nx_capcensus.nx source
↩ module page · 871 lines · 42319 B
1// nx_capcensus.nx -- THE PICKED-CAP CENSUS: is a capacity bound DERIVED, or PICKED by an author?
2//
3// WHY THIS EXISTS, AND WHY IT IS NOT A DUPLICATE (measured 2026-08-23).
4// The same defect class was found FOUR times in ONE session:
5// nx_skeleton.nx SK_MAXB=32 bones / SK_MAXV=2048 verts against a corpus of 104-370 joints and
6// 14,164-423,919 verts -- an 11.6x bone / 207x vertex overflow that made EVERY
7// real character un-riggable, so the served worlds drew bind pose.
8// nx_nxa_skin cluster cap 512 -> 8192, and the CAP IMPERSONATED A COUNT TWICE (clusters=510,
9// then =2046): a saturated buffer read back as if it were a measurement.
10// MG_CAP a SILENT input cap in the mesh path -- an oversized asset reads truncated with
11// no announcement.
12// nx_cron_reconcile one sys_read of 16,383 B against a 24,356 B registry: 11 production jobs
13// silently inert, and it printed declared=55 as if that were the population.
14//
15// ***NAMING A MAGIC NUMBER DOES NOT MAKE IT DERIVED.*** nx_magic is the rule-11 fixer: it hoists an
16// INLINE literal into a NAMED const, and it SKIPS const/static declaration lines BY CONSTRUCTION
17// (its own header says so). So `const SK_MAXB: i64 = 32` is structurally invisible to it and every
18// magic-number detector calls the file clean. Worse, its remedy MANUFACTURES this artifact: the
19// auto-generated K_MAGIC_<value> / <PFX>_MAGIC_<value> names found in the wild (K_MAGIC_262144,
20// K_MAGIC_65536, DC_MAGIC_131072) are picked caps wearing a constant's clothes -- THE NAME ENCODES
21// THE VALUE, so it carries no purpose at all. That is not a defect in nx_magic (its neutrality is
22// provable and its purpose is different); it is exactly why a SECOND, ORTHOGONAL instrument is
23// needed. nx_magic asks "is this literal inline?". This organ asks "is this bound DERIVED or PICKED?".
24//
25// nx_capcliff is NOT the incumbent either: it forecasts RUNTIME growth of rostered append-only
26// ledgers against a known reader cap. This is a STATIC census of bounds declared in source.
27//
28// nx_capcensus scan <dir> -> recursive classified census over every .nx under <dir>
29// nx_capcensus selftest
30//
31// CLASSES (the partition MUST sum to the population, and the sum is printed):
32// DERIVED value computed from an input size / another identifier / an expression. Healthy.
33// PICKED a literal ceiling on data whose real size is knowable at runtime. THE WORKLIST.
34// STRUCTURAL fixed by an external contract (syscall number, mode bits, seek whence, exit code).
35// PROTECTIVE a bound NAMED for bounding unknowable input. See the declared limit below.
36// UNKNOWN could not classify. Reported, NEVER folded into a known bucket.
37//
38// DECLARED LIMIT, so nobody reads this census as more than it is: PROTECTIVE IS UNDER-DETECTED BY
39// CONSTRUCTION. Proving that a bound's truncation ANNOUNCES requires call-site analysis this organ
40// does not perform; it recognises only bounds NAMED for that purpose (WINDOW/WIN/BUDGET/DEADLINE/
41// TIMEOUT). Every other protective bound therefore lands in PICKED and must be adjudicated per-file.
42// That biases PICKED HIGH -- the safe direction for a worklist, and it is stated here rather than
43// discovered later. A second declared limit: a name carrying MAGIC_ is classified autohoist even if
44// it also looks structural (SYS_MAGIC_...), because a name that encodes its own value carries no
45// purpose whichever prefix precedes it.
46//
47// THIS ORGAN MUST NOT CONTAIN THE DEFECT IT HUNTS:
48// - file reads compose sys_read_file (sizes from the file via lseek END; cannot short-read), and
49// release with sys_free_file so a 23k-file walk does not leak
50// - the directory queue GROWS (double-and-copy); it has no ceiling
51// - CE_DIRWIN is a getdents WINDOW, not a cap: the walk loops until getdents64 returns 0, so a
52// directory larger than the window is read in several batches and nothing is truncated
53// - counting is UNCAPPED; the printed worklist is a DECLARED PREFIX and prints its own full count
54// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
55import "nx_syscalls.nx"
56
57// A getdents WINDOW, not a cap -- the drain loop below makes it a throughput choice, not a ceiling.
58const CE_DIRWIN: i64 = 262144
59const CE_PATHW: i64 = 4096
60// Directory queue GROWTH seed. Not a ceiling: the walk doubles and copies when full.
61const CE_QSEED: i64 = 64
62
63const CE_SKIP: i64 = 0
64const CE_DERIVED: i64 = 1
65const CE_PICKED: i64 = 2
66const CE_STRUCTURAL: i64 = 3
67const CE_PROTECTIVE: i64 = 4
68const CE_UNKNOWN: i64 = 5
69
70const CE_DT_DIR: i64 = 4
71const CE_EXIT_USAGE: i64 = 2
72const CE_EXIT_SELFTEST: i64 = 3
73const CE_EXIT_PICKED: i64 = 1
74// A module we could not read is NEVER reported CLEAN -- an unreadable subject must abstain, not
75// acquit, or a foundation check goes green on a file it never opened.
76const CE_EXIT_UNREADABLE: i64 = 3
77const CE_WORKLIST_SHOWN: i64 = 60
78const CE_POW2_FLOOR: i64 = 4096
79
80const CE_C_SEEN: i64 = 0
81const CE_C_POP: i64 = 1
82const CE_C_DER: i64 = 2
83const CE_C_PICK: i64 = 3
84const CE_C_STR: i64 = 4
85const CE_C_PRO: i64 = 5
86const CE_C_UNK: i64 = 6
87const CE_C_AH: i64 = 7
88const CE_C_P2: i64 = 8
89const CE_C_SHOWN: i64 = 9
90const CE_C_MMAPLIT: i64 = 10
91// nx_magic's `apply` stamps EVERY const it generates with an NX-UNNAMED marker declaring that the
92// name RESTATES its value and carries no meaning. Counting that MARKER -- rather than inferring from
93// the name's shape -- measures the auto-hoisted placeholder backlog DIRECTLY, and cross-checks the
94// name-shaped autohoist count from an INDEPENDENT signal. Two witnesses of one population, which is
95// exactly why both are printed instead of one standing in for the other.
