code wiki / _hdl_build / nx_boot_revive.nx
`nx_boot_revive.nx` source

↩ module page · 661 lines · 32680 B
1// nx_boot_revive.nx -- the DOCTOR's boot-resurrection organ (verb: HEAL). CR1 of the
2// crash-recovery ladder (knowledge/specs/2026-06-10-crash-recovery-ladder.md).
3//
4// WHY: the 2026-06-10 Windows reboot proved recovery REQUIRED a live session: /tmp organs
5// were gone (4/16 present), the pulse daemon was dead, and the team self-healed only
6// LAZILY (tp_run heals the 11 pulse steps when a pulse happens to run) and only because a
7// session restarted the daemon by hand. This organ makes recovery a single durable unit a
8// boot hook fires with ZERO sessions:
9//   (1) BOOT DETECT  -- boot_epoch = now - /proc/uptime; one BOOT row per boot appended to
10//       knowledge/status/boot_journal.log incl. dark_gap = boot_epoch - last DAEMON-BEAT
11//       (how long the substrate was DOWN -- the crash is measured, not inferred).
12//   (2) ORGAN REVIVE -- every E row of triage_expected.conf absent-but-recoverable is
13//       rebuilt NOW via _offc/nx_sov_build_run.elf, each under a hard watchdog deadline
14//       (conf B row, seconds; WNOHANG poll + SIGKILL reap, nx_guarded_run idiom -- a hung
15//       build/run becomes a counted TIMEOUT, never a wedged boot).
16//   (3) DAEMON REVIVE -- every D row not found in /proc is re-armed via the same runner
17//       (the daemon's own pidfile dup-guard makes re-arming idempotent).
18// Durable REVIVE line -> knowledge/status/boot_revive.log. Verdict GREEN only if all
19// expected organs are present and daemons running and nothing timed out; W-lane and
20// no-source absences stay LOUD (named debts, never silently skipped).
21//   (4) ORPHANED INTENTS (CR4) -- scan the intent WAL (knowledge/status/intent_wal.log,
22//       INTENT-START/INTENT-DONE rows written by self-journaling work units like
23//       nx_team_pulse): any START from BEFORE this boot with no DONE = work the crash
24//       interrupted mid-flight; it is auto-FILED as a pm_plan row (owner=Conductor) and
25//       marked INTENT-FILED in the WAL so re-runs never refile (idempotent). STARTs from
26//       THIS boot are in-flight, never filed.
27// argv[1]=conf override, argv[2]=log override, argv[3]=journal override,
28// argv[4]=intent-WAL override, argv[5]=pm-plan override (gate fixtures).
29// Sovereign (syscalls only, no .sh). Run from nxc2 root. license_tier: ORIGINAL
30//   (1c) REPLAY + RESUME (M6, crash-recovery capstone) -- on boot, REPLAY the WMS-R2
31//       transition reflog (nx_ws_ledger.ledger_replay) to reconstruct the AUTHORITATIVE
32//       current state of every workstream, then check WMS-M1 heartbeats
33//       (nx_heartbeat_monitor.hbm_scan) to find streams that were IN-FLIGHT at the crash
34//       (recently beating == HB_ALIVE) AND not marked DONE -> resume EXACTLY those.
35//       Completed streams (state==BR_WS_DONE) are ignored; stale streams (HB_STALLED /
36//       HB_UNKNOWN) are reported but NOT resumed (not in-flight at the crash boundary).
37//       Each resume = ONE framed record via fa_appendz to a resume journal. The crash
38//       that started this whole arc becomes a non-event. Purely ADDITIVE: existing
39//       boot-detect / orphan-revive / organ-revive / daemon-revive are byte-identical.
40//   argv[6]=ledger override, argv[7]=heartbeat override, argv[8]=resume-journal override,
41//   argv[9]=now override (no hidden wall-clock for the gate), argv[10]=threshold override.
