nx_compare_regen.nx source
↩ module page · 1415 lines · 91078 B
1// nx_compare_regen.nx -- ON-NAS regeneration of the whole Nishi Compare publish surface (operator 2026-07-09:
2// "no frozen snapshots"). Re-MEASURES every matrix domain against the synced source tree (buildroot/runtime),
3// GATE-CHECKED: for each artifact the generator's liar-kill gate must exit 0 FIRST -- a RED measurement is NEVER
4// published (fail-closed). Then emits json+html per domain + the hub index json/html + the in-code OpenAPI, and
5// hot-swaps each into the LIVE docroot via write-.new + sys_renameat (atomic; a concurrent reader never tears).
6// Because nx_compare_serve reads the SAME docroot files, MCP tools/call and public REST update together, single
7// source. argv: [1]=buildroot dir (default "buildroot"), [2]=docroot prefix (default "../sites/nishifamily/compare/",
8// i.e. the live docroot relative to buildroot). The MCP allowlist row PINS these args (caller argv ignored) so a
9// tools/call caller cannot redirect writes. Targets must already exist (this regenerates, never scaffolds).
10// license_tier: ORIGINAL expect_exit: 0
11import "nx_tool_run.nx"
12import "nx_compare_receipt_lib.nx"
13import "nx_compare_scope_lib.nx"
14import "nx_symdecl_lib.nx"
15import "nx_estate_path.nx"
16import "nx_forkfresh_lib.nx"
17import "nx_compare_feed_lib.nx" // EC47 (2026-09-16): the /compare daily feed -- every board's map position and the day's rows, one RSS file
18// EC17 (2026-09-01): the engine grades ITSELF with the same ladder it applies to the estate. The lib's
19// paths are estate-relative by construction, so this works from the regen's buildroot CWD unchanged.
20import "nx_catalog_lib.nx"
21import "nx_ioadmit_lib.nx" // THE I/O-storm ruler the build gate and the clock already share (2026-09-02): a seat-launched regen must consult it too
22import "nx_heavyio_lib.nx" // THE CLASS BOUND (hub-spoke, 2026-09-03): heavy producers RUNNING across every launch surface vs the derived width
23// PURPOSE-NAMED BOUNDS (2026-08-14). These were five consts literally named K_MAGIC_<value> -- a name
24// that RESTATES the number and is LESS greppable than the bare literal, which is the estate's own banked
25// anti-pattern: in every recorded case the VALUE was right and the NAME was the defect. Worse, they were
26// SHARED ACROSS UNRELATED PURPOSES -- K_MAGIC_65536 was at once the matrix file-read cap, three roster
27// file-read caps, the debtstate OUTPUT accumulator and the getdents64 transfer buffer, and K_MAGIC_262144
28// was both the store-put capture and the debt-tool capture.
29// -- ONE CONSTANT SERVING TWO UNRELATED PURPOSES CAN NEVER BE TUNED FOR EITHER.
30// Every FILE read in this organ now composes sys_read_file (buffer sized from the file by lseek END,
31// cannot short-read), so those caps are DELETED rather than renamed: for a file there is no guess to
32// make, and raising a cap only moves the guess. What survives is only what is genuinely unknowable in
33// advance -- the size of a child process's stdout, and one syscall's transfer buffer.
34const RG_EMIT_CAPTURE_BYTES: i64 = 1048576 // the DIAGNOSTIC copy reserve only (the bytes a GATE RED prints back): since 2026-09-15 every generator page is captured into an OWNED buffer that grows to the page (tr_run_capture_owned, no ceiling), so no number here can cut a page off again. History: this was 1 MiB and SIGPIPE-killed the gameengine emitter the day its page passed 1 MiB (the run read "rc nonzero" while the OLD page stayed published); it was raised to 64 MiB the same day, which only moved the guess. The guess is gone; the gameengine page (1179928 B) is the standing witness that a page larger than this reserve publishes whole
35const RG_EMIT_TIMEOUT_MS: i64 = 0 // the owned capture's timeout: 0 is the explicit opt-out (unbounded), the contract the legacy tr_run_capture already had
36const RG_PROGRESS_BYTES: i64 = 512
37const RG_PROGRESS_STATUS: *u8 = "../knowledge/status/compare_regen.progress" // truncate-written BEFORE every domain and once at the end: a live run moves it, a dead one does not -- the job lane writes no partial output for the whole run, and a present .claim beside an absent .out read exactly like a dead job (operator, 2026-09-15)
38const RG_HTML_MIN_BYTES: i64 = 2000 // a validity FLOOR, not a buffer: shorter than this is not a page
39const RG_DEBTSTATE_BYTES: i64 = 65536 // debtstate accumulator; every write clamps on oo < ocap
40const RG_GETDENTS_BYTES: i64 = 65536 // ONE getdents64 transfer -- the caller loops until it returns 0
41const RG_CHILD_CAPTURE_BYTES: i64 = 262144 // a forked tool's stdout, size unknowable in advance
42
43func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
44func wn(fd: i64, v: i64) -> i64 {
45 var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
46 let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
47 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
48 let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
49}
50func scopy(dst: *u8, doff: i64, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[doff+i] = src[i]; i = i + 1 } return doff + i }
51// rg_read IS GONE (2026-08-14). It was a capped whole-file reader whose loop -- `while tot < cap` --
52// returned a PREFIX and reported it as the length, with no way for any caller to tell a complete read
53// from a truncated one. Seven call sites trusted it: the domain roster (twice), the radar roster, the
54// hand roster, each domain's .matrix, and the organ under each watch contract. One of those was
55// MEASURABLY truncating (nx_parse.nx at 316,533 B against a 262,144 cap) and the rest were one growth
56// spurt away. Every site now composes sys_read_file, which sizes its buffer from the file by lseek END
57// and cannot short-read -- so the failure mode is deleted rather than made less likely.
58// -- A CEILING THAT HAS TO BE GUESSED IS A DEFECT GENERATOR IN BOTH DIRECTIONS, AND RAISING IT ONLY
59// MOVES THE GUESS.
60// atomic publish: write path.new then rename over path (the S-class content-publish primitive).
61func rg_write_atomic(path: *u8, buf: *u8, n: i64) -> i64 {
62 let evidence:*i64=rgr_alloc(16) as *i64
63 if (evidence as i64)<=0 {return RGR_E_WRITE}
64 let rc:i64=rgr_write_atomic(path,buf,n,evidence,(evidence as i64+8) as *i64)
65 if rc!=0 {
66 w(1," ATOMIC-FAIL code=" as *u8);wn(1,rc)
67 w(1," syscall=" as *u8);wn(1,evidence[1])
68 w(1," artifact_published=" as *u8);wn(1,evidence[0]);w(1,"\n" as *u8)
69 }
70 rgr_free(evidence as *u8,16)
71 return rc
72}
73// scaffold: ensure <droot><dom>/ exists before emit (mkdir 0755; EEXIST is harmless). Root-fixes the
74// "never scaffolds" gap that blocked publishing a BRAND-NEW domain (no docroot dir -> WRITE-FAIL). Fail-safe.
75func rg_scaffold(droot: *u8, dom: *u8) -> i64 {
76 let d: *u8 = sys_mmap(600)
77 var o: i64 = scopy(d, 0, droot); o = scopy(d, o, dom); d[o] = 0 as u8
78 sys_mkdir(d, 493) // 0755; ignore return -- EEXIST on an existing domain is expected
79 return 0
80}
81// run elf with up to 2 args, capture stdout. returns child exit code; outlen[0]=captured bytes.
82static g_rg_page_bo: *NxBufOwned // the one owned capture (released before every new capture)
83static g_rg_page_buf: *u8 // the last captured page's bytes, whole
84static g_rg_page_len: i64 // ...and their count; rg_emit_receipted publishes THESE, never the diagnostic copy
85func rg_run(elf: *u8, a1: *u8, a2: *u8, out: *u8, cap: i64, outlen: *i64) -> i64 {
86 let av: *i64 = sys_mmap(64) as *i64
87 av[0] = elf as i64
88 var n: i64 = 1
89 if (a1 as i64) != 0 { av[n] = a1 as i64; n = n + 1 }
90 if (a2 as i64) != 0 { av[n] = a2 as i64; n = n + 1 }
91 av[n] = 0
92 // THE PAGE IS CAPTURED INTO AN OWNED BUFFER THAT GROWS TO IT (2026-09-15). The legacy tr_run_capture stopped reading at cap
93 // and closed the pipe, the child died of SIGPIPE, and the rc read as a crash with the old page left in place (MEASURED on
94 // gameengine at 978 KB + the new sections). A ceiling that has to be guessed is a defect generator in both directions, so
95 // there is no ceiling: max_bytes 0, timeout 0. The caller's fixed `out` is only the DIAGNOSTIC copy a GATE RED prints.
96 if (g_rg_page_bo as i64) == 0 { g_rg_page_bo = sys_mmap(NX_BO_BYTES) as *NxBufOwned }
97 nx_bo_release(g_rg_page_bo) // the previous page's bytes were consumed synchronously by the caller; a repeated release is a no-op
98 let rc: i64 = tr_run_capture_owned(elf, av, g_rg_page_bo, RG_EMIT_TIMEOUT_MS, 0, 0 as *u8)
99 g_rg_page_buf = g_rg_page_bo.buf
100 g_rg_page_len = g_rg_page_bo.len
101 if (outlen as i64) != 0 { outlen[0] = g_rg_page_len }
102 var ncopy: i64 = g_rg_page_len
103 if ncopy > cap { ncopy = cap }
104 var ci: i64 = 0
105 while ci < ncopy { out[ci] = g_rg_page_buf[ci]; ci = ci + 1 }
106 if g_rg_page_len > cap { w(1, " CAPTURE-BEYOND-RESERVE bytes=" as *u8); wn(1, g_rg_page_len); w(1, " reserve=" as *u8); wn(1, cap); w(1, " -- served whole from the owned buffer; the reserve only bounds the diagnostic copy\n" as *u8) }
107 return rc
108}
109// A CHILD'S OWN VERDICT IS PASSED THROUGH, NEVER PARAPHRASED (2026-09-16). The frontier door printed one fixed sentence,
110// "corpus banks absent or vacuous", for every RED radar, while the radar had already named the failing conjunct on its
111// LIAR-KILL line. Eight domains went RED in one full regen with identical text, and the causes were four different
112// things (no .q roster, unbanked corpora, a header-only .axes stub, a zero-result query). This echoes the first line of
113// the last captured page that starts with the marker, newline included, and returns 1 when it found one.
114const RG_RADAR_LIAR_MARK: *u8 = " LIAR-KILL:"
115const RG_RADAR_VERDICT_MARK: *u8 = "NX-SWCOMPARE-GAPMAP "
116const RG_ECHO_INDENT: *u8 = " "
117func rg_echo_marked_line(mark: *u8) -> i64 {
118 var mlen: i64 = 0
119 while mark[mlen] != (0 as u8) { mlen = mlen + 1 }
120 let buf: *u8 = g_rg_page_buf
121 let n: i64 = g_rg_page_len
122 if (buf as i64) == 0 { return 0 }
123 var ls: i64 = 0
124 while ls < n {
125 var le: i64 = ls
126 while le < n { if buf[le] == (10 as u8) { break } le = le + 1 }
127 if le - ls >= mlen {
128 var same: i64 = 1
129 var k: i64 = 0
130 while k < mlen { if buf[ls + k] != mark[k] { same = 0; break } k = k + 1 }
131 if same == 1 {
132 w(1, RG_ECHO_INDENT)
133 if le < n { sys_write(1, (buf as i64 + ls) as *u8, le - ls + 1) } else { sys_write(1, (buf as i64 + ls) as *u8, le - ls); w(1, " (unterminated)\n" as *u8) }
134 return 1
135 }
136 }
137 ls = le + 1
138 }
139 return 0
140}
141// ---- Durable publish receipts; completion rows preserve the existing journal contract.
142// Extra reserve bootstrap=0 means no additional estate reserve; actual writes remain authoritative.
143const RG_PUBJRNL: *u8 = "../knowledge/status/comparepub.jrnl"
144static g_rg_receipt_failures:i64
145static g_rg_published_incomplete:i64
146// a records-file row's fixed bytes beyond its fields: the underscore + five TABs + the newline (7),
147// the longest state word LANDED (6), and a NUL (1).
148const RG_WATCHROW_OVERHEAD: i64 = 14
149func rgr_num(b:*u8,off:i64,v:i64)->i64 {return rgr_decimal(b,off,v)}
150// ---- SINGLETON + I/O ADMISSION, IN THE EMITTER, FOR EVERY LAUNCHER (2026-09-02, the I/O-storm lane) ----------
151// MEASURED: at 15:57Z and 15:59Z two seats launched this organ two minutes apart while a third ran evidence
152// sweeps; nx_dstate at a raised ceiling then showed the array's D-state roster filled with THIS organ's children
153// (nx_swcompare_matrix, nx_site_publish, nx_nav_sentinel) beside the plane writers -- load 29 -> 43, iowait equal
154// to user time, every /api/build refused for hours. The clock beat is already storm-deferred (clk_storm_defer +
155// clock_heavy.conf); a SEAT-launched regen bypassed that ruler entirely, and nothing stopped two of them running
156// at once. Both are closed here, once, for every launcher (beat, MCP nishi_compare_regen, nx_job_run):
157// (1) ONE regen at a time -- ../nx_lease.elf acquire compare-regen <owner> <ttl>. A second launcher is told the
158// holder and exits with nx_lease's own BUSY code; the lease is released before the summary line, and the
159// TTL (900 s = the measured worst run, 811 s, with margin) reaps a crashed holder on its own.