96const CE_C_UNNAMED: i64 = 11
97// THE DISPLAY BOUND, and it is a bound on the DISPLAY -- never on the DATA (2026-08-23).
98// This organ shipped with `CE_WORKLIST_SHOWN = 60` hardcoded and no override, so it published 60
99// rows of its own measured 16,782 PICKED bounds -- 0.36%. THE PICKED-CAP CENSUS HAD A PICKED CAP,
100// and it was the one that made its own worklist unusable: a consumer could not ask "does module X
101// carry a picked cap?", only see whichever 60 rows this organ chose. Measured cost: the first-byte
102// dependency lane's CAPPED axis was UNOBSERVABLE, so no rung could read READY -- and three of the
103// five foundation defects that motivated that lane were themselves picked caps.
104// NOW: 0 means UNBOUNDED, the value is caller-supplied, and any truncation ANNOUNCES and forces
105// coverage_complete=0. The per-module query `file <path>` prints EVERY picked cap in one module and
106// carries the answer in its EXIT CODE, which is the shape a foundation check actually needs.
107const CE_C_SHOWMAX: i64 = 12
108const CE_C_RESOLVED: i64 = 13
109const CE_C_EXCEEDED: i64 = 14
110const CE_C_NEAR: i64 = 15
111const CE_C_OKB: i64 = 16
112const CE_C_MISSING: i64 = 17
113// FIRST-RUN FALSE-POSITIVE RATE OF THE LIVE-EXCEEDED BUCKET: 2 of 3 = 667 permil (2026-08-23).
114// Both causes were predictable and are now their own buckets rather than suppressed, because the
115// estate's law is that a detector which HIDES its false positives has thrown away its own taxonomy
116// -- and a detector with false positives is worse than none, since it teaches everyone to ignore it.
117// TAIL-ANCHORED the reader seeks to the END and keeps the NEWEST bytes (tl_read_tail,
118// cl_slurp_tail, tj_read). For an APPEND-ONLY ledger that is a DECLARED HORIZON and
119// the CORRECT remedy -- the opposite of the head-anchored blindness we hunt.
120// FIXTURE the subject lives under /tmp/, i.e. gate scratch. nx_fsops_gate deliberately
121// drives a 9-byte file through a 4-byte cap so a wrong `size` implementation (count
122// what I read) diverges from a real lseek. THE EXCEEDANCE *IS* THE TEST.
123// What remains in LIVE-EXCEEDED is head-anchored truncation of a real subject -- the shipcheck class.
124const CE_C_TAILANCH: i64 = 18
125const CE_C_FIXTURE: i64 = 19
126const CE_NCTR: i64 = 24
127
128func ce_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
129func ce_wspan(b: *u8, s: i64, e: i64) -> i64 { if e > s { sys_write(1, ((b as i64) + s) as *u8, e - s) } return 0 }
130func ce_wn(v: i64) -> i64 {
131 var m: i64 = v
132 if m < 0 { ce_w("-" as *u8); m = 0 - m }
133 let t: *u8 = sys_mmap(32)
134 var k: i64 = 0
135 if m == 0 { t[0] = 48 as u8; k = 1 }
136 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
137 let o: *u8 = sys_mmap(32)
138 var i: i64 = 0
139 while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
140 sys_write(1, o, k)
141 sys_munmap(t, 32)
142 sys_munmap(o, 32)
143 return 0
144}
145func ce_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
146func ce_streq(a: *u8, b: *u8) -> i64 {
147 var i: i64 = 0
148 var r: i64 = 1
149 var go: i64 = 1
150 while go == 1 {
151 let ca: i64 = a[i]
152 let cb: i64 = b[i]
153 if ca != cb { r = 0; go = 0 }
154 else { if ca == 0 { go = 0 } else { i = i + 1 } }
155 }
156 return r
157}
158
159// literal substring search inside a byte window
160func ce_has(b: *u8, s: i64, e: i64, ned: *u8) -> i64 {
161 let nl: i64 = ce_slen(ned)
162 if nl == 0 { return 0 }
163 var i: i64 = s
164 var found: i64 = 0
165 while i + nl <= e {
166 if found == 0 {
167 var j: i64 = 0
168 var ok: i64 = 1
169 while j < nl {
170 if b[i + j] != ned[j] { ok = 0; j = nl } else { j = j + 1 }
171 }
172 if ok == 1 { found = 1 }
173 }
174 i = i + 1
175 }
176 return found
177}
178
179func ce_isdig(c: i64) -> i64 { if c >= 48 { if c <= 57 { return 1 } } return 0 }
180
181// every byte in [s,e) a decimal digit (underscore separators permitted)
182func ce_all_digits(b: *u8, s: i64, e: i64) -> i64 {
183 if e <= s { return 0 }
184 var i: i64 = s
185 var ok: i64 = 1
186 var ndig: i64 = 0
187 while i < e {
188 let c: i64 = b[i]
189 if ce_isdig(c) == 1 { ndig = ndig + 1 }
190 else { if c != 95 { ok = 0 } }
191 i = i + 1
192 }
193 if ndig == 0 { return 0 }
194 return ok
195}
196
197func ce_atoi_span(b: *u8, s: i64, e: i64) -> i64 {
198 var v: i64 = 0
199 var i: i64 = s
200 while i < e {
201 let c: i64 = b[i]
202 if ce_isdig(c) == 1 { v = v * 10 + (c - 48) }
203 i = i + 1
204 }
205 return v
206}
207
208// A power of two at or above CE_POW2_FLOOR: the fingerprint of an author's round choice. A measured
209// size is almost never exactly 2^n, so this is evidence of picking, reported as its own subcount.
