basep: *u8 = "knowledge/status/board_contract_ratchet.conf"
810 let bbuf: *u8 = sys_mmap(BC_PATH)
811 let bn: i64 = ct_read(basep as *u8, bbuf, BC_PATH)
812 var base: i64 = 0 - 1
813 if bn > 0 {
814 var i: i64 = 0
815 var v: i64 = 0
816 var any: i64 = 0
817 while i < bn {
818 let ch: i64 = bbuf[i] as i64
819 if ch >= BC_ZERO { if ch <= BC_NINE { v = v * 10 + (ch - BC_ZERO); any = 1 } }
820 if any == 1 { if ch < BC_ZERO { break } }
821 if any == 1 { if ch > BC_NINE { break } }
822 i = i + 1
823 }
824 if any == 1 { base = v }
825 }
826 if base < 0 {
827 let nb: *u8 = sys_mmap(BC_PATH)
828 var q: i64 = bc_catn(nb, 0, unflip)
829 q = bc_cat(nb, q, "\n" as *u8)
830 bc_write(basep as *u8, nb)
831 gv_puts(" RATCHET self-baselined at " as *u8); gv_num(unflip); gv_puts(" (first sight -- adopting this gate cannot break a board)\n" as *u8)
832 base = unflip
833 }
834 gv_kv("ratchet_baseline" as *u8, base)
835 gv_check("ratchet-mispointed-candidates-have-not-risen-above-baseline" as *u8, (unflip <= base) as i64, ctr)
836 // TIGHTEN ON A FALL, NEVER ON A RISE. A ratchet that only ever records its first reading is a threshold
837 // wearing a ratchet's name; one that rewrites itself upward launders its own regression green. Only the
838 // downward rewrite is sound, and it is what makes a drained worklist stay drained.
839 if unflip < base {
840 let tb: *u8 = sys_mmap(BC_PATH)
841 var tq: i64 = bc_catn(tb, 0, unflip)
842 tq = bc_cat(tb, tq, "
843" as *u8)
844 bc_write(basep as *u8, tb)
845 gv_puts(" RATCHET TIGHTENED " as *u8); gv_num(base); gv_puts(" -> " as *u8); gv_num(unflip); gv_puts("
846" as *u8)
847 }
848
849 return gv_verdict("nx_board_contract_gate" as *u8, ctr, "every board build contract is classified, every unflippable one is NAMED with its class, the partition sums, and the count is ratcheted" as *u8)
850}