code wiki / (root) / nx_compare_regen_scoped.nx
`nx_compare_regen_scoped.nx` source

↩ module page · 1179 lines · 75245 B
1// nx_compare_regen.nx -- ON-NAS regeneration of the whole Nishi Compare publish surface (operator 2026-07-09:
2// "no frozen snapshots"). Re-MEASURES every matrix domain against the synced source tree (buildroot/runtime),
3// GATE-CHECKED: for each artifact the generator's liar-kill gate must exit 0 FIRST -- a RED measurement is NEVER
4// published (fail-closed). Then emits json+html per domain + the hub index json/html + the in-code OpenAPI, and
5// hot-swaps each into the LIVE docroot via write-.new + sys_renameat (atomic; a concurrent reader never tears).
6// Because nx_compare_serve reads the SAME docroot files, MCP tools/call and public REST update together, single
7// source. argv: [1]=buildroot dir (default "buildroot"), [2]=docroot prefix (default "../sites/nishifamily/compare/",
8// i.e. the live docroot relative to buildroot). The MCP allowlist row PINS these args (caller argv ignored) so a
9// tools/call caller cannot redirect writes. Targets must already exist (this regenerates, never scaffolds).
10// license_tier: ORIGINAL  expect_exit: 0
11import "nx_tool_run.nx"
12import "nx_compare_receipt_lib.nx"
13import "nx_compare_scope_lib.nx"
14import "nx_symdecl_lib.nx"
15import "nx_estate_path.nx"
16import "nx_forkfresh_lib.nx"
17// EC17 (2026-09-01): the engine grades ITSELF with the same ladder it applies to the estate. The lib's
18// paths are estate-relative by construction, so this works from the regen's buildroot CWD unchanged.
19import "nx_catalog_lib.nx"
20import "nx_ioadmit_lib.nx"   // THE I/O-storm ruler the build gate and the clock already share (2026-09-02): a seat-launched regen must consult it too
21import "nx_heavyio_lib.nx"   // THE CLASS BOUND (hub-spoke, 2026-09-03): heavy producers RUNNING across every launch surface vs the derived width
22// PURPOSE-NAMED BOUNDS (2026-08-14). These were five consts literally named K_MAGIC_<value> -- a name
23// that RESTATES the number and is LESS greppable than the bare literal, which is the estate's own banked
24// anti-pattern: in every recorded case the VALUE was right and the NAME was the defect. Worse, they were
25// SHARED ACROSS UNRELATED PURPOSES -- K_MAGIC_65536 was at once the matrix file-read cap, three roster
26// file-read caps, the debtstate OUTPUT accumulator and the getdents64 transfer buffer, and K_MAGIC_262144
27// was both the store-put capture and the debt-tool capture.
28// -- ONE CONSTANT SERVING TWO UNRELATED PURPOSES CAN NEVER BE TUNED FOR EITHER.
29// Every FILE read in this organ now composes sys_read_file (buffer sized from the file by lseek END,
30// cannot short-read), so those caps are DELETED rather than renamed: for a file there is no guess to
31// make, and raising a cap only moves the guess. What survives is only what is genuinely unknowable in
32// advance -- the size of a child process's stdout, and one syscall's transfer buffer.
33const RG_EMIT_CAPTURE_BYTES: i64 = 1048576  // generator stdout: a whole emitted page, size unknown until it runs
34const RG_HTML_MIN_BYTES: i64 = 2000         // a validity FLOOR, not a buffer: shorter than this is not a page
35const RG_DEBTSTATE_BYTES: i64 = 65536       // debtstate accumulator; every write clamps on oo < ocap
36const RG_GETDENTS_BYTES: i64 = 65536        // ONE getdents64 transfer -- the caller loops until it returns 0
37const RG_CHILD_CAPTURE_BYTES: i64 = 262144  // a forked tool's stdout, size unknowable in advance
38
39func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
40func wn(fd: i64, v: i64) -> i64 {
  var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
  let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
45}
46func scopy(dst: *u8, doff: i64, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[doff+i] = src[i]; i = i + 1 } return doff + i }
47// rg_read IS GONE (2026-08-14). It was a capped whole-file reader whose loop -- `while tot < cap` --
48// returned a PREFIX and reported it as the length, with no way for any caller to tell a complete read
49// from a truncated one. Seven call sites trusted it: the domain roster (twice), the radar roster, the
50// hand roster, each domain's .matrix, and the organ under each watch contract. One of those was
51// MEASURABLY truncating (nx_parse.nx at 316,533 B against a 262,144 cap) and the rest were one growth
52// spurt away. Every site now composes sys_read_file, which sizes its buffer from the file by lseek END
53// and cannot short-read -- so the failure mode is deleted rather than made less likely.
