nx_compare_refs_gate.nx source
↩ module page · 1415 lines · 85018 B
1// nx_compare_refs_gate.nx -- THE CITATIONS REGISTER GATE: /compare's research-paper references are
2// MEASURED, never trusted. Subject: every knowledge/compare/<dom>.refs row (schema width, key
3// uniqueness, url shape, mirror EXISTENCE on disk, content-pin agreement via the promoted nx_filehash
4// ruler) plus every inline [@key] cite in the sibling .matrix and .plan resolving to a declared key.
5// Born from a real catch (2026-08-17): a venue-name collision put Walter's EGSR paper on the Ray
6// Tracing symposium page -- a plausible mirror claim only verification killed. This gate makes that
7// class mechanical where it can be (existence, pins, dead cites). DECLARED IMPRECISION: whether a
8// mirror page's TOPIC matches the citation stays a human read; the gate cannot see venue semantics.
9// Composition: nx_atlas_cite is the atlas lane's precheck over the atlas blueprint schema; this
10// register has its own 9-field schema, so the gate shares the LAW, not the parser -- and it composes
11// the estate's hash ruler (fork ./nx_filehash.elf) for pins rather than rolling a second one.
12import "nx_gate_verdict.nx"
13import "nx_tool_run.nx"
14import "nx_mirrorintegrity_lib.nx"
15
16// CRG_CAP bounds ONLY the gate's own snapshot, ratchet and fixture reads (crg_read REFUSES to
17// truncate past it). Domain registers and boards are read whole via sys_read_file. See crg_scan.
18const CRG_CAP: i64 = 262144
19const CRG_KMAX: i64 = 64
20const CRG_KLEN: i64 = 64
21// a ref row cannot be shorter than this many bytes (ref plus eight pipes plus one byte per field), so a key table of
22// bytes/CRG_REF_MINROW+1 slots sized FROM the register can never overflow -- there is no cap to tune (2026-09-16)
23const CRG_REF_MINROW: i64 = 12
24const CRG_DIRBUF: i64 = 65536
25const CRG_PATH: i64 = 600
26const CRG_TMO_MS: i64 = 30000
27const CRG_HASHCAP: i64 = 4096
28// ---- FETCH-TIME PROVENANCE JOIN (2026-08-20, lane E) -------------------------------------------------
29// A content pin proves the mirror's BYTES have not changed. It can never prove the mirror is a capture of
30// the URL sitting beside it in the same row. On 2026-08-18 four rows were appended to charsim.refs from
31// search-engine summaries with ZERO pages opened, one of them carrying a mirror captured from a DIFFERENT
32// url three days earlier, and THIS GATE PASSED ALL OF THEM 9 of 9 -- correctly, by its own teeth.
33// ★★★★★★A PIN PROVES THE BYTES DID NOT CHANGE, NEVER THAT THEY ARE THE RIGHT DOCUMENT.
34// nx_research_fetch now journals requested-url -> mirror -> digest -> bytes -> hops AT FETCH TIME, which
35// is the only moment both facts are in hand. This pass JOINS every declared mirror against that journal.
36// THREE STATES, because two would lie:
37// PROVEN a journal row names this mirror AND this url
38// MISMATCH a journal row names this mirror under a DIFFERENT url -- the offender class, armed at zero
39// UNPROVEN no journal row names this mirror at all -- EVERY mirror captured before 2026-08-20, which is
40// not a defect and must never be scored as one (ratcheted, never armed).
41const CRG_PROV_PATH: *u8 = "knowledge/status/fetch_provenance.jrnl"
42const CRG_PROV_RATCHET: *u8 = "knowledge/status/refs_provenance_ratchet.conf"
43const CRG_PROV_WORKLIST: *u8 = "knowledge/status/refs_provenance_unproven.txt"
44const CRG_PROV_UFIELD: i64 = 2
45const CRG_PROV_MFIELD: i64 = 3
46const CRG_PROV_MINROW: i64 = 8
47// REDIRECT-HOPS (CE10, 2026-09-05): the journal's 7th field is the redirect count the fetcher followed, and until
48// today nothing read it -- a page that MOVED (the Faros /ai-impact product page now redirects to the homepage) was
49// journalled PROVEN with hops=1 and pinned as evidence. Worklist, ratchet and its baseline snapshot, the prov shape.
50const CRG_REDIR_WORKLIST: *u8 = "knowledge/status/refs_redirected.txt"
51const CRG_REDIR_RATCHET: *u8 = "knowledge/status/refs_redirected_ratchet.conf"
52const CRG_REDIR_SNAP: *u8 = "knowledge/status/refs_redirected.at_baseline.txt"
53// 2026-09-05: the ratchet's SUBJECT is the OPEN set -- redirected mirrors whose canonical did NOT prove them to be
54// the cited page (MOVED plus every CANON-UNKNOWN reason). A ratchet over the RAW redirect total fired on BENIGN hops
55// (measured on real data: 20 of 34 redirected = 588 permil false positives), i.e. on a scheme/www/slash hop that the
56// page's own canonical acquits -- a detector with false positives teaches every lane to ignore it. The raw total is
57// still censused (refs_redirected.txt, one NAMED row each) and emitted as a value; only the OPEN set is ratcheted,
58// and every open row carries the class that put it there so the worklist is actionable without re-running anything.
59const CRG_OPEN_WORKLIST: *u8 = "knowledge/status/refs_redirect_open.txt"
60const CRG_OPEN_RATCHET: *u8 = "knowledge/status/refs_redirect_open_ratchet.conf"
61const CRG_OPEN_SNAP: *u8 = "knowledge/status/refs_redirect_open.at_baseline.txt"
62// ---- MIRROR COMPLETENESS (2026-08-20) -----------------------------------------------------------
63// A pin proves the BYTES DID NOT CHANGE. It cannot prove they are ALL THERE, and a truncated body
64// pins just as perfectly as a whole one. Measured over the whole store the day this shipped: 8,465
65// bodies, 48 non-complete, 24 of them CITED by a live [@key] mark -- including a published-paper
66// mirror stored at 255,708 B of its own declared 3,511,324 B, backing an exceed row, pin matching.
67// The judgement is mi_classify from nx_mirrorintegrity_lib, composed IN-PROCESS: the census and this
68// gate then share ONE ruler by construction. Forking the nx_mirrorintegrity PROGRAM per mirror would
69// be worse than useless -- handed a FILE path it walks nothing, prints files=0 and exits GREEN.
70// UNKNOWN is a genuine third state and is NOT scored: a body whose format declares no length and
71// carries no terminator cannot be judged, and counting it either way would be a lie. It is printed.
72const CRG_MIR_RATCHET: *u8 = "knowledge/status/refs_mirror_ratchet.conf"
73const CRG_MIR_WORKLIST: *u8 = "knowledge/status/refs_mirror_incomplete.txt"
74
75func crg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
76func crg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
77 let fd: i64 = sys_openat_rd(path)
78 if fd < 0 { return 0-1 }
79 // 2026-09-04: a cap that stays must ANNOUNCE. Size the file first and REFUSE to truncate, returning
80 // -2 (distinct from -1 absent) so a caller treats an oversized file as UNREADABLE, never as a short
81 // but plausible body. The board/register readers no longer reach this cap (they use sys_read_file);
82 // this guards the gate's own snapshot, ratchet and fixture reads against a future silent overflow.
83 let fsz: i64 = sys_lseek(fd, 0, 2)
84 sys_lseek(fd, 0, 0)
85 if fsz > cap - 1 {
86 gv_puts(" CRG-READ-CAP-EXCEEDED path=" as *u8); gv_puts(path)
87 gv_puts(" size=" as *u8); gv_num(fsz); gv_puts(" cap=" as *u8); gv_num(cap)
88 gv_puts(" -- REFUSED to truncate; treated as UNREADABLE, not a partial body" as *u8); gv_puts("
89" as *u8)
90 sys_close(fd)
91 return 0-2
92 }
93 var t: i64 = 0
94 var go: i64 = 1
95 while go == 1 {
96 let r: i64 = sys_read(fd, ((buf as i64)+t) as *u8, cap - 1 - t)
97 if r <= 0 { go = 0 }
98 if go == 1 { t = t + r; if t >= cap - 1 { go = 0 } }
99 }
100 sys_close(fd)
101 buf[t] = 0 as u8
102 return t
103}
104func crg_split(s: *u8, fld: *i64, maxf: i64) -> i64 {
105 var nf: i64 = 0
106 var i: i64 = 0
107 fld[0] = s as i64
108 nf = 1
109 while s[i] != (0 as u8) {
110 if s[i] == (124 as u8) { if nf < maxf { s[i] = 0 as u8; fld[nf] = (s as i64) + i + 1; nf = nf + 1 } }
111 i = i + 1
112 }
113 return nf
114}
115func crg_streq(a: *u8, b: *u8) -> i64 {
116 var i: i64 = 0
117 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
118 if b[i] != (0 as u8) { return 0 }
119 return 1
120}
121func crg_has(hay: *u8, hn: i64, needle: *u8) -> i64 {
122 var i: i64 = 0
123 let nl: i64 = crg_slen(needle)
124 if nl == 0 { return 0 }
125 while i + nl <= hn {
126 var j: i64 = 0
127 var ok: i64 = 1
128 while j < nl { if hay[i+j] != needle[j] { ok = 0; j = nl } else { j = j + 1 } }
129 if ok == 1 { return 1 }
130 i = i + 1
131 }
132 return 0
133}
134// fork the estate hash ruler on <mirror>; 1 iff its JSON carries the pin's hex (pin passed WITHOUT the h)
135func crg_pin_ok(mirror: *u8, pinhex: *u8) -> i64 {
136 let hb: *u8 = sys_mmap(CRG_HASHCAP)
137 let olen: *i64 = sys_mmap(16) as *i64
138 let trunc: *i64 = sys_mmap(16) as *i64
139 let av: *i64 = sys_mmap(32) as *i64
140 av[0] = "./nx_filehash.elf" as *u8 as i64
141 av[1] = mirror as i64
142 av[2] = 0
143 olen[0] = 0
144 trunc[0] = 0
145 let rc: i64 = tr_run_capture_tr("./nx_filehash.elf" as *u8, av, hb, CRG_HASHCAP, olen, CRG_TMO_MS, trunc)
146 if olen[0] <= 0 { return 0 }
147 return crg_has(hb, olen[0], pinhex)
148}
149// One NAMED row per incomplete mirror, and THE REASON TRAVELS WITH IT: a count without a worklist is
150// not actionable, and a worklist without the reason still costs the reader a re-run of the ruler that
151// already decided it. Lengths are DERIVED from every literal (gv_cat), never hand-counted beside one.
152// wfd <= 0 means "no worklist": fd 0 is stdin, and a zeroed counter slot would otherwise write there.
153func crg_mir_row(wfd: i64, refs: *u8, key: *u8, mir: *u8, rc: i64, size: i64, decl: i64) -> i64 {
154 if wfd <= 0 { return 0 }
155 let b: *u8 = sys_mmap(CRG_PATH * 4)
156 var o: i64 = 0
157 o = gv_cat(b, o, "INCOMPLETE refs=" as *u8)
158 o = gv_cat(b, o, refs)
159 o = gv_cat(b, o, " key=" as *u8)
160 o = gv_cat(b, o, key)
161 o = gv_cat(b, o, " mirror=" as *u8)
162 o = gv_cat(b, o, mir)
163 o = gv_cat(b, o, " reason=" as *u8)
164 o = gv_cat(b, o, mi_reason(rc))
165 o = gv_cat(b, o, " size=" as *u8)
166 o = gv_catn(b, o, size)
167 if decl >= 0 { o = gv_cat(b, o, " declared=" as *u8) o = gv_catn(b, o, decl) }
168 o = gv_cat(b, o, "\n" as *u8)
169 sys_write(wfd, b, o)
170 return 1
171}
172// one pass over a .refs file. st: 0 rows 1 malformed 2 dupkey 3 badurl 4 mirrors 5 mirrors-missing
173// 6 pins 7 pins-matched 8 mirrors-classified 9 truncated-proven 10 truncated-suspect 11 unknown
174// 12 complete-proven 13 worklist fd (IN-param, set by the caller; <=0 disables the worklist).
175// keys table filled (NUL-terminated, CRG_KLEN stride). returns key count.
176func crg_scan(path: *u8, _cbuf: *u8, cap: i64, keys: *u8, kmax: i64, st: *i64) -> i64 {
177 // 2026-09-04: composes sys_read_file -- the buffer is sized from the file (lseek END) and cannot
178 // short-read, so a board/register of ANY size is read whole. The caller's CRG_CAP window (_cbuf) is
179 // deliberately unused; the signature is kept so no call site moves. lang.plan measured 187,305 B and
180 // grew ~23 KB in a day against the 262,144 B window -- a silent cap here would drop its tail marks.
