`nx_capsweep.nx` source

↩ module page · 344 lines · 18683 B
1// nx_capsweep.nx -- CR1 of /compare/capregistry. ONE ROW PER UNIT, AND A RECONCILIATION THAT REFUSES.
2//
3//   nx_capsweep [execsurface.tsv] [tool_allowlist.conf] [cap_consent.log] [actlog.jrnl] [out.tsv]
4//
5// WHY: three censuses of this estate publish three different denominators (2048 promoted artifacts, 2418
6// organs, 1295 registry rows), each internally reconciled and each correct about its own subject, and
7// NOTHING joins them per unit -- so the estate cannot state how many distinct units it has. This organ
8// answers exactly that and nothing else.
9//
10// IT COLLECTS NOTHING. Every input is an artifact another census already wrote. That is deliberate: the
11// moment this grows a collector it becomes a fourth ruler that can disagree with the three it is joining.
12//
13// EXITS: 0 the partition SUMS and the count is published | 1 it does NOT sum, so the count is REFUSED and
14// the residual is named | 3 an input was unreadable, so the answer is UNPROVEN rather than zero -- an
15// absent spine must abstain, never acquit, because 'zero dark' from an empty expectation reads as health.
16
17import "nx_syscalls.nx"
18import "_hdl_build/nx_capsweep_lib.nx"
19
20const CSO_OUT: i64 = 2097152
21const CSO_DEFAULT_SURF: *u8 = "knowledge/status/execsurface.tsv"
22const CSO_DEFAULT_ALLOW: *u8 = "tool_allowlist.conf"
23const CSO_DEFAULT_CONSENT: *u8 = "cap_consent.log"
24const CSO_DEFAULT_ACTLOG: *u8 = "knowledge/status/actlog.jrnl"
25const CSO_DEFAULT_TSV: *u8 = "knowledge/status/capsweep.tsv"
26const CSO_DEFAULT_RESID: *u8 = "knowledge/status/capsweep_residual.txt"
27
28func cso_cat(o: *u8, at: i64, s: *u8) -> i64 {
  var i: i64 = 0
  var p: i64 = at
  while s[i] != (0 as u8) { o[p] = s[i]; p = p + 1; i = i + 1 }
  return p
33}
34
35func cso_num(o: *u8, at: i64, v: i64) -> i64 {
  var x: i64 = v
  var p: i64 = at
  if x < 0 { o[p] = 45 as u8; p = p + 1; x = 0 - x }
  if x == 0 { o[p] = 48 as u8; return p + 1 }
  let tmp: *u8 = sys_mmap(32)
  var n: i64 = 0
  while x > 0 { tmp[n] = ((x % 10) + 48) as u8; x = x / 10; n = n + 1 }
  while n > 0 { n = n - 1; o[p] = tmp[n]; p = p + 1 }
  sys_munmap(tmp, 32)
  return p
46}
47
48func cso_tab(o: *u8, at: i64) -> i64 { o[at] = 9 as u8; return at + 1 }
49
50func cso_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  sys_close(fd)
  return 1
55}
56
57// Build <name><suffix> into a caller-owned buffer. The buffer is allocated ONCE by the caller and reused,
58// because allocating inside the residual loop would be an allocation in a hot loop over 1300+ names.