54// -- A CEILING THAT HAS TO BE GUESSED IS A DEFECT GENERATOR IN BOTH DIRECTIONS, AND RAISING IT ONLY
55//    MOVES THE GUESS.
56// atomic publish: write path.new then rename over path (the S-class content-publish primitive).
57func rg_write_atomic(path: *u8, buf: *u8, n: i64) -> i64 {
  let evidence:*i64=rgr_alloc(16) as *i64
  if (evidence as i64)<=0 {return RGR_E_WRITE}
  let rc:i64=rgr_write_atomic(path,buf,n,evidence,(evidence as i64+8) as *i64)
  if rc!=0 {
      w(1,"    ATOMIC-FAIL code=" as *u8);wn(1,rc)
      w(1," syscall=" as *u8);wn(1,evidence[1])
      w(1," artifact_published=" as *u8);wn(1,evidence[0]);w(1,"\n" as *u8)
  }
  rgr_free(evidence as *u8,16)
  return rc
68}
69// scaffold: ensure <droot><dom>/ exists before emit (mkdir 0755; EEXIST is harmless). Root-fixes the
70// "never scaffolds" gap that blocked publishing a BRAND-NEW domain (no docroot dir -> WRITE-FAIL). Fail-safe.
71func rg_scaffold(droot: *u8, dom: *u8) -> i64 {
  let d: *u8 = sys_mmap(600)
  var o: i64 = scopy(d, 0, droot); o = scopy(d, o, dom); d[o] = 0 as u8
  sys_mkdir(d, 493)   // 0755; ignore return -- EEXIST on an existing domain is expected
  return 0
76}
77// run elf with up to 2 args, capture stdout. returns child exit code; outlen[0]=captured bytes.
78func rg_run(elf: *u8, a1: *u8, a2: *u8, out: *u8, cap: i64, outlen: *i64) -> i64 {
  let av: *i64 = sys_mmap(64) as *i64
  av[0] = elf as i64
  var n: i64 = 1
  if (a1 as i64) != 0 { av[n] = a1 as i64; n = n + 1 }
  if (a2 as i64) != 0 { av[n] = a2 as i64; n = n + 1 }
  av[n] = 0
  return tr_run_capture(elf, av, out, cap, outlen)
86}
87// ---- Durable publish receipts; completion rows preserve the existing journal contract.
88// Extra reserve bootstrap=0 means no additional estate reserve; actual writes remain authoritative.
89const RG_PUBJRNL: *u8 = "../knowledge/status/comparepub.jrnl"
90static g_rg_receipt_failures:i64
91static g_rg_published_incomplete:i64
92// a records-file row's fixed bytes beyond its fields: the underscore + five TABs + the newline (7),
93// the longest state word LANDED (6), and a NUL (1).