181 let fl: *i64 = sys_mmap(16) as *i64
182 fl[0] = 0
183 let buf: *u8 = sys_read_file(path, fl)
184 let n: i64 = fl[0]
185 if (buf as i64) == 0 { return 0 }
186 if n <= 0 { return 0 }
187 let fld: *i64 = sys_mmap(96) as *i64
188 // mi_classify reads a declared 4096-byte head and 4096-byte tail; allocate once per register,
189 // not once per row -- never allocate in a hot loop.
190 let hbuf: *u8 = sys_mmap(MI_HEAD + 16)
191 let tbuf: *u8 = sys_mmap(MI_TAIL + 16)
192 let mrc: *i64 = sys_mmap(16) as *i64
193 let msz: *i64 = sys_mmap(16) as *i64
194 let mdc: *i64 = sys_mmap(16) as *i64
195 var nk: i64 = 0
196 var p: i64 = 0
197 while p < n {
198 var e: i64 = p
199 var scanning: i64 = 1
200 while scanning == 1 {
201 if e >= n { scanning = 0 }
202 if scanning == 1 { if buf[e] == (10 as u8) { scanning = 0 } else { e = e + 1 } }
203 }
204 buf[e] = 0 as u8
205 let line: *u8 = ((buf as i64) + p) as *u8
206 p = e + 1
207 var skip: i64 = 0
208 if line[0] == (0 as u8) { skip = 1 }
209 if line[0] == (35 as u8) { skip = 1 }
210 if skip == 0 {
211 let nf: i64 = crg_split(line, fld, 12)
212 if crg_streq(fld[0] as *u8, "ref" as *u8) == 1 {
213 st[0] = st[0] + 1
214 if nf < 9 { st[1] = st[1] + 1 } else {
215 let key: *u8 = fld[1] as *u8
216 var d: i64 = 0
217 while d < nk {
218 let other: *u8 = ((keys as i64) + d*CRG_KLEN) as *u8
219 if crg_streq(other, key) == 1 { st[2] = st[2] + 1; d = nk } else { d = d + 1 }
220 }
221 if nk < kmax {
222 var kc: i64 = 0
223 let dstk: *u8 = ((keys as i64) + nk*CRG_KLEN) as *u8
224 while key[kc] != (0 as u8) { if kc < CRG_KLEN-1 { dstk[kc] = key[kc] } kc = kc + 1 }
225 var kend: i64 = kc
226 if kend > CRG_KLEN-1 { kend = CRG_KLEN-1 }
227 dstk[kend] = 0 as u8
228 nk = nk + 1
229 } else {
230 // a full table must ANNOUNCE: a key that cannot be entered can neither resolve a mark nor be counted uncited
231 gv_puts(" KEY-TABLE-FULL file=" as *u8); gv_puts(path); gv_puts(" key=" as *u8); gv_puts(key); gv_puts(" -- the key table is full; size it from the register\n" as *u8)
232 }
233 let url: *u8 = fld[3] as *u8
234 var httpok: i64 = 0
235 if url[0] == (104 as u8) { if url[1] == (116 as u8) { if url[2] == (116 as u8) { if url[3] == (112 as u8) { httpok = 1 } } } }
236 if httpok == 0 { st[3] = st[3] + 1 }
237 let mir: *u8 = fld[4] as *u8
238 if crg_streq(mir, "-" as *u8) == 0 {
239 st[4] = st[4] + 1
240 let mfd: i64 = sys_openat_rd(mir)
241 if mfd < 0 { st[5] = st[5] + 1 } else {
242 sys_close(mfd)
243 let cls: i64 = mi_classify(mir, hbuf, tbuf, mrc, msz, mdc)
244 st[8] = st[8] + 1
245 if cls == MI_PROVEN { st[9] = st[9] + 1 }
246 if cls == MI_SUSPECT { st[10] = st[10] + 1 }
247 if cls == MI_UNKNOWN { st[11] = st[11] + 1 }
248 if cls == MI_COMPLETE { st[12] = st[12] + 1 }
249 if cls == MI_PROVEN { crg_mir_row(st[13], path, key, mir, mrc[0], msz[0], mdc[0]) }
250 if cls == MI_SUSPECT { crg_mir_row(st[13], path, key, mir, mrc[0], msz[0], mdc[0]) }
251 }
252 let pin: *u8 = fld[5] as *u8
253 if crg_streq(pin, "-" as *u8) == 0 { if pin[0] == (104 as u8) {
254 st[6] = st[6] + 1
255 if crg_pin_ok(mir, ((pin as i64)+1) as *u8) == 1 { st[7] = st[7] + 1 } else {
256 // NAME THE OFFENDER (2026-08-28). This counter FAILed its tooth as a bare
257 // pins=1053 matched=1052 and said NOTHING about WHICH of 1053 rows had
258 // drifted -- the same defect this file already fixed for dangling marks
259 // nine days earlier and did not carry across to its sibling. A pin
260 // mismatch means the mirror was rewritten under a pin nobody updated, so
261 // the row is either citing a body that is no longer what was read or
262 // carrying a stale pin; both need the file named to be decidable at all.
263 gv_puts(" PIN-MISMATCH file=" as *u8); gv_puts(path)
264 gv_puts(" key=" as *u8); gv_puts(key)
265 gv_puts(" mirror=" as *u8); gv_puts(mir)
266 gv_puts(" declared_pin=" as *u8); gv_puts(pin)
267 gv_puts("\n" as *u8)
268 }
269 } }
270 }
271 }
272 }
273 }
274 }
275 return nk
276}
277// every [@key] in <path> must name a declared key. mst: 0 marks 1 unresolved. absent file = no-op.
278// PER-KEY CITATION LEDGER (2026-08-18): the per-domain UNMARKED worklist was a floor-of-one signal --
279// two seats measured domains it called "landed" at 1 of 7 and 1 of 9 keys cited. `cited` is one byte per
280// declared key (CRG_KMAX), set when any [@key] in any rendered source names it; the tooth below asks that
281// every declared reference is cited AT LEAST ONCE, and the worklist names each uncited key by domain.
282// 2026-09-05: a mark is [@key] with key in [A-Za-z0-9_.-]. Any other byte after [@ (a space, a paren) means
283// prose or CODE that merely starts with those two characters -- WGSL attribute syntax in a graphics log row
284// was read as a dangling mark and turned the fleet gate RED for a citation nobody wrote.
285func crg_keychar(c: i64) -> i64 {
286 if c >= 97 { if c <= 122 { return 1 } }
287 if c >= 65 { if c <= 90 { return 1 } }
288 if c >= 48 { if c <= 57 { return 1 } }
289 if c == 45 { return 1 }
290 if c == 95 { return 1 }
291 if c == 46 { return 1 }
292 return 0
293}
294func crg_marks(path: *u8, _cbuf: *u8, cap: i64, keys: *u8, nk: i64, mst: *i64, cited: *u8) -> i64 {
295 // 2026-09-04: composes sys_read_file -- the buffer is sized from the file (lseek END) and cannot
296 // short-read, so a board/register of ANY size is read whole. The caller's CRG_CAP window (_cbuf) is
297 // deliberately unused; the signature is kept so no call site moves. lang.plan measured 187,305 B and
298 // grew ~23 KB in a day against the 262,144 B window -- a silent cap here would drop its tail marks.
299 let fl: *i64 = sys_mmap(16) as *i64
300 fl[0] = 0
301 let buf: *u8 = sys_read_file(path, fl)
302 let n: i64 = fl[0]
303 if (buf as i64) == 0 { return 0 }
304 if n <= 0 { return 0 }
305 let kb: *u8 = sys_mmap(CRG_KLEN)
306 var i: i64 = 0
307 while i + 1 < n {
308 if buf[i] == (91 as u8) { if buf[i+1] == (64 as u8) {
309 var kl: i64 = 0
310 var bad: i64 = 0
311 var go: i64 = 1
312 while go == 1 {
313 let c: i64 = buf[i+2+kl] as i64
314 if c == 0 { go = 0 }
315 if go == 1 { if c == 93 { go = 0 } else { if crg_keychar(c) == 0 { go = 0; bad = 1 } else { if kl < CRG_KLEN-2 { kb[kl] = c as u8; kl = kl + 1 } else { go = 0 } } } }
316 }
317 if bad == 0 { if buf[i+2+kl] == (93 as u8) { if kl > 0 {
318 kb[kl] = 0 as u8
319 mst[0] = mst[0] + 1
320 var found: i64 = 0
321 var d: i64 = 0
322 while d < nk {
323 let other: *u8 = ((keys as i64) + d*CRG_KLEN) as *u8
324 if crg_streq(other, kb) == 1 { found = 1; cited[d] = 1 as u8; d = nk } else { d = d + 1 }
325 }
326 if found == 0 {
327 mst[1] = mst[1] + 1
328 // NAME THE OFFENDER (2026-08-19): this counter FAILed a tooth without saying which
329 // mark was dangling or in which file -- the reader had to grep 100+ marks by hand.
330 gv_puts(" UNRESOLVED-MARK file=" as *u8); gv_puts(path); gv_puts(" key=" as *u8); gv_puts(kb); gv_puts("\n" as *u8)
331 }
332 i = i + 2 + kl }
333 } }
334 } }
335 i = i + 1
336 }
337 return 0
338}
339// domain name = basename of a compare data path with its extension already cut ("buildroot/knowledge/compare/llm").
340func rp_domname(p: *u8) -> *u8 {
341 var i: i64 = 0
342 var last: i64 = 0
343 while p[i] != (0 as u8) { if p[i] == (47 as u8) { last = i + 1 } i = i + 1 }
344 return ((p as i64) + last) as *u8
345}
346// Index the journal ONCE. crg_split NUL-terminates fields IN PLACE, so re-parsing per ref row would read a
347// destroyed buffer, and re-reading the file per row is 600+ file reads for one gate run.
348// uoff/moff are sized FROM the journal by the caller, never guessed: a journal row cannot be shorter than
349// CRG_PROV_MINROW bytes, so n/8 slots can never overflow and there is no cap to tune.
350func crg_prov_index(buf: *u8, n: i64, uoff: *i64, moff: *i64) -> i64 {
351 var rows: i64 = 0
352 var p: i64 = 0
353 while p < n {
354 var e: i64 = p
355 var scanning: i64 = 1
356 while scanning == 1 {
357 if e >= n { scanning = 0 }
358 if scanning == 1 { if buf[e] == (10 as u8) { scanning = 0 } else { e = e + 1 } }
359 }
360 var f: i64 = 0
361 var fs: i64 = p
362 var u: i64 = 0 - 1
363 var m: i64 = 0 - 1
364 var i: i64 = p
365 while i <= e {
366 var cut: i64 = 0
367 if i == e { cut = 1 } else { if buf[i] == (124 as u8) { cut = 1 } }
368 if cut == 1 {
369 if f == CRG_PROV_UFIELD { u = fs }
370 if f == CRG_PROV_MFIELD { m = fs }
371 buf[i] = 0 as u8
372 f = f + 1
373 fs = i + 1
374 }
375 i = i + 1
376 }
377 if u >= 0 { if m >= 0 { uoff[rows] = u; moff[rows] = m; rows = rows + 1 } }
378 p = e + 1
379 }
380 return rows
381}
382// REDIRECT-HOPS READER (CE10, 2026-09-05). crg_prov_index NUL-terminates every field IN PLACE, so from a matched
383// mirror field the rest of its row is contiguous NUL-split strings: mirror NUL sha NUL bytes NUL hops. Returns the
384// hops of the FIRST row whose mirror matches, and -1 when no row matches: an unjournalled mirror has no hops to
385// report and must never read as 0 -- absence is not zero (the abstain-never-acquit third state). The skip count
386// is DERIVED from the field indices, never hand-counted beside the row grammar.
387const CRG_PROV_HFIELD: i64 = 6
388func crg_prov_hops(buf: *u8, moff: *i64, rows: i64, mirror: *u8) -> i64 {
389 var i: i64 = 0
390 while i < rows {
391 let m: *u8 = ((buf as i64) + moff[i]) as *u8
392 if crg_streq(m, mirror) == 1 {
393 var p: i64 = moff[i]
394 var f: i64 = 0
395 while f < CRG_PROV_HFIELD - CRG_PROV_MFIELD {
396 while buf[p] != (0 as u8) { p = p + 1 }
397 p = p + 1
398 f = f + 1
399 }
400 return crg_num_parse(((buf as i64) + p) as *u8)
401 }
402 i = i + 1
403 }
404 return 0 - 1
405}
406// 2 PROVEN . 1 MISMATCH . 0 UNPROVEN. NEVER collapse 1 and 0: a contradiction and a pre-journal mirror
407// take OPPOSITE remedies, and a two-state answer would have to pick one of them to lie about.
