code wiki / _hdl_build / nx_clock_reregister_gate.nx
nx_clock_reregister_gate.nx source
↩ module page · 546 lines · 34366 B
1// nx_clock_reregister_gate.nx -- BITE PROOF for the clk_register update fix.
2//
3// The existing clock gates were all written while re-registration was a no-op, so every one of them
4// passes just as happily with the defect present. A green suite that cannot fail on the thing you
5// changed has not tested your change.
6// ★★★★★ A GREEN THAT NEVER HAD A CORRESPONDING RED IS UNVERIFIED.
7//
8// T1 is the NEGATIVE CONTROL: an IDENTICAL re-declaration must still be a no-op (rc 0) and must not
9// disturb the row, because capabilities declare their job on every boot.
10// T2/T3 are the bite: a re-registration with a DIFFERENT organ, and one with a DIFFERENT interval,
11// must return 2 AND actually change the stored row. Against the pre-fix organ both return 0 and the
12// row is unchanged, so T2 and T3 fail -- which is the RED this gate exists to produce.
13// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
14import "nx_clock_sched.nx"
15import "nx_syscalls.nx"
16import "nx_gate_verdict.nx"
17import "nx_gatekit_lib.nx"
18
19// ==== COMMAND-SLOT TRUNCATION TEETH -- fixture constants (2026-08-22) ============================
20const CRG_FIX_DIR: *u8 = "/tmp/nx_clock_reregister_gate"
21const CRG_DPFX: *u8 = "/tmp/nx_clock_reregister_gate/clockjobs-"
22const CRG_SPFX: *u8 = "/tmp/nx_clock_reregister_gate/clocksched-"
23const CRG_PROD_DPFX: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/store/clockjobs-"
24const CRG_WRITER: *u8 = "/volume1/homes/elderwesto/nishihost/nx_clockjob.elf"
25const CRG_ARGECHO: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf"
26// FIXTURE-REACHED-CONDITION const: the OLD slot width this fix retires (nx_clock_sched CLK_NAMEW was a
27// hand-mirrored 128 until 2026-08-22). The 300-byte fixture command MUST exceed it, or a green tooth
28// below would prove nothing about the truncation this gate exists to catch -- a fixture the defect
29// cannot fail is not a test. It is a PROOF constant only; nothing sizes a buffer from it.
30const CLK_OLD_NAMEW_FOR_PROOF: i64 = 128
31const CRG_FIX_CMD_LEN: i64 = 300
32const CRG_FIX_TOKENS: i64 = 18
33// 18 tokens, 300 bytes exactly; token 1 is the argecho WITNESS organ (absolute, exists, echoes argv),
34// token 18 is a sentinel asserted BYTE-EXACT so a silent prefix can never pass.
35const CRG_CMD: *u8 = "/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf beat knowledge/gateroster.conf knowledge/status/gr.jrnl 180000 --list DEPLOYED-DARK ks/g.dark --list INVOKED-MISSING ks/g.gap --list DARK-FAILING ks/g.failing --rows ks/g.rows t17-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww t18-LAST-TOKEN-INTACT-END"
36const CRG_LAST: *u8 = "t18-LAST-TOKEN-INTACT-END"
37// overlong-organ padding for the writer neg-control: organ = argecho path (55) + space + CRG_OVERLEN
38// x's => row length 11+1+2+1+55+1+1050 = 1121 >= CJ_ROWCAP-2 = 1022, so ONLY the rowcap refusal can
39// admit-or-refuse it (the first token still resolves, so the resolve guard cannot mask the one under test).
40const CRG_OVERLEN: i64 = 1050
41const CRG_OUTCAP: i64 = 65536
42const CRG_PATHCAP: i64 = 256
43
44// ==== ACTLOG JOB-NAME TEETH -- fixture constants (2026-09-18) ===================================
45// The expected strings are written OUT IN FULL, never composed from the subject's own literals: they are
46// the CONTRACT the close ruler (nx_rungclose) reads, so a subject that drifts from them must go RED here.
47const CRG_AL_ORGAN: *u8 = "/volume1/homes/elderwesto/nishihost/nx_plan_run.elf"
48const CRG_AL_JOB: *u8 = "twincheck"
49const CRG_AL_TOKEN: *u8 = "job=twincheck"
50const CRG_AL_LAST_OK: *u8 = "clockjob lane=clock exit=0 job=twincheck"
51const CRG_AL_LAST_KILL: *u8 = "clockjob lane=clock exit=124 job=twincheck"
52const CRG_AL_LAST_BARE: *u8 = "clockjob lane=clock exit=0"
53const CRG_AL_FAIL_WORD: *u8 = "fail"
54const CRG_AL_KEY: *u8 = "job="
55const CRG_AL_SPACE_NAME: *u8 = "twin check"
56const CRG_AL_KILL_CODE: i64 = 124 // the code clk_dispatch_one logs when its deadline kills a job (the shell-timeout convention)
57const CRG_AL_FIELDS: i64 = 6 // TAB fields in one ledger row; the job token rides INSIDE the last one
58const CRG_AL_ORGAN_COL: i64 = 2 // 0-based index of the ORGAN column
59const CRG_AL_RESULT_COL: i64 = 4 // 0-based index of ok|fail
60const CRG_AL_LAST_COL: i64 = CRG_AL_FIELDS - 1
61const CRG_AL_E2E_JOB: *u8 = "crg-jobwitness"
62const CRG_AL_E2E_TOKEN: *u8 = "job=crg-jobwitness"
63const CRG_AL_E2E_LAST: *u8 = "clockjob lane=clock exit=127 job=crg-jobwitness"
64const CRG_AL_E2E_ORGAN_NAME: *u8 = "absent-organ.elf" // joined under CRG_FIX_DIR at run time, never created
65const CRG_AL_LEDGER_REL: *u8 = "knowledge/status/actlog.jrnl" // the dispatcher's RELATIVE ledger path, joined under CRG_FIX_DIR
66const CRG_AL_E2E_IV: i64 = 60 // any interval: T29-T31 dispatch the job directly by index, never through the EDF clock
67
68
69func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
70func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
71
72func streq(a: *u8, b: *u8) -> i64 {
73 var i: i64 = 0
74 while i < CLK_NAMEW {
75 let x: i64 = a[i] as i64
76 let y: i64 = b[i] as i64
77 if x != y { return 0 }
78 if x == 0 { return 1 }
79 i = i + 1
80 }
81 return 1
82}
83
84// the k-th TAB field (0-based) of ONE ledger row, copied NUL-terminated into `out` (the row's LF belongs
85// to no field). Returns the field length, or -1 when the row has fewer than k+1 fields.