94const RG_WATCHROW_OVERHEAD: i64 = 14
95func rgr_num(b:*u8,off:i64,v:i64)->i64 {return rgr_decimal(b,off,v)}
96// ---- SINGLETON + I/O ADMISSION, IN THE EMITTER, FOR EVERY LAUNCHER (2026-09-02, the I/O-storm lane) ----------
97// MEASURED: at 15:57Z and 15:59Z two seats launched this organ two minutes apart while a third ran evidence
98// sweeps; nx_dstate at a raised ceiling then showed the array's D-state roster filled with THIS organ's children
99// (nx_swcompare_matrix, nx_site_publish, nx_nav_sentinel) beside the plane writers -- load 29 -> 43, iowait equal
100// to user time, every /api/build refused for hours. The clock beat is already storm-deferred (clk_storm_defer +
101// clock_heavy.conf); a SEAT-launched regen bypassed that ruler entirely, and nothing stopped two of them running
102// at once. Both are closed here, once, for every launcher (beat, MCP nishi_compare_regen, nx_job_run):
103//   (1) ONE regen at a time -- ../nx_lease.elf acquire compare-regen <owner> <ttl>. A second launcher is told the
104//       holder and exits with nx_lease's own BUSY code; the lease is released before the summary line, and the
105//       TTL (900 s = the measured worst run, 811 s, with margin) reaps a crashed holder on its own.
106//   (2) the SAME I/O-storm ruler the build gate and the clock use (nx_ioadmit_lib): a zero spawn budget REFUSES
107//       with the live figures and the build gate's QUEUE code -- a regen that starts into a storm only deepens
108//       it and publishes nothing sooner. UNREADABLE never refuses (abstain toward the pre-change behaviour).
109//   Neither can lose a publish: a broken lease organ is announced and the run proceeds unleased.
110const RG_LEASE_NAME: *u8 = "compare-regen"
111const RG_LEASE_TTL_S: *u8 = "900"      // nx_lease takes the ttl as text; DERIVED from the measured worst run 811 s + margin
112const RG_LEASE_CAP: i64 = 4096
113const RG_EXIT_BUSY: i64 = 3            // nx_lease's own BUSY exit, relayed unchanged so a caller learns one code
114const RG_EXIT_STORM: i64 = 4           // the build gate's QUEUE exit, relayed unchanged for the same reason
115const RG_LEASE_ELF: *u8 = "../nx_lease.elf"   // CWD is the build root; the promoted lease organ lives at its parent
116static g_rg_lease_owner: *u8
117// fork the lease organ with this run's owner tag; out is NUL-terminated so the holder line can be relayed verbatim
118func rg_lease_run(verb: *u8, out: *u8) -> i64 {
  let av: *i64 = sys_mmap(64) as *i64
  av[0] = RG_LEASE_ELF as i64
  av[1] = verb as i64
  av[2] = RG_LEASE_NAME as i64
  av[3] = g_rg_lease_owner as i64
  var n: i64 = 4
  if verb[0] == (97 as u8) { av[n] = RG_LEASE_TTL_S as i64; n = n + 1 }   // 'a'cquire carries the ttl; release does not
  av[n] = 0
  let ol: *i64 = sys_mmap(16) as *i64
  ol[0] = 0
  let rc: i64 = tr_run_capture(RG_LEASE_ELF, av, out, RG_LEASE_CAP - 1, ol)
  if ol[0] >= 0 { if ol[0] < RG_LEASE_CAP { out[ol[0]] = 0 as u8 } }
  return rc
132}
133func rg_lease_release() -> i64 {
  if (g_rg_lease_owner as i64) == 0 { return 0 }
  let out: *u8 = sys_mmap(RG_LEASE_CAP)
  let rc: i64 = rg_lease_run("release" as *u8, out)
  sys_munmap(out, RG_LEASE_CAP)
  g_rg_lease_owner = 0 as *u8
  return rc
140}
141
142static g_rg_transaction_sequence:i64
143// Existing emitter contract is retained; all audit failures return nonzero to the run.