210func ce_pow2_big(v: i64) -> i64 {
211 if v < CE_POW2_FLOOR { return 0 }
212 var x: i64 = v
213 while x % 2 == 0 { x = x / 2 }
214 if x == 1 { return 1 }
215 return 0
216}
217
218func ce_capshaped(b: *u8, s: i64, e: i64) -> i64 {
219 if ce_has(b, s, e, "CAP" as *u8) == 1 { return 1 }
220 if ce_has(b, s, e, "MAX" as *u8) == 1 { return 1 }
221 if ce_has(b, s, e, "BUF" as *u8) == 1 { return 1 }
222 if ce_has(b, s, e, "LIMIT" as *u8) == 1 { return 1 }
223 if ce_has(b, s, e, "_SZ" as *u8) == 1 { return 1 }
224 if ce_has(b, s, e, "SIZE" as *u8) == 1 { return 1 }
225 if ce_has(b, s, e, "ROWS" as *u8) == 1 { return 1 }
226 if ce_has(b, s, e, "SLOTS" as *u8) == 1 { return 1 }
227 if ce_has(b, s, e, "ENTRIES" as *u8) == 1 { return 1 }
228 if ce_has(b, s, e, "CELLS" as *u8) == 1 { return 1 }
229 return 0
230}
231
232func ce_structural(b: *u8, s: i64, e: i64) -> i64 {
233 if ce_has(b, s, e, "SYS_" as *u8) == 1 { return 1 }
234 if ce_has(b, s, e, "EXIT" as *u8) == 1 { return 1 }
235 if ce_has(b, s, e, "SEEK" as *u8) == 1 { return 1 }
236 if ce_has(b, s, e, "MODE" as *u8) == 1 { return 1 }
237 if ce_has(b, s, e, "PROT_" as *u8) == 1 { return 1 }
238 if ce_has(b, s, e, "MAP_" as *u8) == 1 { return 1 }
239 if ce_has(b, s, e, "AT_" as *u8) == 1 { return 1 }
240 if ce_has(b, s, e, "SIG" as *u8) == 1 { return 1 }
241 if ce_has(b, s, e, "ERR" as *u8) == 1 { return 1 }
242 if ce_has(b, s, e, "DT_" as *u8) == 1 { return 1 }
243 return 0
244}
245
246func ce_protective(b: *u8, s: i64, e: i64) -> i64 {
247 if ce_has(b, s, e, "WINDOW" as *u8) == 1 { return 1 }
248 if ce_has(b, s, e, "_WIN" as *u8) == 1 { return 1 }
249 if ce_has(b, s, e, "BUDGET" as *u8) == 1 { return 1 }
250 if ce_has(b, s, e, "DEADLINE" as *u8) == 1 { return 1 }
251 if ce_has(b, s, e, "TIMEOUT" as *u8) == 1 { return 1 }
252 return 0
253}
254
255// The name encodes its own value (K_MAGIC_262144): an auto-hoisted literal carrying NO purpose.
256// Provable rather than guessed -- this is the artifact nx_magic's remedy generates.
257func ce_autohoist(b: *u8, s: i64, e: i64) -> i64 {
258 if ce_has(b, s, e, "MAGIC_" as *u8) == 1 { return 1 }
259 return 0
260}
261
262// classify ONE source line; returns the class (CE_SKIP when the line is not a capacity bound)
263func ce_scan_line(b: *u8, s: i64, e: i64, path: *u8, lineno: i64, ctr: *i64) -> i64 {
264 var p: i64 = s
265 var go: i64 = 1
266 while go == 1 {
267 if p >= e { go = 0 }
268 else { if b[p] == 32 { p = p + 1 } else { if b[p] == 9 { p = p + 1 } else { go = 0 } } }
269 }
270 if p + 6 > e { return CE_SKIP }
271 if b[p] != 99 { return CE_SKIP }
272 if b[p+1] != 111 { return CE_SKIP }
273 if b[p+2] != 110 { return CE_SKIP }
274 if b[p+3] != 115 { return CE_SKIP }
275 if b[p+4] != 116 { return CE_SKIP }
276 if b[p+5] != 32 { return CE_SKIP }
277 ctr[CE_C_SEEN] = ctr[CE_C_SEEN] + 1
278
279 var ns: i64 = p + 6
280 var g2: i64 = 1
281 while g2 == 1 {
282 if ns >= e { g2 = 0 }
283 else { if b[ns] == 32 { ns = ns + 1 } else { g2 = 0 } }
284 }
285 var ne: i64 = ns
286 var g3: i64 = 1
287 while g3 == 1 {
288 if ne >= e { g3 = 0 }
289 else {
290 let c: i64 = b[ne]
291 if c == 58 { g3 = 0 }
292 else { if c == 32 { g3 = 0 } else { if c == 61 { g3 = 0 } else { ne = ne + 1 } } }
293 }
294 }
295 if ne <= ns { return CE_SKIP }
296
297 var eq: i64 = ne
298 var g4: i64 = 1
299 var haveq: i64 = 0
300 while g4 == 1 {
301 if eq >= e { g4 = 0 }
302 else { if b[eq] == 61 { haveq = 1; g4 = 0 } else { eq = eq + 1 } }
303 }
304 if haveq == 0 { return CE_SKIP }
305 var vs: i64 = eq + 1
306 var g5: i64 = 1
307 while g5 == 1 {
308 if vs >= e { g5 = 0 }
309 else { if b[vs] == 32 { vs = vs + 1 } else { g5 = 0 } }
310 }
311 var ve: i64 = vs
312 var g6: i64 = 1
313 while g6 == 1 {
314 if ve >= e { g6 = 0 }
315 else {
316 if b[ve] == 47 { g6 = 0 }
317 else { ve = ve + 1 }
318 }
319 }
320 var g7: i64 = 1
321 while g7 == 1 {
322 if ve <= vs { g7 = 0 }
323 else { if b[ve-1] == 32 { ve = ve - 1 } else { if b[ve-1] == 9 { ve = ve - 1 } else { g7 = 0 } } }
324 }
325 if ve <= vs { return CE_SKIP }
326
327 let ah: i64 = ce_autohoist(b, ns, ne)
328 let cs: i64 = ce_capshaped(b, ns, ne)
329 if ah == 0 { if cs == 0 { return CE_SKIP } }
330
331 ctr[CE_C_POP] = ctr[CE_C_POP] + 1
332 let lit: i64 = ce_all_digits(b, vs, ve)
333 var cls: i64 = CE_UNKNOWN
334
335 if ah == 1 {
336 if lit == 1 { cls = CE_PICKED; ctr[CE_C_AH] = ctr[CE_C_AH] + 1 }
337 else { cls = CE_DERIVED }
338 } else {
339 if ce_structural(b, ns, ne) == 1 { cls = CE_STRUCTURAL }
340 else {
341 if ce_protective(b, ns, ne) == 1 { cls = CE_PROTECTIVE }
342 else {
343 if lit == 1 { cls = CE_PICKED } else { cls = CE_DERIVED }
344 }
345 }
346 }
347
348 if cls == CE_DERIVED { ctr[CE_C_DER] = ctr[CE_C_DER] + 1 }
349 if cls == CE_STRUCTURAL { ctr[CE_C_STR] = ctr[CE_C_STR] + 1 }
350 if cls == CE_PROTECTIVE { ctr[CE_C_PRO] = ctr[CE_C_PRO] + 1 }
351 if cls == CE_UNKNOWN { ctr[CE_C_UNK] = ctr[CE_C_UNK] + 1 }
352 if cls == CE_PICKED {
353 ctr[CE_C_PICK] = ctr[CE_C_PICK] + 1
354 let v: i64 = ce_atoi_span(b, vs, ve)
355 if ce_pow2_big(v) == 1 { ctr[CE_C_P2] = ctr[CE_C_P2] + 1 }
356 // DISPLAY gate only. The COUNT above is already recorded and is never bounded.