86func crg_field(row: *u8, n: i64, k: i64, out: *u8) -> i64 {
87 var f: i64 = 0
88 var o: i64 = 0
89 var i: i64 = 0
90 var done: i64 = 0
91 while done == 0 {
92 if i >= n { done = 1 }
93 else {
94 if row[i] == (10 as u8) { done = 1 }
95 else {
96 if row[i] == (9 as u8) { f = f + 1 } else { if f == k { out[o] = row[i]; o = o + 1 } }
97 i = i + 1
98 }
99 }
100 }
101 out[o] = 0 as u8
102 if f < k { return 0 - 1 }
103 return o
104}
105
106// how many TAB fields ONE ledger row carries (TABs before its LF, plus one)
107func crg_nfields(row: *u8, n: i64) -> i64 {
108 var f: i64 = 1
109 var i: i64 = 0
110 var done: i64 = 0
111 while done == 0 {
112 if i >= n { done = 1 }
113 else {
114 if row[i] == (10 as u8) { done = 1 }
115 else { if row[i] == (9 as u8) { f = f + 1 } i = i + 1 }
116 }
117 }
118 return f
119}
120
121// the LAST token of ONE ledger row: the bytes after its final SPACE or TAB, up to the LF, copied
122// NUL-terminated into `out`. This is the token-bounded read the close ruler performs, so "job=<name> is
123// the last token" is asserted the way it is CONSUMED -- never by a substring search that a stray `job=`
124// anywhere else in the row could satisfy.
125func crg_last_token(row: *u8, n: i64, out: *u8) -> i64 {
126 var e: i64 = n
127 if e > 0 { if row[e - 1] == (10 as u8) { e = e - 1 } }
128 var s: i64 = e
129 var go: i64 = 1
130 while go == 1 {
131 if s <= 0 { go = 0 }
132 else {
133 if row[s - 1] == (32 as u8) { go = 0 }
134 else { if row[s - 1] == (9 as u8) { go = 0 } else { s = s - 1 } }
135 }
136 }
137 var o: i64 = 0
138 while s + o < e { out[o] = row[s + o]; o = o + 1 }
139 out[o] = 0 as u8
140 return o
141}
142
143// LF-terminated rows in a buffer
144func crg_rows(b: *u8, n: i64) -> i64 {
145 var r: i64 = 0
146 var i: i64 = 0
147 while i < n { if b[i] == (10 as u8) { r = r + 1 } i = i + 1 }
148 return r
149}
150
151func main() -> i64 {
152 var pass: i64 = 0
153 var tot: i64 = 0
154 w("=== nx_clock_reregister_gate -- corrections must LAND ===\n" as *u8)
155
156 let names: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
157 let orgs: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
158 let iv: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
159 let nd: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
160 let np: *i64 = sys_mmap(8) as *i64
161 np[0] = 0
162
163 let r0: i64 = clk_register(names, orgs, iv, nd, np, "beat" as *u8, "old_shell.sh" as *u8, 600)
164 tot = tot + 1
165 if r0 == 1 { if np[0] == 1 { pass = pass + 1; w(" PASS T0 first registration added (rc=1, jobs=1)\n" as *u8) } else { w(" FAIL T0 jobs!=1\n" as *u8) } } else { w(" FAIL T0 rc=" as *u8); wn(r0); w("\n" as *u8) }
166
167 // NEGATIVE CONTROL -- identical declaration stays a no-op and must not add a row
168 let r1: i64 = clk_register(names, orgs, iv, nd, np, "beat" as *u8, "old_shell.sh" as *u8, 600)
169 tot = tot + 1
170 if r1 == 0 { if np[0] == 1 { pass = pass + 1; w(" PASS T1 neg-control: identical re-declaration is a no-op (rc=0, still 1 job)\n" as *u8) } else { w(" FAIL T1 duplicated a row\n" as *u8) } } else { w(" FAIL T1 identical redeclare returned " as *u8); wn(r1); w("\n" as *u8) }
171
172 // THE BITE -- a different organ must land
173 let r2: i64 = clk_register(names, orgs, iv, nd, np, "beat" as *u8, "new_organ.elf" as *u8, 600)
174 tot = tot + 1
175 if r2 == 2 { pass = pass + 1; w(" PASS T2 changed organ reported as UPDATED (rc=2)\n" as *u8) } else { w(" FAIL T2 changed organ returned " as *u8); wn(r2); w(" (pre-fix organ returns 0 here)\n" as *u8) }
176
177 tot = tot + 1