42import "nx_syscalls.nx"
43import "nx_ws_ledger.nx"
44import "nx_heartbeat_monitor.nx"
45const BR_MAGIC_65536: i64 = 65536
46const BR_MAGIC_1048592: i64 = 1048592
47const BR_MAGIC_1048576: i64 = 1048576
48const BR_MAGIC_16384: i64 = 16384
49const BR_MAGIC_65520: i64 = 65520
50
51const BR_WS_DONE:      i64 = 3     // ledger DONE state code (ws_ledger gate: 0=TODO 1=WIP 2=VIEW 3=DONE 4=NOVEL; data-driven, Cardinal 11)
52const BR_HB_THRESHOLD: i64 = 120   // liveness window (sec): a beat within this == in-flight at crash; older == stale
53const BR_RESUME_MAXWS: i64 = 256   // ws-id range the replay state[] / scan ids[] can hold
54const BR_RESUME_CAP:   i64 = 256   // bounded resume-journal record size (matches WMS RECCAP)
55const BR_TIMEOUT:      i64 = 124   // GNU-timeout convention (nx_guarded_run idiom)
56const BR_SPAWN_FAIL:   i64 = 125   // wait4 error
57const BR_SIGKILL:      i64 = 9     // SIGTERM does not reap these hangs (2026-06-10 lesson)
58const BR_POLL_MS:      i64 = 50    // watchdog poll granularity
59const BR_ARM_GRACE_MS: i64 = 200   // settle time between arming a daemon and recheck
60const BR_BOOT_JITTER:  i64 = 90    // now-uptime recomputation jitter window (same boot if within)
61
62func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
63func _pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
64func _fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
65func _fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
66func br_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
67func br_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i }
68func br_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  sys_close(fd)
  return 1
73}
74func br_read_all(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let base: i64 = buf as i64; let r: i64 = sys_read(fd, (base + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  return n
82}
83func br_contains(hay: *u8, n: i64, pat: *u8) -> i64 {
  let pl: i64 = br_len(pat)
  if pl == 0 { return 0 }
  var i: i64 = 0
  while i + pl <= n {
      var k: i64 = 0
      var hit: i64 = 1
      while k < pl { if hay[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
      if hit == 1 { return 1 }
      i = i + 1
  }
  return 0
95}
96// LAST number following pat in buffer (-1 = no match) -- the triage idiom
97func br_last_num_after(hay: *u8, n: i64, pat: *u8) -> i64 {
  let pl: i64 = br_len(pat)
  if pl == 0 { return 0 - 1 }
  var best: i64 = 0 - 1
  var i: i64 = 0
  while i + pl <= n {
      var k: i64 = 0
      var hit: i64 = 1
      while k < pl { if hay[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
      if hit == 1 { best = i + pl }
      i = i + 1
  }
  if best < 0 { return 0 - 1 }
  var v: i64 = 0
  var q: i64 = best
  var any: i64 = 0
  while q < n {
      if hay[q] >= (48 as u8) { if hay[q] <= (57 as u8) { v = v * 10 + ((hay[q] as i64) - 48); any = 1; q = q + 1 } else { q = n } } else { q = n }
  }
  if any == 0 { return 0 - 1 }
  return v
118}
119func br_is_pid(name: *u8) -> i64 {
  var i: i64 = 0
  if name[0] == (0 as u8) { return 0 }
  while name[i] != (0 as u8) {
      if name[i] < (48 as u8) { return 0 }
      if name[i] > (57 as u8) { return 0 }
      i = i + 1
  }
  return 1
128}
129// organ presence: /tmp/<n>.sov.elf OR /tmp/<n>.elf OR _offc/<n>.elf (durable home counts)
130func br_organ_present(name: *u8) -> i64 {
  let p: *u8 = sys_mmap(256)
  var o: i64 = 0
  o = br_cat(p, o, "/tmp/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".sov.elf" as *u8); p[o] = 0 as u8
  if br_exists(p) == 1 { return 1 }
  o = 0
  o = br_cat(p, o, "/tmp/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".elf" as *u8); p[o] = 0 as u8
  if br_exists(p) == 1 { return 1 }
  o = 0
  o = br_cat(p, o, "_offc/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".elf" as *u8); p[o] = 0 as u8
  return br_exists(p)
141}
142// source presence mirrors the runner's lookup lanes
143func br_source_present(name: *u8) -> i64 {
  let p: *u8 = sys_mmap(256)
  var o: i64 = 0
  o = br_cat(p, o, "runtime/_hdl_build/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".nx" as *u8); p[o] = 0 as u8
  if br_exists(p) == 1 { return 1 }
  o = 0
  o = br_cat(p, o, "runtime/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".nx" as *u8); p[o] = 0 as u8
  if br_exists(p) == 1 { return 1 }
  o = 0
  o = br_cat(p, o, "nxasm/" as *u8); o = br_cat(p, o, name); o = br_cat(p, o, ".nx" as *u8); p[o] = 0 as u8
  return br_exists(p)
154}
155// run elf [a1] muted under a hard wall-clock deadline; WNOHANG poll + SIGKILL reap.
156// returns child exit / 128+sig / BR_TIMEOUT / BR_SPAWN_FAIL (nx_guarded_run idiom).