160// (2) the SAME I/O-storm ruler the build gate and the clock use (nx_ioadmit_lib): a zero spawn budget REFUSES
161// with the live figures and the build gate's QUEUE code -- a regen that starts into a storm only deepens
162// it and publishes nothing sooner. UNREADABLE never refuses (abstain toward the pre-change behaviour).
163// Neither can lose a publish: a broken lease organ is announced and the run proceeds unleased.
164const RG_LEASE_NAME: *u8 = "compare-regen"
165const RG_LEASE_TTL_S: *u8 = "900" // nx_lease takes the ttl as text; DERIVED from the measured worst run 811 s + margin
166const RG_LEASE_CAP: i64 = 4096
167const RG_EXIT_BUSY: i64 = 3 // nx_lease's own BUSY exit, relayed unchanged so a caller learns one code
168const RG_EXIT_STORM: i64 = 4 // the build gate's QUEUE exit, relayed unchanged for the same reason
169const RG_LEASE_ELF: *u8 = "../nx_lease.elf" // CWD is the build root; the promoted lease organ lives at its parent
170static g_rg_lease_owner: *u8
171// fork the lease organ with this run's owner tag; out is NUL-terminated so the holder line can be relayed verbatim
172func rg_lease_run(verb: *u8, out: *u8) -> i64 {
173 let av: *i64 = sys_mmap(64) as *i64
174 av[0] = RG_LEASE_ELF as i64
175 av[1] = verb as i64
176 av[2] = RG_LEASE_NAME as i64
177 av[3] = g_rg_lease_owner as i64
178 var n: i64 = 4
179 if verb[0] == (97 as u8) { av[n] = RG_LEASE_TTL_S as i64; n = n + 1 } // 'a'cquire carries the ttl; release does not
180 av[n] = 0
181 let ol: *i64 = sys_mmap(16) as *i64
182 ol[0] = 0
183 let rc: i64 = tr_run_capture(RG_LEASE_ELF, av, out, RG_LEASE_CAP - 1, ol)
184 if ol[0] >= 0 { if ol[0] < RG_LEASE_CAP { out[ol[0]] = 0 as u8 } }
185 return rc
186}
187func rg_lease_release() -> i64 {
188 if (g_rg_lease_owner as i64) == 0 { return 0 }
189 let out: *u8 = sys_mmap(RG_LEASE_CAP)
190 let rc: i64 = rg_lease_run("release" as *u8, out)
191 sys_munmap(out, RG_LEASE_CAP)
192 g_rg_lease_owner = 0 as *u8
193 return rc
194}
195
196static g_rg_transaction_sequence:i64
197// Existing emitter contract is retained; all audit failures return nonzero to the run.
198func rg_emit_receipted(elf: *u8, a1: *u8, mode: *u8, firstbyte: i64, minbytes: i64, target: *u8, out: *u8, cap: i64, journal:*u8) -> i64 {
199 let ol: *i64 = rgr_alloc(16) as *i64
200 if (ol as i64)<=0 {return 0-1}
201 let rc: i64 = rg_run(elf, a1, mode, out, cap, ol)
202 if rc != 0 { w(1, " EMIT-FAIL rc nonzero: " as *u8); w(1, target); w(1, "\n" as *u8); rgr_free(ol as *u8,16);return 0 - 1 }
203 if ol[0] < minbytes { w(1, " EMIT-FAIL too small: " as *u8); w(1, target); w(1, "\n" as *u8);rgr_free(ol as *u8,16);return 0 - 2 }
204 if (g_rg_page_buf[0] as i64) != firstbyte { w(1, " EMIT-FAIL wrong leading byte: " as *u8); w(1, target); w(1, "\n" as *u8);rgr_free(ol as *u8,16);return 0 - 3 }
205 var prev:i64=0-1
206 let pf:i64=sys_openat_rd(target)
207 if pf>=0 {prev=sys_lseek(pf,0,2);sys_close(pf)}
208 let tx:*RgrTx=rgr_alloc(13*8) as *RgrTx
209 if (tx as i64)<=0 {rgr_free(ol as *u8,16);return 0-6}
210 let idcap:i64=2*RGR_DECIMAL_BYTES+2
211 let id:*u8=rgr_alloc(idcap)
212 if (id as i64)<=0 {rgr_free(tx as *u8,13*8);rgr_free(ol as *u8,16);return 0-6}
213 var o:i64=rgr_decimal(id,0,sys_now_realtime_us());o=rgr_copy(id,o,"-" as *u8)
214 g_rg_transaction_sequence=g_rg_transaction_sequence+1
215 rgr_decimal(id,o,g_rg_transaction_sequence)
216 let tr:i64=rgr_transact(tx,journal,target,g_rg_page_buf,g_rg_page_len,prev,sys_now_realtime_sec(),id,RGR_NO_EXTRA_RESERVE)
217 var result:i64=tr
218 if tr!=0 {
219 g_rg_receipt_failures=g_rg_receipt_failures+1
220 if tx.published==1 {g_rg_published_incomplete=g_rg_published_incomplete+1}
221 w(1," RECEIPT-TRANSACTION-FAIL code=" as *u8);wn(1,tr)
222 w(1," syscall=" as *u8);wn(1,tx.detail)
223 w(1," artifact_published=" as *u8);wn(1,tx.published)
224 w(1," target=" as *u8);w(1,target)
225 w(1," intent=" as *u8);if (tx.intentpath as i64)>0 {w(1,tx.intentpath)}
226 w(1," reserve_extra_bytes=" as *u8);wn(1,tx.reserve)
227 w(1," available_bavail_bytes=" as *u8);wn(1,tx.available)
228 w(1," required_data_bytes=" as *u8);wn(1,tx.required)
229 w(1," next_action=reconcile retained intent before retry; no automatic crash replay\n" as *u8)
230 } else {
231 w(1, " published " as *u8); w(1, target); w(1, " (" as *u8); wn(1, ol[0]); w(1, " bytes" as *u8)
232 if prev >= 0 { w(1, " prev=" as *u8); wn(1, prev); if ol[0] < prev { w(1, " SHRANK" as *u8) } }
233 w(1, ") receipt=durable reserve_extra_bytes=0 (no additional estate reserve; bavail is advisory)\n" as *u8)
234 }
235 let release:i64=rgr_release(tx)
236 if release!=0 {
237 w(1," RECEIPT-CLOSE-FAIL syscall=" as *u8);wn(1,release);w(1,"\n" as *u8)
238 if result==0 {g_rg_receipt_failures=g_rg_receipt_failures+1;g_rg_published_incomplete=g_rg_published_incomplete+1}
239 result=RGR_E_DURABLE
240 }
241 rgr_free(tx as *u8,13*8);rgr_free(id,idcap);rgr_free(ol as *u8,16)
242 if result!=0 {return 0-6}
243 return 0
244}
245func rg_emit(elf:*u8,a1:*u8,mode:*u8,firstbyte:i64,minbytes:i64,target:*u8,out:*u8,cap:i64)->i64 {return rg_emit_receipted(elf,a1,mode,firstbyte,minbytes,target,out,cap,RG_PUBJRNL)}
246// ---- WATCHLIST PASS (2026-08-13, operator: the compare IS the workflow -- parallel workstreams
247// as a hive). Every _ABSENT_:<sym> watch row across the matrix roster is reconciled into ONE
248// machine-readable artifact, published twice: knowledge/status/compare_watchlist.tsv (the PM /
249// frontier plane intake) and <droot>watchlist.tsv (the public hive queue). Status is MEASURED here
250// with the same ruler as the page cells, so LANDED appears the moment an organ ships its symbol.
251// Additive like the census: this pass can never turn the core publish RED.
252// SUBSTRING MATCHING IS NOT OWNED HERE: the hand-rolled rgw_has that used to sit at this spot was a
253// SECOND scanner beside nx_tool_run's tr_contains, which this organ already imports transitively --
254// the duplicate-ruler defect wearing a local helper. Removed 2026-08-14 after proving it had exactly
255// ONE call site (corpus_complete=1 over 23,073 files). The only behavioural difference was on an EMPTY
256// needle (rgw_has 0, tr_contains 1), which is unreachable here: the watch parser requires at least one
257// character after "_ABSENT_:" before a row is treated as a contract at all.
258func rg_watchlist(droot: *u8) -> i64 {
259 w(1, " watchlist (the hive queue -- every watch contract across the roster):\n" as *u8)
260 // THE DOMAIN ROSTER IS READ WHOLE OR NOT AT ALL. A capped read here would drop domains off the
261 // TAIL of regen.list in silence, and a domain that never gets scanned contributes no watch rows --
262 // which is indistinguishable from a domain that has none.
263 let llen: *i64 = sys_mmap(16) as *i64
264 let lbuf: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, llen)
265 if (lbuf as i64) == 0 { w(1, " UNOBSERVABLE (regen.list unreadable)\n" as *u8); return 0 - 1 }
266 let lln: i64 = llen[0]
267 if lln <= 0 { w(1, " UNOBSERVABLE (regen.list empty)\n" as *u8); return 0 - 1 }
268 // BATCHED PLANE WRITE (2026-08-19, the 1787080869 convoy fix). The old pass forked
269 // ../nx_store_put.elf ONCE PER WATCH ROW: ~90 forks x 2 planes x fsync-under-flock serialized in
270 // the fs journal, so ONE watchlist pass ran 1-3 HOURS under load and regens stacked faster than
271 // they drained (MEASURED 2026-08-18: 23 stacked regens, the lock holder D-state in
272 // wait_log_commit, waiters 78 min in locks_lock_inode_wait). The store ALREADY grew the cure the
273 // same day -- putmany, one sts_load + one sts_seed for the whole batch ("the 88->1 fsync
274 // collapse", its own words) -- and this pass now COMPOSES it: rows accumulate in a records file,
275 // ONE fork commits them all. Records-file shape is putmany-owned: one row per line, TAB-joined,
276 // first field = id; the per-row retry is gone BECAUSE the race it paced around is gone.
277 let mlen: *i64 = sys_mmap(16) as *i64
278 let obuf: *u8 = sys_mmap(RG_CHILD_CAPTURE_BYTES)
279 let mp: *u8 = sys_mmap(600)
280 let op: *u8 = sys_mmap(600)
281 let sp: *u8 = sys_mmap(256)
282 let av: *i64 = sys_mmap(96) as *i64
283 let prl: *i64 = sys_mmap(16) as *i64
284 let olen: *i64 = sys_mmap(16) as *i64
285 let spe: *u8 = "../nx_store_put.elf" as *u8
286 let pfx: *u8 = "../knowledge/store/comparewatch-" as *u8
287 let vactor: *u8 = "nx_compare_regen" as *u8
288 let recpath: *u8 = "/tmp/comparewatch_batch.rec" as *u8
289 let rfd: i64 = sys_openat_wr(recpath, MODE_0644)
290 if rfd < 0 { w(1, " UNOBSERVABLE (cannot open the batch records file)\n" as *u8); return 0 - 1 }
291 var open_c: i64 = 0
292 var land_c: i64 = 0
293 // DARK (2026-09-06, operator: a permanent fix, we do not build and lose capability to darkness): the organ file
294 // the watch names EXISTS and was read, but does not declare the contracted symbol -- something shipped there
295 // under another name. A strict refinement of OPEN: still work, now named. The ruler already separated the two
296 // (sd_present -1 unreadable / 0 read-and-absent); every consumer folded them together until today.