178 if streq(clk_slot(orgs, 0), "new_organ.elf" as *u8) == 1 { if np[0] == 1 { pass = pass + 1; w(" PASS T3 the STORED organ actually changed, without adding a row\n" as *u8) } else { w(" FAIL T3 row count changed\n" as *u8) } } else { w(" FAIL T3 stored organ still the old one -- the correction was discarded\n" as *u8) }
179
180 // a different interval must land too
181 let r3: i64 = clk_register(names, orgs, iv, nd, np, "beat" as *u8, "new_organ.elf" as *u8, 21600)
182 tot = tot + 1
183 if r3 == 2 { if iv[0] == 21600 { pass = pass + 1; w(" PASS T4 changed interval landed (rc=2, interval=21600)\n" as *u8) } else { w(" FAIL T4 interval still " as *u8); wn(iv[0]); w("\n" as *u8) } } else { w(" FAIL T4 changed interval returned " as *u8); wn(r3); w("\n" as *u8) }
184
185 // and a genuinely new name must still be ADDED, not folded into the existing row
186 let r4: i64 = clk_register(names, orgs, iv, nd, np, "other" as *u8, "other.elf" as *u8, 60)
187 tot = tot + 1
188 if r4 == 1 { if np[0] == 2 { pass = pass + 1; w(" PASS T5 a new name is still ADDED (rc=1, jobs=2)\n" as *u8) } else { w(" FAIL T5 jobs=" as *u8); wn(np[0]); w("\n" as *u8) } } else { w(" FAIL T5 new name returned " as *u8); wn(r4); w("\n" as *u8) }
189
190
191 // ==== COMMAND-SLOT TRUNCATION TEETH (2026-08-22) =============================================
192 // Everything below runs inside /tmp/nx_clock_reregister_gate/ so every cwd-relative side-write of
193 // the code under test (logs/<job>.log, knowledge/status/actlog.jrnl) lands in the FIXTURE, never
194 // in production (the nx_gate_fixture_ratchet law). cwd is restored before gv_verdict so
195 // gv_journal still reaches the real knowledge/status/harness.jrnl.
196 let ctr: *i64 = gv_ctr()
197 let cwd0: *u8 = sys_mmap(CRG_PATHCAP)
198 sys_getcwd(cwd0, CRG_PATHCAP)
199 gk_mkdir(CRG_FIX_DIR)
200 sys_chdir(CRG_FIX_DIR)
201 gk_mkdir("logs" as *u8)
202 gk_mkdir("knowledge" as *u8)
203 gk_mkdir("knowledge/store" as *u8)
204 gk_mkdir("knowledge/status" as *u8)
205 // FIXTURE-ISOLATION SNAPSHOT (2026-08-22): production desired-plane LENGTH before any fork. The gate's
206 // forks all run with cwd = the fixture, so a well-behaved run leaves production byte-length unchanged.
207 // A DELTA tests THIS run; it is immune to the append-only tombstone persistence that permanently
208 // poisons a marker-name-absence check after one stray put (the exact false-RED this replaces).
209 let prodlp0: *i64 = sys_mmap(16) as *i64
210 prodlp0[0] = 0
211 let prodbuf0: *u8 = sts_load_fit(CRG_PROD_DPFX, prodlp0)
212 var prodlen_before: i64 = 0 - 1
213 if (prodbuf0 as i64) != 0 { prodlen_before = prodlp0[0] }
214
215 // T6 fixture-reached-condition: the fixture command is really 300 bytes, really 18 tokens, and
216 // really LONGER than the OLD 128-byte slot -- asserted BEFORE any outcome tooth, so a RED below is
217 // attributable to the code, never to a fixture that shrank.
218 let fixcmd: *u8 = CRG_CMD
219 let cmdlen: i64 = gk_len(fixcmd)
220 var t6ok: i64 = 0
221 if cmdlen == CRG_FIX_CMD_LEN { if cmdlen > CLK_OLD_NAMEW_FOR_PROOF { t6ok = 1 } }
222 var spc: i64 = 0
223 var si: i64 = 0
224 while fixcmd[si] != (0 as u8) { if fixcmd[si] == (32 as u8) { spc = spc + 1 } si = si + 1 }
225 if spc + 1 != CRG_FIX_TOKENS { t6ok = 0 }
226 gv_check("T6 fixture-reached-condition: cmd = 300 bytes, 18 tokens, > CLK_OLD_NAMEW_FOR_PROOF=128 (the old cap WOULD have cut it; a fixture the defect cannot fail is not a test)" as *u8, t6ok, ctr)
227
228 // T7 fixture-reached-condition: a writer-shaped row (name TAB interval TAB organ, the exact
229 // grammar and the exact primitive nx_clockjob `put` commits with) lands in a FIXTURE desired plane.