157func br_guarded(elf: *u8, a1: *u8, ms: i64) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let argv: *i64 = sys_mmap(32) as *i64
      argv[0] = elf as i64
      var i: i64 = 1
      if (a1 as i64) != 0 { argv[i] = a1 as i64; i = i + 1 }
      argv[i] = 0
      let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
      let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
      if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
      sys_execve(elf, argv, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  let start: i64 = sys_now_ms()
  var rc: i64 = 0 - 1
  while rc < 0 {
      let w: i64 = sys_wait4(pid, st, 1)
      if w == pid {
          let sig: i64 = st[0] & 0x7f
          if sig != 0 { rc = 128 + sig } else { rc = (st[0] >> 8) & 0xff }
      }
      if w < 0 { rc = BR_SPAWN_FAIL }
      if rc < 0 {
          let el: i64 = sys_now_ms() - start
          if el >= ms {
              nx_kill(pid, BR_SIGKILL)
              sys_wait4(pid, st, 0)
              rc = BR_TIMEOUT
          } else { sys_sleep_ms(BR_POLL_MS) }
      }
  }
  return rc
191}
192// seconds since boot from /proc/uptime (leading integer); -1 if unreadable
193func br_uptime() -> i64 {
  let b: *u8 = sys_mmap(128)
  let n: i64 = br_read_all("/proc/uptime" as *u8, b, 120)
  if n <= 0 { return 0 - 1 }
  var v: i64 = 0
  var i: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i >= n { go = 0 }
      else {
          var dig: i64 = 0
          if b[i] >= (48 as u8) { if b[i] <= (57 as u8) { dig = 1 } }
          if dig == 1 { v = v * 10 + ((b[i] as i64) - 48); i = i + 1 } else { go = 0 }
      }
  }
  return v
209}
210// does /proc/<nm>/cmdline contain sub? (one pid; 4 args, register path)
211func br_pid_match(nm: *u8, cmdl: *u8, ppath: *u8, sub: *u8) -> i64 {
  var po: i64 = 0
  po = br_cat(ppath, po, "/proc/" as *u8); po = br_cat(ppath, po, nm); po = br_cat(ppath, po, "/cmdline" as *u8); ppath[po] = 0 as u8
  let cl: i64 = br_read_all(ppath, cmdl, 500)
  if cl <= 0 { return 0 }
  // ROBUST liveness: match only argv[0] (the executable), NOT the whole cmdline. A shell/grep/
  // session that merely MENTIONS the daemon name in a later arg (e.g. bash -lc '...name...')
  // must NOT count as the daemon being alive -- otherwise a genuinely-dead daemon is never
  // revived (a silent false-UP that keeps the substrate down). /proc/<pid>/cmdline is NUL-
  // separated; argv[0] is the leading token, which for our daemons is the binary path.
  var a0: i64 = 0
  var go0: i64 = 1
  while go0 == 1 { if a0 >= cl { go0 = 0 } else { if cmdl[a0] == (0 as u8) { go0 = 0 } else { a0 = a0 + 1 } } }
  return br_contains(cmdl, a0, sub)
225}
226// is any live process's cmdline matching sub? (/proc sweep, triage idiom)
227func br_daemon_up(sub: *u8) -> i64 {
  let pfd: i64 = sys_openat_rd("/proc" as *u8)
  if pfd < 0 { return 0 }
  let dirbuf: *u8 = sys_mmap(BR_MAGIC_65536)
  let cmdl: *u8 = sys_mmap(512)
  let ppath: *u8 = sys_mmap(256)
  var found: i64 = 0
  var done: i64 = 0
  while done == 0 {
      let nb: i64 = sys_getdents64(pfd, dirbuf, BR_MAGIC_65536)
      if nb <= 0 { done = 1 }
      else {
          var off: i64 = 0
          while off < nb {
              let dbase: i64 = dirbuf as i64
              let rec: *u8 = (dbase + off) as *u8
              let rl: i64 = dirent_reclen(rec)
              if rl <= 0 { off = nb }
              else {
                  let nm: *u8 = dirent_name(rec)
                  if br_is_pid(nm) == 1 { found = found + br_pid_match(nm, cmdl, ppath, sub) }
                  off = off + rl
              }
          }
      }
  }
  sys_close(pfd)
  if found > 0 { return 1 }
  return 0
256}
257// position right after pat inside [from,to) or -1
258func br_find_in(buf: *u8, from: i64, to: i64, pat: *u8) -> i64 {
  let pl: i64 = br_len(pat)
  var i: i64 = from
  while i + pl <= to {
      var k: i64 = 0
      var hit: i64 = 1
      while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
      if hit == 1 { return i + pl }
      i = i + 1
  }
  return 0 - 1
269}
270// parse digits starting at pos (until non-digit or end); -1 if pos invalid or no digits
271func br_digits_at(buf: *u8, pos: i64, to: i64) -> i64 {
  if pos < 0 { return 0 - 1 }
  var v: i64 = 0
  var any: i64 = 0
  var q: i64 = pos
  while q < to {
      if buf[q] >= (48 as u8) { if buf[q] <= (57 as u8) { v = v * 10 + ((buf[q] as i64) - 48); any = 1; q = q + 1 } else { q = to } } else { q = to }
  }
  if any == 0 { return 0 - 1 }
  return v
281}
282// CR4: file every intent that STARTED before this boot and never finished. WAL rows:
283// INTENT-START id= name= epoch= / INTENT-DONE id= / INTENT-FILED id= (our idempotence
284// mark). Orphan = START with no DONE, no FILED, start-epoch < boot_epoch. Returns count.