408func crg_prov_state(buf: *u8, uoff: *i64, moff: *i64, rows: i64, url: *u8, mirror: *u8) -> i64 {
409 var seen: i64 = 0
410 var i: i64 = 0
411 while i < rows {
412 let m: *u8 = ((buf as i64) + moff[i]) as *u8
413 if crg_streq(m, mirror) == 1 {
414 seen = 1
415 let u: *u8 = ((buf as i64) + uoff[i]) as *u8
416 if crg_streq(u, url) == 1 { return 2 }
417 }
418 i = i + 1
419 }
420 if seen == 1 { return 1 }
421 return 0
422}
423func crg_num_parse(s: *u8) -> i64 {
424 var v: i64 = 0
425 var i: i64 = 0
426 var any: i64 = 0
427 while s[i] != (0 as u8) {
428 let c: i64 = s[i] as i64
429 if c >= 48 { if c <= 57 { v = v*10 + (c - 48); any = 1 } }
430 i = i + 1
431 }
432 if any == 0 { return 0 - 1 }
433 return v
434}
435func crg_num_fmt(dst: *u8, v: i64) -> i64 {
436 if v == 0 { dst[0] = 48 as u8; dst[1] = 10 as u8; dst[2] = 0 as u8; return 2 }
437 let d: *u8 = sys_mmap(24)
438 var m: i64 = v
439 var k: i64 = 0
440 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
441 var i: i64 = 0
442 while i < k { dst[i] = d[k-1-i]; i = i + 1 }
443 dst[k] = 10 as u8
444 dst[k+1] = 0 as u8
445 return k + 1
446}
447// A SECOND PASS over the same .refs file, deliberately NOT folded into crg_scan: changing that function's
448// signature would leave every intermediate edit state uncompilable and would put a new question inside a
449// proven counter. Same rows, different question, composed from the same crg_split.
450// CE10 HALF TWO (2026-09-05): CANONICAL-URL COMPARISON. A redirected mirror is MOVED only when its own
451// canonical (rel=canonical link href, else og:url content) names a DIFFERENT page than the row url; a
452// scheme, leading-www or trailing-slash hop is BENIGN; a body with no canonical is UNKNOWN and abstains.
453// The head read is bounded and the token must sit INSIDE a tag (an anchor whose TEXT says canonical is
454// not a canonical), so an inline mention cannot forge one. Buffers are allocated ONCE in main (pv slots).
455const CRG_CANON_HEAD: i64 = 16384
456const CRG_CANON_TAGSPAN: i64 = 512
457const CRG_CANON_URLCAP: i64 = 2048
458const CRG_MOVED_WORKLIST: *u8 = "knowledge/status/refs_moved.txt"
459const CRG_MOVED_RATCHET: *u8 = "knowledge/status/refs_moved_ratchet.conf"
460const CRG_MOVED_SNAP: *u8 = "knowledge/status/refs_moved.at_baseline.txt"
461// canonical reader return-code magnitudes (returned NEGATED): the window ended before the head closed with no tag seen
462const CRG_CANON_RC_TRUNC: i64 = 2
463// og:url is a social-card hint, not a canonicalisation: many sites set it SITE-WIDE (dora.dev's guide pages carry og:url
464// = the homepage), so a mirror whose only tag is og:url is named OG-URL-ONLY and never MOVED (measured 2026-09-05: two
465// correctly re-cited DORA rows read MOVED purely from that fallback)
466const CRG_CANON_RC_OGONLY: i64 = 3
467// room for the NUL terminator on an mmap'd text buffer sized from a cap
468const CRG_NUL_SLACK: i64 = 16
469// canonical bite: head bytes placed BEFORE the in-window tag, so a reader that only looks at offset 0 cannot pass
470const CRG_CANON_BITE_LEAD: i64 = 1024
471// canonical bite: fixture buffer headroom beyond two head windows (markup plus terminator)
472const CRG_CANON_BITE_SLACK: i64 = 4096
473// canonical bite: the byte the fixtures pad with (ASCII x) -- never a tag opener, so no tag can form inside the filler
474const CRG_BITE_FILL_BYTE: i64 = 120
475// the MOVED ratchet re-baselines on a WRITTEN DIRECTIVE (conf content starting with this byte, r for rebaseline),
476// announced verbatim in the run -- a blind instrument's baseline is re-taken with its reason, never by a bare number
477const CRG_REBASELINE_BYTE: i64 = 114
478func crg_bfind(buf: *u8, n: i64, from: i64, needle: *u8) -> i64 {
479 let nl: i64 = crg_slen(needle)
480 if nl == 0 { return 0 - 1 }
481 var i: i64 = from
482 while i + nl <= n {
483 var k: i64 = 0
484 var ok: i64 = 1
485 while k < nl { if buf[i + k] != needle[k] { ok = 0; k = nl } else { k = k + 1 } }
486 if ok == 1 { return i }
487 i = i + 1
488 }
489 return 0 - 1
490}
491// the quoted (or bare) value of attr= inside [s,e) copied into out; 0 when absent
492func crg_tag_attr(buf: *u8, s: i64, e: i64, attr: *u8, out: *u8, cap: i64) -> i64 {
493 let a: i64 = crg_bfind(buf, e, s, attr)
494 if a < 0 { return 0 }
495 var p: i64 = a + crg_slen(attr)
496 if p >= e { return 0 }
497 var q: i64 = 0
498 if buf[p] == (34 as u8) { q = 34; p = p + 1 }
499 if buf[p] == (39 as u8) { q = 39; p = p + 1 }
500 var o: i64 = 0
501 while p < e {
502 let c: i64 = buf[p] as i64
503 var stop: i64 = 0
504 if q != 0 { if c == q { stop = 1 } }
505 if q == 0 { if c == 32 { stop = 1 } if c == 62 { stop = 1 } }
506 if stop == 1 { p = e } else {
507 if o < cap - 1 { out[o] = c as u8; o = o + 1 }
508 p = p + 1
509 }
510 }
511 out[o] = 0 as u8
512 return o
513}
514// attr value of the TAG that encloses offset c; 0 when c is not inside a tag or the tag lacks attr
515func crg_tag_span_attr(hbuf: *u8, n: i64, c: i64, attr: *u8, out: *u8) -> i64 {
516 var ts: i64 = c
517 var lim: i64 = c - CRG_CANON_TAGSPAN
518 if lim < 0 { lim = 0 }
519 var go: i64 = 1
520 var inside: i64 = 0
521 while go == 1 {
522 if ts < lim { go = 0 } else {
523 if hbuf[ts] == (60 as u8) { go = 0; inside = 1 } else {
524 if hbuf[ts] == (62 as u8) { go = 0 } else { ts = ts - 1 }
525 }
526 }
527 }
528 if inside == 0 { return 0 }
529 var te: i64 = c
530 var hi: i64 = c + CRG_CANON_TAGSPAN
531 if hi > n { hi = n }
532 var go2: i64 = 1
533 while go2 == 1 {
534 if te >= hi { go2 = 0 } else {
535 if hbuf[te] == (62 as u8) { go2 = 0 } else { te = te + 1 }
536 }
537 }
538 if te >= hi { return 0 }
539 return crg_tag_attr(hbuf, ts, te, attr, out, CRG_CANON_URLCAP)
540}
541// canonical of a mirror into out: length, 0 when the head carries none, -1 when unreadable
542// 2026-09-05: the canonical tag lives in <head>, so the honest read is a HEAD WINDOW, never a whole-file read
543// behind a cap: the cap reader REFUSED 30 of 33 redirected mirrors and the detector was vacuous on real pages
544// while printing CANON-UNKNOWN as if it had looked. Reads at most cap-1 bytes; the caller decides whether the
545// head CLOSED inside the window (EOF, </head> or <body>) so an absent tag is NONE only when the head was seen whole.
546func crg_read_head(path: *u8, buf: *u8, cap: i64) -> i64 {
547 let fd: i64 = sys_openat_rd(path)
548 if fd < 0 { return 0 - 1 }
549 var t: i64 = 0
550 var go: i64 = 1
551 while go == 1 {
552 let r: i64 = sys_read(fd, ((buf as i64) + t) as *u8, cap - 1 - t)
553 if r <= 0 { go = 0 }
554 if go == 1 { t = t + r; if t >= cap - 1 { go = 0 } }
555 }
556 sys_close(fd)
557 buf[t] = 0 as u8
558 return t
559}
560// canonical url of a mirror: >0 length of out (rel=canonical href, else og:url content) . 0 NONE in a head seen
561// whole . -1 unreadable . -2 the window ended before the head closed and no tag was seen (TRUNCATED, never NONE)
562func crg_canon_of_mirror(mirror: *u8, hbuf: *u8, out: *u8) -> i64 {
563 let n: i64 = crg_read_head(mirror, hbuf, CRG_CANON_HEAD)
564 if n <= 0 { return 0 - 1 }
565 var c: i64 = crg_bfind(hbuf, n, 0, "canonical" as *u8)
566 while c >= 0 {
567 let l: i64 = crg_tag_span_attr(hbuf, n, c, "href=" as *u8, out)
568 if l > 0 { return l }
569 c = crg_bfind(hbuf, n, c + 1, "canonical" as *u8)
570 }
571 var g: i64 = crg_bfind(hbuf, n, 0, "og:url" as *u8)
572 while g >= 0 {
573 let l2: i64 = crg_tag_span_attr(hbuf, n, g, "content=" as *u8, out)
574 if l2 > 0 { return 0 - CRG_CANON_RC_OGONLY }
575 g = crg_bfind(hbuf, n, g + 1, "og:url" as *u8)
576 }
577 if n < CRG_CANON_HEAD - 1 { return 0 }
578 if crg_bfind(hbuf, n, 0, "</head>" as *u8) >= 0 { return 0 }
579 if crg_bfind(hbuf, n, 0, "<body" as *u8) >= 0 { return 0 }
580 return 0 - CRG_CANON_RC_TRUNC
581}
582// normalised equality: the scheme, a leading www. and one trailing slash are not a move
583func crg_url_skip(u: *u8) -> i64 {
584 var p: i64 = 0
585 let sch: i64 = crg_bfind(u, crg_slen(u), 0, "://" as *u8)
586 if sch >= 0 { p = sch + 3 }
587 if u[p] == (119 as u8) { if u[p + 1] == (119 as u8) { if u[p + 2] == (119 as u8) { if u[p + 3] == (46 as u8) { p = p + 4 } } } }
588 return p
589}
590// copies u[p..l) into out with every RUN of slashes collapsed to one and a trailing slash dropped; returns the length.
591// 2026-09-05: bevy.org// and bevy.org//news/ are the site's own canonical tags -- a slash run is not a move.
592func crg_url_canon(u: *u8, p: i64, l: i64, out: *u8) -> i64 {
593 var o: i64 = 0
594 var i: i64 = p
595 while i < l {
596 let c: i64 = u[i] as i64
597 var emit: i64 = 1
598 if c == 47 { if o > 0 { if out[o - 1] == (47 as u8) { emit = 0 } } }
599 if emit == 1 { out[o] = c as u8; o = o + 1 }
600 i = i + 1
601 }
602 if o > 0 { if out[o - 1] == (47 as u8) { o = o - 1 } }
603 out[o] = 0 as u8
604 return o
605}
606func crg_url_norm_eq(a: *u8, b: *u8) -> i64 {
607 let na: *u8 = sys_mmap(CRG_CANON_URLCAP + CRG_NUL_SLACK)
608 let nb: *u8 = sys_mmap(CRG_CANON_URLCAP + CRG_NUL_SLACK)
609 let la: i64 = crg_url_canon(a, crg_url_skip(a), crg_slen(a), na)
610 let lb: i64 = crg_url_canon(b, crg_url_skip(b), crg_slen(b), nb)
611 if la != lb { return 0 }
612 var i: i64 = 0
613 while i < la { if na[i] != nb[i] { return 0 } i = i + 1 }
614 return 1
615}
616// pv: 0 jrnl-buf . 1 uoff . 2 moff . 3 rows . 4 worklist-fd . 5 proven . 6 mismatch . 7 unproven . 8 redirected . 9 redir-fd . 10 canon-head-buf . 11 canon-url-buf . 12 moved . 13 benign . 14 canon-unknown . 15 moved-fd
617func crg_prov_pass(path: *u8, _cbuf: *u8, cap: i64, pv: *i64) -> i64 {
618 // 2026-09-04: composes sys_read_file -- the buffer is sized from the file (lseek END) and cannot
619 // short-read, so a board/register of ANY size is read whole. The caller's CRG_CAP window (_cbuf) is
620 // deliberately unused; the signature is kept so no call site moves. lang.plan measured 187,305 B and
621 // grew ~23 KB in a day against the 262,144 B window -- a silent cap here would drop its tail marks.