230 let e0: *u8 = sys_mmap(8)
231 e0[0] = 0 as u8
232 sts_seed(CRG_DPFX, e0, 0)
233 sts_seed(CRG_SPFX, e0, 0)
234 let row: *u8 = sys_mmap(CLK_ROWW)
235 var ro: i64 = 0
236 ro = clk_msgcat(row, ro, "wide300" as *u8)
237 row[ro] = 9 as u8
238 ro = ro + 1
239 ro = clk_msgcat(row, ro, "3600" as *u8)
240 row[ro] = 9 as u8
241 ro = ro + 1
242 ro = clk_msgcat(row, ro, fixcmd)
243 let arc: i64 = sts_append_fast_locked(CRG_DPFX, row, ro)
244 var t7ok: i64 = 0
245 if arc >= 1 { t7ok = 1 }
246 gv_check("T7 fixture-reached-condition: the 300-byte row COMMITTED to the fixture desired plane (append rc >= 1)" as *u8, t7ok, ctr)
247
248 // T8..T11: put -> merge -> persist -> reload -> the dispatcher's own split.
249 let namesW: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
250 let orgsW: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
251 let ivW: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
252 let ndW: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
253 let npW: *i64 = sys_mmap(8) as *i64
254 npW[0] = 0
255 let mrc: i64 = clk_merge_store(CRG_DPFX, namesW, orgsW, ivW, ndW, npW, 1000000000)
256 clk_save_plane(CRG_SPFX, namesW, orgsW, ivW, ndW, npW[0])
257 let namesR: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
258 let orgsR: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
259 let ivR: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
260 let ndR: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
261 let npR: *i64 = sys_mmap(8) as *i64
262 clk_load_plane(CRG_SPFX, namesR, orgsR, ivR, ndR, npR)
263 let ix: i64 = clk_find(namesR, npR[0], "wide300" as *u8)
264 var t8ok: i64 = 0
265 if mrc >= 1 { if ix >= 0 { t8ok = 1 } }
266 gv_check("T8 merge+persist+reload found the job (clk_merge_store -> clk_save_plane -> clk_load_plane)" as *u8, t8ok, ctr)
267 var t9ok: i64 = 0
268 if ix >= 0 { if clk_streq(clk_slot(orgsR, ix), fixcmd) == 1 { t9ok = 1 } }
269 gv_check("T9 BITE organ slot survives put->merge->persist->reload BYTE-EXACT at 300 bytes (under CLK_NAMEW=128 only a 127-byte prefix survives -> RED)" as *u8, t9ok, ctr)
270 let sbuf: *u8 = sys_mmap(CLK_NAMEW + 8)
271 let sargv: *i64 = sys_mmap(8*(CLK_ARGV_MAX+1)) as *i64
272 var acg: i64 = 0
273 if ix >= 0 { acg = clk_split_argv(clk_slot(orgsR, ix), sbuf, sargv, "wide300" as *u8) }
274 var t10ok: i64 = 0
275 if acg == CRG_FIX_TOKENS { t10ok = 1 }
276 gv_check("T10 BITE clk_split_argv (the dispatcher's split) yields token count == 18 (a silent prefix yields fewer)" as *u8, t10ok, ctr)
277 var t11ok: i64 = 0
278 if acg == CRG_FIX_TOKENS { if streq(sargv[17] as *u8, CRG_LAST) == 1 { t11ok = 1 } }
279 gv_check("T11 BITE the LAST argv token is byte-exact (asserting the TAIL bytes, so a prefix can never pass on count alone)" as *u8, t11ok, ctr)
280
281 // T12 END-TO-END: the real fork path. clk_dispatch_one chmods+execs the fixture command (token 1
282 // is the argecho witness organ, an idempotent chmod 0755 of an already-0755 production one-shot);
283 // with cwd = the fixture dir its stdout is captured to ./logs/wide300.log by the dispatcher's own
284 // per-job log capture, and the 18th token must arrive in the child.
285 if gv_need("argecho witness organ present at /volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf" as *u8, gk_exists(CRG_ARGECHO), ctr) == 1 {
286 let drc: i64 = clk_dispatch_one(orgsR, namesR, ix)
287 var t12ok: i64 = 0
288 if drc == 1 { if gk_contains("logs/wide300.log" as *u8, CRG_LAST) == 1 { t12ok = 1 } }
289 gv_check("T12 END-TO-END fork+exec: the child RECEIVED the 18th token (logs/wide300.log carries it; dispatch rc=1)" as *u8, t12ok, ctr)
290 }
291
292 // T13 neg-control at the WRITER + its positive control, gv_bite shaped: the overlong put must be
293 // REFUSED BY TEXT (never truncated-and-accepted), the short put must be ACCEPTED. Both forks run
294 // with cwd = the fixture dir, so even a mutant that drops the refusal writes only to the fixture's
295 // cwd-relative knowledge/store/clockjobs- -- production is unreachable by construction.