285func br_file_orphans(walpath: *u8, pmpath: *u8, boot_epoch: i64) -> i64 {
  let w: *u8 = sys_mmap(BR_MAGIC_1048592)
  let wn: i64 = br_read_all(walpath, w, BR_MAGIC_1048576)
  if wn <= 0 { return 0 }
  let sid: *i64 = sys_mmap(256*8) as *i64
  let sep: *i64 = sys_mmap(256*8) as *i64
  let snm: *i64 = sys_mmap(256*8) as *i64
  var ns: i64 = 0
  let did: *i64 = sys_mmap(512*8) as *i64
  var ndone: i64 = 0
  let fid: *i64 = sys_mmap(512*8) as *i64
  var nfil: i64 = 0
  let pool: *u8 = sys_mmap(BR_MAGIC_16384)
  var poff: i64 = 0
  var ci: i64 = 0
  while ci < wn {
      var le: i64 = ci
      var scan: i64 = 1
      while scan == 1 {
          if le >= wn { scan = 0 }
          else { if w[le] == (10 as u8) { scan = 0 } else { le = le + 1 } }
      }
      let ps: i64 = br_find_in(w, ci, le, "INTENT-START id=" as *u8)
      if ps == ci + 16 {
          let idv: i64 = br_digits_at(w, ps, le)
          let ep: i64 = br_digits_at(w, br_find_in(w, ci, le, " epoch=" as *u8), le)
          let np: i64 = br_find_in(w, ci, le, " name=" as *u8)
          var keep: i64 = 1
          if idv <= 0 { keep = 0 }
          if np < 0 { keep = 0 }
          if ns >= 256 { keep = 0 }
          if keep == 1 {
              sid[ns] = idv
              sep[ns] = ep
              let nptr: i64 = (pool as i64) + poff
              var q: i64 = np
              var s3: i64 = 1
              while s3 == 1 {
                  if q >= le { s3 = 0 }
                  else { if w[q] == (32 as u8) { s3 = 0 } else { pool[poff] = w[q]; poff = poff + 1; q = q + 1 } }
              }
              pool[poff] = 0 as u8; poff = poff + 1
              snm[ns] = nptr
              ns = ns + 1
          }
      }
      let pd: i64 = br_find_in(w, ci, le, "INTENT-DONE id=" as *u8)
      if pd == ci + 15 { let dv: i64 = br_digits_at(w, pd, le); if dv > 0 { if ndone < 512 { did[ndone] = dv; ndone = ndone + 1 } } }
      let pf: i64 = br_find_in(w, ci, le, "INTENT-FILED id=" as *u8)
      if pf == ci + 16 { let fv: i64 = br_digits_at(w, pf, le); if fv > 0 { if nfil < 512 { fid[nfil] = fv; nfil = nfil + 1 } } }
      ci = le + 1
  }
  var cnt: i64 = 0
  var i: i64 = 0
  while i < ns {
      var orphan: i64 = 1
      var k: i64 = 0
      while k < ndone { if did[k] == sid[i] { orphan = 0 } k = k + 1 }
      var k2: i64 = 0
      while k2 < nfil { if fid[k2] == sid[i] { orphan = 0 } k2 = k2 + 1 }
      if sep[i] < 0 { orphan = 0 }
      if boot_epoch < 0 { orphan = 0 }
      if sep[i] >= boot_epoch { orphan = 0 }
      if orphan == 1 {
          _p("  ORPHANED INTENT: " as *u8); _p(snm[i] as *u8); _p(" id=" as *u8); _pn(sid[i]); _p(" started epoch=" as *u8); _pn(sep[i]); _p(" never finished -- FILING\n" as *u8)
          let pfd: i64 = sys_openat_append(pmpath, 0x1a4)
          if pfd >= 0 {
              _fp(pfd, "arc=CRASH-RECOVERY step=ORPHAN-INTENT FILED: step " as *u8); _fp(pfd, snm[i] as *u8)
              _fp(pfd, " (intent id=" as *u8); _fn(pfd, sid[i])
              _fp(pfd, " started epoch=" as *u8); _fn(pfd, sep[i])
              _fp(pfd, ") never finished -- interrupted by crash/reboot (boot_epoch=" as *u8); _fn(pfd, boot_epoch)
              _fp(pfd, "); re-verify its evidence owner=Conductor\n" as *u8)
              sys_close(pfd)
          }
          let wfd: i64 = sys_openat_append(walpath, 0x1a4)
          if wfd >= 0 {
              _fp(wfd, "INTENT-FILED id=" as *u8); _fn(wfd, sid[i])
              _fp(wfd, " epoch=" as *u8); _fn(wfd, sys_now_realtime_sec())
              _fp(wfd, "\n" as *u8)
              sys_close(wfd)
          }
          cnt = cnt + 1
      }
      i = i + 1
  }
  return cnt
371}