622 let fl: *i64 = sys_mmap(16) as *i64
623 fl[0] = 0
624 let buf: *u8 = sys_read_file(path, fl)
625 let n: i64 = fl[0]
626 if (buf as i64) == 0 { return 0 }
627 if n <= 0 { return 0 }
628 let fld: *i64 = sys_mmap(96) as *i64
629 let dom: *u8 = rp_domname(path)
630 let uptag: *u8 = "UNPROVEN " as *u8
631 let sp: *u8 = " " as *u8
632 let nl: *u8 = "\n" as *u8
633 var p: i64 = 0
634 while p < n {
635 var e: i64 = p
636 var scanning: i64 = 1
637 while scanning == 1 {
638 if e >= n { scanning = 0 }
639 if scanning == 1 { if buf[e] == (10 as u8) { scanning = 0 } else { e = e + 1 } }
640 }
641 buf[e] = 0 as u8
642 let line: *u8 = ((buf as i64) + p) as *u8
643 p = e + 1
644 var skip: i64 = 0
645 if line[0] == (0 as u8) { skip = 1 }
646 if line[0] == (35 as u8) { skip = 1 }
647 if skip == 0 {
648 let nf: i64 = crg_split(line, fld, 12)
649 if crg_streq(fld[0] as *u8, "ref" as *u8) == 1 { if nf >= 9 {
650 let mir: *u8 = fld[4] as *u8
651 if crg_streq(mir, "-" as *u8) == 0 {
652 let url: *u8 = fld[3] as *u8
653 let key: *u8 = fld[1] as *u8
654 let stt: i64 = crg_prov_state(pv[0] as *u8, pv[1] as *i64, pv[2] as *i64, pv[3], url, mir)
655 if stt == 2 { pv[5] = pv[5] + 1 }
656 // CE10 (2026-09-05): a PROVEN mirror whose fetch followed a redirect may be a DIFFERENT page than the
657 // cited url (the Faros /ai-impact page redirects to the homepage and was pinned as evidence). Counted,
658 // NAMED, ratcheted -- never refused: a moved page is a worklist row, not a takedown of the board.
659 if stt == 2 {
660 let hops: i64 = crg_prov_hops(pv[0] as *u8, pv[2] as *i64, pv[3], mir)
661 if hops > 0 {
662 pv[8] = pv[8] + 1
663 gv_puts(" PROV-REDIRECTED domain=" as *u8); gv_puts(dom)
664 gv_puts(" key=" as *u8); gv_puts(key)
665 gv_puts(" mirror=" as *u8); gv_puts(mir)
666 gv_puts(" hops=" as *u8); gv_num(hops)
667 gv_puts(" -- the fetch followed a redirect, so this mirror may be a different page than the cited url; read its canonical before treating it as the cited page\n" as *u8)
668 let cl: i64 = crg_canon_of_mirror(mir, pv[10] as *u8, pv[11] as *u8)
669 var cls: *u8 = "CANON-UNKNOWN" as *u8
670 if cl > 0 {
671 if cr_canonical_moved(cl, pv[11] as *u8, url) == 1 { cls = "MOVED" as *u8; pv[12] = pv[12] + 1 } else { cls = "BENIGN-HOP" as *u8; pv[13] = pv[13] + 1 }
672 } else {
673 // 2026-09-05: three distinguishable negatives share ONE partition bucket (pv[14]) so the sum
674 // tooth holds; the REASON travels on the row and in pv[16..18] so the summary can split it.
675 pv[14] = pv[14] + 1
676 if cl == 0 { cls = "CANON-NONE-IN-HEAD" as *u8; pv[16] = pv[16] + 1 }
677 if cl == (0 - CRG_CANON_RC_TRUNC) { cls = "CANON-HEAD-TRUNCATED" as *u8; pv[17] = pv[17] + 1 }
678 if cl == (0 - 1) { cls = "CANON-UNREADABLE" as *u8; pv[18] = pv[18] + 1 }
679 if cl == (0 - CRG_CANON_RC_OGONLY) { cls = "CANON-OG-URL-ONLY" as *u8; pv[19] = pv[19] + 1 }
680 }
681 // OPEN = not acquitted by its own canonical: MOVED or any CANON-UNKNOWN reason. One NAMED row each, the class ON the row,
682 // so the open worklist can be triaged without re-running the gate. BENIGN-HOP rows are censused, never ratcheted.
683 var isopen: i64 = 1
684 if cl > 0 { if crg_url_norm_eq(pv[11] as *u8, url) == 1 { isopen = 0 } }
685 if isopen == 1 {
686 let ofd: i64 = pv[20]
687 if ofd >= 0 {
688 let otag: *u8 = "OPEN-REDIRECT " as *u8
689 sys_write(ofd, otag, crg_slen(otag))
690 sys_write(ofd, dom, crg_slen(dom))
691 sys_write(ofd, sp, crg_slen(sp))
692 sys_write(ofd, key, crg_slen(key))
693 sys_write(ofd, sp, crg_slen(sp))
694 sys_write(ofd, mir, crg_slen(mir))
695 sys_write(ofd, sp, crg_slen(sp))
696 sys_write(ofd, cls, crg_slen(cls))
697 sys_write(ofd, nl, crg_slen(nl))
698 }
699 }
700 gv_puts(" canonical=" as *u8); gv_puts(cls)
701 if cl > 0 { gv_puts(" " as *u8); gv_puts(pv[11] as *u8) }
702 gv_puts("\n" as *u8)
703 if cl > 0 { if crg_url_norm_eq(pv[11] as *u8, url) == 0 {
704 let mfd2: i64 = pv[15]
705 if mfd2 >= 0 {
706 let mtag: *u8 = "MOVED " as *u8
707 sys_write(mfd2, mtag, crg_slen(mtag))
708 sys_write(mfd2, dom, crg_slen(dom))
709 sys_write(mfd2, sp, crg_slen(sp))
710 sys_write(mfd2, key, crg_slen(key))
711 sys_write(mfd2, sp, crg_slen(sp))
712 sys_write(mfd2, mir, crg_slen(mir))
713 sys_write(mfd2, sp, crg_slen(sp))
714 sys_write(mfd2, pv[11] as *u8, crg_slen(pv[11] as *u8))
715 sys_write(mfd2, nl, crg_slen(nl))
716 }
717 } }
718 let rfd: i64 = pv[9]
719 if rfd >= 0 {
720 let rtag: *u8 = "REDIRECTED " as *u8
721 sys_write(rfd, rtag, crg_slen(rtag))
722 sys_write(rfd, dom, crg_slen(dom))
723 sys_write(rfd, sp, crg_slen(sp))
724 sys_write(rfd, key, crg_slen(key))
725 sys_write(rfd, sp, crg_slen(sp))
726 sys_write(rfd, mir, crg_slen(mir))
727 sys_write(rfd, nl, crg_slen(nl))
728 }
729 }
730 }
731 if stt == 1 {
732 pv[6] = pv[6] + 1
733 gv_puts(" PROV-MISMATCH domain=" as *u8); gv_puts(dom)
734 gv_puts(" key=" as *u8); gv_puts(key)
735 gv_puts(" mirror=" as *u8); gv_puts(mir)
736 gv_puts(" row_url=" as *u8); gv_puts(url)
737 gv_puts(" -- the fetch journal holds this mirror under a DIFFERENT url\n" as *u8)
738 }
739 if stt == 0 {
740 pv[7] = pv[7] + 1
741 let wfd: i64 = pv[4]
742 if wfd >= 0 {
743 sys_write(wfd, uptag, crg_slen(uptag))
744 sys_write(wfd, dom, crg_slen(dom))
745 sys_write(wfd, sp, crg_slen(sp))
746 sys_write(wfd, key, crg_slen(key))
747 sys_write(wfd, sp, crg_slen(sp))
748 sys_write(wfd, mir, crg_slen(mir))
749 sys_write(wfd, nl, crg_slen(nl))
750 }
751 }
752 }
753 } }
754 }
755 }
756 return 0
757}
758func crg_w(path: *u8, s: *u8) -> i64 {
759 let fd: i64 = sys_openat_wr(path, MODE_0644)
760 if fd < 0 { return 0 }
761 let n: i64 = crg_slen(s)
762 let w: i64 = sys_write(fd, s, n)
763 sys_close(fd)
764 if w == n { return 1 }
765 return 0
766}
767// ---- WORKLIST SNAPSHOT: make the comparison this gate's own header already promises PERFORMABLE.
768//
769// The ratchet header states its imprecision honestly -- the baseline is a COUNT, so a RISE says how
770// many and not which -- and it correctly REFUSED a 600-name conf as a second ruler beside a 600-row
771// worklist. That judgement stands and is not overridden here. What it also says is that the diff a
772// name-set would give is "one file comparison away", and that comparison was NOT PERFORMABLE,
773// because nothing retained the worklist as it stood WHEN THE BAR WAS SET. This retains it.
774//
775// IT IS NOT A SECOND AUTHORITY: same worklist, same writer, no new number and no new verdict --
776// only the other operand of a comparison the header already promised. The numeric tooth is
777// untouched, so nothing here can turn a RED green.
778// MEASURED COST OF ITS ABSENCE, 2026-08-25: a rise of 2 unproven mirrors on a tree with EIGHT
779// concurrent seats could not be attributed to any row by anyone, including the seat that looked.
780const CRG_PROV_SNAP: *u8 = "knowledge/status/refs_provenance_unproven.at_baseline.txt"
781const CRG_MIR_SNAP: *u8 = "knowledge/status/refs_mirror_incomplete.at_baseline.txt"
782
783func crg_snap(src: *u8, dst: *u8) -> i64 {
784 let b: *u8 = sys_mmap(CRG_CAP)
785 let n: i64 = crg_read(src, b, CRG_CAP)
786 if n < 0 { return 0 }
787 b[n] = 0 as u8
788 return crg_w(dst, b)
789}
790
791// Name every CURRENT offender absent from the snapshot. Substring membership is sufficient and is
792// DECLARED as such rather than implied: each worklist line carries a domain, a key and a mirror
793// path, so a whole line is distinctive within its own file. When no snapshot exists the answer is
794// UNAVAILABLE and is printed as such -- never silently zero, which would read as "nothing is new".
795// Count newline-terminated rows in a buffer. The attributor needs this to answer a question its first
796// version could not even ask: does the snapshot it is reading actually CORRESPOND to the bar it is
797// explaining?
798func crg_nlines(b: *u8, n: i64) -> i64 {
799 var c: i64 = 0
800 var i: i64 = 0
801 while i < n {
802 if b[i] == (10 as u8) { c = c + 1 }
803 i = i + 1
804 }
805 return c
806}
807// 2026-09-05: rows in a worklist the gate itself just wrote, for the state teeth that pin a WRITTEN worklist to its
808// COUNTER (test the state, not the message). A worklist that could not be opened reads -1 here and the tooth fails honestly.
809func crg_nlcount_file(path: *u8) -> i64 {
810 let b: *u8 = sys_mmap(CRG_CAP)
811 let n: i64 = crg_read(path, b, CRG_CAP)
812 if n < 0 { return n }
813 return crg_nlines(b, n)
814}
815func crg_attrib(cur: *u8, snap: *u8, tag: *u8, bar: i64) -> i64 {
816 let sb: *u8 = sys_mmap(CRG_CAP)
817 let sn: i64 = crg_read(snap, sb, CRG_CAP)
818 if sn <= 0 {
819 gv_puts(" " as *u8); gv_puts(tag)
820 gv_puts("-ATTRIB UNAVAILABLE -- no worklist snapshot was retained when this bar was set, so a rise cannot be attributed to a row. One is written on the next baseline or tighten.\n" as *u8)
821 return 0 - 1
822 }
823 // THE SNAPSHOT MUST CORRESPOND TO THE BAR IT EXPLAINS, AND UNTIL 2026-08-28 NOTHING CHECKED THAT.
824 // Both artifacts are written TOGETHER by the baseline and tighten paths, so a snapshot whose row
825 // count differs from the bar means the pair was broken by something outside those paths. In that
826 // state the naming loop below is worse than useless: every current offender is found in the larger
827 // snapshot, so it prints NAMED NOTHING and reports the rise as the same set measured against an
828 // older bar -- the most reassuring sentence it can emit, and untrue. MEASURED on live data the day
829 // this guard was written: bar=610 against a 612-row snapshot byte-identical to the current
830 // worklist, on a gate that had been RED with a silent explanation ever since.
831 // AN ATTRIBUTOR THAT CANNOT ATTRIBUTE MUST SAY SO RATHER THAN ACQUIT.