297 var dark_c: i64 = 0
298 var p: i64 = 0
299 while p < lln {
300 var e: i64 = p
301 while e < lln { if lbuf[e] == (10 as u8) { break } e = e + 1 }
302 lbuf[e] = 0 as u8
303 let dom: *u8 = (lbuf as i64 + p) as *u8
304 p = e + 1
305 if dom[0] == (0 as u8) { } else { if dom[0] == (35 as u8) { } else {
306 var mo: i64 = scopy(mp, 0, "knowledge/compare/" as *u8)
307 mo = scopy(mp, mo, dom); mo = scopy(mp, mo, ".matrix" as *u8); mp[mo] = 0 as u8
308 let mbuf: *u8 = sys_read_file(mp, mlen)
309 var mn: i64 = 0
310 if (mbuf as i64) != 0 { mn = mlen[0] }
311 var q: i64 = 0
312 while q < mn {
313 var f: i64 = q
314 while f < mn { if mbuf[f] == (10 as u8) { break } f = f + 1 }
315 var p1: i64 = 0 - 1
316 var p2: i64 = 0 - 1
317 var p3: i64 = 0 - 1
318 var x: i64 = q
319 while x < f {
320 if mbuf[x] == (124 as u8) {
321 if p1 < 0 { p1 = x } else { if p2 < 0 { p2 = x } else { if p3 < 0 { p3 = x } } }
322 }
323 x = x + 1
324 }
325 var iswatch: i64 = 0
326 if p2 >= 0 { if p3 > p2 { if p3 - (p2 + 1) > 9 { if mbuf[q] != (35 as u8) {
327 let pref: *u8 = "_ABSENT_:" as *u8
328 var kk: i64 = 0
329 var okp: i64 = 1
330 var gop: i64 = 1
331 while gop == 1 {
332 if kk >= 9 { gop = 0 } else {
333 if mbuf[p2 + 1 + kk] != pref[kk] { okp = 0; gop = 0 } else { kk = kk + 1 }
334 }
335 }
336 if okp == 1 { iswatch = 1 }
337 } } } }
338 if iswatch == 1 {
339 var oc: i64 = 0
340 var y: i64 = p1 + 1
341 while y < p2 { op[oc] = mbuf[y]; oc = oc + 1; y = y + 1 }
342 op[oc] = 0 as u8
343 var sc: i64 = 0
344 y = p2 + 10
345 while y < p3 { sp[sc] = mbuf[y]; sc = sc + 1; y = y + 1 }
346 sp[sc] = 0 as u8
347 // the LANDED measurement reads the named organ source WHOLE (sys_read_file -- no cap
348 // to cross in silence) and asks THE ONE RULER (nx_symdecl_lib, 2026-08-23): a top-level
349 // declaration of the symbol. tr_contains (substring) used to sit here, so a comment or
350 // a call site naming the symbol wrote LANDED into the plane every seat reads for work
351 // (measured on lang LN8: LANDED here, OPEN in the ranker). The plane, the page cells
352 // and the ranker now share one function and cannot disagree.
353 let osrc: *u8 = sys_read_file(op, olen)
354 var landed: i64 = 0
355 let rl: *i64 = sys_mmap(16) as *i64
356 if (osrc as i64) != 0 { if olen[0] > 0 { landed = sd_present_buf(osrc, olen[0], op, sp, rl) } }
357 // one records-file row: <dom>_<symbol> TAB dom TAB label TAB organ TAB symbol TAB state --
358 // sized FROM THE FIELDS IT HOLDS (rule 11: a buffer is derived from its input, never guessed):
359 // dom twice, symbol twice, the label (p1 - q bytes), the organ, plus the fixed overhead.
360 var dlen: i64 = 0
361 while dom[dlen] != (0 as u8) { dlen = dlen + 1 }
362 let rrow: *u8 = sys_mmap(dlen + dlen + sc + sc + (p1 - q) + oc + RG_WATCHROW_OVERHEAD)
363 var ro: i64 = 0
364 ro = scopy(rrow, ro, dom)
365 rrow[ro] = 95 as u8; ro = ro + 1
366 ro = scopy(rrow, ro, sp)
367 rrow[ro] = 9 as u8; ro = ro + 1
368 ro = scopy(rrow, ro, dom)
369 rrow[ro] = 9 as u8; ro = ro + 1
370 var lc: i64 = q
371 while lc < p1 { rrow[ro] = mbuf[lc]; ro = ro + 1; lc = lc + 1 }
372 rrow[ro] = 9 as u8; ro = ro + 1
373 ro = scopy(rrow, ro, op)
374 rrow[ro] = 9 as u8; ro = ro + 1
375 ro = scopy(rrow, ro, sp)
376 rrow[ro] = 9 as u8; ro = ro + 1
377 if landed == 1 { ro = scopy(rrow, ro, "LANDED" as *u8); land_c = land_c + 1 }
378 else {
379 // DARK: the organ was READ (osrc non-null, olen > 0) and the declaration ruler said absent under a
380 // rule that can judge (the JS rule's abstention is folded to 0 by sd_present_buf and is excluded
381 // through rl[0]). Something shipped at this path under another name; the cell would read OPEN
382 // forever and the capability would be lost to darkness. Still work, now named.
383 var isdark: i64 = 0
384 if (osrc as i64) != 0 { if olen[0] > 0 { if rl[0] != SD_RULE_JSDECL { isdark = 1 } } }
385 if isdark == 1 { ro = scopy(rrow, ro, "DARK" as *u8); dark_c = dark_c + 1 }
386 else { ro = scopy(rrow, ro, "OPEN" as *u8); open_c = open_c + 1 }
387 }
388 rrow[ro] = 10 as u8; ro = ro + 1
389 sys_write(rfd, rrow, ro)
390 }
391 q = f + 1
392 }
393 } }
394 }
395 sys_close(rfd)
396 var stored: i64 = 0
397 if open_c + land_c + dark_c > 0 {
398 av[0] = spe as i64
399 av[1] = pfx as i64
400 av[2] = "putmany" as *u8 as i64
401 av[3] = vactor as i64
402 av[4] = recpath as i64
403 av[5] = 0
404 prl[0] = 0
405 let prc: i64 = tr_run_capture(spe, av, obuf, RG_CHILD_CAPTURE_BYTES, prl)
406 // PRINT THE STORE OWN WORDS -- capturing a diagnostic and not printing it is the same as
407 // not capturing it (this file own banked law).
408 if prl[0] > 0 { w(1, " " as *u8); sys_write(1, obuf, prl[0]) }
409 if prc == 0 { stored = open_c + land_c + dark_c }
410 }
411 w(1, " contracts OPEN=" as *u8); wn(1, open_c); w(1, " LANDED=" as *u8); wn(1, land_c); w(1, " DARK=" as *u8); wn(1, dark_c)
412 w(1, " -> comparewatch- plane rows stored=" as *u8); wn(1, stored)
413 w(1, " of " as *u8); wn(1, open_c + land_c + dark_c)
414 w(1, " via=putmany-single-commit" as *u8)
415 // A PARTITION IS A CLAIM -- PRINT THE VERDICT, DO NOT MAKE THE READER SUBTRACT.
416 if stored == open_c + land_c + dark_c { w(1, " partition=RECONCILES\n" as *u8) } else {
417 w(1, " partition=SHORTFALL -- the batch did not commit; the store own words are above\n" as *u8)
418 }
419 return 0
420}
421
422// ---- DEBT STATE SYNC (2026-08-14). The registers on each compare page are AUTHORED prose, but their
423// STATE must not be. This forks the debt tool per domain and writes `<dom>.debtstate` as `id<TAB>state`,
424// so the generator can show what the PLANE says rather than what the page claims.
425// ★THE SPLIT IS DELIBERATE AND WAS SETTLED BY PROBING THE TOOL: the PLANE owns STATE (open/eaten), the
426// PAGE owns NARRATIVE. Regenerating the register wholesale from the plane would destroy the written
427// remedies; pushing page prose into the plane would corrupt the audit trail. So: state only, one way.
428// It also exposes ids that are NOT in the plane at all -- page-local notes wearing the shape of a filed
429// debt -- which is the honest thing to surface rather than let them read as filed work.
430// Line shape from the tool: <index> <epoch-id>\t<sev>\t<scope>\t<state>\t<desc>
431func rg_debtstate(dom: *u8, buf: *u8, cap: i64, out: *u8, ocap: i64) -> i64 {
432 let av: *i64 = sys_mmap(64) as *i64
433 let ol: *i64 = sys_mmap(16) as *i64
434 let ELF: *u8 = "../nx_debt.elf" as *u8
435 // ⚠PASS THE PLANE PREFIX EXPLICITLY. The debt tool resolves its store RELATIVE TO CWD, and this organ
436 // runs from buildroot where that path does not exist -- so it found zero rows and wrote no file, which
437 // is indistinguishable from "this domain has no debt". Same CWD-relative trap as the two knowledge
438 // trees, the gate forking "../elf", and the watchlist writing into the wrong tree: FOUR times in one
439 // day. ★A TOOL THAT RESOLVES ITS DATA RELATIVE TO CWD IS A TOOL THAT LIES QUIETLY WHEN FORKED.
440 av[0] = ELF as i64
441 av[1] = "find" as i64
442 av[2] = dom as i64
443 av[3] = "../knowledge/store/debt-" as i64
444 av[4] = 0
445 // ⚠DO NOT GATE ON THE EXIT CODE. This is a QUERY, and a query tool's exit status is not a reliable
446 // success signal -- it may encode a match count or a no-match. The output is the answer, so parse what
447 // came back and let `rows > 0` decide whether anything is written. Gating on rc silently produced no
448 // state file at all on the first run, which reads exactly like "this domain has no debt".
449 tr_run_capture(ELF, av, buf, cap, ol)
450 let n: i64 = ol[0]
451 if n <= 0 { return 0 - 1 }
452 var oo: i64 = 0
453 var p: i64 = 0
454 var rows: i64 = 0
455 while p < n {
456 var e: i64 = p
457 while e < n { if buf[e] == (10 as u8) { break } e = e + 1 }
458 // id begins after the first space, and runs to the first tab
459 var s: i64 = p
460 while s < e { if buf[s] == (32 as u8) { break } s = s + 1 }
461 if s < e {
462 s = s + 1
463 var idend: i64 = s
464 while idend < e { if buf[idend] == (9 as u8) { break } idend = idend + 1 }
465 if idend < e {
466 // walk three tab-separated fields to reach state: sev, scope, state
467 var f: i64 = 0
468 var q: i64 = idend
469 var sts: i64 = 0 - 1
470 while q < e {
471 if buf[q] == (9 as u8) {
472 f = f + 1
473 if f == 3 { sts = q + 1; q = e } else { q = q + 1 }
474 } else { q = q + 1 }
475 }
476 if sts > 0 {
477 var ste: i64 = sts
478 while ste < e { if buf[ste] == (9 as u8) { break } ste = ste + 1 }
479 var k: i64 = s
480 while k < idend { if oo < ocap { out[oo] = buf[k]; oo = oo + 1 } k = k + 1 }
481 if oo < ocap { out[oo] = 9 as u8; oo = oo + 1 }
482 k = sts
483 while k < ste { if oo < ocap { out[oo] = buf[k]; oo = oo + 1 } k = k + 1 }
484 if oo < ocap { out[oo] = 10 as u8; oo = oo + 1 }
485 rows = rows + 1
486 }
487 }
488 }
489 p = e + 1
490 }
491 let path: *u8 = sys_mmap(600)
492 var po: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
493 po = scopy(path, po, dom)
494 po = scopy(path, po, ".debtstate" as *u8)
495 path[po] = 0 as u8
496 if rows > 0 { rg_write_atomic(path, out, oo) }
497 return rows
498}
499// ---- ORPHAN CENSUS (2026-08-13, operator: one sota compare capability, no orphans) ----
500// Reconciles the LIVE docroot against every roster that feeds this emitter. Each top-level dir in
501// <droot> must be claimed by exactly one of: regen.list (matrix/sota lane), radar.list (radar lane),
502// or hand.roster (adjudicated hand pages awaiting matrix admission -- a SHRINK-ONLY worklist). An
503// unclaimed dir is an ORPHAN, printed BY NAME with the remedy. Additive by design: the census never
504// turns the core publish RED (a permanently-RED detector is one everyone learns to ignore); new
505// sprawl is loud on every run, and the partition is printed so the parts provably sum. It re-reads
506// the roster files itself because main()'s line loop NUL-terminates lines in its own buffers.
507func rgc_inlist(lst: *u8, ln: i64, name: *u8) -> i64 {
508 var p: i64 = 0
509 while p < ln {
510 var e: i64 = p
511 while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
512 var i: i64 = 0
513 var ok: i64 = 1
514 var stop: i64 = 0
515 while stop == 0 {
516 if p + i >= e { stop = 1 } else {
517 let c: i64 = lst[p + i]
518 if c == 124 { stop = 1 } else {
519 let nc: i64 = name[i]
520 if nc == 0 { ok = 0; stop = 1 } else {
521 if nc != c { ok = 0; stop = 1 } else { i = i + 1 }
522 }
523 }
524 }
525 }
526 if ok == 1 { let nc2: i64 = name[i]; if nc2 == 0 { if i > 0 { return 1 } } }
527 p = e + 1
528 }
529 return 0
530}
531// ORGAN-EMITTED BOARDS ARE CLAIMED BY THEIR ORGAN, NOT BY THE HAND ROSTER (2026-09-16). /compare/acceptance is written
532// on its own beat by nx_acceptview and read ORPHAN-DIR, with remedies that all fit badly: it has no .matrix, no .axes,
533// it is not hand-authored, and retiring it would delete a live queue. hand.roster already carried one such claim
534// (maturity, emitted by nx_maturity_board) against its own shrink-only ratchet. organ.roster rows are
535// <dir>|<organ>|<story>; the claim holds only while ../<organ>.elf (the promoted binary, CWD buildroot) exists, so a
536// claim whose organ was retired reads ORGAN-CLAIM-DEAD and counts as an orphan again rather than hiding one.