144func rg_emit_receipted(elf: *u8, a1: *u8, mode: *u8, firstbyte: i64, minbytes: i64, target: *u8, out: *u8, cap: i64, journal:*u8) -> i64 {
  let ol: *i64 = rgr_alloc(16) as *i64
  if (ol as i64)<=0 {return 0-1}
  let rc: i64 = rg_run(elf, a1, mode, out, cap, ol)
  if rc != 0 { w(1, "    EMIT-FAIL rc nonzero: " as *u8); w(1, target); w(1, "\n" as *u8); rgr_free(ol as *u8,16);return 0 - 1 }
  if ol[0] < minbytes { w(1, "    EMIT-FAIL too small: " as *u8); w(1, target); w(1, "\n" as *u8);rgr_free(ol as *u8,16);return 0 - 2 }
  if (out[0] as i64) != firstbyte { w(1, "    EMIT-FAIL wrong leading byte: " as *u8); w(1, target); w(1, "\n" as *u8);rgr_free(ol as *u8,16);return 0 - 3 }
  var prev:i64=0-1
  let pf:i64=sys_openat_rd(target)
  if pf>=0 {prev=sys_lseek(pf,0,2);sys_close(pf)}
  let tx:*RgrTx=rgr_alloc(13*8) as *RgrTx
  if (tx as i64)<=0 {rgr_free(ol as *u8,16);return 0-6}
  let idcap:i64=2*RGR_DECIMAL_BYTES+2
  let id:*u8=rgr_alloc(idcap)
  if (id as i64)<=0 {rgr_free(tx as *u8,13*8);rgr_free(ol as *u8,16);return 0-6}
  var o:i64=rgr_decimal(id,0,sys_now_realtime_us());o=rgr_copy(id,o,"-" as *u8)
  g_rg_transaction_sequence=g_rg_transaction_sequence+1
  rgr_decimal(id,o,g_rg_transaction_sequence)
  let tr:i64=rgr_transact(tx,journal,target,out,ol[0],prev,sys_now_realtime_sec(),id,RGR_NO_EXTRA_RESERVE)
  var result:i64=tr
  if tr!=0 {
      g_rg_receipt_failures=g_rg_receipt_failures+1
      if tx.published==1 {g_rg_published_incomplete=g_rg_published_incomplete+1}
      w(1,"    RECEIPT-TRANSACTION-FAIL code=" as *u8);wn(1,tr)
      w(1," syscall=" as *u8);wn(1,tx.detail)
      w(1," artifact_published=" as *u8);wn(1,tx.published)
      w(1," target=" as *u8);w(1,target)
      w(1," intent=" as *u8);if (tx.intentpath as i64)>0 {w(1,tx.intentpath)}
      w(1," reserve_extra_bytes=" as *u8);wn(1,tx.reserve)
      w(1," available_bavail_bytes=" as *u8);wn(1,tx.available)
      w(1," required_data_bytes=" as *u8);wn(1,tx.required)
      w(1," next_action=reconcile retained intent before retry; no automatic crash replay\n" as *u8)
  } else {
      w(1, "    published " as *u8); w(1, target); w(1, " (" as *u8); wn(1, ol[0]); w(1, " bytes" as *u8)
      if prev >= 0 { w(1, " prev=" as *u8); wn(1, prev); if ol[0] < prev { w(1, " SHRANK" as *u8) } }
      w(1, ") receipt=durable reserve_extra_bytes=0 (no additional estate reserve; bavail is advisory)\n" as *u8)
  }
  let release:i64=rgr_release(tx)
  if release!=0 {
      w(1,"    RECEIPT-CLOSE-FAIL syscall=" as *u8);wn(1,release);w(1,"\n" as *u8)
      if result==0 {g_rg_receipt_failures=g_rg_receipt_failures+1;g_rg_published_incomplete=g_rg_published_incomplete+1}
      result=RGR_E_DURABLE
  }
  rgr_free(tx as *u8,13*8);rgr_free(id,idcap);rgr_free(ol as *u8,16)
  if result!=0 {return 0-6}
  return 0
190}
191func rg_emit(elf:*u8,a1:*u8,mode:*u8,firstbyte:i64,minbytes:i64,target:*u8,out:*u8,cap:i64)->i64 {return rg_emit_receipted(elf,a1,mode,firstbyte,minbytes,target,out,cap,RG_PUBJRNL)}
192// ---- WATCHLIST PASS (2026-08-13, operator: the compare IS the workflow -- parallel workstreams
193// as a hive). Every _ABSENT_:<sym> watch row across the matrix roster is reconciled into ONE
194// machine-readable artifact, published twice: knowledge/status/compare_watchlist.tsv (the PM /
195// frontier plane intake) and <droot>watchlist.tsv (the public hive queue). Status is MEASURED here
196// with the same ruler as the page cells, so LANDED appears the moment an organ ships its symbol.