357 // showmax <= 0 means UNBOUNDED -- the whole worklist prints, which is what a consumer
358 // querying a single module needs.
359 // showmax < 0 = SILENT (the subjects pass wants the COUNT without the raw worklist);
360 // showmax == 0 = UNBOUNDED; showmax > 0 = a display prefix that announces its truncation.
361 let showmax: i64 = ctr[CE_C_SHOWMAX]
362 var doprint: i64 = 0
363 if showmax < 0 { doprint = 0 }
364 else { if showmax == 0 { doprint = 1 } else { if ctr[CE_C_SHOWN] < showmax { doprint = 1 } } }
365 if doprint == 1 {
366 ctr[CE_C_SHOWN] = ctr[CE_C_SHOWN] + 1
367 ce_w(" PICKED " as *u8)
368 ce_w(path)
369 ce_w(":" as *u8); ce_wn(lineno)
370 ce_w(" " as *u8); ce_wspan(b, ns, ne)
371 ce_w("=" as *u8); ce_wspan(b, vs, ve)
372 if ce_pow2_big(v) == 1 { ce_w(" [pow2]" as *u8) }
373 if ah == 1 { ce_w(" [autohoist: name encodes its value]" as *u8) }
374 ce_w("\n" as *u8)
375 }
376 }
377 return cls
378}
379
380func ce_scan_file(fb: *u8, flen: i64, path: *u8, ctr: *i64) -> i64 {
381 var ls: i64 = 0
382 var lineno: i64 = 1
383 while ls < flen {
384 var le: i64 = ls
385 var stop: i64 = 0
386 while stop == 0 {
387 if le >= flen { stop = 1 }
388 else { if fb[le] == 10 { stop = 1 } else { le = le + 1 } }
389 }
390 ce_scan_line(fb, ls, le, path, lineno, ctr)
391 if ce_has(fb, ls, le, "NX-UNNAMED" as *u8) == 1 { ctr[CE_C_UNNAMED] = ctr[CE_C_UNNAMED] + 1 }
392 if ce_has(fb, ls, le, "sys_mmap(" as *u8) == 1 {
393 var k: i64 = ls
394 var g: i64 = 1
395 while g == 1 {
396 if k + 9 > le { g = 0 }
397 else {
398 if fb[k] == 115 {
399 if ce_has(fb, k, k + 9, "sys_mmap(" as *u8) == 1 {
400 if ce_isdig(fb[k+9]) == 1 { ctr[CE_C_MMAPLIT] = ctr[CE_C_MMAPLIT] + 1 }
401 g = 0
402 } else { k = k + 1 }
403 } else { k = k + 1 }
404 }
405 }
406 }
407 lineno = lineno + 1
408 ls = le + 1
409 }
410 return 0
411}
412
413// ---- THE PER-CAP SUBJECT RESOLVER ---------------------------------------------------------
414// A count without an ordering is not a worklist: 16,782 PICKED bounds with no ratio cannot sort
415// live-exceeded above latent, so the campaign order comes from whoever noticed rather than from
416// measurement. This resolves a cap's SUBJECT -- the thing it bounds -- and measures it.
417//
418// THE PAIRING RULE IS DELIBERATELY NARROW AND MUST NOT BE WIDENED: a cap is resolved ONLY when a
419// single source line carries ALL THREE of (a) a read call, (b) a literal path, (c) the cap const.
420// Same line, no inference. A resolver that GUESSES a subject is worse than one that abstains,
421// because a wrong subject yields a wrong ratio and a wrong ratio yields a wrong worklist order --
422// which defeats the entire purpose. Everything else is UNRESOLVED, reported as its own bucket, and
423// resolved+unresolved MUST sum to PICKED.
424//
425// AND THE UNRESOLVED BUCKET IS NOT MERELY A COVERAGE GAP -- IT IS A CORRECTNESS FILTER ON THIS
426// ORGAN'S OWN POPULATION. A cap BOUNDS a subject; an INDEX does not. This organ's own
427// `CE_C_SHOWMAX = 12` is a counter index flagged PICKED purely because its name contains "MAX" --
428// a false positive found in its own output. Index and slot constants can never resolve to a
429// subject, so PICKED is an UPPER BOUND with a knowable error term, not a count.
430func ce_path_size(p: *u8) -> i64 {
431 let fd: i64 = sys_openat_rd(p)
432 if fd < 0 { return 0 - 1 }
433 let sz: i64 = sys_lseek(fd, 0, 2)
434 sys_close(fd)
435 return sz
436}
437
438// does the byte window [ns,ne) of `nb` occur inside [s,e) of `b`?
439func ce_span_in(b: *u8, s: i64, e: i64, nb: *u8, ns: i64, ne: i64) -> i64 {
440 let nl: i64 = ne - ns
441 if nl <= 0 { return 0 }
442 var i: i64 = s
443 var found: i64 = 0
444 while i + nl <= e {
445 if found == 0 {
446 var j: i64 = 0
447 var ok: i64 = 1
448 while j < nl { if b[i+j] != nb[ns+j] { ok = 0; j = nl } else { j = j + 1 } }
449 if ok == 1 { found = 1 }
450 }
451 i = i + 1
452 }
453 return found
454}
455
456func ce_subjects_file(fb: *u8, flen: i64, path: *u8, ctr: *i64) -> i64 {
457 // capacity DERIVED from the input: a const declaration cannot occupy fewer than ~24 bytes of
458 // source, so flen/24+8 is a true upper bound on how many this file can hold. Not a picked cap.