537const RG_ORGAN_ROSTER: *u8 = "knowledge/compare/organ.roster"
538const RG_ORGAN_ELF_PREFIX: *u8 = "../"
539const RG_ORGAN_ELF_SUFFIX: *u8 = ".elf"
540const RG_ORGAN_PATH_SLACK: i64 = 16
541// the organ named in field 2 of dir's organ.roster row, copied into out (the caller sizes out from the roster, so a
542// field can never be longer than its buffer); 1 when the row exists with a non-empty organ
543func rgc_organ_of(lst: *u8, ln: i64, name: *u8, out: *u8) -> i64 {
544 var p: i64 = 0
545 while p < ln {
546 var e: i64 = p
547 while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
548 var i: i64 = 0
549 var ok: i64 = 1
550 while ok == 1 {
551 if p + i >= e { ok = 0 } else {
552 let c: i64 = lst[p + i]
553 let nc: i64 = name[i]
554 if c == 124 { if nc == 0 { if i > 0 { ok = 2 } else { ok = 0 } } else { ok = 0 } } else {
555 if nc == 0 { ok = 0 } else { if nc != c { ok = 0 } else { i = i + 1 } }
556 }
557 }
558 }
559 if ok == 2 {
560 var q: i64 = p + i + 1
561 var k: i64 = 0
562 while q < e { if lst[q] == (124 as u8) { break } out[k] = lst[q]; k = k + 1; q = q + 1 }
563 out[k] = 0 as u8
564 if k > 0 { return 1 }
565 }
566 p = e + 1
567 }
568 return 0
569}
570func rg_census(droot: *u8) -> i64 {
571 w(1, " orphan census (docroot dirs vs regen.list + radar.list + hand.roster + organ.roster):\n" as *u8)
572 // ALL THREE ROSTERS READ WHOLE. This census decides ORPHAN by absence from these lists, so a capped
573 // read is not merely lossy here -- it MANUFACTURES FALSE ORPHANS: a domain whose name sat past the cap
574 // would be reported by name as unclaimed sprawl, with a remedy attached, while its roster row existed
575 // all along. An absence verdict may never rest on a read that could have been partial.
576 let mlen2: *i64 = sys_mmap(16) as *i64
577 let rlen2: *i64 = sys_mmap(16) as *i64
578 let hlen2: *i64 = sys_mmap(16) as *i64
579 let mbuf: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, mlen2)
580 let rbuf: *u8 = sys_read_file("knowledge/compare/radar.list" as *u8, rlen2)
581 let hbuf: *u8 = sys_read_file("knowledge/compare/hand.roster" as *u8, hlen2)
582 let olen2: *i64 = sys_mmap(16) as *i64
583 let obuf: *u8 = sys_read_file(RG_ORGAN_ROSTER, olen2)
584 var oln: i64 = 0
585 if (obuf as i64) != 0 { oln = olen2[0] }
586 if oln < 0 { oln = 0 }
587 let oname: *u8 = sys_mmap(oln + 1)
588 let opath: *u8 = sys_mmap(oln + RG_ORGAN_PATH_SLACK)
589 var inorg: i64 = 0
590 var deadorg: i64 = 0
591 var mln: i64 = 0
592 var rln: i64 = 0
593 var hln: i64 = 0
594 if (mbuf as i64) != 0 { mln = mlen2[0] }
595 if (rbuf as i64) != 0 { rln = rlen2[0] }
596 if (hbuf as i64) != 0 { hln = hlen2[0] }
597 if mln <= 0 { w(1, " CENSUS-UNOBSERVABLE: regen.list unreadable -- refusing to judge orphans\n" as *u8); return 0 - 1 }
598 if hln <= 0 { w(1, " (hand.roster absent -- every unroster'd dir will read ORPHAN)\n" as *u8) }
599 let dfd: i64 = sys_openat_rd(droot)
600 if dfd < 0 { w(1, " CENSUS-UNOBSERVABLE: cannot open docroot (withheld, not GREEN)\n" as *u8); return 0 - 1 }
601 let dbuf: *u8 = sys_mmap(RG_GETDENTS_BYTES)
602 var dirs: i64 = 0
603 var inm: i64 = 0
604 var inr: i64 = 0
605 var inh: i64 = 0
606 var orph: i64 = 0
607 var go: i64 = 1
608 while go == 1 {
609 let nr: i64 = sys_getdents64(dfd, dbuf, RG_GETDENTS_BYTES)
610 if nr <= 0 { go = 0 } else {
611 var o: i64 = 0
612 while o < nr {
613 let rec: *u8 = (dbuf as i64 + o) as *u8
614 let ty: i64 = dirent_type(rec)
615 let nm: *u8 = dirent_name(rec)
616 let n0: i64 = nm[0]
617 if ty == DT_DIR { if n0 != 46 {
618 dirs = dirs + 1
619 if rgc_inlist(mbuf, mln, nm) == 1 { inm = inm + 1 } else {
620 if rgc_inlist(rbuf, rln, nm) == 1 { inr = inr + 1 } else {
621 if rgc_inlist(hbuf, hln, nm) == 1 { inh = inh + 1 } else {
622 var claimed: i64 = 0
623 if oln > 0 { if rgc_organ_of(obuf, oln, nm, oname) == 1 {
624 var po: i64 = scopy(opath, 0, RG_ORGAN_ELF_PREFIX); po = scopy(opath, po, oname); po = scopy(opath, po, RG_ORGAN_ELF_SUFFIX); opath[po] = 0 as u8
625 let ofd: i64 = sys_openat_rd(opath)
626 if ofd >= 0 { sys_close(ofd); claimed = 1; inorg = inorg + 1 } else {
627 deadorg = deadorg + 1
628 w(1, " ORGAN-CLAIM-DEAD " as *u8); w(1, nm); w(1, " claims organ " as *u8); w(1, oname); w(1, " but " as *u8); w(1, opath); w(1, " is not promoted -- the claim cannot hold, so the dir counts as an orphan\n" as *u8)
629 }
630 } }
631 if claimed == 0 {
632 orph = orph + 1
633 w(1, " ORPHAN-DIR " as *u8); w(1, nm)
634 w(1, " (no roster claims it -- adopt: regen.list+matrix | radar.list+axes | organ.roster row naming its promoted organ | hand.roster row; or retire)\n" as *u8)
635 }
636 } } }
637 } }
638 o = o + dirent_reclen(rec)
639 }
640 }
641 }
642 sys_close(dfd)
643 w(1, " census dirs=" as *u8); wn(1, dirs)
644 w(1, " matrix=" as *u8); wn(1, inm)
645 w(1, " radar=" as *u8); wn(1, inr)
646 w(1, " hand=" as *u8); wn(1, inh)
647 w(1, " organ=" as *u8); wn(1, inorg)
648 w(1, " organ_dead=" as *u8); wn(1, deadorg)
649 w(1, " ORPHANS=" as *u8); wn(1, orph)
650 let parts: i64 = inm + inr + inh + inorg + orph
651 if parts == dirs { w(1, " parts-sum OK\n" as *u8) } else { w(1, " PARTITION-LEAK parts!=dirs\n" as *u8) }
652 return orph
653}
654// ---- FORK FRESHNESS: THE PUBLISHER CHECKS ITS OWN FORKS BEFORE IT PUBLISHES (2026-08-31) ----
655// THE DEFECT, MEASURED TWICE IN ONE DAY. This organ chdirs into the BUILD ROOT and forks the bare path
656// _offc/<gen>.elf, so the publisher of every /compare page executes buildroot/_offc/. But /api/promote
657// writes the SERVING ROOT (and nishihost/_offc); buildroot/_offc updates ONLY via a manual nx_restage.
658// A regen therefore returned published=201 fails=0 verdict=GREEN and CHANGED NOTHING -- every publish
659// line read prev= EQUAL to the new byte count -- because all three generators were a generation behind.
660// FOUR AGENTS EACH VERIFIED THEIR PROMOTE AGAINST THE SERVING ROOT AND/OR nishihost/_offc AND ALL FOUR
661// MISSED THIS COPY. nx_catalog cannot see buildroot/_offc, so every row read BUILT==PROMOTED with_gaps=0
662// VERDICT LIVE -- the clean-looking reading that hid it. The remedy was "remember to nx_restage", which
663// is O(seats) forever, and a law that must be RECALLED at the moment of temptation is not a control.
664//
665// ANNOUNCE, DELIBERATELY -- NOT REFUSE. Read how this receipt is consumed before choosing: `fails` drives
666// verdict=GREEN/RED and this organ EXIT CODE, which the compare beat stamp depends on. Folding fork
667// staleness into `fails` would turn the whole surface RED and, because restage is a MANUAL step, would
668// leave /compare unpublishable until a human intervened -- the permanently-red detector everyone learns
669// to ignore, installed on the estate own headline surface. It is not hypothetical: on the day this
670// shipped, TWO of the four generators were stale, so a refusal would have taken the surface down at once.
671// FAIL DIRECTION, ESTABLISHED BEFORE SHIPPING: this check can only PRINT and only COUNT. It cannot stop a
672// publish that would otherwise succeed, cannot delete, cannot restage. Its worst false positive costs a
673// wrong line of text; a refusal false positive costs the surface.
674// AND AN ANNOUNCEMENT NOBODY READS IS THE ABSTENTION NOBODY READS, so the result is ALSO a NAMED,
675// MACHINE-READABLE FIELD on the summary line and a durable truncate-written status file -- a consumer can
676// branch on the staleness without the publisher becoming a single point of failure for publishing.
677const RG_FORK_MATRIX: i64 = 0
678const RG_FORK_SOTA: i64 = 1
679const RG_FORK_HUB: i64 = 2
680// the SELFCATALOG status line: ts + three counters, ~80 B measured; 4096 is a reserve for one line (the ratchet named
681// the bare literal 2026-09-02 -- a number without a purpose is a number nobody can re-derive)
682const RG_SELFCAT_STATUS_BYTES: i64 = 4096
683const RG_FORK_BOARD: i64 = 3
684const RG_FORKS: i64 = 4 // the DENOMINATOR: every generator this organ forks from _offc/
685const RG_PROMOTED_PREFIX: *u8 = "../" // CWD is the build root; /api/promote installs FLAT at its parent
686const RG_FORKFRESH_STATUS: *u8 = "../knowledge/status/compare_forkfresh.status"
687const RG_FORKSTATUS_BYTES: i64 = 4096 // derived from RG_FORKS rows plus a header, not guessed
688const RG_ELF_SUFFIX_LEN: i64 = 4
689
690static g_rg_fork_fresh: i64
691static g_rg_fork_stale: i64
692static g_rg_fork_unproven: i64
693static g_rg_fork_absent: i64
694static g_rg_fork_checked: i64
695static g_rg_fork_state: *i64
696
697// ONE TABLE OWNS THESE PATHS AND main() FORKS FROM IT (see the MATRIX/SOTA/HUB/BOARD bindings below).
698// A checker holding its own second copy of the path literals would be a duplicate ruler that drifts the
699// day somebody adds a generator -- and the check would then be silently measuring a binary nobody runs.
700// nx_swcompare_gapmap is deliberately NOT in this table: it is already forked from ../ , i.e. from the
701// promoted artifact itself, so checking it would compare a file with itself and manufacture a green.
702func rg_forkpath(idx: i64) -> *u8 {
703 if idx == RG_FORK_MATRIX { return "_offc/nx_swcompare_matrix.elf" as *u8 }
704 if idx == RG_FORK_SOTA { return "_offc/nx_swcompare_sota.elf" as *u8 }
705 if idx == RG_FORK_HUB { return "_offc/nx_swcompare_hub.elf" as *u8 }
706 return "_offc/nx_maturity_board.elf" as *u8
707}
708
709// The nx_restage TARGET name, DERIVED from the fork path rather than written a second time.
710func rg_forkname(idx: i64, out: *u8) -> i64 {
711 let p: *u8 = rg_forkpath(idx)
712 let b: i64 = ff_basename(p)
713 var n: i64 = 0
714 while p[b + n] != (0 as u8) { n = n + 1 }
715 var k: i64 = n - RG_ELF_SUFFIX_LEN
716 if k < 0 { k = n }
717 var i: i64 = 0
718 while i < k { out[i] = p[b + i]; i = i + 1 }
719 out[k] = 0 as u8
720 return k
721}
722
723// A STDOUT-ONLY ANNOUNCEMENT IN AN ORGAN RUN BY A BEAT IS AN ABSTENTION NOBODY READS -- a cron row that
724// discards its output makes its own finding unobservable. So the same measurement lands in a durable,
725// TRUNCATE-WRITTEN status file with a canonical verdict LAST (never an append-only journal, which any
726// substring check would read as vacuously green forever). It reuses rg_write_atomic, the writer this
727// organ already owns, rather than introducing a second write idiom.
728// ITS SUBJECT IS FORK FRESHNESS AND NOTHING ELSE: a RED here says the publisher is executing a binary
729// that is not the promoted one. That is a true statement about the forks and is deliberately NOT the
730// publish verdict, which keeps its own meaning on this organ own last line.
731// It reads the states RECORDED BY THE SINGLE PASS in rg_forkcheck rather than re-classifying: two passes
732// could straddle a restage and then the printed line and the status file would contradict each other.