372// revive one organ row. counters: [0]=present [1]=revived [2]=fails [3]=wskip [4]=unrec [5]=timeouts
373func br_revive_one(en: *u8, lane: u8, budget: i64, c: *i64) -> i64 {
  _p("  organ " as *u8); _p(en); _p(": " as *u8)
  var state: i64 = 3                                   // 0 present / 1 W-lane / 2 no-source / 3 rebuild
  if br_organ_present(en) == 1 { state = 0 }
  if state == 3 { if lane == (87 as u8) { state = 1 } }
  if state == 3 { if br_source_present(en) == 0 { state = 2 } }
  if state == 0 { _p("PRESENT\n" as *u8); c[0] = c[0] + 1 }
  if state == 1 { _p("ABSENT lane=W -- wheeler rebuild OWED (loud, not auto-healed here)\n" as *u8); c[3] = c[3] + 1 }
  if state == 2 { _p("ABSENT + NO SOURCE -- UNRECOVERABLE!\n" as *u8); c[4] = c[4] + 1 }
  if state == 3 {
      let rc: i64 = br_guarded("_offc/nx_sov_build_run.elf" as *u8, en, budget * 1000)
      if rc == BR_TIMEOUT { c[5] = c[5] + 1 }
      if br_organ_present(en) == 1 { _p("REVIVED run_rc=" as *u8); _pn(rc); _p("\n" as *u8); c[1] = c[1] + 1 }
      else { _p("REVIVE-FAIL rc=" as *u8); _pn(rc); _p("\n" as *u8); c[2] = c[2] + 1 }
  }
  return 0
389}
390// ---- (1c) M6: REPLAY the reflog + RESUME the in-flight streams ----
391// Reconstructs authoritative current state from the WMS-R2 reflog (ledger_replay),
392// then for every workstream SEEN in the reflog asks WMS-M1 whether it was recently
393// beating (hbm_scan -> HB_ALIVE).  RESUME predicate (the crash-recovery decision):
394//     resume iff  state[ws] != BR_WS_DONE   (NOT completed)
395//             AND verdicts[k] == HB_ALIVE   (was in-flight / recently beating at crash)
396// A DONE stream is skipped (completed -> non-event).  A not-done stream that is STALLED
397// or UNKNOWN is reported but NOT resumed (it was not in-flight at the crash boundary).
398// Each resume emits ONE framed record via fa_appendz (the WMS-R0 atomic locked single
399// write -- NEVER a sequence of sys_write) to the resume journal.
400//   counters[0]=resumed  [1]=completed_skipped  [2]=ledger_flagged  [3]=hb_flagged
401//   [4]=stale_not_resumed  [5]=streams_seen
402// `now`/`threshold` are CALLER PARAMETERS (gate injects fixtures, no hidden wall-clock).
403// Returns resumed_count.
404func br_replay_resume(ledgerpath: *u8, hbpath: *u8, resumepath: *u8,
                    now: i64, threshold: i64, boot_epoch: i64, counters: *i64) -> i64 {
  // 1) REPLAY -> authoritative current state per ws (state[ws] = final new_st; -1 unseen)
  let state: *i64 = sys_mmap(8 * BR_RESUME_MAXWS) as *i64
  var si: i64 = 0
  while si < BR_RESUME_MAXWS { state[si] = 0 - 1; si = si + 1 }
  let louts: *i64 = sys_mmap(32) as *i64
  ledger_replay(ledgerpath, state, louts, BR_RESUME_MAXWS)
  let ledger_flagged: i64 = louts[2]
  // 2) build ids[] = every ws seen in the reflog (state >= 0)
  let ids: *i64 = sys_mmap(8 * BR_RESUME_MAXWS) as *i64
  var nids: i64 = 0
  var w: i64 = 0
  while w < BR_RESUME_MAXWS {
      if state[w] >= 0 { ids[nids] = w; nids = nids + 1 }
      w = w + 1
  }
  // 3) liveness for those ids (HB_ALIVE == recently beating == in-flight at crash)
  let verdicts: *i64 = sys_mmap(8 * BR_RESUME_MAXWS) as *i64
  let houts: *i64 = sys_mmap(32) as *i64
  hbm_scan(hbpath, now, threshold, ids, nids, verdicts, houts)
  let hb_flagged: i64 = houts[2]
  // 4) decide + resume
  var resumed: i64 = 0
  var completed: i64 = 0
  var stale: i64 = 0
  var k: i64 = 0
  while k < nids {
      let id: i64 = ids[k]
      let st: i64 = state[id]
      if st == BR_WS_DONE {
          completed = completed + 1
      } else {
          if verdicts[k] == HB_ALIVE {
              let lastb: i64 = hb_last_beat(hbpath, id)