59func cso_mkpath(dst: *u8, name: *u8, sfx: *u8) -> i64 {
  var p: i64 = 0
  var i: i64 = 0
  while name[i] != (0 as u8) { dst[p] = name[i]; p = p + 1; i = i + 1 }
  i = 0
  while sfx[i] != (0 as u8) { dst[p] = sfx[i]; p = p + 1; i = i + 1 }
  dst[p] = 0 as u8
  return p
67}
68func cso_nl(o: *u8, at: i64) -> i64 { o[at] = 10 as u8; return at + 1 }
69
70func main(argc: i64, argv: *i64) -> i64 {
  var spath: *u8 = CSO_DEFAULT_SURF
  var apath: *u8 = CSO_DEFAULT_ALLOW
  var cpath: *u8 = CSO_DEFAULT_CONSENT
  var lpath: *u8 = CSO_DEFAULT_ACTLOG
  var opath: *u8 = CSO_DEFAULT_TSV
  var rpath: *u8 = CSO_DEFAULT_RESID
  if argc > 6 { rpath = argv[6] as *u8 }
  if argc > 1 { spath = argv[1] as *u8 }
  if argc > 2 { apath = argv[2] as *u8 }
  if argc > 3 { cpath = argv[3] as *u8 }
  if argc > 4 { lpath = argv[4] as *u8 }
  if argc > 5 { opath = argv[5] as *u8 }
83
  let o: *u8 = sys_mmap(CSO_OUT)
  var b: i64 = 0
  let tr: *i64 = sys_mmap(16) as *i64
  tr[0] = 0
88
  // ---- the JOIN SPINE: the surface census, which is the widest population of the three ----
  let sbuf: *u8 = sys_mmap(WC_BUF)
  let sn: i64 = wc_read(spath, sbuf, WC_BUF)
  if sn <= 0 {
      b = cso_cat(o, b, "CAPSWEEP UNPROVEN -- cannot read the surface census: " as *u8)
      b = cso_cat(o, b, spath)
      b = cso_cat(o, b, "\n  Without the join spine there is no population to reconcile, and publishing a unit\n  count of zero here would be a confident answer about an estate nobody looked at.\n" as *u8)
      sys_write(2, o, b)
      return 3
  }
99
  let un: *u8 = sys_mmap(CS_MAXU * WC_NAMEMAX)
  let ul: *i64 = sys_mmap(CS_MAXU * 8) as *i64
  let us: *i64 = sys_mmap(CS_MAXU * 8) as *i64
  let units: i64 = cs_parse_surface(sbuf, sn, un, ul, us, CS_MAXU, tr)
  // BIND THE ASSERTION TO ITS DENOMINATOR. The byte-count guard above only proves the FILE was readable;
  // a spine that is readable but carries no data rows would sail past it and this organ would publish
  // units=0 and verdict=GREEN while 100 percent of the registry sat in the residual -- a gate that passes
  // on the empty set is not a gate. The organ's own exit-3 contract already covers this: an absent spine
  // must ABSTAIN, never acquit.
  if units <= 0 {
      b = cso_cat(o, b, "CAPSWEEP UNPROVEN -- the spine file was readable but parsed to ZERO units: " as *u8)
      b = cso_cat(o, b, spath)
      b = cso_cat(o, b, "\n  Publishing a unit count of zero here would be a confident answer about an estate nobody\n  enumerated, and every registered tool would fall into the residual as if it were dark.\n" as *u8)
      sys_write(2, o, b)
      return 3
  }
116
  // TWO INSTRUMENTS, ONE FACT: what this organ parsed versus what the census itself published.
  let footer: i64 = cs_footer_num(sbuf, sn, "organs=" as *u8)
119
  // ---- the three lifecycle sets, parsed by the estate's ONE parser for each ----
  let abuf: *u8 = sys_mmap(WC_BUF)
  let an: i64 = wc_read(apath, abuf, WC_BUF)
  if an <= 0 {
      b = cso_cat(o, b, "CAPSWEEP UNPROVEN -- cannot read the tool allowlist: " as *u8)
      b = cso_cat(o, b, apath)
      b = cso_nl(o, b)
      sys_write(2, o, b)
      return 3
  }
  let rn: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let rl: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  let regc: i64 = wc_parse_registered(abuf, an, rn, rl, tr)
133
  let cbuf: *u8 = sys_mmap(WC_BUF)
  let cn: i64 = wc_read_tail(cpath, cbuf, WC_BUF)
  let an2: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let al2: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  var authc: i64 = 0
  if cn > 0 { authc = wc_parse_authorised(cbuf, cn, an2, al2, tr) }
140
  let lbuf: *u8 = sys_mmap(WC_BUF)
  let ln: i64 = wc_read_tail(lpath, lbuf, WC_BUF)
  let in2: *u8 = sys_mmap(WC_MAXT * WC_NAMEMAX)
  let il2: *i64 = sys_mmap(WC_MAXT * 8) as *i64
  var invc: i64 = 0
  if ln > 0 { invc = wc_parse_invoked(lbuf, ln, in2, il2, tr) }
147
  // ---- the join: one row per unit ----
  var on_surface: i64 = 0
  var reg_joined: i64 = 0
  var i: i64 = 0
  while i < units {
      let p: *u8 = ((un as i64) + i * WC_NAMEMAX) as *u8
      let l: i64 = ul[i]
      let r: i64 = wc_has(rn, rl, regc, p, l)
      let a: i64 = wc_has(an2, al2, authc, p, l)
      let v: i64 = wc_has(in2, il2, invc, p, l)
      var hs: i64 = 0
      if us[i] != CS_S_NONE { hs = 1 }
      if hs == 1 { on_surface = on_surface + 1 }
      if r == 1 { reg_joined = reg_joined + 1 }
      b = cso_cat(o, b, p)
      b = cso_tab(o, b); b = cso_num(o, b, cs_stage_bits(hs, r, a, v))
      b = cso_tab(o, b); b = cso_num(o, b, us[i])
      b = cso_tab(o, b); b = cso_num(o, b, r)
      b = cso_tab(o, b); b = cso_num(o, b, a)
      b = cso_tab(o, b); b = cso_num(o, b, v)
      b = cso_nl(o, b)
      i = i + 1
  }
171
  // REGISTERED NAMES THE SPINE NEVER SAW. Named as a residual, never dropped: a registered tool with no
  // surface row is precisely the class three separate censuses each report differently.