832 let srows: i64 = crg_nlines(sb, sn)
833 if bar >= 0 {
834 if srows != bar {
835 gv_puts(" " as *u8); gv_puts(tag)
836 gv_puts("-ATTRIB SNAPSHOT INCONSISTENT snapshot_rows=" as *u8); gv_num(srows)
837 gv_puts(" bar=" as *u8); gv_num(bar)
838 gv_puts(" -- the snapshot does not correspond to the bar it explains, so this rise CANNOT be attributed and no naming below would be evidence. REPAIR by letting the ratchet TIGHTEN, which rewrites bar and snapshot together; do NOT hand-edit the bar to match the count, which is exactly the laundering this ratchet exists to prevent.\n" as *u8)
839 return 0 - 2
840 }
841 }
842 let cb: *u8 = sys_mmap(CRG_CAP)
843 let cn: i64 = crg_read(cur, cb, CRG_CAP)
844 if cn <= 0 { return 0 }
845 var named: i64 = 0
846 var p: i64 = 0
847 while p < cn {
848 var e: i64 = p
849 var scanning: i64 = 1
850 while scanning == 1 {
851 if e >= cn { scanning = 0 }
852 if scanning == 1 { if cb[e] == (10 as u8) { scanning = 0 } else { e = e + 1 } }
853 }
854 cb[e] = 0 as u8
855 let line: *u8 = ((cb as i64) + p) as *u8
856 p = e + 1
857 if line[0] != (0 as u8) {
858 if crg_has(sb, sn, line) == 0 {
859 gv_puts(" " as *u8); gv_puts(tag); gv_puts("-ROSE-NEW " as *u8)
860 gv_puts(line); gv_puts("\n" as *u8)
861 named = named + 1
862 }
863 }
864 }
865 // NEVER SILENTLY ZERO -- the header above promises exactly this and the first cut BROKE it. When
866 // nothing was named the function returned without printing, so "ran and found nothing new" was
867 // byte-identical in the output to "never ran", and a sibling lane consequently and CORRECTLY
868 // reported this mechanism as INOPERATIVE on live data. Naming nothing is a REAL finding and a
869 // DIFFERENT one: the offender SET is unchanged, so the rise is the same rows measured against an
870 // older bar rather than new rows arriving.
871 if named == 0 {
872 gv_puts(" " as *u8); gv_puts(tag)
873 gv_puts("-ATTRIB RAN, NAMED NOTHING -- every current offender is present in the snapshot, so this rise is the SAME SET measured against an older bar, not new rows arriving.\n" as *u8)
874 }
875 return named
876}
877
878// cr_canonical_moved -- THE CE10 PREDICATE, named because the codeeffectiveness watch row measures this symbol:
879// 1 iff the mirror carries a readable canonical (cl > 0) that, normalised, names a DIFFERENT page than the cited
880// url -- a genuine MOVE. A benign scheme/www/slash hop reads 0; no readable canonical (cl <= 0) is NOT a move,
881// it is CANON-UNKNOWN and the row loop names which reason. Defined after crg_url_norm_eq, before its one caller.
882func cr_canonical_moved(cl: i64, canon: *u8, url: *u8) -> i64 {
883 if cl <= 0 { return 0 }
884 if crg_url_norm_eq(canon, url) == 1 { return 0 }
885 return 1
886}
887
888func main() -> i64 {
889 let ctr: *i64 = gv_ctr()
890 gv_head("=== NX-COMPARE-REFS-GATE -- the citations register is measured, never trusted ===" as *u8)
891 let buf: *u8 = sys_mmap(CRG_CAP)
892 var keys: *u8 = sys_mmap(CRG_KMAX * CRG_KLEN)
893 // 20 slots: the completeness axis added 8..12 and a worklist fd at 13. The old 96-byte block was
894 // EXACTLY 12 slots, so writing slot 13 into it would have run off the end.
895 let st: *i64 = sys_mmap(256) as *i64
896 var zi: i64 = 0
897 while zi < 20 { st[zi] = 0; zi = zi + 1 }
898 let mst: *i64 = sys_mmap(32) as *i64
899 mst[0] = 0
900 mst[1] = 0
901 mst[2] = 0
902 var unmarked: i64 = 0
903 var uncited: i64 = 0
904 var cited: *u8 = sys_mmap(CRG_KMAX)
905 // ---- FETCH-TIME PROVENANCE: load the journal ONCE, before any register is read ----
906 // FIXED 2026-09-04. This read wore CRG_CAP (262144), one constant shared by NINE unrelated reads in
907 // this file, and the provenance journal crossed it the day 33 new mirrors were admitted -- so the
908 // gate printed PROV-JOURNAL-TRUNCATED, abstained (correctly), and reported the ratchet RISING on 29
909 // rows that were IN the journal but past the window. A CAP IS NOT A NUMBER TO TUNE; sys_read_file
910 // sizes its buffer from the file and cannot short-read, so the truncated state is retired BY
911 // CONSTRUCTION and the tooth below keeps only its honest half: absent still fails it.
912 let pjl: *i64 = sys_mmap(16) as *i64
913 pjl[0] = 0
914 var pjb: *u8 = sys_read_file(CRG_PROV_PATH, pjl)
915 var pjn: i64 = pjl[0]
916 if (pjb as i64) == 0 { pjb = sys_mmap(CRG_PROV_MINROW); pjn = 0 }
917 var pcapped: i64 = 0
918 if pcapped == 1 { gv_puts(" PROV-JOURNAL-TRUNCATED: the journal filled this reader's window, so the provenance verdict below is UNOBSERVABLE and NOT clean -- an axis that cannot see must abstain, not acquit\n" as *u8) }
919 var psz: i64 = pjn
920 if psz < CRG_PROV_MINROW { psz = CRG_PROV_MINROW }
921 let pu: *i64 = sys_mmap(psz + CRG_PROV_MINROW) as *i64
922 let pm: *i64 = sys_mmap(psz + CRG_PROV_MINROW) as *i64
923 var prows: i64 = 0
924 if pjn > 0 { prows = crg_prov_index(pjb, pjn, pu, pm) }
925 let pv: *i64 = sys_mmap(256) as *i64
926 pv[0] = pjb as i64
927 pv[1] = pu as i64
928 pv[2] = pm as i64
929 pv[3] = prows
930 pv[5] = 0
931 pv[6] = 0
932 pv[7] = 0
933 pv[8] = 0
934 // CE10: the redirected worklist is truncate-written per run like its prov sibling (one NAMED row per redirected mirror)
935 pv[9] = sys_openat_wr(CRG_REDIR_WORKLIST, MODE_0644)
936 pv[20] = sys_openat_wr(CRG_OPEN_WORKLIST, MODE_0644)
937 // CE10 half two: canonical buffers allocated ONCE (never in the row loop), counters zeroed, moved worklist truncate-written
938 pv[10] = sys_mmap(CRG_CANON_HEAD + 16) as i64
939 pv[11] = sys_mmap(CRG_CANON_URLCAP + 16) as i64
940 pv[12] = 0
941 pv[13] = 0
942 pv[14] = 0
943 pv[16] = 0
944 pv[17] = 0
945 pv[18] = 0
946 pv[19] = 0
947 pv[15] = sys_openat_wr(CRG_MOVED_WORKLIST, MODE_0644)
948 let pwfd: i64 = sys_openat_wr(CRG_PROV_WORKLIST, MODE_0644)
949 pv[4] = pwfd
950 let mwfd: i64 = sys_openat_wr(CRG_MIR_WORKLIST, MODE_0644)
951 st[13] = mwfd
952 let dfd: i64 = sys_openat_rd("buildroot/knowledge/compare" as *u8)
953 if gv_need("compare data dir readable from this CWD" as *u8, (dfd >= 0) as i64, ctr) == 0 { return gv_verdict("comparerefs" as *u8, ctr, "precondition missing" as *u8) }
954 let db: *u8 = sys_mmap(CRG_DIRBUF)
955 let pathb: *u8 = sys_mmap(CRG_PATH)
956 var files: i64 = 0
957 var reading: i64 = 1
958 while reading == 1 {
959 let nd: i64 = sys_getdents64(dfd, db, CRG_DIRBUF)
960 if nd <= 0 { reading = 0 }
961 if reading == 1 {
962 var off: i64 = 0
963 while off < nd {
964 let rec: *u8 = ((db as i64) + off) as *u8
965 let rl: i64 = dirent_reclen(rec)
966 let nm: *u8 = dirent_name(rec)
967 let ln: i64 = crg_slen(nm)
968 var isrefs: i64 = 0
969 if ln > 5 { if nm[ln-5] == (46 as u8) { if nm[ln-4] == (114 as u8) { if nm[ln-3] == (101 as u8) { if nm[ln-2] == (102 as u8) { if nm[ln-1] == (115 as u8) { isrefs = 1 } } } } } }
970 if isrefs == 1 {
971 files = files + 1
972 var po: i64 = 0
973 let pre: *u8 = "buildroot/knowledge/compare/" as *u8
974 var pz: i64 = 0
975 while pre[pz] != (0 as u8) { pathb[po] = pre[pz]; po = po + 1; pz = pz + 1 }
976 var nz: i64 = 0
977 while nm[nz] != (0 as u8) { pathb[po] = nm[nz]; po = po + 1; nz = nz + 1 }
978 pathb[po] = 0 as u8
979 // KEY TABLE SIZED FROM THE REGISTER (2026-09-16). CRG_KMAX=64 silently dropped every key past the
980 // 64th (aesthetictwin declared more), so their marks read UNRESOLVED and their rows were never counted
981 // UNCITED -- a fixed-cap reader deleting its own tail. Slots derive from the register bytes.
982 let kszl: *i64 = sys_mmap(16) as *i64
983 kszl[0] = 0
984 let kszb: *u8 = sys_read_file(pathb, kszl)
985 var kslots: i64 = kszl[0] / CRG_REF_MINROW + 1
986 if (kszb as i64) != 0 { sys_free_file(kszb, kszl[0]) }
987 if kslots < CRG_KMAX { kslots = CRG_KMAX }
988 keys = sys_mmap(kslots * CRG_KLEN)
989 cited = sys_mmap(kslots)
990 let nk: i64 = crg_scan(pathb, buf, CRG_CAP, keys, kslots, st)
991 crg_prov_pass(pathb, buf, CRG_CAP, pv)
992 var zc: i64 = 0
993 while zc < kslots { cited[zc] = 0 as u8; zc = zc + 1 }
994 var cut: i64 = po - 5
995 pathb[cut] = 0 as u8
996 var mo: i64 = cut
997 let mx: *u8 = ".matrix" as *u8
998 var mzz: i64 = 0
999 while mx[mzz] != (0 as u8) { pathb[mo] = mx[mzz]; mo = mo + 1; mzz = mzz + 1 }
1000 pathb[mo] = 0 as u8
1001 crg_marks(pathb, buf, CRG_CAP, keys, nk, mst, cited)
1002 pathb[cut] = 0 as u8
1003 mo = cut
1004 let pl: *u8 = ".plan" as *u8
1005 mzz = 0
1006 while pl[mzz] != (0 as u8) { pathb[mo] = pl[mzz]; mo = mo + 1; mzz = mzz + 1 }
1007 pathb[mo] = 0 as u8
1008 crg_marks(pathb, buf, CRG_CAP, keys, nk, mst, cited)
1009 // .sota is a RENDERED source too (nx_swcompare_sota refs_pass ported 2026-08-18): the nine
1010 // sota-class domains carry their axis notes there, so a [@key] mark in a .sota that names
1011 // no declared ref must fail this gate exactly as a .matrix mark does.
1012 pathb[cut] = 0 as u8
1013 mo = cut
1014 let sx: *u8 = ".sota" as *u8
1015 mzz = 0
1016 while sx[mzz] != (0 as u8) { pathb[mo] = sx[mzz]; mo = mo + 1; mzz = mzz + 1 }
1017 pathb[mo] = 0 as u8
1018 crg_marks(pathb, buf, CRG_CAP, keys, nk, mst, cited)
1019 // PER-DOMAIN WORKLIST (2026-08-18): a fleet-wide marks= count cannot say WHICH domain
1020 // still cites nothing inline. mst[2] holds the running total BEFORE this domain; a
1021 // register that declares keys yet added zero marks across .matrix/.plan/.sota is
1022 // named on its own line, so the number is a worklist and not a headline.
1023 // per-key: every declared reference must be cited inline at least once across the domain's
1024 // rendered sources; each uncited key is NAMED (domain + key), so the number is a worklist.