              // ONE framed record, ONE locked write (fa_appendz) -- the resume journal entry
              let rec: *u8 = sys_mmap(BR_RESUME_CAP + 16)
              var o: i64 = 0
              o = fa_cat(rec, o, "BR-RESUME ws=\x00" as *u8)
              o = fa_catn(rec, o, id)
              o = fa_cat(rec, o, " state=\x00" as *u8)
              o = fa_catn(rec, o, st)
              o = fa_cat(rec, o, " last_beat=\x00" as *u8)
              o = fa_catn(rec, o, lastb)
              o = fa_cat(rec, o, " boot_epoch=\x00" as *u8)
              o = fa_catn(rec, o, boot_epoch)
              o = fa_cat(rec, o, " END\x00" as *u8)
              rec[o] = 0 as u8
              fa_appendz(resumepath, rec, BR_RESUME_CAP)
              _p("  IN-FLIGHT RESUME: ws=" as *u8); _pn(id); _p(" state=" as *u8); _pn(st); _p(" last_beat=" as *u8); _pn(lastb); _p(" (recently beating at crash -- resuming)\n" as *u8)
              resumed = resumed + 1
          } else {
              // not-done but not recently beating: report, do NOT resume
              _p("  stale (not in-flight at crash): ws=" as *u8); _pn(id); _p(" state=" as *u8); _pn(st); _p(" verdict=" as *u8); _pn(verdicts[k]); _p(" -- NOT resumed\n" as *u8)
              stale = stale + 1
          }
      }
      k = k + 1
  }
  counters[0] = resumed
  counters[1] = completed
  counters[2] = ledger_flagged
  counters[3] = hb_flagged
  counters[4] = stale
  counters[5] = nids
  return resumed
470}
471func main(argc: i64, argv: *i64) -> i64 {
  _p("=== BOOT REVIVE (Doctor): resurrect organs + daemons after a crash/reboot, zero sessions needed ===\n" as *u8)
  var confpath: *u8 = "knowledge/status/triage_expected.conf" as *u8
  if argc >= 2 { confpath = argv[1] as *u8 }
  var logpath: *u8 = "knowledge/status/boot_revive.log" as *u8
  if argc >= 3 { logpath = argv[2] as *u8 }
  var journalpath: *u8 = "knowledge/status/boot_journal.log" as *u8
  if argc >= 4 { journalpath = argv[3] as *u8 }
  // ---- parse conf: E organ rows, D daemon rows, B per-organ build budget (sec) ----
  let conf: *u8 = sys_mmap(BR_MAGIC_65536)
  let cn: i64 = br_read_all(confpath, conf, BR_MAGIC_65520)
  if cn <= 0 { _p(" REVIVE: conf MISSING (" as *u8); _p(confpath); _p(") -- fail loud\n" as *u8); sys_exit(1); return 1 }
  let pool: *u8 = sys_mmap(BR_MAGIC_16384)
  var poff: i64 = 0
  let enames: *i64 = sys_mmap(64*8) as *i64
  let elanes: *u8 = sys_mmap(64)
  var ne: i64 = 0
  let dnames: *i64 = sys_mmap(16*8) as *i64
  var nd: i64 = 0
  var budget: i64 = 0
  var ci: i64 = 0
  while ci < cn {
      var le: i64 = ci
      var scan: i64 = 1
      while scan == 1 {
          if le >= cn { scan = 0 }
          else { if conf[le] == (10 as u8) { scan = 0 } else { le = le + 1 } }
      }
      if conf[ci] == (69 as u8) {
          var te: i64 = ci + 2
          var s2: i64 = 1
          while s2 == 1 {
              if te >= le { s2 = 0 }
              else { if conf[te] == (32 as u8) { s2 = 0 } else { te = te + 1 } }
          }
          let nptr: i64 = (pool as i64) + poff
          var q: i64 = ci + 2
          while q < te { pool[poff] = conf[q]; poff = poff + 1; q = q + 1 }
          pool[poff] = 0 as u8; poff = poff + 1
          if ne < 64 {
              enames[ne] = nptr
              elanes[ne] = 83 as u8
              if te + 1 < le { elanes[ne] = conf[te+1] }
              ne = ne + 1
          }
      }
      if conf[ci] == (68 as u8) {
          let dptr: i64 = (pool as i64) + poff
          var q2: i64 = ci + 2
          while q2 < le { pool[poff] = conf[q2]; poff = poff + 1; q2 = q2 + 1 }
          pool[poff] = 0 as u8; poff = poff + 1
          if nd < 16 { dnames[nd] = dptr; nd = nd + 1 }