  let reg_residual: i64 = regc - reg_joined
  // ⛔THE PARTITION CHECK THAT USED TO LIVE HERE WAS A TAUTOLOGY AND IT WAS THIS ORGAN'S PUBLISHED
  // HEADLINE. It read cs_partition_ok(regc, reg_joined, reg_residual) with reg_residual DERIVED one line
  // above as regc - reg_joined, so it expanded to reg_joined + (regc - reg_joined) == regc -- that is
  // regc == regc. It could not fail for any input, its REFUSE branch was unreachable dead code, and the
  // organ printed PARTITION RECONCILES as though that were evidence. Found 2026-08-28 by an adversarial
  // audit, confirmed by an independent refuter reading the source.
  // ★★★★★A PARTITION WHOSE THIRD TERM IS DERIVED BY SUBTRACTION FROM THE FIRST TWO IS AN IDENTITY, NOT A
  // MEASUREMENT -- THE RESIDUAL MUST BE COUNTED INDEPENDENTLY OR THE CHECK IS ARITHMETIC AGREEING WITH
  // ITSELF. The real check now lives AFTER the residual loop, over the three reason buckets, because those
  // are tallied one-by-one by a classifier and can therefore genuinely disagree with their total.
185
  // NAME THE RESIDUAL. A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, and this is the highest-value class
  // this organ produces: registered tools the surface spine never saw. Added 2026-08-28 after a sibling
  // seat asked 'can you name them?' and the honest answer was no -- the organ had committed the very defect
  // the board it feeds exists to expose.
  // AND IT IS A SECOND METHOD, NOT A RESTATEMENT: reg_residual above is ARITHMETIC (registered minus
  // joined) while shown below is ENUMERATION (names actually absent from the spine). Two independent
  // computations of one number over the same data, so a disagreement is a real internal defect and is
  // reported as one rather than silently reconciled.
  let rbuf: *u8 = sys_mmap(CSO_OUT)
  let pbuf: *u8 = sys_mmap(WC_NAMEMAX + 32)
  var rb: i64 = 0
  var shown: i64 = 0
  var n_stale: i64 = 0
  var n_scaf: i64 = 0
  var n_noart: i64 = 0
  var j: i64 = 0
  while j < regc {
      let rp: *u8 = ((rn as i64) + j * WC_NAMEMAX) as *u8
      if wc_has(un, ul, units, rp, rl[j]) == 0 {
          cso_mkpath(pbuf, rp, ".elf" as *u8)
          let has_elf: i64 = cso_exists(pbuf)
          cso_mkpath(pbuf, rp, ".elf.new" as *u8)
          let has_new: i64 = cso_exists(pbuf)
          let reason: i64 = cs_residual_reason(has_elf, has_new)
          rb = cso_cat(rbuf, rb, rp)
          rb = cso_tab(rbuf, rb)
          if reason == CS_R_STALE_SPINE {
              n_stale = n_stale + 1
              rb = cso_cat(rbuf, rb, "STALE-SPINE" as *u8)
          }
          if reason == CS_R_SCAFFOLD {
              n_scaf = n_scaf + 1
              rb = cso_cat(rbuf, rb, "SCAFFOLD" as *u8)
          }
          if reason == CS_R_NO_ARTIFACT {
              n_noart = n_noart + 1
              rb = cso_cat(rbuf, rb, "NO-ARTIFACT-BY-THAT-NAME" as *u8)
          }
          rb = cso_nl(rbuf, rb)
          shown = shown + 1
      }
      j = j + 1
  }
  // THE REAL PARTITION, over three buckets each tallied INDEPENDENTLY by cs_residual_reason as the loop
  // classified them. Unlike the identity it replaces, these can genuinely disagree with their own total --
  // a classifier that returned a fourth code, or a bucket increment missed on one branch, makes this FALSE.