1025 pathb[cut] = 0 as u8
1026 var dk: i64 = 0
1027 var dom_uncited: i64 = 0
1028 while dk < nk {
1029 if cited[dk] == (0 as u8) {
1030 gv_puts(" UNCITED domain=" as *u8); gv_puts(rp_domname(pathb)); gv_puts(" key=" as *u8); gv_puts(((keys as i64) + dk*CRG_KLEN) as *u8); gv_puts("\n" as *u8)
1031 dom_uncited = dom_uncited + 1
1032 }
1033 dk = dk + 1
1034 }
1035 uncited = uncited + dom_uncited
1036 if nk > 0 { if mst[0] == mst[2] { unmarked = unmarked + 1 } }
1037 mst[2] = mst[0]
1038 }
1039 off = off + rl
1040 }
1041 }
1042 }
1043 sys_close(dfd)
1044 gv_puts(" values: files=" as *u8); gv_num(files)
1045 gv_puts(" rows=" as *u8); gv_num(st[0])
1046 gv_puts(" malformed=" as *u8); gv_num(st[1])
1047 gv_puts(" dupkey=" as *u8); gv_num(st[2])
1048 gv_puts(" badurl=" as *u8); gv_num(st[3])
1049 gv_puts(" mirrors=" as *u8); gv_num(st[4])
1050 gv_puts(" missing=" as *u8); gv_num(st[5])
1051 gv_puts(" pins=" as *u8); gv_num(st[6])
1052 gv_puts(" matched=" as *u8); gv_num(st[7])
1053 gv_puts(" marks=" as *u8); gv_num(mst[0])
1054 gv_puts(" unresolved=" as *u8); gv_num(mst[1])
1055 gv_puts(" unmarked_domains=" as *u8); gv_num(unmarked)
1056 gv_puts(" uncited_keys=" as *u8); gv_num(uncited)
1057 gv_puts("\n" as *u8)
1058 gv_check("corpus-at-least-one-register-ten-rows" as *u8, ((files >= 1) as i64) & ((st[0] >= 10) as i64), ctr)
1059 gv_check("rows-well-formed-every-one" as *u8, ((st[1] == 0) as i64) & ((st[0] > 0) as i64), ctr)
1060 gv_check("keys-unique-every-register" as *u8, (st[2] == 0) as i64, ctr)
1061 gv_check("urls-http-every-row" as *u8, (st[3] == 0) as i64, ctr)
1062 gv_check("mirrors-exist-every-declared" as *u8, ((st[5] == 0) as i64) & ((st[4] >= 1) as i64), ctr)
1063 gv_check("pins-match-filehash-every-declared" as *u8, ((st[7] == st[6]) as i64) & ((st[6] >= 1) as i64), ctr)
1064 gv_check("cite-marks-resolve-every-one" as *u8, ((mst[1] == 0) as i64) & ((mst[0] >= 1) as i64), ctr)
1065 // every declared reference is cited inline at least once (bound to the row count so it cannot pass on
1066 // an empty corpus). Made a TOOTH the day the fleet reached 0 (2026-08-18) -- the day before it would
1067 // have been permanently RED, which is the detector everyone learns to ignore.
1068 gv_check("declared-refs-cited-inline-every-one" as *u8, ((uncited == 0) as i64) & ((st[0] > 0) as i64), ctr)
1069 sys_mkdir("/tmp/comparerefsgate" as *u8, MODE_0755)
1070 crg_w("/tmp/comparerefsgate/m.txt" as *u8, "mirror bytes\n" as *u8)
1071 crg_w("/tmp/comparerefsgate/good.refs" as *u8, "ref|alpha|Alpha citation prose.|https://example.org/a|/tmp/comparerefsgate/m.txt|-|-|published-paper|grounds alpha\nref|beta|Beta citation prose.|https://example.org/b|-|-|-|dataset|grounds beta\n" as *u8)
1072 crg_w("/tmp/comparerefsgate/bad.refs" as *u8, "ref|gamma|Gamma citation prose.|https://example.org/c|-|-|-|dataset|grounds gamma\nref|gamma|Duplicate key bad url.|notaurl|/tmp/comparerefsgate/absent.bin|-|-|dataset|grounds gamma dup\nref|delta|Seven fields only|https://example.org/d|-|-|-\n" as *u8)
1073 let gst: *i64 = sys_mmap(256) as *i64
1074 zi = 0
1075 while zi < 20 { gst[zi] = 0; zi = zi + 1 }
1076 gst[13] = 0 - 1
1077 let gkeys: *u8 = sys_mmap(CRG_KMAX * CRG_KLEN)
1078 let gnk: i64 = crg_scan("/tmp/comparerefsgate/good.refs" as *u8, buf, CRG_CAP, gkeys, CRG_KMAX, gst)
1079 let bst: *i64 = sys_mmap(256) as *i64
1080 zi = 0
1081 while zi < 20 { bst[zi] = 0; zi = zi + 1 }
1082 bst[13] = 0 - 1
1083 let bkeys: *u8 = sys_mmap(CRG_KMAX * CRG_KLEN)
1084 crg_scan("/tmp/comparerefsgate/bad.refs" as *u8, buf, CRG_CAP, bkeys, CRG_KMAX, bst)
1085 var fired: i64 = 0
1086 if bst[1] > 0 { if bst[2] > 0 { if bst[3] > 0 { if bst[5] > 0 { fired = 1 } } } }
1087 var goodfired: i64 = 0
1088 if gst[1] + gst[2] + gst[3] + gst[5] > 0 { goodfired = 1 }
1089 gv_bite("neg-control-scan-defects" as *u8, fired, goodfired, ctr)
1090 crg_w("/tmp/comparerefsgate/bad.mx" as *u8, "a row citing [@nope] which no register declares\n" as *u8)
1091 crg_w("/tmp/comparerefsgate/good.mx" as *u8, "a row citing [@alpha] which the good register declares\n" as *u8)
1092 let bmst: *i64 = sys_mmap(32) as *i64
1093 bmst[0] = 0
1094 bmst[1] = 0
1095 let ncited: *u8 = sys_mmap(CRG_KMAX)
1096 crg_marks("/tmp/comparerefsgate/bad.mx" as *u8, buf, CRG_CAP, gkeys, gnk, bmst, ncited)
1097 let gmst: *i64 = sys_mmap(32) as *i64
1098 gmst[0] = 0
1099 gmst[1] = 0
1100 crg_marks("/tmp/comparerefsgate/good.mx" as *u8, buf, CRG_CAP, gkeys, gnk, gmst, ncited)
1101 var mfired: i64 = 0
1102 if bmst[1] > 0 { mfired = 1 }
1103 var mgood: i64 = 0
1104 if gmst[1] > 0 { mgood = 1 }
1105 gv_bite("neg-control-dead-cite" as *u8, mfired, mgood, ctr)
1106 // ---- FETCH-TIME PROVENANCE: the join, its ratchet, its worklist and its bite ----
1107 if pwfd >= 0 { sys_close(pwfd) }
1108 gv_puts(" provenance: jrnl_rows=" as *u8); gv_num(prows)
1109 gv_puts(" proven=" as *u8); gv_num(pv[5])
1110 gv_puts(" mismatch=" as *u8); gv_num(pv[6])
1111 gv_puts(" unproven=" as *u8); gv_num(pv[7])
1112 gv_puts(" declared_mirrors=" as *u8); gv_num(st[4])
1113 gv_puts(" sum=" as *u8); gv_num(pv[5] + pv[6] + pv[7])
1114 gv_puts("\n" as *u8)
1115 // RATCHETED, NEVER ARMED. Every mirror captured before the journal existed reads UNPROVEN and is not a
1116 // defect; arming on unproven==0 would turn 68 domains RED in one step, which is the detector everyone
1117 // learns to ignore. The bar SELF-BASELINES on first sight (so the change is non-breaking by
1118 // construction) and TIGHTENS whenever the number falls (so it cannot be satisfied by standing still).
1119 // DECLARED IMPRECISION: the baseline is a COUNT, not a set of names, so a RISE says how many and not
1120 // which. The names are ALWAYS written to the worklist below, so the diff a name-set would give is one
1121 // file comparison away -- and a 600-name conf beside a 600-row worklist would be a second ruler.
1122 let rbuf: *u8 = sys_mmap(CRG_CAP)
1123 let rn: i64 = crg_read(CRG_PROV_RATCHET, rbuf, CRG_CAP)
1124 var baseline: i64 = 0 - 1
1125 if rn > 0 { baseline = crg_num_parse(rbuf) }
1126 var ratchet_ok: i64 = 1
1127 var attrib_rc: i64 = 0
1128 let nbuf: *u8 = sys_mmap(64)
1129 if baseline < 0 {
1130 crg_num_fmt(nbuf, pv[7])
1131 crg_w(CRG_PROV_RATCHET, nbuf)
1132 baseline = pv[7]
1133 crg_snap(CRG_PROV_WORKLIST, CRG_PROV_SNAP)
1134 gv_puts(" PROV-RATCHET SELF-BASELINED at " as *u8); gv_num(baseline)
1135 gv_puts(" (first sight -- non-breaking by construction)\n" as *u8)
1136 } else {
1137 if pv[7] > baseline {
1138 ratchet_ok = 0
1139 attrib_rc = crg_attrib(CRG_PROV_WORKLIST, CRG_PROV_SNAP, "PROV-RATCHET" as *u8, baseline)
1140 }
1141 if pv[7] < baseline {
1142 crg_num_fmt(nbuf, pv[7])
1143 crg_w(CRG_PROV_RATCHET, nbuf)
1144 crg_snap(CRG_PROV_WORKLIST, CRG_PROV_SNAP)
1145 gv_puts(" PROV-RATCHET TIGHTENED " as *u8); gv_num(baseline)
1146 gv_puts(" -> " as *u8); gv_num(pv[7]); gv_puts("\n" as *u8)
1147 baseline = pv[7]
1148 }
1149 }
1150 // CE10 REDIRECT RATCHET (2026-09-05): counts journalled-PROVEN mirrors whose fetch followed a redirect. Self-baselines
1151 // on first sight (non-breaking by construction), names every row in its worklist, and is RED only when the count
1152 // RISES -- a moved page cited yesterday is a worklist row, a new one is a regression. The canonical-url comparison
1153 // that separates MOVED from a benign scheme or trailing-slash hop is the next increment; this half consumes the flag
1154 // the fetcher has written on every journal row since the journal began and nothing read.
1155 if pv[9] >= 0 { sys_close(pv[9]); pv[9] = 0 - 1 }
1156 let rrbuf: *u8 = sys_mmap(CRG_CAP)
1157 // 2026-09-05: the SUBJECT is the OPEN set -- redirected minus the benign hops the page's own canonical acquitted.
1158 // pv[13] is final here (the row loop classified every redirected mirror) and the identity teeth below pin the
1159 // written worklists to their counters. The raw total stays a censused VALUE; only OPEN is ratcheted.
1160 if pv[20] >= 0 { sys_close(pv[20]); pv[20] = 0 - 1 }
1161 let ropen: i64 = pv[8] - pv[13]
1162 let rrn: i64 = crg_read(CRG_OPEN_RATCHET, rrbuf, CRG_CAP)
1163 var rbase: i64 = 0 - 1
1164 if rrn > 0 { rbase = crg_num_parse(rrbuf) }
1165 var redir_ok: i64 = 1
1166 let rnbuf: *u8 = sys_mmap(64)
1167 if rbase < 0 {
1168 crg_num_fmt(rnbuf, ropen)
1169 crg_w(CRG_OPEN_RATCHET, rnbuf)
1170 rbase = ropen
1171 crg_snap(CRG_OPEN_WORKLIST, CRG_OPEN_SNAP)
1172 gv_puts(" OPEN-REDIRECT-RATCHET SELF-BASELINED at " as *u8); gv_num(rbase); gv_puts(" (first sight -- non-breaking by construction)\n" as *u8)
1173 } else {
1174 if ropen > rbase {
1175 redir_ok = 0
1176 attrib_rc = crg_attrib(CRG_OPEN_WORKLIST, CRG_OPEN_SNAP, "OPEN-REDIRECT-RATCHET" as *u8, rbase)
1177 }
1178 if ropen < rbase {
1179 crg_num_fmt(rnbuf, ropen)
1180 crg_w(CRG_OPEN_RATCHET, rnbuf)
1181 crg_snap(CRG_OPEN_WORKLIST, CRG_OPEN_SNAP)
1182 gv_puts(" OPEN-REDIRECT-RATCHET TIGHTENED " as *u8); gv_num(rbase); gv_puts(" -> " as *u8); gv_num(ropen); gv_puts("\n" as *u8)
1183 rbase = ropen
1184 }
1185 }
1186 gv_puts(" PROV-REDIRECTED worklist=" as *u8); gv_puts(CRG_REDIR_WORKLIST); gv_puts(" count=" as *u8); gv_num(pv[8]); gv_puts(" benign_hop=" as *u8); gv_num(pv[13]); gv_puts(" (journalled-proven mirrors whose fetch followed a redirect; one NAMED row each; CENSUSED not ratcheted -- a benign hop is acquitted by the page's own canonical)\n" as *u8)
1187 gv_puts(" PROV-OPEN-REDIRECT worklist=" as *u8); gv_puts(CRG_OPEN_WORKLIST); gv_puts(" open=" as *u8); gv_num(ropen); gv_puts(" baseline=" as *u8); gv_num(rbase); gv_puts(" (redirected mirrors NOT acquitted by their canonical: MOVED plus every CANON-UNKNOWN reason; one NAMED row each, class on the row)\n" as *u8)
1188 gv_check("provenance-open-redirect-ratchet-does-not-rise" as *u8, redir_ok, ctr)
1189 gv_check("open-redirect-equals-moved-plus-canon-unknown" as *u8, (ropen == (pv[12] + pv[14])) as i64, ctr)
1190 gv_check("open-redirect-worklist-rows-equal-the-open-count" as *u8, (crg_nlcount_file(CRG_OPEN_WORKLIST) == ropen) as i64, ctr)
1191 gv_check("redirected-worklist-rows-equal-the-redirected-count" as *u8, (crg_nlcount_file(CRG_REDIR_WORKLIST) == pv[8]) as i64, ctr)
1192 gv_kv("redirected_total" as *u8, pv[8]); gv_kv("redirected_benign_hop" as *u8, pv[13]); gv_kv("redirected_open" as *u8, ropen)
1193 // CE10 half two summary + ratchet: of the redirected mirrors, how many MOVED (canonical names a different page),
1194 // how many are a BENIGN hop (scheme/www/slash only), how many carry no canonical (UNKNOWN, abstains). MOVED is the
1195 // liar class -- a mirror pinned as evidence that is really a different page -- and only its count is ratcheted.