296 if gv_need("writer elf present at /volume1/homes/elderwesto/nishihost/nx_clockjob.elf" as *u8, gk_exists(CRG_WRITER), ctr) == 1 {
297 let bigorg: *u8 = sys_mmap(CLK_CMD_CAP*2)
298 var bo: i64 = clk_msgcat(bigorg, 0, CRG_ARGECHO)
299 bigorg[bo] = 32 as u8
300 bo = bo + 1
301 var fi: i64 = 0
302 while fi < CRG_OVERLEN { bigorg[bo] = 120 as u8; bo = bo + 1; fi = fi + 1 }
303 bigorg[bo] = 0 as u8
304 let outb: *u8 = sys_mmap(CRG_OUTCAP)
305 let outl: *i64 = sys_mmap(8) as *i64
306 let wrc: i64 = gk_run_capture(CRG_WRITER, "put" as *u8, "crg-negover" as *u8, "60" as *u8, bigorg, outb, CRG_OUTCAP - 1, outl)
307 var bad: i64 = 0
308 if wrc == 1 { if gk_out_has(outb, outl[0], "REFUSED row exceeds CJ_ROWCAP" as *u8) == 1 { bad = 1 } }
309 let outb2: *u8 = sys_mmap(CRG_OUTCAP)
310 let outl2: *i64 = sys_mmap(8) as *i64
311 let wrc2: i64 = gk_run_capture(CRG_WRITER, "put" as *u8, "crg-negok" as *u8, "60" as *u8, CRG_ARGECHO, outb2, CRG_OUTCAP - 1, outl2)
312 var goodfired: i64 = 0
313 if gk_out_has(outb2, outl2[0], "REFUSED row exceeds CJ_ROWCAP" as *u8) == 1 { goodfired = 1 }
314 // POSITIVE CONTROL = length DISCRIMINATION, not commit success (2026-08-22). A bare fixture cwd
315 // cannot complete a real fork-commit -- sts_append_fast_locked finds no store lock and returns
316 // "FAIL commit error" exit 1 -- so `if wrc2 != 0` counted THAT environmental failure as the control
317 // firing (measured: short put in a fixture cwd -> exit 1 + "FAIL commit error", NO length text). The
318 // property under test is that the length guard fires on overlong and NOT on short; the specific
319 // refusal TEXT above is that signal. A genuine fork/transport failure (negative rc) is still kept.
320 if wrc2 < 0 { goodfired = 1 }
321 gv_bite("T13 neg-control-overlong-command-is-refused-not-truncated at the WRITER (asserts the refusal TEXT and exit 1; the short command is accepted)" as *u8, bad, goodfired, ctr)
322
323 // T14 fixture-isolation PROVEN, not assumed: the gate-unique marker names appear NOWHERE in
324 // the PRODUCTION desired plane. Concurrency-immune (absence of OUR marker, never plane
325 // byte-equality), and it abstains via gv_need when it cannot read -- UNREADABLE never acquits.
326 let plenp: *i64 = sys_mmap(16) as *i64
327 plenp[0] = 0
328 let pbuf: *u8 = sts_load_fit(CRG_PROD_DPFX, plenp)
329 var prodreadable: i64 = 0
330 if (pbuf as i64) != 0 { prodreadable = 1 }
331 if gv_need("production desired plane readable (an absence claim needs coverage)" as *u8, prodreadable, ctr) == 1 {
332 var t14ok: i64 = 1
333 if prodlen_before < 0 { t14ok = 0 }
334 if plenp[0] != prodlen_before { t14ok = 0 }
335 gv_check("T14 neg-control-writer-did-not-touch-production: the LIVE clockjobs- plane byte-length is UNCHANGED across the gate's fixture forks (a delta -- immune to the append-only tombstone persistence that permanently poisons a marker-name-absence check after one stray put; a concurrent unrelated clock declaration in the ~2s window is a re-runnable transient, not this gate's write)" as *u8, t14ok, ctr)
336 }
337 }
338 // ==== STORM-DEFER TEETH (2026-09-02): the PURE decision clk_run_edf consults before forking a heavy beat.
339 // The fixture conf is assembled at RUNTIME (a detector that scans source finds its own fixture), carries a
340 // comment row, a CR-terminated row, an LF-terminated row and an UNTERMINATED last row -- the four shapes a
341 // hand-edited conf actually takes -- so a reader that only handles one of them cannot pass.
342 let hc: *u8 = sys_mmap(256)
343 var hn: i64 = 0
344 hn = clk_msgcat(hc, hn, "# comment rows never match a job name" as *u8)
345 hc[hn] = 10 as u8
346 hn = hn + 1
347 hn = clk_msgcat(hc, hn, "rebuilddrain" as *u8)
348 hc[hn] = 13 as u8
349 hn = hn + 1
350 hc[hn] = 10 as u8
351 hn = hn + 1
352 hn = clk_msgcat(hc, hn, "mutsweep" as *u8)
353 hc[hn] = 10 as u8
354 hn = hn + 1
355 hn = clk_msgcat(hc, hn, "websegfold" as *u8)
356 var t15: i64 = 1
357 if clk_heavy_listed(hc, hn, "rebuilddrain" as *u8) != 1 { t15 = 0 }
358 if clk_heavy_listed(hc, hn, "mutsweep" as *u8) != 1 { t15 = 0 }
359 if clk_heavy_listed(hc, hn, "websegfold" as *u8) != 1 { t15 = 0 }
360 gv_check("T15 clk_heavy_listed finds every listed name: CR-terminated, LF-terminated and the UNTERMINATED last row" as *u8, t15, ctr)
361 var t16: i64 = 1
362 if clk_heavy_listed(hc, hn, "mutsweep2" as *u8) != 0 { t16 = 0 }
363 if clk_heavy_listed(hc, hn, "mut" as *u8) != 0 { t16 = 0 }
364 if clk_heavy_listed(hc, hn, "resmonbeat" as *u8) != 0 { t16 = 0 }
365 if clk_heavy_listed(hc, hn, "" as *u8) != 0 { t16 = 0 }
366 if clk_heavy_listed(hc, 0, "mutsweep" as *u8) != 0 { t16 = 0 }
367 gv_check("T16 neg-control-heavy-membership-is-exact-whole-line: a suffix, a prefix, an absent name, an empty name and an ABSENT conf (n=0) all read 0 -- an instrument can never be deferred by a near-miss" as *u8, t16, ctr)
368 var t17: i64 = 1
369 if clk_defer_secs(1800) != 450 { t17 = 0 }
370 if clk_defer_secs(60) != CLK_DEFER_MIN_S { t17 = 0 }
371 if clk_defer_secs(86400) != CLK_DEFER_MAX_S { t17 = 0 }
372 if clk_defer_secs(3600) != 900 { t17 = 0 }