  let ok: i64 = cs_partition_ok(shown, n_stale + n_scaf, n_noart)
233
  let rfd: i64 = sys_openat_wr(rpath, MODE_0644)
  var rwrote: i64 = 0
  if rfd >= 0 {
      rwrote = sys_write(rfd, rbuf, rb)
      sys_close(rfd)
  }
240
  // ---- durable artifact, truncate-write ----
  let wfd: i64 = sys_openat_wr(opath, MODE_0644)
  var wrote: i64 = 0
  if wfd >= 0 {
      wrote = sys_write(wfd, o, b)
      sys_close(wfd)
  }
248
  // ---- the report ----
  var r2: i64 = 0
  let rep: *u8 = sys_mmap(65536)
  r2 = cso_cat(rep, r2, "=== NX-CAPSWEEP -- one row per unit, joined from censuses that already ran ===\n  units=" as *u8)
  r2 = cso_num(rep, r2, units)
  r2 = cso_cat(rep, r2, "  footer_organs=" as *u8); r2 = cso_num(rep, r2, footer)
  r2 = cso_cat(rep, r2, "  on_surface=" as *u8); r2 = cso_num(rep, r2, on_surface)
  r2 = cso_cat(rep, r2, "\n  registered=" as *u8); r2 = cso_num(rep, r2, regc)
  r2 = cso_cat(rep, r2, "  reg_joined=" as *u8); r2 = cso_num(rep, r2, reg_joined)
  r2 = cso_cat(rep, r2, "  reg_residual=" as *u8); r2 = cso_num(rep, r2, reg_residual)
  r2 = cso_cat(rep, r2, "  named=" as *u8); r2 = cso_num(rep, r2, shown)
  r2 = cso_cat(rep, r2, "  worklist=" as *u8); r2 = cso_cat(rep, r2, rpath)
  r2 = cso_cat(rep, r2, " residual_bytes=" as *u8); r2 = cso_num(rep, r2, rwrote)
  r2 = cso_cat(rep, r2, "\n  residual by REASON: stale_spine=" as *u8); r2 = cso_num(rep, r2, n_stale)
  r2 = cso_cat(rep, r2, " scaffold=" as *u8); r2 = cso_num(rep, r2, n_scaf)
  r2 = cso_cat(rep, r2, " no_artifact_by_that_name=" as *u8); r2 = cso_num(rep, r2, n_noart)
  r2 = cso_cat(rep, r2, " sum=" as *u8); r2 = cso_num(rep, r2, n_stale + n_scaf + n_noart)
  // SPINE FRESHNESS. A join against a SNAPSHOT manufactures residual members at the rate the estate
  // promotes, and the organ cannot tell them from real ones -- nx_capsweep appeared in its OWN residual
  // exactly this way. The age is PRINTED rather than thresholded: there is no defensible constant for how
  // stale is too stale, and inventing one would be a magic number deciding a verdict.
  let spine_asof: i64 = cs_footer_num(sbuf, sn, "asof=" as *u8)
  let now_s: i64 = sys_now_realtime_sec()
  r2 = cso_cat(rep, r2, "\n  spine_asof=" as *u8); r2 = cso_num(rep, r2, spine_asof)
  if spine_asof > 0 {
      r2 = cso_cat(rep, r2, " spine_age_s=" as *u8); r2 = cso_num(rep, r2, now_s - spine_asof)
      if n_stale > 0 {
          r2 = cso_cat(rep, r2, "\n  ! SPINE IS BEHIND THE ESTATE: " as *u8)
          r2 = cso_num(rep, r2, n_stale)
          r2 = cso_cat(rep, r2, " residual rows have a PROMOTED artifact of that name, so they are an artifact of the snapshot's age and NOT dark. Re-run nx_execsurface to clear them; adjudicating them as dark would create phantom work." as *u8)
      }
  }
  if spine_asof <= 0 { r2 = cso_cat(rep, r2, "  ! SPINE AGE UNKNOWN: the census published no asof, so staleness is UNMEASURED rather than zero" as *u8) }
  r2 = cso_cat(rep, r2, "\n  authorised=" as *u8); r2 = cso_num(rep, r2, authc)
  r2 = cso_cat(rep, r2, "  invoked=" as *u8); r2 = cso_num(rep, r2, invc)
  r2 = cso_cat(rep, r2, "  table_truncated=" as *u8); r2 = cso_num(rep, r2, tr[0])
  r2 = cso_cat(rep, r2, "\n  wrote=" as *u8); r2 = cso_num(rep, r2, wrote)
  r2 = cso_cat(rep, r2, " of=" as *u8); r2 = cso_cat(rep, r2, opath)
  if cn <= 0 { r2 = cso_cat(rep, r2, "\n  ! AUTHORISED ABSENT: cap_consent.log unreadable -- that column is UNMEASURED, not zero" as *u8) }
  if ln <= 0 { r2 = cso_cat(rep, r2, "\n  ! INVOKED ABSENT: actlog unreadable -- that column is UNMEASURED, not zero" as *u8) }
  if tr[0] > 0 { r2 = cso_cat(rep, r2, "\n  ! TABLE TRUNCATED: a unit table filled, so units is a FLOOR and not a total" as *u8) }
  if footer >= 0 {
      if footer != units {