459 let maxn: i64 = flen / 24 + 8
460 let noff: *i64 = sys_mmap(maxn * 8) as *i64
461 let nlenv: *i64 = sys_mmap(maxn * 8) as *i64
462 let nval: *i64 = sys_mmap(maxn * 8) as *i64
463 var nc: i64 = 0
464
465 // pass 1: every PICKED cap declared in this file (name span + literal value)
466 var ls: i64 = 0
467 while ls < flen {
468 var le: i64 = ls
469 var stop: i64 = 0
470 while stop == 0 { if le >= flen { stop = 1 } else { if fb[le] == 10 { stop = 1 } else { le = le + 1 } } }
471 var p: i64 = ls
472 var g0: i64 = 1
473 while g0 == 1 { if p >= le { g0 = 0 } else { if fb[p] == 32 { p = p + 1 } else { if fb[p] == 9 { p = p + 1 } else { g0 = 0 } } } }
474 var isc: i64 = 0
475 if p + 6 <= le { if fb[p] == 99 { if fb[p+1] == 111 { if fb[p+2] == 110 { if fb[p+3] == 115 { if fb[p+4] == 116 { if fb[p+5] == 32 { isc = 1 } } } } } } }
476 if isc == 1 {
477 var ns: i64 = p + 6
478 while ns < le { if fb[ns] == 32 { ns = ns + 1 } else { ns = le + 1 } }
479 if ns > le { ns = p + 6 }
480 var ns2: i64 = p + 6
481 var g1: i64 = 1
482 while g1 == 1 { if ns2 >= le { g1 = 0 } else { if fb[ns2] == 32 { ns2 = ns2 + 1 } else { g1 = 0 } } }
483 var ne: i64 = ns2
484 var g2: i64 = 1
485 while g2 == 1 {
486 if ne >= le { g2 = 0 }
487 else { let c: i64 = fb[ne]
488 if c == 58 { g2 = 0 } else { if c == 32 { g2 = 0 } else { if c == 61 { g2 = 0 } else { ne = ne + 1 } } } }
489 }
490 if ne > ns2 {
491 if ce_capshaped(fb, ns2, ne) == 1 {
492 var eq: i64 = ne
493 var g3: i64 = 1
494 var hq: i64 = 0
495 while g3 == 1 { if eq >= le { g3 = 0 } else { if fb[eq] == 61 { hq = 1; g3 = 0 } else { eq = eq + 1 } } }
496 if hq == 1 {
497 var vs: i64 = eq + 1
498 var g4: i64 = 1
499 while g4 == 1 { if vs >= le { g4 = 0 } else { if fb[vs] == 32 { vs = vs + 1 } else { g4 = 0 } } }
500 var ve: i64 = vs
501 var g5: i64 = 1
502 while g5 == 1 { if ve >= le { g5 = 0 } else { if fb[ve] == 47 { g5 = 0 } else { ve = ve + 1 } } }
503 var g6: i64 = 1
504 while g6 == 1 { if ve <= vs { g6 = 0 } else { if fb[ve-1] == 32 { ve = ve - 1 } else { if fb[ve-1] == 9 { ve = ve - 1 } else { g6 = 0 } } } }
505 if ce_all_digits(fb, vs, ve) == 1 {
506 if nc < maxn {
507 noff[nc] = ns2
508 nlenv[nc] = ne - ns2
509 nval[nc] = ce_atoi_span(fb, vs, ve)
510 nc = nc + 1
511 }
512 }
513 }
514 }
515 }
516 }
517 ls = le + 1
518 }
519
520 // pass 2: a line carrying a READ CALL + a LITERAL PATH + one of those consts = a resolved pair
521 ls = 0
522 var lineno: i64 = 1
523 while ls < flen {
524 var le2: i64 = ls
525 var st2: i64 = 0
526 while st2 == 0 { if le2 >= flen { st2 = 1 } else { if fb[le2] == 10 { st2 = 1 } else { le2 = le2 + 1 } } }
527 if ce_has(fb, ls, le2, "read" as *u8) == 1 {
528 var qs: i64 = 0 - 1
529 var qe: i64 = 0 - 1
530 var k: i64 = ls
531 while k < le2 {
532 if fb[k] == 34 {
533 if qs < 0 { qs = k + 1 } else { if qe < 0 { qe = k } }
534 }
535 k = k + 1
536 }
537 var isp: i64 = 0
538 if qs > 0 { if qe > qs { if qe - qs > 3 { if ce_has(fb, qs, qe, "/" as *u8) == 1 { isp = 1 } } } }
539 if isp == 1 {
540 var ci2: i64 = 0
541 while ci2 < nc {
542 if ce_span_in(fb, ls, le2, fb, noff[ci2], noff[ci2] + nlenv[ci2]) == 1 {
543 let cap: i64 = nval[ci2]
544 let pb: *u8 = sys_mmap(qe - qs + 8)
545 var z2: i64 = 0
546 while z2 < qe - qs { pb[z2] = fb[qs + z2]; z2 = z2 + 1 }
547 pb[qe - qs] = 0 as u8
548 let sz: i64 = ce_path_size(pb)
549 ctr[CE_C_RESOLVED] = ctr[CE_C_RESOLVED] + 1
550 ce_w(" SUBJECT " as *u8); ce_w(path); ce_w(":" as *u8); ce_wn(lineno)
551 ce_w(" " as *u8); ce_wspan(fb, noff[ci2], noff[ci2] + nlenv[ci2])
552 ce_w("=" as *u8); ce_wn(cap)
553 ce_w(" subject=" as *u8); ce_w(pb)
554 if sz < 0 {
555 ctr[CE_C_MISSING] = ctr[CE_C_MISSING] + 1
556 ce_w(" size=ABSENT verdict=UNMEASURABLE (subject not present; NEVER counted OK)\n" as *u8)
557 } else {
558 ce_w(" size=" as *u8); ce_wn(sz)
559 var permil: i64 = 0
560 if cap > 0 { permil = sz * 1000 / cap }
561 ce_w(" permil=" as *u8); ce_wn(permil)
562 // DISCRIMINATE before accusing: an exceedance is only a defect if the
563 // read is head-anchored and the subject is real.