733func rg_forkstatus() -> i64 {
734 let b: *u8 = sys_mmap(RG_FORKSTATUS_BYTES)
735 var o: i64 = 0
736 o = scopy(b, o, "ts=" as *u8); o = rgr_num(b, o, sys_now_realtime_sec())
737 o = scopy(b, o, "\nsubject=fork-freshness-of-the-compare-generators" as *u8)
738 o = scopy(b, o, "\nchecked=" as *u8); o = rgr_num(b, o, g_rg_fork_checked)
739 o = scopy(b, o, "\nfresh=" as *u8); o = rgr_num(b, o, g_rg_fork_fresh)
740 o = scopy(b, o, "\nstale=" as *u8); o = rgr_num(b, o, g_rg_fork_stale)
741 o = scopy(b, o, "\nunproven=" as *u8); o = rgr_num(b, o, g_rg_fork_unproven)
742 o = scopy(b, o, "\nabsent=" as *u8); o = rgr_num(b, o, g_rg_fork_absent)
743 let nm: *u8 = sys_mmap(FF_PATH_BYTES)
744 var i: i64 = 0
745 while i < RG_FORKS {
746 rg_forkname(i, nm)
747 o = scopy(b, o, "\n" as *u8); o = scopy(b, o, ff_state_word(g_rg_fork_state[i]))
748 o = scopy(b, o, " " as *u8); o = scopy(b, o, nm)
749 i = i + 1
750 }
751 o = scopy(b, o, "\nverdict=" as *u8)
752 if g_rg_fork_stale == 0 { o = scopy(b, o, "GREEN" as *u8) } else { o = scopy(b, o, "RED" as *u8) }
753 o = scopy(b, o, "\n" as *u8)
754 return rg_write_atomic(RG_FORKFRESH_STATUS, b, o)
755}
756
757// Runs BEFORE anything is published, so the announcement precedes the pages it is about.
758// Returns the STALE count; the caller reports it and does not act on it.
759func rg_forkcheck() -> i64 {
760 w(1, " fork freshness -- the generator copies this publisher ACTUALLY executes, vs the PROMOTED artifacts:\n" as *u8)
761 g_rg_fork_state = sys_mmap(RG_FORKS * 8) as *i64
762 let fdig: *u8 = sys_mmap(FF_DIGEST_BYTES)
763 let rdig: *u8 = sys_mmap(FF_DIGEST_BYTES)
764 let fhex: *u8 = sys_mmap(FF_HEX_BYTES)
765 let rhex: *u8 = sys_mmap(FF_HEX_BYTES)
766 let refp: *u8 = sys_mmap(FF_PATH_BYTES)
767 let nm: *u8 = sys_mmap(FF_PATH_BYTES)
768 let sz: *i64 = sys_mmap(FF_SIZES_SLOTS * 8) as *i64
769 var i: i64 = 0
770 while i < RG_FORKS {
771 let fp: *u8 = rg_forkpath(i)
772 ff_promoted_path(fp, refp, RG_PROMOTED_PREFIX)
773 let st: i64 = ff_classify(fp, refp, fdig, rdig, sz)
774 g_rg_fork_state[i] = st
775 // THE DIRECTION IS DERIVED ONCE, BESIDE THE CLASSIFICATION AND AT THE SAME SCOPE AS THE STATE IT
776 // QUALIFIES, so the printed remedy and the recorded state can never straddle two measurements.
777 // It is FF_DIR_NA by construction for every non-STALE row, so deriving it unconditionally is safe.
778 let dir: i64 = ff_direction(st, sz)
779 rg_forkname(i, nm)
780 g_rg_fork_checked = g_rg_fork_checked + 1
781 w(1, " " as *u8); w(1, ff_state_word(st)); w(1, " " as *u8); w(1, fp)
782 if sz[0] >= 0 { w(1, " " as *u8); wn(1, sz[0]); w(1, "B" as *u8) }
783 w(1, "\n" as *u8)
784 if st == FF_FRESH { g_rg_fork_fresh = g_rg_fork_fresh + 1 }
785 if st == FF_UNPROVEN {
786 g_rg_fork_unproven = g_rg_fork_unproven + 1
787 w(1, " COULD NOT LOOK: no readable promoted artifact at " as *u8); w(1, refp)
788 w(1, " -- this is NOT a finding that the fork is stale, and NOT a licence to trust it.\n" as *u8)
789 }
790 if st == FF_NOFORK {
791 g_rg_fork_absent = g_rg_fork_absent + 1
792 w(1, " the fork target itself is unreadable -- the fork will fail on its own below.\n" as *u8)
793 }
794 if st == FF_STALE {
795 g_rg_fork_stale = g_rg_fork_stale + 1
796 ff_hex(fdig, fhex, FF_DIGEST_BYTES)
797 ff_hex(rdig, rhex, FF_DIGEST_BYTES)
798 w(1, " RUNS " as *u8); w(1, fhex); w(1, "\n" as *u8)
799 w(1, " PROMOTED " as *u8); w(1, rhex); w(1, " (" as *u8); w(1, refp); w(1, " " as *u8); wn(1, sz[1]); w(1, "B)\n" as *u8)
800 w(1, " EVERY PAGE BELOW IS PUBLISHED BY THE COPY ON THE RUNS LINE, NOT BY WHAT WAS PROMOTED.\n" as *u8)
801 // THE REMEDY BRANCHES ON THE DIRECTION, BECAUSE THE TWO DIRECTIONS WANT OPPOSITE ACTIONS.
802 // This line used to print "nx_restage" UNCONDITIONALLY. That was correct for a fork that is
803 // BEHIND and was THE CAPABILITY-DESTROYING ACTION for a fork that is AHEAD -- and the check
804 // had already measured both digests and both sizes, so the comparison that decides it was in
805 // hand the whole time and only the message failed to use it. Caught live on nx_maturity_board
806 // by a publish owner who measured before obeying its instrument.
807 // IT STILL ONLY ANNOUNCES. It does not refuse and must not: 2 of 4 generators were stale the
808 // day this check shipped, and a refusal would have taken /compare down.
809 w(1, " DIRECTION " as *u8); w(1, ff_direction_word(dir))
810 w(1, " (fork " as *u8); wn(1, sz[0]); w(1, "B vs promoted " as *u8); wn(1, sz[1]); w(1, "B)\n" as *u8)
811 if ff_restage_is_safe(dir) == 1 {
812 w(1, " REMEDY: nx_restage " as *u8); w(1, nm); w(1, " (nothing else updates buildroot/_offc)\n" as *u8)
813 }
814 if dir == FF_DIR_AHEAD {
815 w(1, " DO NOT RESTAGE. The executing copy is LARGER than the promoted artifact, so it may\n" as *u8)
816 w(1, " carry runs the promoted one lacks, and a restage would overwrite exactly those.\n" as *u8)
817 w(1, " REMEDY: nx_contentdiff " as *u8); w(1, refp); w(1, " " as *u8); w(1, fp); w(1, "\n" as *u8)
818 w(1, " and if the fork proves a superset, REBUILD FROM SOURCE AND PROMOTE FORWARD so the\n" as *u8)
819 w(1, " promoted artifact GAINS it. Never restage backward. If the source can no longer\n" as *u8)
820 w(1, " rebuild what the fork carries, BANK THE FORK first -- it is unreproducible.\n" as *u8)
821 }
822 if dir == FF_DIR_UNDECIDED {
823 w(1, " UNDECIDED: the two artifacts are the SAME SIZE and still differ, so size cannot say\n" as *u8)
824 w(1, " which way, and restaging on a guess is a coin flip over a destructive action.\n" as *u8)
825 w(1, " WHAT WOULD SETTLE IT: nx_contentdiff in BOTH directions between\n" as *u8)
826 w(1, " " as *u8); w(1, refp); w(1, " and " as *u8); w(1, fp); w(1, "\n" as *u8)
827 w(1, " -- whichever side loses no runs is the one that is behind. If neither loses runs,\n" as *u8)
828 w(1, " the delta is code-only (a string ruler is blind to it) and nx_behaveprobe on a real\n" as *u8)
829 w(1, " workload is the instrument that decides.\n" as *u8)
830 }
831 if dir == FF_DIR_NA {
832 w(1, " DIRECTION UNAVAILABLE: a size was not measured, so NO remedy is named here rather\n" as *u8)
833 w(1, " than naming one that could be the destructive direction.\n" as *u8)
834 }
835 }
836 i = i + 1
837 }
838 // A PARTITION IS A CLAIM: CHECK THE PARTS SUM, AND PRINT THE SUM.
839 let parts: i64 = g_rg_fork_fresh + g_rg_fork_stale + g_rg_fork_unproven + g_rg_fork_absent
840 w(1, " forkchecked=" as *u8); wn(1, g_rg_fork_checked)
841 w(1, " fresh=" as *u8); wn(1, g_rg_fork_fresh)
842 w(1, " stale=" as *u8); wn(1, g_rg_fork_stale)
843 w(1, " unproven=" as *u8); wn(1, g_rg_fork_unproven)
844 w(1, " absent=" as *u8); wn(1, g_rg_fork_absent)
845 w(1, " parts_sum=" as *u8); wn(1, parts)
846 if parts == g_rg_fork_checked { w(1, " partition=RECONCILED\n" as *u8) } else { w(1, " partition=LEAK\n" as *u8) }
847 if rg_forkstatus() != 0 { w(1, " (status file not written -- the stdout announcement above still stands)\n" as *u8) }
848 return g_rg_fork_stale
849}
850
851// ---- EC17 (ecosystem rung): THE ENGINE GRADES ITSELF, every run ----
852// Measured 2026-09-01 before this existed: of the organs that publish and rank the boards, the gap map
853// was PROMOTED-UNREGISTERED, the maturity board PROMOTED-UNREGISTERED and behind its own staged binary,
854// the fleet ranker REGISTERED-DARK, the flywheel beat PROMOTED-UNREGISTERED, and nx_comparestale is
855// REGISTERED and AUTHORISED while having no source and no binary at all. The surface that measures the
856// estate was the estate's own worst instance of the pattern it measures. Membership is DECLARED in
857// knowledge/compare/engine.roster (never a name pattern); each row is graded by clb_classify -- the same
858// ladder every board row gets -- and every gap prints WITH ITS REMEDY. Announces and counts, never
859// refuses: 6 of the engine's own organs carried gaps the day this shipped, and folding that into the
860// publish verdict would have taken the headline surface down until a human intervened -- the permanently
861// red detector, installed on /compare itself. UNPROVEN is its own exit: a missing roster publishes NO
862// counts, because zero-members-zero-gaps would be the vacuous green wearing a self-audit's name.
863func rg_selfcatalog() -> i64 {
864 let lp: *i64 = sys_mmap(16) as *i64
865 let rb: *u8 = sys_read_file("knowledge/compare/engine.roster" as *u8, lp)
866 if (rb as i64) == 0 { w(1, "SELFCATALOG UNPROVEN -- engine.roster missing; the engine publishes ungraded this run\n" as *u8); return 3 }
867 let rn: i64 = lp[0]
868 if rn <= 0 { w(1, "SELFCATALOG UNPROVEN -- engine.roster empty\n" as *u8); return 3 }
869 let ads: *i64 = sys_mmap(CLB_N * 8) as *i64
870 clb_load(ads)
871 var members: i64 = 0
872 var full: i64 = 0
873 var gaps: i64 = 0
874 let tok: *u8 = sys_mmap(CLB_TOK_CAP)
875 let remp: *i64 = sys_mmap(8) as *i64
876 var p: i64 = 0
877 while p < rn {
878 var e: i64 = p
879 while e < rn { if rb[e] == (10 as u8) { break } e = e + 1 }
880 var t: i64 = e
881 if t > p { if rb[t-1] == (13 as u8) { t = t - 1 } }
882 rb[t] = 0 as u8
883 let nm: *u8 = ((rb as i64) + p) as *u8
884 p = e + 1
885 if nm[0] != (0 as u8) { if nm[0] != (35 as u8) {
886 members = members + 1
887 tok[0] = 0 as u8
888 remp[0] = "" as *u8 as i64
889 let ful: i64 = clb_classify(nm, ads, tok, remp)
890 if ful == CLB_FULL { full = full + 1 } else {
891 gaps = gaps + 1
892 w(1, " SELFCATALOG-GAP " as *u8); w(1, nm); w(1, " " as *u8); w(1, tok)
893 let rr: *u8 = remp[0] as *u8
894 if rr[0] != (0 as u8) { w(1, " -- " as *u8); w(1, rr) }
895 w(1, "\n" as *u8)
896 }
897 } }
898 }
899 w(1, "SELFCATALOG members=" as *u8); wn(1, members)
900 w(1, " full=" as *u8); wn(1, full)
901 w(1, " gaps=" as *u8); wn(1, gaps)
902 w(1, " (partition: full+gaps=members) -- the surface that grades the estate, graded by its own ruler\n" as *u8)
903 let sb: *u8 = sys_mmap(RG_SELFCAT_STATUS_BYTES)
904 var so: i64 = 0
905 so = scopy(sb, so, "ts=" as *u8); so = rgr_num(sb, so, sys_now_realtime_sec())
906 so = scopy(sb, so, " members=" as *u8); so = rgr_num(sb, so, members)
907 so = scopy(sb, so, " full=" as *u8); so = rgr_num(sb, so, full)
908 so = scopy(sb, so, " gaps=" as *u8); so = rgr_num(sb, so, gaps)
909 so = scopy(sb, so, "\nverdict=" as *u8)
910 if gaps == 0 { so = scopy(sb, so, "GREEN" as *u8) } else { so = scopy(sb, so, "AMBER" as *u8) }
911 sb[so] = 10 as u8; so = so + 1
912 rg_write_atomic("../knowledge/status/compare_selfcatalog.status" as *u8, sb, so)
913 return 0
914}
915
916// Selected runs retain domain gates and receipts. Aggregate views have a separate scope.