      }
      if conf[ci] == (66 as u8) {
          var bv: i64 = 0
          var q3: i64 = ci + 2
          while q3 < le {
              if conf[q3] >= (48 as u8) { if conf[q3] <= (57 as u8) { bv = bv * 10 + ((conf[q3] as i64) - 48) } }
              q3 = q3 + 1
          }
          budget = bv
      }
      ci = le + 1
  }
  if budget <= 0 { _p(" REVIVE: B row MISSING in conf (per-organ watchdog budget, seconds) -- fail loud\n" as *u8); sys_exit(1); return 1 }
  // ---- (1) boot detect + durable journal (one BOOT row per boot) ----
  let now: i64 = sys_now_realtime_sec()
  let up: i64 = br_uptime()
  var boot_epoch: i64 = 0 - 1
  if up >= 0 { boot_epoch = now - up }
  let jbuf: *u8 = sys_mmap(BR_MAGIC_1048592)
  let jn: i64 = br_read_all(journalpath, jbuf, BR_MAGIC_1048576)
  let last_boot: i64 = br_last_num_after(jbuf, jn, "BOOT boot_epoch=" as *u8)
  var new_boot: i64 = 1
  if boot_epoch < 0 { new_boot = 0 }
  if last_boot > 0 {
      var dd: i64 = boot_epoch - last_boot
      if dd < 0 { dd = 0 - dd }
      if dd <= BR_BOOT_JITTER { new_boot = 0 }
  }
  var dark_gap: i64 = 0 - 1
  if new_boot == 1 {
      let hbuf: *u8 = sys_mmap(BR_MAGIC_1048592)
      let hn: i64 = br_read_all("knowledge/status/pulse_daemon.log" as *u8, hbuf, BR_MAGIC_1048576)
      let last_beat: i64 = br_last_num_after(hbuf, hn, "DAEMON-BEAT epoch=" as *u8)
      if last_beat > 0 { dark_gap = boot_epoch - last_beat; if dark_gap < 0 { dark_gap = 0 } }
      let jfd: i64 = sys_openat_append(journalpath, 0x1a4)
      if jfd >= 0 {
          _fp(jfd, "BOOT boot_epoch=" as *u8); _fn(jfd, boot_epoch)
          _fp(jfd, " revive_epoch=" as *u8); _fn(jfd, now)
          _fp(jfd, " dark_gap=" as *u8); _fn(jfd, dark_gap)
          _fp(jfd, "\n" as *u8)
          sys_close(jfd)
      }
      _p(" NEW BOOT detected: boot_epoch=" as *u8); _pn(boot_epoch); _p(" dark_gap=" as *u8); _pn(dark_gap); _p("s (substrate downtime, measured)\n" as *u8)
  } else {
      _p(" same boot as last journal row (no BOOT row appended)\n" as *u8)
  }
  // ---- (1b) orphaned intents (CR4): file work the crash interrupted mid-flight ----
  var walpath: *u8 = "knowledge/status/intent_wal.log" as *u8
  if argc >= 5 { walpath = argv[4] as *u8 }
  var pmpath: *u8 = "knowledge/status/pm_plan_durable.log" as *u8
  if argc >= 6 { pmpath = argv[5] as *u8 }
  _p(" -- ORPHANED INTENTS (started before this boot, never finished) --\n" as *u8)
  let orphans: i64 = br_file_orphans(walpath, pmpath, boot_epoch)
  if orphans == 0 { _p("  (none)\n" as *u8) }
  // ---- (1c) REPLAY + RESUME (M6): reconstruct + resume exactly the in-flight streams ----
  var ledgerpath: *u8 = "knowledge/status/ws_ledger.log" as *u8
  if argc >= 7 { ledgerpath = argv[6] as *u8 }
  var hbpath: *u8 = "knowledge/status/heartbeat.log" as *u8
  if argc >= 8 { hbpath = argv[7] as *u8 }
  var resumepath: *u8 = "knowledge/status/boot_resume.log" as *u8
  if argc >= 9 { resumepath = argv[8] as *u8 }
  var rr_now: i64 = sys_now_realtime_sec()
  if argc >= 10 { rr_now = br_digits_at(argv[9] as *u8, 0, br_len(argv[9] as *u8)) }
  var rr_thr: i64 = BR_HB_THRESHOLD
  if argc >= 11 { rr_thr = br_digits_at(argv[10] as *u8, 0, br_len(argv[10] as *u8)) }
  _p(" -- REPLAY + RESUME (M6: reconstruct authoritative state, resume in-flight streams) --\n" as *u8)
  let rc6: *i64 = sys_mmap(8*8) as *i64
  var rz: i64 = 0
  while rz < 8 { rc6[rz] = 0; rz = rz + 1 }
  br_replay_resume(ledgerpath, hbpath, resumepath, rr_now, rr_thr, boot_epoch, rc6)
  let streams_resumed:   i64 = rc6[0]
  let streams_completed: i64 = rc6[1]
  let ledger_flagged:    i64 = rc6[2]
  let hb_flagged:        i64 = rc6[3]