1196 if pv[15] >= 0 { sys_close(pv[15]); pv[15] = 0 - 1 }
1197 gv_puts(" PROV-MOVED worklist=" as *u8); gv_puts(CRG_MOVED_WORKLIST); gv_puts(" moved=" as *u8); gv_num(pv[12]); gv_puts(" benign_hop=" as *u8); gv_num(pv[13]); gv_puts(" canon_unknown=" as *u8); gv_num(pv[14]); gv_puts(" (none_in_head=" as *u8); gv_num(pv[16]); gv_puts(" head_truncated=" as *u8); gv_num(pv[17]); gv_puts(" unreadable=" as *u8); gv_num(pv[18]); gv_puts(" og_url_only=" as *u8); gv_num(pv[19]); gv_puts(")" as *u8); gv_puts(" of_redirected=" as *u8); gv_num(pv[8]); gv_puts("\n" as *u8)
1198 gv_check("moved-partition-sums-to-redirected" as *u8, ((pv[12] + pv[13] + pv[14]) == pv[8]) as i64, ctr)
1199 gv_check("canon-unknown-partition-sums-to-its-named-reasons" as *u8, ((pv[16] + pv[17] + pv[18] + pv[19]) == pv[14]) as i64, ctr)
1200 let mvbuf: *u8 = sys_mmap(CRG_CAP)
1201 let mvn: i64 = crg_read(CRG_MOVED_RATCHET, mvbuf, CRG_CAP)
1202 var mvbase: i64 = 0 - 1
1203 if mvn > 0 { mvbase = crg_num_parse(mvbuf) }
1204 // 2026-09-05: a baseline taken by a blind reader (the cap reader that refused 30 of 33 pages) is re-taken by
1205 // DIRECTIVE: conf content beginning with r (rebaseline ...) is announced verbatim and treated as absent, so this
1206 // run self-baselines and rewrites the conf with the number -- the reason travels through the gate's own output.
1207 if mvn > 0 { if mvbuf[0] == (CRG_REBASELINE_BYTE as u8) { gv_puts(" MOVED-RATCHET REBASELINE DIRECTIVE: " as *u8); gv_puts(mvbuf); mvbase = 0 - 1 } }
1208 var moved_ok: i64 = 1
1209 let mvnbuf: *u8 = sys_mmap(64)
1210 if mvbase < 0 {
1211 crg_num_fmt(mvnbuf, pv[12]); crg_w(CRG_MOVED_RATCHET, mvnbuf); mvbase = pv[12]
1212 crg_snap(CRG_MOVED_WORKLIST, CRG_MOVED_SNAP)
1213 gv_puts(" MOVED-RATCHET SELF-BASELINED at " as *u8); gv_num(mvbase); gv_puts(" (first sight -- non-breaking by construction)\n" as *u8)
1214 } else {
1215 if pv[12] > mvbase { moved_ok = 0; attrib_rc = crg_attrib(CRG_MOVED_WORKLIST, CRG_MOVED_SNAP, "MOVED-RATCHET" as *u8, mvbase) }
1216 if pv[12] < mvbase { crg_num_fmt(mvnbuf, pv[12]); crg_w(CRG_MOVED_RATCHET, mvnbuf); crg_snap(CRG_MOVED_WORKLIST, CRG_MOVED_SNAP); gv_puts(" MOVED-RATCHET TIGHTENED " as *u8); gv_num(mvbase); gv_puts(" -> " as *u8); gv_num(pv[12]); gv_puts("\n" as *u8); mvbase = pv[12] }
1217 }
1218 gv_check("moved-ratchet-does-not-rise" as *u8, moved_ok, ctr)
1219 gv_puts(" PROV-UNPROVEN worklist=" as *u8); gv_puts(CRG_PROV_WORKLIST)
1220 gv_puts(" baseline=" as *u8); gv_num(baseline)
1221 gv_puts(" (one NAMED row per unproven mirror -- a count without a worklist is not actionable)\n" as *u8)
1222 gv_check("provenance-journal-observed-not-absent-not-truncated" as *u8, ((prows >= 1) as i64) & ((pcapped == 0) as i64), ctr)
1223 gv_check("provenance-mirror-url-never-contradicted" as *u8, ((pv[6] == 0) as i64) & ((st[4] >= 1) as i64), ctr)
1224 gv_check("provenance-partition-sums-to-declared-mirrors" as *u8, (((pv[5] + pv[6] + pv[7]) == st[4]) as i64) & ((st[4] >= 1) as i64), ctr)
1225 gv_check("provenance-unproven-ratchet-does-not-rise" as *u8, ((ratchet_ok == 1) as i64) & ((baseline >= 0) as i64), ctr)
1226 // This tooth is SATISFIED whenever the attributor was not needed (no rise) or could speak; it fails
1227 // ONLY where the snapshot does not correspond to its bar. That is not a permanently-red tooth: it
1228 // goes green the moment the pair is repaired by a tighten, which is the one repair that cannot
1229 // launder the bar. It exists because the failure it names is otherwise INVISIBLE -- the attributor's
1230 // reassuring NAMED NOTHING is what a broken pair looks like from outside.
1231 gv_check("prov-attrib-snapshot-corresponds-to-the-bar-it-explains" as *u8, (attrib_rc != (0 - 2)) as i64, ctr)
1232 // BITE, BOTH DIRECTIONS, on fixtures assembled at RUNTIME under /tmp. The POSITIVE control asserts
1233 // PROVEN rather than merely "did not fire": a state function that answered UNPROVEN for everything
1234 // would sail through a fire/no-fire pair while proving nothing at all.
1235 crg_w("/tmp/comparerefsgate/prov_good.jrnl" as *u8, "prov|1|https://example.org/a|/tmp/comparerefsgate/m.txt|deadbeef|12|0\n" as *u8)
1236 crg_w("/tmp/comparerefsgate/prov_bad.jrnl" as *u8, "prov|1|https://example.org/OTHER|/tmp/comparerefsgate/m.txt|deadbeef|12|0\n" as *u8)
1237 let gj: *u8 = sys_mmap(CRG_CAP)
1238 let gjn: i64 = crg_read("/tmp/comparerefsgate/prov_good.jrnl" as *u8, gj, CRG_CAP)
1239 var gsz: i64 = gjn
1240 if gsz < CRG_PROV_MINROW { gsz = CRG_PROV_MINROW }
1241 let gu: *i64 = sys_mmap(gsz + CRG_PROV_MINROW) as *i64
1242 let gm: *i64 = sys_mmap(gsz + CRG_PROV_MINROW) as *i64
1243 let gr: i64 = crg_prov_index(gj, gjn, gu, gm)
1244 let bj: *u8 = sys_mmap(CRG_CAP)
1245 let bjn: i64 = crg_read("/tmp/comparerefsgate/prov_bad.jrnl" as *u8, bj, CRG_CAP)
1246 var bsz: i64 = bjn
1247 if bsz < CRG_PROV_MINROW { bsz = CRG_PROV_MINROW }
1248 let bu: *i64 = sys_mmap(bsz + CRG_PROV_MINROW) as *i64
1249 let bm: *i64 = sys_mmap(bsz + CRG_PROV_MINROW) as *i64
1250 let br: i64 = crg_prov_index(bj, bjn, bu, bm)
1251 let gs: i64 = crg_prov_state(gj, gu, gm, gr, "https://example.org/a" as *u8, "/tmp/comparerefsgate/m.txt" as *u8)
1252 let bs: i64 = crg_prov_state(bj, bu, bm, br, "https://example.org/a" as *u8, "/tmp/comparerefsgate/m.txt" as *u8)
1253 let us: i64 = crg_prov_state(gj, gu, gm, gr, "https://example.org/a" as *u8, "/tmp/comparerefsgate/absent.bin" as *u8)
1254 gv_puts(" provenance bite: fixture_rows_good=" as *u8); gv_num(gr)
1255 gv_puts(" fixture_rows_bad=" as *u8); gv_num(br)
1256 gv_puts(" state_good=" as *u8); gv_num(gs)
1257 gv_puts(" state_bad=" as *u8); gv_num(bs)
1258 gv_puts(" state_absent_mirror=" as *u8); gv_num(us)
1259 gv_puts("\n" as *u8)
1260 gv_check("neg-control-provenance-fixtures-actually-parsed" as *u8, ((gr == 1) as i64) & ((br == 1) as i64), ctr)
1261 gv_check("neg-control-provenance-positive-a-matching-row-reads-PROVEN" as *u8, (gs == 2) as i64, ctr)
1262 gv_bite("neg-control-provenance-mirror-under-a-different-url" as *u8, (bs == 1) as i64, (gs == 1) as i64, ctr)
1263 gv_check("neg-control-provenance-unjournalled-mirror-reads-UNPROVEN-not-MISMATCH" as *u8, (us == 0) as i64, ctr)
1264 // CE10 REDIRECT BITE (2026-09-05): a journal row with hops=1 must read 1, the direct row 0, and an unjournalled
1265 // mirror -1 rather than 0 -- the same three-state discipline as the state reader above.
1266 crg_w("/tmp/comparerefsgate/prov_redir.jrnl" as *u8, "prov|1|https://example.org/moved|/tmp/comparerefsgate/moved.txt|deadbeef|12|1\n" as *u8)
1267 let rj: *u8 = sys_mmap(CRG_CAP)
1268 let rjn: i64 = crg_read("/tmp/comparerefsgate/prov_redir.jrnl" as *u8, rj, CRG_CAP)
1269 var rsz: i64 = rjn
1270 if rsz < CRG_PROV_MINROW { rsz = CRG_PROV_MINROW }
1271 let ru: *i64 = sys_mmap(rsz + CRG_PROV_MINROW) as *i64
1272 let rm: *i64 = sys_mmap(rsz + CRG_PROV_MINROW) as *i64
1273 let rr: i64 = crg_prov_index(rj, rjn, ru, rm)
1274 let h1: i64 = crg_prov_hops(rj, rm, rr, "/tmp/comparerefsgate/moved.txt" as *u8)
1275 let h0: i64 = crg_prov_hops(gj, gm, gr, "/tmp/comparerefsgate/m.txt" as *u8)
1276 let hx: i64 = crg_prov_hops(gj, gm, gr, "/tmp/comparerefsgate/absent.bin" as *u8)
1277 gv_puts(" redirect bite: hops_redirected=" as *u8); gv_num(h1); gv_puts(" hops_direct=" as *u8); gv_num(h0); gv_puts(" hops_absent=" as *u8); gv_num(hx); gv_puts("\n" as *u8)
1278 gv_bite("neg-control-provenance-redirect-hops-read-from-the-journal" as *u8, (h1 == 1) as i64, (h0 == 1) as i64, ctr)
1279 gv_check("neg-control-provenance-unjournalled-mirror-has-no-hops-not-zero" as *u8, (hx == (0 - 1)) as i64, ctr)
1280 // CE10 CANONICAL BITE (2026-09-05): the detector must READ a page the cap reader refused (that refusal made 30 of 33
1281 // real rows UNKNOWN), must tell a moved page from a benign hop, and must say TRUNCATED rather than NONE when the
1282 // window never closed the head. Fixtures are assembled at RUNTIME so a source scanner cannot find them.