373 gv_check("T17 clk_defer_secs = interval/4 clamped to [CLK_DEFER_MIN_S,CLK_DEFER_MAX_S]: 1800->450, 60->floor, 86400->cap, 3600->900" as *u8, t17, ctr)
374 var t18: i64 = 1
375 if clk_storm_defer(1, 0) != 1 { t18 = 0 }
376 if clk_storm_defer(1, 3) != 0 { t18 = 0 }
377 if clk_storm_defer(0, 0) != 0 { t18 = 0 }
378 if clk_storm_defer(1, 0 - 1) != 0 { t18 = 0 }
379 gv_check("T18 clk_storm_defer defers ONLY heavy+zero-budget; a light job in a storm, a heavy job with headroom and an UNREADABLE ruler (-1) all dispatch -- abstention never stalls the clock" as *u8, t18, ctr)
380 var t19: i64 = 0
381 let ioa: *i64 = sys_mmap(16) as *i64
382 let bud: i64 = clk_storm_budget(ioa)
383 if bud >= 0 { if ioa[0] > 0 { if ioa[1] >= 0 { t19 = 1 } } }
384 if bud == (0 - 1) { if ioa[0] == (0 - 1) { if ioa[1] == (0 - 1) { t19 = 1 } } }
385 w(" storm-budget live: budget=" as *u8); wn(bud); w(" ncpu=" as *u8); wn(ioa[0]); w(" procs_blocked=" as *u8); wn(ioa[1]); w("\n" as *u8)
386 gv_check("T19 clk_storm_budget composes the live ruler: budget>=0 carries ncpu>0 and procs_blocked>=0, or UNREADABLE carries -1 in BOTH slots (a named state, never a crash)" as *u8, t19, ctr)
387
388 // ==== ACTLOG JOB-NAME TEETH (2026-09-18) ==================================================
389 // The close ruler (nx_rungclose) judges a rung OPERATED when its agent -- a clock ROW NAME such as
390 // twincheck -- has run since the rung landed. The ledger row named only the ORGAN, so every
391 // `nx_plan_run.elf <plan>` row read identically and no plan-run agent could ever be witnessed; the row
392 // now appends ` job=<name>` as the LAST token of its LAST field. T20-T28 compose rows with
393 // clk_actlog_row -- the SAME function clk_actlog calls, nothing mirrored -- so no tooth writes a ledger.
394 // T29-T31 then prove the CALL SITE end to end: clk_dispatch_one must hand the row its job's name.
395 let alrow: *u8 = sys_mmap(CLK_ACTLOGW + CLK_NAMEW) // the subject's budget + one slot: an overrun is MEASURED by T28, never written past this buffer
396 let alfld: *u8 = sys_mmap(CLK_ACTLOGW + CLK_NAMEW)
397 let altok: *u8 = sys_mmap(CLK_ACTLOGW + CLK_NAMEW)
398 let alnow: i64 = sys_now_realtime_sec()
399
400 let al0: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, CRG_AL_JOB)
401 w(" composed ok-row: " as *u8)
402 sys_write(1, alrow, al0)
403 crg_last_token(alrow, al0, altok)
404 w(" last_token=" as *u8); w(altok); w("\n" as *u8)
405 gv_check("T20 the job name is the LAST token of the row (`job=twincheck`), read token-bounded the way the close ruler reads it -- a row naming only the organ can never witness a plan-run agent" as *u8, streq(altok, CRG_AL_TOKEN), ctr)
406 var t21: i64 = 0
407 if crg_field(alrow, al0, CRG_AL_ORGAN_COL, alfld) >= 0 { if streq(alfld, CRG_AL_ORGAN) == 1 { t21 = 1 } }
408 gv_check("T21 the ORGAN column is byte-exact the organ, never the job name -- nx_catalog and every column reader see it unchanged" as *u8, t21, ctr)
409 gv_check_eq("T22 the row still has exactly six TAB fields -- the job token rides INSIDE the last field and adds no column" as *u8, crg_nfields(alrow, al0), CRG_AL_FIELDS, ctr)
410 var t23: i64 = 0
411 if crg_field(alrow, al0, CRG_AL_LAST_COL, alfld) >= 0 { if streq(alfld, CRG_AL_LAST_OK) == 1 { t23 = 1 } }
412 w(" last_field=" as *u8); w(alfld); w("\n" as *u8)
413 gv_check("T23 the last field is exactly `clockjob lane=clock exit=0 job=twincheck` -- every pre-existing byte in place, the job token the ONLY addition" as *u8, t23, ctr)
414
415 let alk: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, CRG_AL_KILL_CODE, CRG_AL_JOB)
416 w(" composed kill-row: " as *u8)
417 sys_write(1, alrow, alk)
418 var t24: i64 = 0
419 if crg_field(alrow, alk, CRG_AL_RESULT_COL, alfld) >= 0 { if streq(alfld, CRG_AL_FAIL_WORD) == 1 {
420 if crg_field(alrow, alk, CRG_AL_LAST_COL, alfld) >= 0 { if streq(alfld, CRG_AL_LAST_KILL) == 1 { t24 = 1 } }
421 } }
422 gv_check("T24 the DEADLINE-KILL row (code 124, clk_dispatch_one's timeout path) reads `fail` and ends `exit=124 job=twincheck` -- the name stays last on the path a reader most needs" as *u8, t24, ctr)
423
424 var t25: i64 = 1
425 let ale: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, "" as *u8)
426 if gk_out_has(alrow, ale, CRG_AL_KEY) == 1 { t25 = 0 }
427 if crg_field(alrow, ale, CRG_AL_LAST_COL, alfld) < 0 { t25 = 0 } else { if streq(alfld, CRG_AL_LAST_BARE) != 1 { t25 = 0 } }
428 let aln: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, 0 as *u8)
429 if gk_out_has(alrow, aln, CRG_AL_KEY) == 1 { t25 = 0 }
430 if crg_field(alrow, aln, CRG_AL_LAST_COL, alfld) < 0 { t25 = 0 } else { if streq(alfld, CRG_AL_LAST_BARE) != 1 { t25 = 0 } }
431 gv_check("T25 neg-control-empty-or-absent-name-writes-no-job-field: an EMPTY and a NULL name each yield the old row byte for byte (last field `clockjob lane=clock exit=0`, no `job=` anywhere) -- a bare `job=` would hand a token reader an empty agent" as *u8, t25, ctr)
432
433 // Names that cannot travel as ONE token, assembled at RUNTIME (a TAB or a CR inside a literal would be
434 // the very row grammar they break), plus one wider than its slot; and the POSITIVE control: the widest
435 // legal name, CLK_NAMEW-1 bytes, which must still be written.