564 var tailanch: i64 = 0
565 if ce_has(fb, ls, le2, "tail" as *u8) == 1 { tailanch = 1 }
566 if ce_has(fb, ls, le2, "slurp" as *u8) == 1 { tailanch = 1 }
567 var fixture: i64 = 0
568 if ce_has(fb, qs, qs + 5, "/tmp/" as *u8) == 1 { fixture = 1 }
569 if sz >= cap {
570 if tailanch == 1 {
571 ctr[CE_C_TAILANCH] = ctr[CE_C_TAILANCH] + 1
572 ce_w(" verdict=TAIL-ANCHORED (declared horizon: keeps the NEWEST bytes -- correct for an append-only ledger, NOT a defect)\n" as *u8)
573 } else {
574 if fixture == 1 {
575 ctr[CE_C_FIXTURE] = ctr[CE_C_FIXTURE] + 1
576 ce_w(" verdict=FIXTURE (gate scratch under /tmp/ -- an undersized cap here is usually the TEST, not a defect)\n" as *u8)
577 } else {
578 ctr[CE_C_EXCEEDED] = ctr[CE_C_EXCEEDED] + 1
579 ce_w(" verdict=LIVE-EXCEEDED <== head-anchored read of a REAL subject already past this cap\n" as *u8)
580 }
581 }
582 } else {
583 if permil >= 900 {
584 ctr[CE_C_NEAR] = ctr[CE_C_NEAR] + 1
585 ce_w(" verdict=NEAR\n" as *u8)
586 } else {
587 ctr[CE_C_OKB] = ctr[CE_C_OKB] + 1
588 ce_w(" verdict=LATENT\n" as *u8)
589 }
590 }
591 }
592 sys_munmap(pb, qe - qs + 8)
593 ci2 = nc
594 } else { ci2 = ci2 + 1 }
595 }
596 }
597 }
598 lineno = lineno + 1
599 ls = le2 + 1
600 }
601 sys_munmap(noff as *u8, maxn * 8)
602 sys_munmap(nlenv as *u8, maxn * 8)
603 sys_munmap(nval as *u8, maxn * 8)
604 return 0
605}
606
607func main(argc: i64, argv: *i64) -> i64 {
608 if argc < 2 {
609 ce_w("usage: nx_capcensus scan <dir> [showmax|0=unbounded] | nx_capcensus file <path> | nx_capcensus selftest\n" as *u8)
610 ce_w(" file <path> -> per-module query, EVERY picked bound printed, answer in the exit code:\n" as *u8)
611 ce_w(" 0 CLEAN (no picked bound) | 1 CAPPED | 3 UNREADABLE (never CLEAN)\n" as *u8)
612 sys_exit(CE_EXIT_USAGE)
613 return CE_EXIT_USAGE
614 }
615 let verb: *u8 = argv[1] as *u8
616 var root: *u8 = "buildroot/runtime" as *u8
617 if argc >= 3 { root = argv[2] as *u8 }
618
619 let ctr: *i64 = sys_mmap(CE_NCTR * 8) as *i64
620 var ci: i64 = 0
621 while ci < CE_NCTR { ctr[ci] = 0; ci = ci + 1 }
622 // display bound: caller-supplied, 0 = UNBOUNDED. Default bounds only the TERMINAL view of a
623 // whole-tree scan; it never bounds the count, and truncation announces below.
624 ctr[CE_C_SHOWMAX] = CE_WORKLIST_SHOWN
625 if argc >= 4 { ctr[CE_C_SHOWMAX] = ce_atoi_span(argv[3] as *u8, 0, ce_slen(argv[3] as *u8)) }
626
627 // ---- PER-MODULE QUERY: "does module X carry a picked cap?" ------------------------------
628 // The shape a foundation check needs: one module, EVERY picked bound printed (no display
629 // bound at all), and the ANSWER IN THE EXIT CODE so a caller can branch without parsing.
630 // exit 0 = no picked caps in this module 1 = at least one 3 = unreadable (never 0)
631 if ce_streq(verb, "file" as *u8) == 1 {
632 ctr[CE_C_SHOWMAX] = 0
633 let flp: *i64 = sys_mmap(8) as *i64
634 *flp = 0
635 let fb1: *u8 = sys_read_file(root, flp)
636 let fl1: i64 = *flp
637 if fl1 <= 0 {
638 ce_w("NX-CAPCENSUS file UNREADABLE " as *u8); ce_w(root)
639 ce_w(" -- refusing to report CLEAN over a module it never read\n" as *u8)
640 sys_exit(CE_EXIT_UNREADABLE)
641 return CE_EXIT_UNREADABLE
642 }
643 ce_w("NX-CAPCENSUS module=" as *u8); ce_w(root); ce_w("\n" as *u8)
644 ce_scan_file(fb1, fl1, root, ctr)
645 let s1: i64 = ctr[CE_C_DER] + ctr[CE_C_PICK] + ctr[CE_C_STR] + ctr[CE_C_PRO] + ctr[CE_C_UNK]
646 ce_w(" consts_seen=" as *u8); ce_wn(ctr[CE_C_SEEN])
647 ce_w(" capacity_population=" as *u8); ce_wn(ctr[CE_C_POP])
648 ce_w(" DERIVED=" as *u8); ce_wn(ctr[CE_C_DER])
649 ce_w(" PICKED=" as *u8); ce_wn(ctr[CE_C_PICK])
650 ce_w(" STRUCTURAL=" as *u8); ce_wn(ctr[CE_C_STR])
651 ce_w(" PROTECTIVE=" as *u8); ce_wn(ctr[CE_C_PRO])
652 ce_w(" UNKNOWN=" as *u8); ce_wn(ctr[CE_C_UNK]); ce_w("\n" as *u8)
653 ce_w(" partition_sum=" as *u8); ce_wn(s1)
654 if s1 == ctr[CE_C_POP] { ce_w(" SUMS=1" as *u8) } else { ce_w(" SUMS=0" as *u8) }
655 ce_w(" worklist_complete=1 (no display bound on a single-module query)\n" as *u8)
656 if ctr[CE_C_PICK] > 0 {
657 ce_w("NX-CAPCENSUS verdict=CAPPED (this module carries picked bounds)\n" as *u8)
658 sys_exit(CE_EXIT_PICKED)
659 return CE_EXIT_PICKED
660 }
661 ce_w("NX-CAPCENSUS verdict=CLEAN (no picked bound in this module)\n" as *u8)
662 return 0
663 }
664
665 if ce_streq(verb, "selftest" as *u8) == 1 {
666 // A fixture the defect CANNOT pass: one PICKED literal cap, one DERIVED bound, one
667 // STRUCTURAL, one autohoist. Anything that classifies them all alike fails here.