  _p("  resumed=" as *u8); _pn(streams_resumed); _p(" completed_skipped=" as *u8); _pn(streams_completed); _p(" stale_not_resumed=" as *u8); _pn(rc6[4]); _p(" streams_seen=" as *u8); _pn(rc6[5]); _p(" ledger_flagged=" as *u8); _pn(ledger_flagged); _p(" hb_flagged=" as *u8); _pn(hb_flagged); _p("\n" as *u8)
  if streams_resumed == 0 { _p("  (no in-flight streams to resume -- clean boot is a non-event)\n" as *u8) }
  // ---- (2) proactive organ revive (watchdog-bounded per organ) ----
  let c: *i64 = sys_mmap(8*8) as *i64
  var z: i64 = 0
  while z < 8 { c[z] = 0; z = z + 1 }
  _p(" -- ORGANS (expected E rows: rebuild every recoverable absence NOW) --\n" as *u8)
  var ei: i64 = 0
  while ei < ne { br_revive_one(enames[ei] as *u8, elanes[ei], budget, c); ei = ei + 1 }
  // ---- (3) daemon revive (idempotent via the daemon's own pidfile dup-guard) ----
  var dstart: i64 = 0
  var dfail: i64 = 0
  var drun: i64 = 0
  _p(" -- DAEMONS (expected D rows: re-arm every one not in /proc) --\n" as *u8)
  var dvi: i64 = 0
  while dvi < nd {
      let dsub: *u8 = dnames[dvi] as *u8
      _p("  daemon " as *u8); _p(dsub); _p(": " as *u8)
      if br_daemon_up(dsub) == 1 { _p("RUNNING\n" as *u8); drun = drun + 1 }
      else {
          let rcd: i64 = br_guarded("_offc/nx_sov_build_run.elf" as *u8, dsub, budget * 1000)
          if rcd == BR_TIMEOUT { c[5] = c[5] + 1 }
          sys_sleep_ms(BR_ARM_GRACE_MS)
          if br_daemon_up(dsub) == 1 { _p("RE-ARMED rc=" as *u8); _pn(rcd); _p("\n" as *u8); dstart = dstart + 1 }
          else { _p("ARM-FAIL rc=" as *u8); _pn(rcd); _p("\n" as *u8); dfail = dfail + 1 }
      }
      dvi = dvi + 1
  }
  // ---- verdict + durable REVIVE line ----
  var verdict: i64 = 0
  if c[2] > 0 { verdict = 1 }
  if c[3] > 0 { verdict = 1 }
  if c[4] > 0 { verdict = 1 }
  if c[5] > 0 { verdict = 1 }
  if dfail > 0 { verdict = 1 }
  if ledger_flagged > 0 { verdict = 1 }   // M6: reflog corruption surfaced, never swallowed
  if hb_flagged > 0 { verdict = 1 }        // M6: heartbeat-channel corruption surfaced
  let lfd: i64 = sys_openat_append(logpath, 0x1a4)
  if lfd >= 0 {
      _fp(lfd, "REVIVE epoch=" as *u8); _fn(lfd, now)
      _fp(lfd, " new_boot=" as *u8); _fn(lfd, new_boot)
      _fp(lfd, " boot_epoch=" as *u8); _fn(lfd, boot_epoch)
      _fp(lfd, " organs_present=" as *u8); _fn(lfd, c[0])
      _fp(lfd, " organs_revived=" as *u8); _fn(lfd, c[1])
      _fp(lfd, " revive_fails=" as *u8); _fn(lfd, c[2])
      _fp(lfd, " lane_w_skipped=" as *u8); _fn(lfd, c[3])
      _fp(lfd, " unrecoverable=" as *u8); _fn(lfd, c[4])
      _fp(lfd, " timeouts=" as *u8); _fn(lfd, c[5])
      _fp(lfd, " intents_orphaned=" as *u8); _fn(lfd, orphans)
      _fp(lfd, " daemons_running=" as *u8); _fn(lfd, drun)
      _fp(lfd, " daemons_started=" as *u8); _fn(lfd, dstart)
      _fp(lfd, " daemon_fails=" as *u8); _fn(lfd, dfail)
      _fp(lfd, " streams_resumed=" as *u8); _fn(lfd, streams_resumed)
      _fp(lfd, " streams_completed=" as *u8); _fn(lfd, streams_completed)
      _fp(lfd, " ledger_flagged=" as *u8); _fn(lfd, ledger_flagged)
      _fp(lfd, " hb_flagged=" as *u8); _fn(lfd, hb_flagged)
      if verdict == 0 { _fp(lfd, " verdict=GREEN\n" as *u8) } else { _fp(lfd, " verdict=ATTENTION\n" as *u8) }
      sys_close(lfd)
  }
  _p(" durable: " as *u8); _p(logpath); _p(" + " as *u8); _p(journalpath); _p("\n" as *u8)
  if verdict == 0 { _p(" BOOT REVIVE: GREEN (everything expected is present/running)\n" as *u8); sys_exit(0); return 0 }
  _p(" BOOT REVIVE: ATTENTION (revive-fail / W-lane absence / no-source / timeout / daemon down)\n" as *u8)
  sys_exit(1)
  return 1
661}
nx_boot_revive.nx source

`nx_boot_revive.nx` source