917const RG_SCOPE_PATH_BYTES: i64 = 600
918func rg_scope_len(s: *u8) -> i64 {
919 var n: i64 = 0
920 while s[n] != (0 as u8) { n = n + 1 }
921 return n
922}
923// the two path bounds a selected domain must fit (shared by --domain and --domain-file so the check cannot drift between them)
924func rg_scope_bounds(droot: *u8, selected_len: i64) -> i64 {
925 if rg_scope_len(droot) + selected_len + rg_scope_len("/frontier/index.html.new" as *u8) + 1 > RG_SCOPE_PATH_BYTES {
926 w(1, "REFUSED-SCOPE: output path exceeds existing emitter path bound\n" as *u8)
927 return 1
928 }
929 if rg_scope_len("knowledge/compare/" as *u8) + selected_len + rg_scope_len(".debtstate.new" as *u8) + 1 > RG_SCOPE_PATH_BYTES {
930 w(1, "REFUSED-SCOPE: source path exceeds existing emitter path bound\n" as *u8)
931 return 1
932 }
933 return 0
934}
935// the liveness stamp: truncate-written before every domain and once at the end (see RG_PROGRESS_STATUS)
936// THE EXPORT PASS (datavis DV6, 2026-09-15): after a matrix page is published, the SAME generator is forked in export mode
937// on the directory it just published, and writes the position map's SVG and PNG twins plus a receipt beside index.html.
938// COUNTED, never a publish failure: exit 0 landed (exports), 2 the page carries no map (exports_absent), anything else
939// export_fails -- a picture that could not be drawn must not take the page down, and the receipt names why.
940static g_rg_exports: i64
941static g_rg_exports_absent: i64
942static g_rg_export_fails: i64
943const RG_EXPORT_ABSENT_RC: i64 = 2
944func rg_export(elf: *u8, dom: *u8, dir: *u8, out: *u8, cap: i64) -> i64 {
945 let av: *i64 = sys_mmap(64) as *i64
946 av[0] = elf as i64
947 av[1] = dom as i64
948 av[2] = ("export" as *u8) as i64
949 av[3] = dir as i64
950 av[4] = 0
951 let ol: *i64 = sys_mmap(16) as *i64
952 ol[0] = 0
953 let rc: i64 = tr_run_capture(elf, av, out, cap, ol)
954 if ol[0] > 0 { w(1, " " as *u8); sys_write(1, out, ol[0]) }
955 if rc == 0 { g_rg_exports = g_rg_exports + 1; return 0 }
956 if rc == RG_EXPORT_ABSENT_RC { g_rg_exports_absent = g_rg_exports_absent + 1; return 0 }
957 g_rg_export_fails = g_rg_export_fails + 1
958 w(1, " EXPORT-FAIL rc=" as *u8); wn(1, rc); w(1, " dir=" as *u8); w(1, dir); w(1, " (the page stands; the twins did not land -- read the receipt line above)\n" as *u8)
959 return 0 - 1
960}
961func rg_progress(dom: *u8, done: i64, pubs: i64, fails: i64) -> i64 {
962 let b: *u8 = sys_mmap(RG_PROGRESS_BYTES)
963 var o: i64 = scopy(b, 0, "ts=" as *u8); o = rgr_decimal(b, o, sys_now_realtime_sec())
964 o = scopy(b, o, " domain=" as *u8); o = scopy(b, o, dom)
965 o = scopy(b, o, " domains_done=" as *u8); o = rgr_decimal(b, o, done)
966 o = scopy(b, o, " published=" as *u8); o = rgr_decimal(b, o, pubs)
967 o = scopy(b, o, " fails=" as *u8); o = rgr_decimal(b, o, fails)
968 o = scopy(b, o, " -- truncate-written by nx_compare_regen before each domain; a ts that stops moving under a held compare-regen lease is a hung run, not a slow one\n" as *u8)
969 let rc: i64 = rg_write_atomic(RG_PROGRESS_STATUS, b, o)
970 sys_munmap(b, RG_PROGRESS_BYTES)
971 return rc
972}
973func rg_scope_list(name: *u8, n: i64) -> *u8 {
974 let b: *u8 = sys_mmap(n + 2)
975 scopy(b, 0, name)
976 b[n] = 10 as u8
977 b[n + 1] = 0 as u8
978 return b
979}
980func rg_scope_receipt(droot: *u8, domain: *u8, pubs: i64, fails: i64) -> i64 {
981 let path: *u8 = sys_mmap(RG_SCOPE_PATH_BYTES)
982 var p: i64 = scopy(path, 0, droot)
983 p = scopy(path, p, domain)
984 p = scopy(path, p, "/scope.json" as *u8)
985 path[p] = 0 as u8
986 let b: *u8 = sys_mmap(RG_SCOPE_PATH_BYTES + RG_SCOPE_PATH_BYTES)
987 var o: i64 = scopy(b, 0, "{\"schema\":1,\"record_kind\":\"last_domain_scoped_run\",\"scope\":\"domain\",\"domain\":\"" as *u8)
988 o = scopy(b, o, domain)
989 o = scopy(b, o, "\",\"aggregates_refreshed_by_this_run\":false,\"published\":" as *u8)
990 o = rgr_num(b, o, pubs)
991 o = scopy(b, o, ",\"fails\":" as *u8)
992 o = rgr_num(b, o, fails)
993 o = scopy(b,o,",\"audit_failures\":" as *u8);o=rgr_num(b,o,g_rg_receipt_failures)
994 o = scopy(b,o,",\"published_evidence_incomplete\":" as *u8);o=rgr_num(b,o,g_rg_published_incomplete)
995 o = scopy(b,o,",\"receipt_extra_reserve_bytes\":0" as *u8)
996 o = scopy(b, o, ",\"ts\":" as *u8)
997 o = rgr_num(b, o, sys_now_realtime_sec())
998 o = scopy(b, o, "}\n" as *u8)
999 return rg_write_atomic(path, b, o)
1000}
1001// These finalizers are shared by the real run and the isolated subprocess gate.
1002func rg_published_count(successful:i64)->i64 {return successful+g_rg_published_incomplete}
1003func rg_exit_verdict(fails:i64)->i64 {
1004 if fails == 0 && g_rg_receipt_failures==0 { w(1, " verdict=GREEN (measured fresh from source; atomic hot-swap; MCP+REST single source)\n" as *u8); sys_exit(0); return 0 }
1005 w(1, " verdict=RED\n" as *u8); sys_exit(1); return 1
1006}
1007static g_rg_feed_items: i64
1008static g_rg_feed_written: i64
1009func main(argc: i64, argv: *i64) -> i64 {
1010 var broot: *u8 = "buildroot" as *u8
1011 var droot: *u8 = "../sites/nishifamily/compare/" as *u8
1012 if argc >= 2 { broot = argv[1] as *u8 }
1013 if argc >= 3 { droot = argv[2] as *u8 }
1014 var selected: *u8 = 0 as *u8
1015 var selected_len: i64 = 0
1016 var scope_file: *u8 = 0 as *u8
1017 if argc > 3 {
1018 if argc != 5 {
1019 w(1, "USAGE: nx_compare_regen [buildroot [docroot]] | nx_compare_regen buildroot docroot --domain name | nx_compare_regen buildroot docroot --domain-file path\n" as *u8)
1020 sys_exit(2); return 2
1021 }
1022 let opt: *u8 = argv[3] as *u8
1023 let is_dom: i64 = cscope_roster_count("--domain\n" as *u8, 9, opt, rg_scope_len(opt))
1024 let is_file: i64 = cscope_roster_count("--domain-file\n" as *u8, 14, opt, rg_scope_len(opt))
1025 if is_dom != 1 { if is_file != 1 {
1026 w(1, "USAGE: expected --domain name or --domain-file path; no publication started\n" as *u8)
1027 sys_exit(2); return 2
1028 } }
1029 if is_dom == 1 {
1030 selected = argv[4] as *u8
1031 selected_len = cscope_validate_name(selected, RG_SCOPE_PATH_BYTES - 1)
1032 if selected_len < 1 {
1033 w(1, "REFUSED-SCOPE: invalid domain name; no publication started\n" as *u8)
1034 sys_exit(2); return 2
1035 }
1036 if rg_scope_bounds(droot, selected_len) != 0 { sys_exit(2); return 2 }
1037 } else {
1038 // THE SCOPE COMES FROM DATA THE PINNED ROW CAN NAME (operator, 2026-09-15). The MCP row pins its argv, so a seat
1039 // could only ever scope a run from the CLI or a job lane; a second registered row pins `--domain-file <path>` and
1040 // the seat writes the domain into that file (CAS through nx_fs_write) before calling it. The file is read AFTER
1041 // the chdir below, so the path is build-root relative like every board file, and the run PRINTS both the path
1042 // and the domain it took from it, so a stale scope is visible in the receipt rather than silent.
1043 scope_file = argv[4] as *u8
1044 }
1045 }
1046 w(1, "=== NX-COMPARE-REGEN -- re-measure + atomically republish the compare surface (gate-checked) ===\n" as *u8)
1047 // NAME THE PATH YOU ACTUALLY TRIED. This printed the literal word "buildroot" while chdir'ing whatever
1048 // argv[1] held, so a caller who passed a DOMAIN (a reasonable guess -- every sibling compare tool takes
1049 // one) got "cannot chdir buildroot" and went looking for a broken build root. The message named a
1050 // subject the code was not operating on, which costs the reader exactly the investigation an error
1051 // exists to save them. argv[1] is the BUILD ROOT; this organ regenerates the WHOLE surface.
1052 // TRY THE CALLER'S CWD FIRST, THEN ANCHOR AS A FALLBACK. Both the build root and the docroot here
1053 // are CWD-relative, so this organ only ever ran correctly from the estate root -- i.e. from the
1054 // beat's own `cd`. Every other launcher (nx_job_run, the MCP surface) hands it a different CWD,
1055 // where this chdir fails and the organ reports a broken BUILD ROOT when the real subject is the
1056 // WORKING DIRECTORY -- a message naming a subject the code was not operating on, which is the very
1057 // defect the comment above already records. ep_anchor binds that ONE act instead of asking every
1058 // caller to remember it. Ordered as a FALLBACK and never as a precondition: a caller passing a
1059 // relative build root reachable from its own CWD keeps its exact present meaning, so no currently
1060 // working invocation can change behaviour.
1061 var moved: i64 = sys_chdir(broot)
1062 if moved != 0 {
1063 let anch: i64 = ep_anchor()
1064 if anch == 1 { w(1, " anchored to the estate root (the caller's CWD held no build root)\n" as *u8) }
1065 moved = sys_chdir(broot)
1066 }
1067 if moved != 0 {
1068 w(1, "FAIL: cannot chdir " as *u8); w(1, broot)
1069 w(1, " -- argv[1] is the BUILD ROOT; use buildroot docroot --domain name for a selected domain\n" as *u8)
1070 sys_exit(1); return 1
1071 }
1072 if (scope_file as i64) != 0 {
1073 let sfl: *i64 = sys_mmap(16) as *i64
1074 let sfb: *u8 = sys_read_file(scope_file, sfl)
1075 if (sfb as i64) == 0 {
1076 w(1, "REFUSED-SCOPE-FILE: cannot read " as *u8); w(1, scope_file); w(1, " (build-root relative); no publication started\n" as *u8)
1077 sys_exit(2); return 2
1078 }
1079 // the domain is the first line, cut at a newline, a carriage return or a space; anything after it is ignored and said so
1080 var sq: i64 = 0
1081 var sgo: i64 = 1
1082 while sgo == 1 {
1083 if sq >= sfl[0] { sgo = 0 } else {
1084 let sc: i64 = sfb[sq] as i64
1085 if sc == 10 { sgo = 0 } else { if sc == 13 { sgo = 0 } else { if sc == 32 { sgo = 0 } else { sq = sq + 1 } } }
1086 }
1087 }
1088 sfb[sq] = 0 as u8
1089 selected = sfb
1090 selected_len = cscope_validate_name(selected, RG_SCOPE_PATH_BYTES - 1)
1091 if selected_len < 1 {
1092 w(1, "REFUSED-SCOPE-FILE: no valid domain name on the first line of " as *u8); w(1, scope_file); w(1, "; no publication started\n" as *u8)
1093 sys_exit(2); return 2
1094 }
1095 if rg_scope_bounds(droot, selected_len) != 0 { sys_exit(2); return 2 }
1096 w(1, "SCOPE-FILE path=" as *u8); w(1, scope_file); w(1, " domain=" as *u8); w(1, selected)
1097 w(1, " -- the pinned MCP row names the FILE; the seat named the domain in it\n" as *u8)
1098 }
1099 if selected_len > 0 {
1100 let sl: *i64 = sys_mmap(16) as *i64
1101 let sr: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, sl)
1102 if cscope_roster_count(sr, sl[0], selected, selected_len) != 1 {
1103 w(1, "REFUSED-SCOPE: domain must occur exactly once in regen.list; no publication started\n" as *u8)
1104 sys_exit(2); return 2
1105 }
1106 w(1, "SCOPE domain=" as *u8); w(1, selected)
1107 w(1, " aggregates_refreshed_by_this_run=0; unrelated domain and aggregate passes excluded\n" as *u8)
1108 }
1109 // ---- ADMISSION + SINGLETON, before a single fork (2026-09-02; rationale beside rg_lease_run) ----
1110 let ioa: *i64 = sys_mmap(16) as *i64
1111 var rg_budget: i64 = IOA_UNREADABLE
1112 if ioa_measure(ioa) == 0 { rg_budget = ioa_spawn_budget(ioa[0], ioa[1], IOA_BLOCKED_PER_CPU, IOA_RESERVE_SLOTS) }
1113 if rg_budget == 0 {
1114 w(1, "REFUSED-IO-STORM procs_blocked=" as *u8); wn(1, ioa[1]); w(1, " ncpu=" as *u8); wn(1, ioa[0])
1115 w(1, " sample=instant blocked_per_cpu=" as *u8); wn(1, IOA_BLOCKED_PER_CPU); w(1, " reserve_slots=" as *u8); wn(1, IOA_RESERVE_SLOTS)
1116 w(1, " -- configured spawn budget is zero. This proxy does not establish sustained storage saturation or predict completion cost. No publication started. Build admission may use different evidence; retry through this publisher admission after pressure changes.\n" as *u8)
1117 sys_exit(RG_EXIT_STORM); return RG_EXIT_STORM
1118 }
1119 if rg_budget < 0 { w(1, " io-admission UNOBSERVABLE (/proc/stat unreadable) -- proceeding, as the clock does\n" as *u8) }
1120 // ---- THE CLASS BOUND (hub-spoke, 2026-09-03). The ioadmit check above is INSTANTANEOUS and per-caller: a
1121 // burst of beats can each read "not stormed" and proceed, the storm being their SUM. hio_admit counts the
1122 // heavy producers RUNNING across every launch surface against the width derived from knowledge/heavyio.conf,
1123 // with the storm witness as its second conjunct. DEFER -> named refusal on the clock's requeue code;
1124 // UNOBSERVABLE -> announced, proceed (a periodic publisher must never be silenced by a missing conf). The
1125 // conf lives at the estate root and CWD is the build root here, so the ../ twin is tried first.