          r2 = cso_cat(rep, r2, "\n  ! SPINE MISMATCH: this organ parsed a different number of rows than the census published.\n    That is a parser defect in ONE of the two and the join cannot be trusted until it is found." as *u8)
      }
  }
  if footer < 0 { r2 = cso_cat(rep, r2, "\n  ! FOOTER ABSENT: the census published no organs= total, so the cross-check is UNAVAILABLE" as *u8) }
296
  var rc: i64 = 0
  if ok == 1 {
      if footer >= 0 {
          if footer != units { rc = 1 }
      }
  } else { rc = 1 }
303
  // THE TWO METHODS MUST AGREE. reg_residual is ARITHMETIC (registered minus joined); shown is ENUMERATION
  // (names actually absent from the spine). A disagreement is a real internal defect, so it REFUSES rather
  // than quietly preferring one of the two.
  if shown != reg_residual {
      rc = 1
      r2 = cso_cat(rep, r2, "\n  ! RESIDUAL DISAGREES WITH ITSELF: the arithmetic count and the enumerated worklist differ, and they are two independent computations over the same data, so one of them is wrong and the worklist must not be acted on until it is found" as *u8)
  }
311
  // ABSTAIN, NEVER ACQUIT -- AND THIS ORGAN WAS ACQUITTING. An unreadable consent ledger or actlog leaves
  // its parsed table EMPTY, and wc_has over an empty table returns 0 for every unit, so the durable
  // artifact carried a confident 0 in those columns and the process still exited GREEN. Zero and
  // could-not-look were the same observation, which is the one thing a measuring organ may never do.
  // RED KEEPS PRECEDENCE: a broken partition is a stronger statement than an unread input, so UNPROVEN
  // only upgrades a would-be GREEN and never masks a refusal.
  if rc == 0 { if cn <= 0 { rc = 3 } }
  if rc == 0 { if ln <= 0 { rc = 3 } }
320
  // THE INVOKED COLUMN IS A FLOOR WHENEVER ITS WINDOW FILLED. wc_read_tail reads the LAST WC_BUF bytes of
  // an append-only journal; when the journal is larger than the window, everything older is dropped and
  // the organ cannot see it. Announcing this is not optional -- an unannounced window turns a floor into a
  // published value, which is the same defect class as a fixed-cap reader and is exactly what this board
  // exists to expose.
  if ln >= WC_BUF - 1 {
      r2 = cso_cat(rep, r2, "\n  ! INVOKED IS A FLOOR, NOT A VALUE: the actlog tail window FILLED, so an unknown quantity of older invocation evidence was dropped and every unit it would have credited reads as never-invoked. Quote invoked as a lower bound." as *u8)
  }
329
  if rc == 0 {
      // THE NOTE DOES NOT RECITE THE TEETH. It used to say "registered = joined + residual, and the parsed
      // spine matches the census's own total" -- a recital that had ALREADY DRIFTED: the first clause named
      // the tautology deleted above, and the second named a check that is parse integrity over ONE artifact
      // rather than the corroboration the wording implied. Every conjunct states itself on its own line, so
      // adding one can never make this stale.
      r2 = cso_cat(rep, r2, "\n  UNITS ON THE SURFACE SPINE: " as *u8)
      r2 = cso_num(rep, r2, units)
      r2 = cso_cat(rep, r2, " -- A FLOOR, NOT A POPULATION. The spine walks the serving root and _offc and does NOT walk buildroot/_offc, which holds further artifacts, so the true unit count is bounded BELOW by this number and no instrument in this estate has yet been shown to enumerate it.\nverdict=GREEN\n" as *u8)
  } else {
      r2 = cso_cat(rep, r2, "\n  COUNT REFUSED: the parts do not sum, so no unit count is published. A partition that does\n  not reconcile is a leak, and printing its total would launder the leak into a fact.\nverdict=RED\n" as *u8)
  }
  sys_write(1, rep, r2)
  return rc
344}
nx_capsweep.nx source

`nx_capsweep.nx` source