197// Additive like the census: this pass can never turn the core publish RED.
198// SUBSTRING MATCHING IS NOT OWNED HERE: the hand-rolled rgw_has that used to sit at this spot was a
199// SECOND scanner beside nx_tool_run's tr_contains, which this organ already imports transitively --
200// the duplicate-ruler defect wearing a local helper. Removed 2026-08-14 after proving it had exactly
201// ONE call site (corpus_complete=1 over 23,073 files). The only behavioural difference was on an EMPTY
202// needle (rgw_has 0, tr_contains 1), which is unreachable here: the watch parser requires at least one
203// character after "_ABSENT_:" before a row is treated as a contract at all.
204func rg_watchlist(droot: *u8) -> i64 {
  w(1, "  watchlist (the hive queue -- every watch contract across the roster):\n" as *u8)
  // THE DOMAIN ROSTER IS READ WHOLE OR NOT AT ALL. A capped read here would drop domains off the
  // TAIL of regen.list in silence, and a domain that never gets scanned contributes no watch rows --
  // which is indistinguishable from a domain that has none.
  let llen: *i64 = sys_mmap(16) as *i64
  let lbuf: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, llen)
  if (lbuf as i64) == 0 { w(1, "    UNOBSERVABLE (regen.list unreadable)\n" as *u8); return 0 - 1 }
  let lln: i64 = llen[0]
  if lln <= 0 { w(1, "    UNOBSERVABLE (regen.list empty)\n" as *u8); return 0 - 1 }
  // BATCHED PLANE WRITE (2026-08-19, the 1787080869 convoy fix). The old pass forked
  // ../nx_store_put.elf ONCE PER WATCH ROW: ~90 forks x 2 planes x fsync-under-flock serialized in
  // the fs journal, so ONE watchlist pass ran 1-3 HOURS under load and regens stacked faster than
  // they drained (MEASURED 2026-08-18: 23 stacked regens, the lock holder D-state in
  // wait_log_commit, waiters 78 min in locks_lock_inode_wait). The store ALREADY grew the cure the
  // same day -- putmany, one sts_load + one sts_seed for the whole batch ("the 88->1 fsync
  // collapse", its own words) -- and this pass now COMPOSES it: rows accumulate in a records file,
  // ONE fork commits them all. Records-file shape is putmany-owned: one row per line, TAB-joined,
  // first field = id; the per-row retry is gone BECAUSE the race it paced around is gone.
  let mlen: *i64 = sys_mmap(16) as *i64
  let obuf: *u8 = sys_mmap(RG_CHILD_CAPTURE_BYTES)
  let mp: *u8 = sys_mmap(600)
  let op: *u8 = sys_mmap(600)
  let sp: *u8 = sys_mmap(256)
  let av: *i64 = sys_mmap(96) as *i64
  let prl: *i64 = sys_mmap(16) as *i64
  let olen: *i64 = sys_mmap(16) as *i64
  let spe: *u8 = "../nx_store_put.elf" as *u8
  let pfx: *u8 = "../knowledge/store/comparewatch-" as *u8
  let vactor: *u8 = "nx_compare_regen" as *u8
  let recpath: *u8 = "/tmp/comparewatch_batch.rec" as *u8
  let rfd: i64 = sys_openat_wr(recpath, MODE_0644)
  if rfd < 0 { w(1, "    UNOBSERVABLE (cannot open the batch records file)\n" as *u8); return 0 - 1 }
  var open_c: i64 = 0
  var land_c: i64 = 0
  // DARK (2026-09-06, operator: a permanent fix, we do not build and lose capability to darkness): the organ file
  // the watch names EXISTS and was read, but does not declare the contracted symbol -- something shipped there
  // under another name. A strict refinement of OPEN: still work, now named. The ruler already separated the two
  // (sd_present -1 unreadable / 0 read-and-absent); every consumer folded them together until today.