1126 let hio: *i64 = sys_mmap(32) as *i64
1127 var hv: i64 = hio_admit_conf("../knowledge/heavyio.conf" as *u8, hio)
1128 if hv == HIO_UNOBSERVABLE { hv = hio_admit(hio) }
1129 hio_announce(1, hv, hio)
1130 if hv == HIO_DEFER {
1131 w(1, "REFUSED-HEAVYIO: the heavy-I/O class bound is reached (running > width, or the storm line) -- a regen started now only deepens it. Re-fire when the HEAVYIO line reads ADMIT\n" as *u8)
1132 sys_exit(RG_EXIT_STORM); return RG_EXIT_STORM
1133 }
1134 g_rg_lease_owner = sys_mmap(64)
1135 var lo: i64 = scopy(g_rg_lease_owner, 0, "regen-" as *u8)
1136 lo = rgr_num(g_rg_lease_owner, lo, sys_now_realtime_sec())
1137 g_rg_lease_owner[lo] = 0 as u8
1138 let lout: *u8 = sys_mmap(RG_LEASE_CAP)
1139 let lrc: i64 = rg_lease_run("acquire" as *u8, lout)
1140 if lrc == RG_EXIT_BUSY {
1141 w(1, "REFUSED-ALREADY-RUNNING: another nx_compare_regen holds lease " as *u8); w(1, RG_LEASE_NAME); w(1, " -- " as *u8); w(1, lout)
1142 w(1, "\n two regens at once double the array's fsync load and publish nothing sooner; wait for the holder or its TTL.\n" as *u8)
1143 g_rg_lease_owner = 0 as *u8
1144 sys_exit(RG_EXIT_BUSY); return RG_EXIT_BUSY
1145 }
1146 if lrc != 0 { w(1, " lease UNAVAILABLE (nx_lease rc=" as *u8); wn(1, lrc); w(1, ") -- proceeding unleased rather than blocking the publish on a broken lock\n" as *u8); g_rg_lease_owner = 0 as *u8 }
1147 if lrc == 0 { w(1, " lease compare-regen held by " as *u8); w(1, g_rg_lease_owner); w(1, " (ttl " as *u8); w(1, RG_LEASE_TTL_S); w(1, " s; a second regen is refused until release)\n" as *u8) }
1148 // BOUND FROM THE FORK TABLE, NOT RE-TYPED. rg_forkcheck iterates that same table, so the binary it
1149 // checks and the binary this loop forks CANNOT diverge -- which is the whole point: a checker holding
1150 // its own copy of these literals would go quietly out of date the day a generator is added or moved.
1151 let MATRIX: *u8 = rg_forkpath(RG_FORK_MATRIX)
1152 let SOTA: *u8 = rg_forkpath(RG_FORK_SOTA)
1153 let HUB: *u8 = rg_forkpath(RG_FORK_HUB)
1154 // IN THE PATH, BEFORE ANY PAGE IS WRITTEN. Announces and counts; it never refuses (see the reasoning
1155 // above rg_forkpath). The pages published below are published by whatever this just measured.
1156 rg_forkcheck()
1157 // EC17: and the engine grades ITSELF before publishing anything -- announces and counts, never refuses
1158 rg_selfcatalog()
1159 let sprobe: *u8 = sys_mmap(600)
1160 let cap: i64 = RG_EMIT_CAPTURE_BYTES
1161 let out: *u8 = sys_mmap(cap)
1162 let llen0: *i64 = sys_mmap(16) as *i64
1163 var sota_c: i64 = 0
1164 var sota_matrix_c: i64 = 0
1165 var lst: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, llen0)
1166 if (lst as i64) == 0 { w(1, "FAIL: regen.list missing\n" as *u8); rg_lease_release(); sys_exit(1); return 1 }
1167 var ln: i64 = llen0[0]
1168 if selected_len > 0 { lst = rg_scope_list(selected, selected_len); ln = selected_len + 1 }
1169 if ln <= 0 { w(1, "FAIL: regen.list empty\n" as *u8); rg_lease_release(); sys_exit(1); return 1 }
1170 // DEBT STATE FIRST, before any page is emitted -- a sync that runs after the emit loop would leave
1171 // every page showing the PREVIOUS run's state, which is the quiet one-run lag that makes a dashboard
1172 // wrong exactly when someone acts on it.
1173 w(1, " debt state sync (plane owns state, page owns narrative):\n" as *u8)
1174 let dsbuf: *u8 = sys_mmap(RG_CHILD_CAPTURE_BYTES)
1175 let dsout: *u8 = sys_mmap(RG_DEBTSTATE_BYTES)
1176 let dlen0: *i64 = sys_mmap(16) as *i64
1177 var dlst: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, dlen0)
1178 if selected_len > 0 { dlst = rg_scope_list(selected, selected_len); dlen0[0] = selected_len + 1 }
1179 var dln: i64 = 0
1180 if (dlst as i64) != 0 { dln = dlen0[0] }
1181 var dsdom: i64 = 0
1182 var dsrows: i64 = 0
1183 var dp: i64 = 0
1184 while dp < dln {
1185 var de: i64 = dp
1186 while de < dln { if dlst[de] == (10 as u8) { break } de = de + 1 }
1187 dlst[de] = 0 as u8
1188 let dd: *u8 = (dlst as i64 + dp) as *u8
1189 dp = de + 1
1190 if dd[0] == (0 as u8) { } else { if dd[0] == (35 as u8) { } else {
1191 // ONLY domains that declare a plan render a debt register, so only they need the sync.
1192 // Forking the debt tool for all 48 domains cost 48 full reads of a 3,930-row plane on every
1193 // beat to serve one page. A feature that works and hammers the box is still a defect.
1194 var pl: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8)
1195 pl = scopy(sprobe, pl, dd)
1196 pl = scopy(sprobe, pl, ".plan" as *u8)
1197 sprobe[pl] = 0 as u8
1198 let pfd2: i64 = sys_openat_rd(sprobe)
1199 if pfd2 >= 0 {
1200 sys_close(pfd2)
1201 let dr: i64 = rg_debtstate(dd, dsbuf, RG_CHILD_CAPTURE_BYTES, dsout, RG_DEBTSTATE_BYTES)
1202 if dr > 0 { dsdom = dsdom + 1; dsrows = dsrows + dr }
1203 }
1204 } }
1205 }
1206 w(1, " domains with filed debt=" as *u8); wn(1, dsdom)
1207 w(1, " rows=" as *u8); wn(1, dsrows); w(1, "\n" as *u8)
1208 let target: *u8 = sys_mmap(600)
1209 let ol: *i64 = sys_mmap(16) as *i64
1210 var fails: i64 = 0
1211 var pubs: i64 = 0
1212 var domains_done: i64 = 0
1213 var p: i64 = 0
1214 while p < ln {
1215 var e: i64 = p
1216 while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
1217 lst[e] = 0 as u8
1218 let dom: *u8 = (lst as i64 + p) as *u8
1219 p = e + 1
1220 if dom[0] == (0 as u8) { } else { if dom[0] == (35 as u8) { } else {
1221 w(1, " domain " as *u8); w(1, dom); w(1, ":\n" as *u8)
1222 rg_progress(dom, domains_done, pubs, fails)
1223 domains_done = domains_done + 1
1224 // a <dom>.sota file promotes the domain to the SOTA generator (N competitors, quantitative,
1225 // categorized); otherwise the 4-column matrix generator. Same CLI shape, same gate contract.
1226 var gen: *u8 = MATRIX
1227 var so: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); so = scopy(sprobe, so, dom); so = scopy(sprobe, so, ".sota" as *u8); sprobe[so] = 0 as u8
1228 let sfd: i64 = sys_openat_rd(sprobe)
1229 // ONE ASSEMBLER (2026-09-02): a sota-class domain is rendered by the MATRIX generator too, which now
1230 // composes the SOTA field from nx_swcompare_sota_lib. The census below still counts the class;
1231 // the SOTA fork path stays declared (and fork-fresh-checked) until the second generator is retired.
1232 if sfd >= 0 { sys_close(sfd); gen = MATRIX; w(1, " (sota-class: N-competitor quantitative -- rendered by the one assembler)\n" as *u8)
1233 // census (2026-08-23): a sota-class domain that ALSO carries a .matrix now renders its watch
1234 // contracts on the page (nx_swcompare_lib watch_pass) -- count the population that reaches.
1235 sota_c = sota_c + 1
1236 var mpo: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); mpo = scopy(sprobe, mpo, dom); mpo = scopy(sprobe, mpo, ".matrix" as *u8); sprobe[mpo] = 0 as u8
1237 let mfd: i64 = sys_openat_rd(sprobe)
1238 if mfd >= 0 { sys_close(mfd); sota_matrix_c = sota_matrix_c + 1; w(1, " (carries a .matrix: watch contracts rendered, measured)\n" as *u8) }
1239 }
1240 let grc: i64 = rg_run(gen, dom, 0 as *u8, out, cap, ol)
1241 if grc != 0 {
1242 w(1, " GATE RED -- refusing to publish this domain\n" as *u8)
1243 // PRINT THE GENERATOR'S OWN WORDS (2026-08-07). rg_run already CAPTURED the reason
1244 // into `out` and this branch threw it away, so every refusal read as an unexplained
1245 // GATE RED and the only way to learn why was to guess. I guessed twice today (a
1246 // buildroot/ path prefix, then a missing @verdict) and was wrong twice, on a domain
1247 // whose generator had been naming the real cause all along.
1248 // ★A GATE THAT REPORTS A FAILURE WITHOUT ITS DIAGNOSTIC IS UNACTIONABLE -- the law was
1249 // already written in nx_cc_equiv_gate's own comments; this loop had not adopted it.
1250 // ★CAPTURING A DIAGNOSTIC AND NOT PRINTING IT IS THE SAME AS NOT CAPTURING IT.
1251 if ol[0] > 0 {
1252 w(1, " --- generator said ---\n" as *u8)
1253 var dl: i64 = ol[0]
1254 if dl > cap { dl = cap } // `out` is the diagnostic copy, bounded by the reserve; the page itself lives in the owned buffer
1255 sys_write(1, out, dl)
1256 w(1, " --- end ---\n" as *u8)
1257 }
1258 fails = fails + 1
1259 } else {
1260 rg_scaffold(droot, dom) // create the domain docroot dir if new (fixes WRITE-FAIL on first publish)
1261 var o: i64 = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/api.json" as *u8); target[o] = 0 as u8
1262 if rg_emit(gen, dom, "json" as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
1263 o = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/index.html" as *u8); target[o] = 0 as u8
1264 if rg_emit(gen, dom, "html" as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 {
1265 pubs = pubs + 1
1266 // the twins beside the page it just published (matrix-class pages carry the position map)
1267 if gen == MATRIX { o = scopy(target, 0, droot); o = scopy(target, o, dom); target[o] = 0 as u8; rg_export(gen, dom, target, out, cap) }
1268 } else { fails = fails + 1 }
1269 // FRONTIER door (2026-08-05, debt 1785937893): a <dom>.axes file promotes the domain to ALSO
1270 // publish its researcher-fed frontier radar via the gapmap generator -- same gate contract as
1271 // matrix/sota. FAIL-SAFE by design: a RED frontier gate (banks absent / vacuous momentum) skips
1272 // LOUDLY without failing the core publish; the radar is additive, its gate is its own.