436 let ntab: *u8 = sys_mmap(CLK_NAMEW + CLK_NAMEW)
437 var tq: i64 = clk_msgcat(ntab, 0, "twin" as *u8)
438 ntab[tq] = 9 as u8
439 tq = tq + 1
440 tq = clk_msgcat(ntab, tq, "check" as *u8)
441 ntab[tq] = 0 as u8
442 let ncr: *u8 = sys_mmap(CLK_NAMEW + CLK_NAMEW)
443 var cq: i64 = clk_msgcat(ncr, 0, CRG_AL_JOB)
444 ncr[cq] = 13 as u8
445 cq = cq + 1
446 ncr[cq] = 0 as u8
447 let nover: *u8 = sys_mmap(CLK_NAMEW + CLK_NAMEW) // CLK_NAMEW bytes, its NUL only AFTER the slot
448 let nmax: *u8 = sys_mmap(CLK_NAMEW + CLK_NAMEW) // CLK_NAMEW-1 bytes, the widest name a slot holds
449 let npad: *u8 = "n" as *u8
450 var pi: i64 = 0
451 while pi < CLK_NAMEW {
452 nover[pi] = npad[0]
453 if pi < CLK_NAMEW - 1 { nmax[pi] = npad[0] }
454 pi = pi + 1
455 }
456 nover[CLK_NAMEW] = 0 as u8
457 nmax[CLK_NAMEW - 1] = 0 as u8
458 var badfired: i64 = 1 // stays 1 only if EVERY non-token name was refused its job= field
459 let r1: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, CRG_AL_SPACE_NAME)
460 if gk_out_has(alrow, r1, CRG_AL_KEY) == 1 { badfired = 0 }
461 let r2: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, ntab)
462 if gk_out_has(alrow, r2, CRG_AL_KEY) == 1 { badfired = 0 }
463 let r3: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, ncr)
464 if gk_out_has(alrow, r3, CRG_AL_KEY) == 1 { badfired = 0 }
465 let r4: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, nover)
466 if gk_out_has(alrow, r4, CRG_AL_KEY) == 1 { badfired = 0 }
467 let r5: i64 = clk_actlog_row(alrow, alnow, CRG_AL_ORGAN, 0, nmax)
468 var goodfired: i64 = 0 // 1 = the filter WRONGLY refused the widest legal name
469 if gk_out_has(alrow, r5, CRG_AL_KEY) != 1 { goodfired = 1 }
470 gv_bite("T26 neg-control-name-that-cannot-travel-as-one-token-writes-no-job-field: a SPACE, a TAB, a CR and a slot-overflowing name each yield NO job= field (no false witness, no broken row), while the widest legal name (CLK_NAMEW-1 bytes) is still written" as *u8, badfired, goodfired, ctr)
471
472 let omax: *u8 = sys_mmap(CLK_NAMEW + CLK_NAMEW) // CLK_NAMEW-1 bytes, the widest organ a slot holds
473 let opad: *u8 = "o" as *u8
474 var oi: i64 = 0
475 while oi < CLK_NAMEW - 1 { omax[oi] = opad[0]; oi = oi + 1 }
476 omax[CLK_NAMEW - 1] = 0 as u8
477 let wl: i64 = clk_actlog_row(alrow, alnow, omax, CRG_AL_KILL_CODE, nmax)
478 let wtl: i64 = crg_last_token(alrow, wl, altok)
479 gv_check_eq("T27 fixture-reached-condition: the widest row really carries BOTH full slots -- its last token is `job=` plus a CLK_NAMEW-1 byte name (a budget measured on a row without the job field proves nothing)" as *u8, wtl, gk_len(CRG_AL_KEY) + CLK_NAMEW - 1, ctr)
480 w(" widest_row_bytes=" as *u8); wn(wl); w(" budget CLK_ACTLOGW=" as *u8); wn(CLK_ACTLOGW); w("\n" as *u8)
481 gv_check("T28 the ledger-line budget CLK_ACTLOGW holds the widest row both slots admit (full organ + full job name + the fixed words) -- it grew by one NAME slot, derived; an ungrown CLK_NAMEW+128 reads RED here instead of writing past its mapping" as *u8, (wl <= CLK_ACTLOGW) as i64, ctr)
482
483 // T29-T31 END TO END -- the CALL SITE. clk_dispatch_one forks an organ path that is ABSENT inside this
484 // fixture (execve fails and the child exits 127: no organ runs, and its chmod reaches nothing outside the
485 // fixture), then on reap writes its ledger row through clk_actlog into THIS fixture's own
486 // knowledge/status/actlog.jrnl. Same on the laptop and the NAS. GUARDED ON CWD: the dispatcher writes a
487 // RELATIVE ledger path, so unless cwd IS the fixture this block neither clears nor dispatches anything --
488 // a failed chdir must never aim a clear or a fixture row at the production ledger.