668 let fx: *u8 = sys_mmap(1024)
669 let src: *u8 = "const A_CAP: i64 = 65536\nconst B_CAP: i64 = other_size * 2\nconst SYS_MAX_X: i64 = 12\nconst K_MAGIC_262144: i64 = 262144\n" as *u8
670 var n: i64 = 0
671 while src[n] != (0 as u8) { fx[n] = src[n]; n = n + 1 }
672 ce_scan_file(fx, n, "selftest" as *u8, ctr)
673 var ok: i64 = 1
674 if ctr[CE_C_SEEN] != 4 { ok = 0 }
675 if ctr[CE_C_POP] != 4 { ok = 0 }
676 if ctr[CE_C_PICK] != 2 { ok = 0 }
677 if ctr[CE_C_DER] != 1 { ok = 0 }
678 if ctr[CE_C_STR] != 1 { ok = 0 }
679 if ctr[CE_C_AH] != 1 { ok = 0 }
680 if ctr[CE_C_P2] != 2 { ok = 0 }
681 ce_w("selftest seen=" as *u8); ce_wn(ctr[CE_C_SEEN])
682 ce_w(" pop=" as *u8); ce_wn(ctr[CE_C_POP])
683 ce_w(" picked=" as *u8); ce_wn(ctr[CE_C_PICK])
684 ce_w(" derived=" as *u8); ce_wn(ctr[CE_C_DER])
685 ce_w(" structural=" as *u8); ce_wn(ctr[CE_C_STR])
686 ce_w(" autohoist=" as *u8); ce_wn(ctr[CE_C_AH])
687 ce_w(" pow2=" as *u8); ce_wn(ctr[CE_C_P2]); ce_w("\n" as *u8)
688 if ok == 1 { ce_w("NX-CAPCENSUS selftest PASS\n" as *u8); return 0 }
689 ce_w("NX-CAPCENSUS selftest FAIL\n" as *u8)
690 sys_exit(CE_EXIT_SELFTEST)
691 return CE_EXIT_SELFTEST
692 }
693
694 // `subjects` walks the same tree but ALSO resolves each cap's subject and measures it.
695 // The raw picked worklist is silenced (showmax < 0) so the SUBJECT rows are the output.
696 var subjmode: i64 = 0
697 if ce_streq(verb, "subjects" as *u8) == 1 {
698 subjmode = 1
699 ctr[CE_C_SHOWMAX] = 0 - 1
700 ce_w("NX-CAPCENSUS subject resolution -- a cap is RESOLVED only when ONE line carries a read\n" as *u8)
701 ce_w("call, a literal path AND the cap const. No inference: everything else is UNRESOLVED.\n" as *u8)
702 }
703
704 var qcap: i64 = CE_QSEED
705 var qbuf: *u8 = sys_mmap(qcap * CE_PATHW)
706 var qn: i64 = 0
707 var qi: i64 = 0
708 let rl0: i64 = ce_slen(root)
709 var z: i64 = 0
710 while z < rl0 { qbuf[z] = root[z]; z = z + 1 }
711 qbuf[rl0] = 0 as u8
712 qn = 1
713
714 let lenp: *i64 = sys_mmap(8) as *i64
715 let pathb: *u8 = sys_mmap(CE_PATHW)
716 let dirbuf: *u8 = sys_mmap(CE_DIRWIN + 64)
717
718 var files: i64 = 0
719 var dirs: i64 = 0
720 var readfail: i64 = 0
721
722 ce_w("NX-CAPCENSUS worklist -- PICKED bounds, a DECLARED PREFIX of the full count below\n" as *u8)
723
724 while qi < qn {
725 dirs = dirs + 1
726 let dbase: i64 = qbuf as i64
727 let dcur: *u8 = (dbase + qi * CE_PATHW) as *u8
728 let dlen: i64 = ce_slen(dcur)
729 let dfd: i64 = sys_openat_rd(dcur)
730 qi = qi + 1
731 if dfd >= 0 {
732 var done: i64 = 0
733 while done == 0 {
734 let nb: i64 = sys_getdents64(dfd, dirbuf, CE_DIRWIN)
735 if nb <= 0 { done = 1 }
736 else {
737 var off: i64 = 0
738 while off < nb {
739 let rb: i64 = dirbuf as i64
740 let rec: *u8 = (rb + off) as *u8
741 let rl: i64 = dirent_reclen(rec)
742 if rl <= 0 { off = nb }
743 else {
744 let nm: *u8 = dirent_name(rec)
745 let nl: i64 = ce_slen(nm)
746 let dty: i64 = dirent_type(rec)
747 var skipdot: i64 = 0
748 if nl == 1 { if nm[0] == 46 { skipdot = 1 } }
749 if nl == 2 { if nm[0] == 46 { if nm[1] == 46 { skipdot = 1 } } }
750 if skipdot == 0 {
751 var p: i64 = 0
752 while p < dlen { pathb[p] = dcur[p]; p = p + 1 }
753 pathb[p] = 47 as u8
754 p = p + 1
755 var q: i64 = 0
756 while q < nl { pathb[p + q] = nm[q]; q = q + 1 }
757 pathb[p + nl] = 0 as u8
758 let plen: i64 = p + nl
759
760 if dty == CE_DT_DIR {
761 if qn >= qcap {
762 let ncap: i64 = qcap * 2
763 let nbuf: *u8 = sys_mmap(ncap * CE_PATHW)
764 var c: i64 = 0
765 while c < qcap * CE_PATHW { nbuf[c] = qbuf[c]; c = c + 1 }
766 sys_munmap(qbuf, qcap * CE_PATHW)
767 qbuf = nbuf
768 qcap = ncap
769 }
770 let nb2: i64 = qbuf as i64
771 let slot: *u8 = (nb2 + qn * CE_PATHW) as *u8
772 var c2: i64 = 0
773 while c2 <= plen { slot[c2] = pathb[c2]; c2 = c2 + 1 }
774 qn = qn + 1
775 } else {
776 var isnx: i64 = 0
777 if nl > 3 {
778 if nm[nl-3] == 46 { if nm[nl-2] == 110 { if nm[nl-1] == 120 { isnx = 1 } } }
779 }
780 if isnx == 1 {
781 files = files + 1
782 *lenp = 0
783 let fb: *u8 = sys_read_file(pathb, lenp)
784 let flen: i64 = *lenp
785 if flen <= 0 { readfail = readfail + 1 }
786 else {
787 ce_scan_file(fb, flen, pathb, ctr)
788 if subjmode == 1 { ce_subjects_file(fb, flen, pathb, ctr) }
789 sys_free_file(fb, flen)
790 }
791 }
792 }
793 }
794 off = off + rl
795 }
796 }
797 }
798 }
799 sys_close(dfd)
800 }
801 }
802
803 let sum: i64 = ctr[CE_C_DER] + ctr[CE_C_PICK] + ctr[CE_C_STR] + ctr[CE_C_PRO] + ctr[CE_C_UNK]
804 ce_w("\nNX-CAPCENSUS summary root=" as *u8); ce_w(root); ce_w("\n" as *u8)