1273 var ax: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); ax = scopy(sprobe, ax, dom); ax = scopy(sprobe, ax, ".axes" as *u8); sprobe[ax] = 0 as u8
1274 let axfd: i64 = sys_openat_rd(sprobe)
1275 if axfd >= 0 { sys_close(axfd)
1276 // promoted-elf path (nishihost root, CWD is buildroot): /api/build + /api/promote place it -- API-pure staging
1277 let GAPMAP: *u8 = "../nx_swcompare_gapmap.elf" as *u8
1278 let gfd2: i64 = sys_openat_rd(GAPMAP)
1279 if gfd2 < 0 { w(1, " frontier SKIPPED (nx_swcompare_gapmap.elf not promoted -- /api/build + /api/promote it)\n" as *u8) } else { sys_close(gfd2)
1280 let frc: i64 = rg_run(GAPMAP, dom, 0 as *u8, out, cap, ol)
1281 if frc != 0 {
1282 w(1, " frontier gate RED -- skipping frontier, core artifacts stand; the radar's own lines rc=" as *u8); wn(1, frc); w(1, ":\n" as *u8)
1283 let echo_liar: i64 = rg_echo_marked_line(RG_RADAR_LIAR_MARK)
1284 let echo_verdict: i64 = rg_echo_marked_line(RG_RADAR_VERDICT_MARK)
1285 if (echo_liar + echo_verdict) == 0 { w(1, " (the radar printed neither line -- UNOBSERVABLE: the radar did not reach its verdict, which is not evidence about its banks)\n" as *u8) }
1286 } else {
1287 var fo: i64 = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier" as *u8); target[fo] = 0 as u8
1288 sys_mkdir(target, 493)
1289 fo = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier/index.html" as *u8); target[fo] = 0 as u8
1290 if rg_emit(GAPMAP, dom, "html" as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
1291 }
1292 }
1293 }
1294 }
1295 } }
1296 }
1297 if selected_len == 0 {
1298 // RADAR PASS (2026-08-08). The .axes/gapmap radar domains are NOT in regen.list and have no
1299 // .matrix/.sota source, so the loop above cannot carry them: it runs MATRIX/SOTA FIRST and a missing
1300 // source prints "GATE RED -- refusing to publish this domain" and fails the whole run. They were
1301 // therefore hand-published, and went 20-21 DAYS STALE while every one of them still served HTTP 200,
1302 // so the liveness sentinel reported them perfectly healthy the entire time.
1303 // (STAR)LIVENESS AND FRESHNESS ARE DIFFERENT QUESTIONS -- A 200 SAYS NOTHING ABOUT AGE.
1304 // SAFE HALF ONLY: this emits <dom>/api.json and NOTHING ELSE. Those paths mostly 404 today so the
1305 // write cannot clobber anything; regenerating their HTML from .axes COULD destroy curated content
1306 // (/compare/crm is a 13,169 B hand-authored page) and is deliberately NOT done here.
1307 // ADDITIVE LIKE THE FRONTIER DOOR: a radar failure is reported LOUDLY but does NOT increment fails,
1308 // because the radar must never be able to turn the core publish RED (and with it the beat's stamp).
1309 w(1, " radar pass:\n" as *u8)
1310 let rlen0: *i64 = sys_mmap(16) as *i64
1311 let rlst: *u8 = sys_read_file("knowledge/compare/radar.list" as *u8, rlen0)
1312 var rln: i64 = 0
1313 if (rlst as i64) != 0 { rln = rlen0[0] }
1314 if rln <= 0 { w(1, " SKIPPED (no radar.list in this buildroot)\n" as *u8) } else {
1315 let RGAP: *u8 = "../nx_swcompare_gapmap.elf" as *u8
1316 let rgfd: i64 = sys_openat_rd(RGAP)
1317 if rgfd < 0 { w(1, " SKIPPED (nx_swcompare_gapmap.elf not promoted)\n" as *u8) } else { sys_close(rgfd)
1318 var rp: i64 = 0
1319 while rp < rln {
1320 var re: i64 = rp
1321 while re < rln { if rlst[re] == (10 as u8) { break } re = re + 1 }
1322 rlst[re] = 0 as u8
1323 let rdom: *u8 = (rlst as i64 + rp) as *u8
1324 rp = re + 1
1325 if rdom[0] == (0 as u8) { } else { if rdom[0] == (35 as u8) { } else {
1326 w(1, " domain " as *u8); w(1, rdom); w(1, ":\n" as *u8)
1327 rg_scaffold(droot, rdom)
1328 var ro: i64 = scopy(target, 0, droot); ro = scopy(target, ro, rdom); ro = scopy(target, ro, "/api.json" as *u8); target[ro] = 0 as u8
1329 let radar_emit:i64=rg_emit(RGAP, rdom, "json" as *u8, 123, 400, target, out, cap)
1330 if radar_emit == 0 { pubs = pubs + 1 } else { if radar_emit==(0-6) {fails=fails+1} w(1, " radar emission failed; published/evidence state shown above\n" as *u8) }
1331 } }
1332 }
1333 }
1334 }
1335 rg_census(droot)
1336 rg_watchlist(droot)
1337 w(1, " hub:\n" as *u8)
1338 // The hub/openapi regenerate FROM the registry. On the NAS the registry is DELIBERATELY not synced
1339 // (it is multi-session contended on the laptop; regenerating from a stale snapshot would clobber
1340 // parallel additions) -> absent registry = SKIP hub cleanly, matrices-only regen. Laptop publishes hub.
1341 let regchk: i64 = sys_openat_rd("knowledge/compare/registry" as *u8)
1342 if regchk < 0 {
1343 w(1, " SKIPPED (registry not synced here; hub + openapi are laptop-published by design)\n" as *u8)
1344 } else { sys_close(regchk)
1345 let hrc: i64 = rg_run(HUB, 0 as *u8, 0 as *u8, out, cap, ol)
1346 if hrc != 0 { w(1, " HUB GATE RED -- refusing to publish hub\n" as *u8); fails = fails + 1 } else {
1347 var o2: i64 = scopy(target, 0, droot); o2 = scopy(target, o2, "api.json" as *u8); target[o2] = 0 as u8
1348 if rg_emit(HUB, "json" as *u8, 0 as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
1349 o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "index.html" as *u8); target[o2] = 0 as u8
1350 if rg_emit(HUB, "html" as *u8, 0 as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
1351 o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "openapi.json" as *u8); target[o2] = 0 as u8
1352 if rg_emit(HUB, "openapi" as *u8, 0 as *u8, 123, 800, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
1353 } }
1354 // MATURITY BOARD (2026-07-16, operator "the high scores are liars without a maturity analysis"):
1355 // every regen re-grades ALL matrix domains with the evidence-capped census and republishes
1356 // /compare/maturity (presence vs honest maturity + inflation ratio). The board writes atomically
1357 // itself (same .nxnew+rename discipline) and FAILS CLOSED below 10 graded domains.
1358 w(1, " maturity board:\n" as *u8)
1359 let BOARD: *u8 = rg_forkpath(RG_FORK_BOARD)
1360 let bfd: i64 = sys_openat_rd(BOARD)
1361 if bfd < 0 { w(1, " SKIPPED (board organ not staged in this buildroot)\n" as *u8) } else { sys_close(bfd)
1362 let brc: i64 = rg_run(BOARD, 0 as *u8, 0 as *u8, out, cap, ol)
1363 if brc != 0 { w(1, " MATURITY-BOARD RED -- refusing\n" as *u8); fails = fails + 1 }
1364 else { w(1, " published /compare/maturity (evidence-capped census over every matrix domain)\n" as *u8); pubs = pubs + 1 }
1365 }
1366 } else {
1367 pubs=rg_published_count(pubs)
1368 if rg_scope_receipt(droot, selected, pubs, fails) != 0 {
1369 w(1, "SCOPE-RECEIPT-FAIL: domain publication cannot claim complete scope metadata\n" as *u8)
1370 fails = fails + 1
1371 }
1372 w(1, "SCOPE-COMPLETE domain=" as *u8); w(1, selected)
1373 w(1, " aggregates_refreshed_by_this_run=0; full-surface freshness not claimed\n" as *u8)
1374 }
1375 w(1, " sota-class domains=" as *u8); wn(1, sota_c); w(1, " with_matrix=" as *u8); wn(1, sota_matrix_c); w(1, " (watch contracts rendered on those pages; the rest have no contracts to render)\n" as *u8)
1376 w(1," audit_failures=" as *u8);wn(1,g_rg_receipt_failures);w(1," published_evidence_incomplete=" as *u8);wn(1,g_rg_published_incomplete);w(1," reserve_extra_bytes=0 (no additional estate reserve; bavail advisory)\n" as *u8)
1377 if selected_len==0 {pubs=rg_published_count(pubs)}
1378 rg_lease_release() // every publish is done; a second regen may now start (2026-09-02)
1379 rg_progress("DONE" as *u8, domains_done, pubs, fails)
1380 // EC47 (2026-09-16): THE COMPARE FEED -- every board's daily place on the four-quadrant map and the rows journaled that
1381 // day, as RSS at <droot>feed.xml on this same beat (nx_compare_feed_lib). Scope does not narrow it: the feed is one file
1382 // over every board and its inputs (the spines and plans) are already on disk, so a scoped run refreshes it too.
1383 // ANNOUNCES AND COUNTS, NEVER FAILS THE RUN: a feed that could not be built leaves the previous feed in place.
1384 let fst: *i64 = sys_mmap(8 * CF_ST_SLOTS) as *i64
1385 let foutp: *i64 = sys_mmap(8) as *i64
1386 let ftoday: i64 = sys_now_realtime_sec() / CF_DAY_S
1387 let flen: i64 = cf_build("" as *u8, CF_LIST_PATH, ftoday, fst, foutp)
1388 let fpath: *u8 = sys_mmap(CF_PATH_MAX)
1389 var fpo: i64 = scopy(fpath, 0, droot); fpo = scopy(fpath, fpo, "feed.xml" as *u8); fpath[fpo] = 0 as u8
1390 var fwrote: i64 = 0
1391 if flen > 0 { if fst[CF_ST_SHORT] == 0 { rg_write_atomic(fpath, foutp[0] as *u8, flen); fwrote = 1 } }
1392 w(1, "FEED path=" as *u8); w(1, fpath); w(1, " items=" as *u8); wn(1, fst[CF_ST_ITEMS]); w(1, " boards=" as *u8); wn(1, fst[CF_ST_DOMAINS])
1393 w(1, " spines=" as *u8); wn(1, fst[CF_ST_SPINES]); w(1, " rows_quoted=" as *u8); wn(1, fst[CF_ST_ROWS]); w(1, " malformed=" as *u8); wn(1, fst[CF_ST_MALFORMED])
1394 w(1, " overflow=" as *u8); wn(1, fst[CF_ST_OVERFLOW]); w(1, " short=" as *u8); wn(1, fst[CF_ST_SHORT]); w(1, " window_days=" as *u8); wn(1, fst[CF_ST_WINDOW])
1395 w(1, " bytes=" as *u8); wn(1, flen); w(1, " written=" as *u8); wn(1, fwrote); w(1, "\n" as *u8)
1396 g_rg_feed_items = fst[CF_ST_ITEMS]
1397 g_rg_feed_written = fwrote
1398 w(1, "REGEN published=" as *u8); wn(1, pubs); w(1, " fails=" as *u8); wn(1, fails)
1399 if selected_len > 0 { w(1, " scope=domain aggregates_refreshed_by_this_run=0" as *u8) } else { w(1, " scope=full" as *u8) }
1400 // THE NAMED FIELDS A CONSUMER BRANCHES ON, so the fork check is not an announcement nobody reads.
1401 // Placed BEFORE verdict= deliberately: this estate judges by the LAST line and anchors by POSITION,
1402 // so verdict must remain the final token here. STRICTLY ADDITIVE -- none of these touch `fails`, so
1403 // no run that passed before can fail now. forkstale>0 beside verdict=GREEN is the honest and intended
1404 // reading: the surface published, AND it published from a binary that is not the promoted one.
1405 w(1, " forkchecked=" as *u8); wn(1, g_rg_fork_checked)
1406 w(1, " forkfresh=" as *u8); wn(1, g_rg_fork_fresh)
1407 w(1, " forkstale=" as *u8); wn(1, g_rg_fork_stale)
1408 w(1, " forkunproven=" as *u8); wn(1, g_rg_fork_unproven)
1409 w(1, " forkabsent=" as *u8); wn(1, g_rg_fork_absent)
1410 w(1, " exports=" as *u8); wn(1, g_rg_exports)
1411 w(1, " exports_absent=" as *u8); wn(1, g_rg_exports_absent)
1412 w(1, " export_fails=" as *u8); wn(1, g_rg_export_fails)
1413 w(1, " feed_items=" as *u8); wn(1, g_rg_feed_items); w(1, " feed_written=" as *u8); wn(1, g_rg_feed_written)
1414 return rg_exit_verdict(fails)
1415}