489 let alcwd: *u8 = sys_mmap(CRG_PATHCAP)
490 sys_getcwd(alcwd, CRG_PATHCAP)
491 var e2erows: i64 = 0 - 1
492 if gv_need("cwd is the gate fixture /tmp/nx_clock_reregister_gate (the dispatcher's relative ledger write must land there, never in production)" as *u8, streq(alcwd, CRG_FIX_DIR), ctr) == 1 {
493 let eorg: *u8 = sys_mmap(CRG_PATHCAP)
494 gk_join(eorg, CRG_FIX_DIR, CRG_AL_E2E_ORGAN_NAME)
495 let eled: *u8 = sys_mmap(CRG_PATHCAP)
496 gk_join(eled, CRG_FIX_DIR, CRG_AL_LEDGER_REL)
497 gk_rm(eled) // this run's rows only: a gate that inherits its predecessor's rows measures the predecessor
498 gk_rm(eorg) // the organ must be ABSENT so execve fails by construction
499 let namesE: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
500 let orgsE: *u8 = sys_mmap(CLK_MAXJOBS*CLK_NAMEW)
501 let ivE: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
502 let ndE: *i64 = sys_mmap(CLK_MAXJOBS*8) as *i64
503 let npE: *i64 = sys_mmap(8) as *i64
504 npE[0] = 0
505 clk_register(namesE, orgsE, ivE, ndE, npE, CRG_AL_E2E_JOB, eorg, CRG_AL_E2E_IV)
506 let erc: i64 = clk_dispatch_one(orgsE, namesE, 0)
507 let elen: *i64 = sys_mmap(16) as *i64
508 elen[0] = 0
509 let eb: *u8 = sys_read_file(eled, elen)
510 var en: i64 = 0
511 if (eb as i64) != 0 { en = elen[0] }
512 e2erows = 0
513 if en > 0 { e2erows = crg_rows(eb, en) }
514 w(" dispatcher row: " as *u8)
515 if en > 0 { sys_write(1, eb, en) } else { w("(no ledger row)\n" as *u8) }
516 var t29: i64 = 0
517 if erc == 0 { if e2erows == 1 { t29 = 1 } }
518 gv_check("T29 fixture-reached-condition: clk_dispatch_one ran the absent organ as designed (rc 0 = exec failed, exit 127) and wrote EXACTLY ONE row into the fixture ledger" as *u8, t29, ctr)
519 var t30: i64 = 0
520 if e2erows == 1 {
521 crg_last_token(eb, en, altok)
522 if streq(altok, CRG_AL_E2E_TOKEN) == 1 { t30 = 1 }
523 }
524 gv_check("T30 the CALL SITE names the job: the dispatcher's own row ends `job=crg-jobwitness`, the clock ROW NAME -- a composer that is right but never handed the name reads RED here and nowhere above" as *u8, t30, ctr)
525 var t31: i64 = 0
526 if e2erows == 1 { if crg_field(eb, en, CRG_AL_ORGAN_COL, alfld) >= 0 { if streq(alfld, eorg) == 1 {
527 if crg_field(eb, en, CRG_AL_LAST_COL, alfld) >= 0 { if streq(alfld, CRG_AL_E2E_LAST) == 1 { t31 = 1 } }
528 } } }
529 gv_check("T31 the dispatcher's row keeps argv[0] in the ORGAN column and ends `exit=127 job=crg-jobwitness` -- the name is ADDED, the organ is never replaced" as *u8, t31, ctr)
530 }
531 gv_values_head()
532 gv_kv("actlog_ok_row_bytes" as *u8, al0)
533 gv_kv("actlog_kill_row_bytes" as *u8, alk)
534 gv_kv("actlog_budget_bytes" as *u8, CLK_ACTLOGW)
535 gv_kv("actlog_widest_row_bytes" as *u8, wl)
536 gv_kv("actlog_e2e_ledger_rows" as *u8, e2erows)
537 sys_chdir(cwd0)
538
539 w("nx_clock_reregister_gate legacy pass=" as *u8); wn(pass); w("/" as *u8); wn(tot); w("\n" as *u8)
540 // The legacy T0-T5 counters fold into the shared base-class counter; every row above is untouched.
541 ctr[0] = ctr[0] + pass
542 ctr[1] = ctr[1] + tot
543 let rc__dry: i64 = gv_verdict("CLOCK-REREGISTER-GATE" as *u8, ctr, "one shared cap: the writer refuses, the reader never truncates" as *u8)
544 sys_exit(rc__dry)
545 return rc__dry
546}