805 ce_w(" dirs_walked=" as *u8); ce_wn(dirs)
806 ce_w(" nx_files=" as *u8); ce_wn(files)
807 ce_w(" read_failures=" as *u8); ce_wn(readfail); ce_w("\n" as *u8)
808 ce_w(" consts_seen=" as *u8); ce_wn(ctr[CE_C_SEEN])
809 ce_w(" capacity_population=" as *u8); ce_wn(ctr[CE_C_POP]); ce_w("\n" as *u8)
810 ce_w(" DERIVED=" as *u8); ce_wn(ctr[CE_C_DER])
811 ce_w(" PICKED=" as *u8); ce_wn(ctr[CE_C_PICK])
812 ce_w(" STRUCTURAL=" as *u8); ce_wn(ctr[CE_C_STR])
813 ce_w(" PROTECTIVE=" as *u8); ce_wn(ctr[CE_C_PRO])
814 ce_w(" UNKNOWN=" as *u8); ce_wn(ctr[CE_C_UNK]); ce_w("\n" as *u8)
815 ce_w(" partition_sum=" as *u8); ce_wn(sum)
816 ce_w(" population=" as *u8); ce_wn(ctr[CE_C_POP])
817 if sum == ctr[CE_C_POP] { ce_w(" SUMS=1\n" as *u8) } else { ce_w(" SUMS=0\n" as *u8) }
818 ce_w(" picked_autohoist=" as *u8); ce_wn(ctr[CE_C_AH])
819 ce_w(" picked_pow2=" as *u8); ce_wn(ctr[CE_C_P2]); ce_w("\n" as *u8)
820 ce_w(" worklist_shown=" as *u8); ce_wn(ctr[CE_C_SHOWN])
821 ce_w(" of_picked=" as *u8); ce_wn(ctr[CE_C_PICK])
822 if ctr[CE_C_SHOWN] < ctr[CE_C_PICK] {
823 ce_w(" worklist_truncated=1 coverage_complete=0 <== A DISPLAY BOUND, NOT A DATA BOUND:\n" as *u8)
824 ce_w(" the count above is complete; the LIST is a prefix. Pass 0 as the 3rd argument for the\n" as *u8)
825 ce_w(" WHOLE worklist, or `nx_capcensus file <path>` to ask about ONE module (answer in the\n" as *u8)
826 ce_w(" exit code: 0 CLEAN, 1 CAPPED, 3 UNREADABLE).\n" as *u8)
827 } else {
828 ce_w(" worklist_truncated=0 coverage_complete=1 <== every picked bound was listed\n" as *u8)
829 }
830 ce_w(" callsite_sys_mmap_literal_lines=" as *u8); ce_wn(ctr[CE_C_MMAPLIT]); ce_w("\n" as *u8)
831 ce_w(" nx_magic_NX_UNNAMED_placeholders=" as *u8); ce_wn(ctr[CE_C_UNNAMED])
832 ce_w(" <== apply MARKS these as carrying no meaning: the DRAINABLE subset of PICKED\n" as *u8)
833 if subjmode == 1 {
834 let unres: i64 = ctr[CE_C_PICK] - ctr[CE_C_RESOLVED]
835 ce_w(" --- SUBJECT RESOLUTION (the ordering, by measurement) ---\n" as *u8)
836 ce_w(" resolved=" as *u8); ce_wn(ctr[CE_C_RESOLVED])
837 ce_w(" unresolved=" as *u8); ce_wn(unres)
838 ce_w(" of_picked=" as *u8); ce_wn(ctr[CE_C_PICK])
839 if ctr[CE_C_RESOLVED] + unres == ctr[CE_C_PICK] { ce_w(" SUMS=1\n" as *u8) } else { ce_w(" SUMS=0\n" as *u8) }
840 var permil_cov: i64 = 0
841 if ctr[CE_C_PICK] > 0 { permil_cov = ctr[CE_C_RESOLVED] * 1000 / ctr[CE_C_PICK] }
842 ce_w(" coverage_permil=" as *u8); ce_wn(permil_cov)
843 ce_w(" <== HOW MUCH OF THE POPULATION THIS RANKING ACTUALLY COVERS. The rest abstain by\n" as *u8)
844 ce_w(" design: widening the pairing rule to raise this number would invent subjects, and a\n" as *u8)
845 ce_w(" wrong subject yields a wrong ratio yields a wrong worklist order.\n" as *u8)
846 ce_w(" LIVE-EXCEEDED=" as *u8); ce_wn(ctr[CE_C_EXCEEDED])
847 ce_w(" NEAR=" as *u8); ce_wn(ctr[CE_C_NEAR])
848 ce_w(" LATENT=" as *u8); ce_wn(ctr[CE_C_OKB])
849 ce_w(" UNMEASURABLE=" as *u8); ce_wn(ctr[CE_C_MISSING])
850 ce_w(" TAIL-ANCHORED=" as *u8); ce_wn(ctr[CE_C_TAILANCH])
851 ce_w(" FIXTURE=" as *u8); ce_wn(ctr[CE_C_FIXTURE]); ce_w("\n" as *u8)
852 let vsum: i64 = ctr[CE_C_EXCEEDED] + ctr[CE_C_NEAR] + ctr[CE_C_OKB] + ctr[CE_C_MISSING] + ctr[CE_C_TAILANCH] + ctr[CE_C_FIXTURE]
853 ce_w(" verdict_sum=" as *u8); ce_wn(vsum)
854 ce_w(" resolved=" as *u8); ce_wn(ctr[CE_C_RESOLVED])
855 if vsum == ctr[CE_C_RESOLVED] { ce_w(" SUMS=1\n" as *u8) } else { ce_w(" SUMS=0\n" as *u8) }
856 ce_w(" LIVE-EXCEEDED is the ACTIONABLE class: head-anchored reads of REAL subjects already\n" as *u8)
857 ce_w(" past their cap. TAIL-ANCHORED and FIXTURE are split out because this bucket ran at a\n" as *u8)
858 ce_w(" 667 permil false-positive rate on its first estate-wide run -- classified, not hidden.\n" as *u8)
859 ce_w(" NOTE: UNRESOLVED is not only a coverage gap -- a cap BOUNDS a subject, an INDEX does\n" as *u8)
860 ce_w(" not, so index/slot constants with cap-shaped names can NEVER resolve. PICKED is an\n" as *u8)
861 ce_w(" UPPER BOUND with a knowable error term, not a count.\n" as *u8)
862 }
863 ce_w(" corpus_complete=1 (recursive walk, getdents drained to 0, reads sized by sys_read_file)\n" as *u8)
864 ce_w(" DECLARED LIMIT: PROTECTIVE is under-detected -- only bounds NAMED for that purpose are\n" as *u8)
865 ce_w(" recognised, so protective bounds otherwise land in PICKED. PICKED is biased HIGH.\n" as *u8)
866 if ctr[CE_C_PICK] > 0 {
867 sys_exit(CE_EXIT_PICKED)
868 return CE_EXIT_PICKED
869 }
870 return 0
871}