1283 crg_w("/tmp/comparerefsgate/canon_moved.html" as *u8, "<html><head><title>x</title><link rel='canonical' href='https://example.org/home'></head><body>moved</body></html>" as *u8)
1284 crg_w("/tmp/comparerefsgate/canon_same.html" as *u8, "<html><head><link href='https://www.example.org/moved/' rel='canonical'></head><body>same</body></html>" as *u8)
1285 crg_w("/tmp/comparerefsgate/canon_none.html" as *u8, "<html><head><title>none</title></head><body>plain</body></html>" as *u8)
1286 crg_w("/tmp/comparerefsgate/canon_trap.html" as *u8, "<html><head><title>trap</title></head><body><a href='https://example.org/elsewhere'>canonical</a></body></html>" as *u8)
1287 let cb: *u8 = sys_mmap(CRG_CANON_HEAD + CRG_CANON_HEAD + CRG_CANON_BITE_SLACK)
1288 let cu: *u8 = sys_mmap(CRG_CANON_URLCAP + CRG_NUL_SLACK)
1289 let ch: *u8 = sys_mmap(CRG_CANON_HEAD + CRG_NUL_SLACK)
1290 let cpre: *u8 = "<html><head>" as *u8
1291 let ctag: *u8 = "<link rel='canonical' href='https://example.org/deep'>" as *u8
1292 let cpost: *u8 = "</head><body>big</body></html>" as *u8
1293 // big-in-window: LARGER than the cap reader allows, the tag inside the first window
1294 var bi: i64 = 0
1295 var ti: i64 = 0
1296 while cpre[ti] != (0 as u8) { cb[bi] = cpre[ti]; bi = bi + 1; ti = ti + 1 }
1297 var fi: i64 = 0
1298 while fi < CRG_CANON_BITE_LEAD { cb[bi] = CRG_BITE_FILL_BYTE as u8; bi = bi + 1; fi = fi + 1 }
1299 ti = 0
1300 while ctag[ti] != (0 as u8) { cb[bi] = ctag[ti]; bi = bi + 1; ti = ti + 1 }
1301 fi = 0
1302 while fi < CRG_CANON_HEAD { cb[bi] = CRG_BITE_FILL_BYTE as u8; bi = bi + 1; fi = fi + 1 }
1303 ti = 0
1304 while cpost[ti] != (0 as u8) { cb[bi] = cpost[ti]; bi = bi + 1; ti = ti + 1 }
1305 cb[bi] = 0 as u8
1306 let cbig: i64 = bi
1307 crg_w("/tmp/comparerefsgate/canon_big.html" as *u8, cb)
1308 // big-beyond-window: the same size, the tag AFTER the window and the head never closing inside it
1309 bi = 0
1310 ti = 0
1311 while cpre[ti] != (0 as u8) { cb[bi] = cpre[ti]; bi = bi + 1; ti = ti + 1 }
1312 fi = 0
1313 while fi < CRG_CANON_HEAD { cb[bi] = CRG_BITE_FILL_BYTE as u8; bi = bi + 1; fi = fi + 1 }
1314 ti = 0
1315 while ctag[ti] != (0 as u8) { cb[bi] = ctag[ti]; bi = bi + 1; ti = ti + 1 }
1316 ti = 0
1317 while cpost[ti] != (0 as u8) { cb[bi] = cpost[ti]; bi = bi + 1; ti = ti + 1 }
1318 cb[bi] = 0 as u8
1319 crg_w("/tmp/comparerefsgate/canon_beyond.html" as *u8, cb)
1320 let c1: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_moved.html" as *u8, ch, cu)
1321 let c1eq: i64 = crg_url_norm_eq(cu, "https://example.org/moved" as *u8)
1322 let c2: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_same.html" as *u8, ch, cu)
1323 let c2eq: i64 = crg_url_norm_eq(cu, "https://example.org/moved" as *u8)
1324 let c3: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_none.html" as *u8, ch, cu)
1325 let c4: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_trap.html" as *u8, ch, cu)
1326 let c5: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_big.html" as *u8, ch, cu)
1327 let c6: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_beyond.html" as *u8, ch, cu)
1328 let c7: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/absent.bin" as *u8, ch, cu)
1329 gv_puts(" canonical bite: moved=" as *u8); gv_num(c1); gv_puts("/eq" as *u8); gv_num(c1eq); gv_puts(" same=" as *u8); gv_num(c2); gv_puts("/eq" as *u8); gv_num(c2eq); gv_puts(" none=" as *u8); gv_num(c3); gv_puts(" trap=" as *u8); gv_num(c4); gv_puts(" big_in_window=" as *u8); gv_num(c5); gv_puts(" beyond=" as *u8); gv_num(c6); gv_puts(" absent=" as *u8); gv_num(c7); gv_puts(" fixture_bytes=" as *u8); gv_num(cbig); gv_puts(" head_window=" as *u8); gv_num(CRG_CANON_HEAD); gv_puts("\n" as *u8)
1330 gv_check("neg-control-canonical-fixture-exceeds-the-head-window" as *u8, (cbig > CRG_CANON_HEAD) as i64, ctr)
1331 gv_bite("neg-control-canonical-moved-page-differs-from-the-cited-url" as *u8, ((c1 > 0) as i64) * ((c1eq == 0) as i64), ((c2 > 0) as i64) * ((c2eq == 0) as i64), ctr)
1332 gv_check("neg-control-canonical-www-and-trailing-slash-read-as-the-same-page" as *u8, ((c2 > 0) as i64) * ((c2eq == 1) as i64), ctr)
1333 gv_check("neg-control-canonical-slash-runs-collapse-to-one-and-a-trailing-run-is-nothing" as *u8, crg_url_norm_eq("https://example.org//moved//" as *u8, "https://example.org/moved" as *u8), ctr)
1334 gv_check("neg-control-canonical-a-different-path-is-still-a-move" as *u8, (crg_url_norm_eq("https://example.org/moved/x" as *u8, "https://example.org/moved" as *u8) == 0) as i64, ctr)
1335 crg_w("/tmp/comparerefsgate/canon_og.html" as *u8, "<html><head><meta property='og:url' content='https://example.org/elsewhere'></head><body>og only</body></html>" as *u8)
1336 let c8: i64 = crg_canon_of_mirror("/tmp/comparerefsgate/canon_og.html" as *u8, ch, cu)
1337 gv_check("neg-control-canonical-og-url-alone-is-not-a-canonical-and-never-a-move" as *u8, (c8 == (0 - CRG_CANON_RC_OGONLY)) as i64, ctr)
1338 gv_check("neg-control-canonical-absent-tag-in-a-closed-head-reads-NONE" as *u8, (c3 == 0) as i64, ctr)
1339 gv_check("neg-control-canonical-token-outside-a-tag-is-not-a-canonical" as *u8, (c4 == 0) as i64, ctr)
1340 gv_check("neg-control-canonical-head-window-reads-a-page-the-cap-reader-refuses" as *u8, (c5 > 0) as i64, ctr)
1341 gv_check("neg-control-canonical-window-that-never-closes-the-head-reads-TRUNCATED-not-NONE" as *u8, (c6 == (0 - CRG_CANON_RC_TRUNC)) as i64, ctr)
1342 gv_check("neg-control-canonical-unreadable-mirror-reads-UNREADABLE-not-NONE" as *u8, (c7 == (0 - 1)) as i64, ctr)
1343 // ---- MIRROR COMPLETENESS: the partition, its ratchet, its worklist and its bite ----
1344 if mwfd >= 0 { sys_close(mwfd) }
1345 st[13] = 0 - 1
1346 gv_puts(" mirror_completeness: classified=" as *u8); gv_num(st[8])
1347 gv_puts(" complete=" as *u8); gv_num(st[12])
1348 gv_puts(" truncated_proven=" as *u8); gv_num(st[9])
1349 gv_puts(" truncated_suspect=" as *u8); gv_num(st[10])
1350 gv_puts(" unknown=" as *u8); gv_num(st[11])
1351 gv_puts(" incomplete=" as *u8); gv_num(st[9] + st[10])
1352 gv_puts(" sum=" as *u8); gv_num(st[9] + st[10] + st[11] + st[12])
1353 gv_puts("\n" as *u8)
1354 let mrbuf: *u8 = sys_mmap(CRG_CAP)
1355 let mrn: i64 = crg_read(CRG_MIR_RATCHET, mrbuf, CRG_CAP)
1356 var mbase: i64 = 0 - 1
1357 if mrn > 0 { mbase = crg_num_parse(mrbuf) }
1358 let mincomplete: i64 = st[9] + st[10]
1359 var mratchet_ok: i64 = 1
1360 var mattrib_rc: i64 = 0
1361 let mnbuf: *u8 = sys_mmap(64)
1362 if mbase < 0 {
1363 crg_num_fmt(mnbuf, mincomplete)
1364 crg_w(CRG_MIR_RATCHET, mnbuf)
1365 mbase = mincomplete
1366 crg_snap(CRG_MIR_WORKLIST, CRG_MIR_SNAP)
1367 gv_puts(" MIRROR-RATCHET SELF-BASELINED at " as *u8); gv_num(mbase)
1368 gv_puts(" (first sight -- non-breaking by construction, and this run compared NOTHING)\n" as *u8)
1369 } else {
1370 if mincomplete > mbase {
1371 mratchet_ok = 0
1372 mattrib_rc = crg_attrib(CRG_MIR_WORKLIST, CRG_MIR_SNAP, "MIRROR-RATCHET" as *u8, mbase)
1373 }
1374 if mincomplete < mbase {
1375 crg_num_fmt(mnbuf, mincomplete)
1376 crg_w(CRG_MIR_RATCHET, mnbuf)
1377 crg_snap(CRG_MIR_WORKLIST, CRG_MIR_SNAP)
1378 gv_puts(" MIRROR-RATCHET TIGHTENED " as *u8); gv_num(mbase)
1379 gv_puts(" -> " as *u8); gv_num(mincomplete); gv_puts("\n" as *u8)
1380 mbase = mincomplete
1381 }
1382 }
1383 gv_puts(" MIRROR-INCOMPLETE worklist=" as *u8); gv_puts(CRG_MIR_WORKLIST)
1384 gv_puts(" baseline=" as *u8); gv_num(mbase)
1385 gv_puts(" (one NAMED row per incomplete mirror, carrying the reason that decided it)\n" as *u8)
1386 gv_check("mirror-completeness-partition-sums-to-classified" as *u8, (((st[9] + st[10] + st[11] + st[12]) == st[8]) as i64) & ((st[8] >= 1) as i64), ctr)
1387 gv_check("mirror-incompleteness-ratchet-does-not-rise" as *u8, ((mratchet_ok == 1) as i64) & ((mbase >= 0) as i64), ctr)
1388 // The SIBLING of the provenance tooth above. A fix landed in one ratchet and not its twin is half a
1389 // fix, and the half left undone is always the one that ships.
1390 gv_check("mirror-attrib-snapshot-corresponds-to-the-bar-it-explains" as *u8, (mattrib_rc != (0 - 2)) as i64, ctr)
1391 // BITE, BOTH DIRECTIONS, on bodies assembled at RUNTIME. The closing tag is concatenated rather
1392 // than written as one literal so a source scanner cannot find this gate's own fixture in it --
1393 // and the POSITIVE control asserts the whole body reads exactly COMPLETE, because a classifier
1394 // that answered UNKNOWN for everything would sail through a plain fire/no-fire pair.
1395 let fxb: *u8 = sys_mmap(CRG_PATH)
1396 var fo: i64 = 0
1397 fo = gv_cat(fxb, fo, "<html><body>whole body</body>" as *u8)
1398 fo = gv_cat(fxb, fo, "</" as *u8)
1399 fo = gv_cat(fxb, fo, "html>\n" as *u8)
1400 crg_w("/tmp/comparerefsgate/mi_good.html" as *u8, fxb)
1401 crg_w("/tmp/comparerefsgate/mi_bad.html" as *u8, "<html><body>cut mid-docum" as *u8)
1402 let mih: *u8 = sys_mmap(MI_HEAD + 16)
1403 let mit: *u8 = sys_mmap(MI_TAIL + 16)
1404 let birc: *i64 = sys_mmap(16) as *i64
1405 let bisz: *i64 = sys_mmap(16) as *i64
1406 let bidc: *i64 = sys_mmap(16) as *i64
1407 let clsgood: i64 = mi_classify("/tmp/comparerefsgate/mi_good.html" as *u8, mih, mit, birc, bisz, bidc)
1408 let clsbad: i64 = mi_classify("/tmp/comparerefsgate/mi_bad.html" as *u8, mih, mit, birc, bisz, bidc)
1409 gv_puts(" mirror bite: cls_good=" as *u8); gv_num(clsgood)
1410 gv_puts(" cls_bad=" as *u8); gv_num(clsbad)
1411 gv_puts(" (0 proven-truncated 1 suspect 2 complete 3 unknown)\n" as *u8)
1412 gv_check("neg-control-mirror-positive-a-whole-body-reads-COMPLETE" as *u8, (clsgood == MI_COMPLETE) as i64, ctr)
1413 gv_bite("neg-control-mirror-truncation-detected-both-ways" as *u8, (clsbad != MI_COMPLETE) as i64, (clsgood != MI_COMPLETE) as i64, ctr)
1414 return gv_verdict("comparerefs" as *u8, ctr, "every conjunct is a NAMED tooth above and this note restates none of them, so adding a tooth can never make it stale. THE RESIDUAL, STATED: fetch-time provenance proves the mirror is OF the url. It does NOT prove the mirror SUPPORTS the claim -- that is still a declared human read, and no tooth here measures it" as *u8)
1415}