  var dark_c: i64 = 0
  var p: i64 = 0
  while p < lln {
      var e: i64 = p
      while e < lln { if lbuf[e] == (10 as u8) { break } e = e + 1 }
      lbuf[e] = 0 as u8
      let dom: *u8 = (lbuf as i64 + p) as *u8
      p = e + 1
      if dom[0] == (0 as u8) { } else { if dom[0] == (35 as u8) { } else {
          var mo: i64 = scopy(mp, 0, "knowledge/compare/" as *u8)
          mo = scopy(mp, mo, dom); mo = scopy(mp, mo, ".matrix" as *u8); mp[mo] = 0 as u8
          let mbuf: *u8 = sys_read_file(mp, mlen)
          var mn: i64 = 0
          if (mbuf as i64) != 0 { mn = mlen[0] }
          var q: i64 = 0
          while q < mn {
              var f: i64 = q
              while f < mn { if mbuf[f] == (10 as u8) { break } f = f + 1 }
              var p1: i64 = 0 - 1
              var p2: i64 = 0 - 1
              var p3: i64 = 0 - 1
              var x: i64 = q
              while x < f {
                  if mbuf[x] == (124 as u8) {
                      if p1 < 0 { p1 = x } else { if p2 < 0 { p2 = x } else { if p3 < 0 { p3 = x } } }
                  }
                  x = x + 1
              }
              var iswatch: i64 = 0
              if p2 >= 0 { if p3 > p2 { if p3 - (p2 + 1) > 9 { if mbuf[q] != (35 as u8) {
                  let pref: *u8 = "_ABSENT_:" as *u8
                  var kk: i64 = 0
                  var okp: i64 = 1
                  var gop: i64 = 1
                  while gop == 1 {
                      if kk >= 9 { gop = 0 } else {
                          if mbuf[p2 + 1 + kk] != pref[kk] { okp = 0; gop = 0 } else { kk = kk + 1 }
                      }
                  }
                  if okp == 1 { iswatch = 1 }
              } } } }
              if iswatch == 1 {
                  var oc: i64 = 0
                  var y: i64 = p1 + 1
                  while y < p2 { op[oc] = mbuf[y]; oc = oc + 1; y = y + 1 }
                  op[oc] = 0 as u8
                  var sc: i64 = 0
                  y = p2 + 10
                  while y < p3 { sp[sc] = mbuf[y]; sc = sc + 1; y = y + 1 }
                  sp[sc] = 0 as u8
                  // the LANDED measurement reads the named organ source WHOLE (sys_read_file -- no cap
                  // to cross in silence) and asks THE ONE RULER (nx_symdecl_lib, 2026-08-23): a top-level
                  // declaration of the symbol. tr_contains (substring) used to sit here, so a comment or
                  // a call site naming the symbol wrote LANDED into the plane every seat reads for work
                  // (measured on lang LN8: LANDED here, OPEN in the ranker). The plane, the page cells
                  // and the ranker now share one function and cannot disagree.
                  let osrc: *u8 = sys_read_file(op, olen)
                  var landed: i64 = 0
                  let rl: *i64 = sys_mmap(16) as *i64
                  if (osrc as i64) != 0 { if olen[0] > 0 { landed = sd_present_buf(osrc, olen[0], op, sp, rl) } }
                  // one records-file row: <dom>_<symbol> TAB dom TAB label TAB organ TAB symbol TAB state --
                  // sized FROM THE FIELDS IT HOLDS (rule 11: a buffer is derived from its input, never guessed):
                  // dom twice, symbol twice, the label (p1 - q bytes), the organ, plus the fixed overhead.
                  var dlen: i64 = 0
                  while dom[dlen] != (0 as u8) { dlen = dlen + 1 }
                  let rrow: *u8 = sys_mmap(dlen + dlen + sc + sc + (p1 - q) + oc + RG_WATCHROW_OVERHEAD)
                  var ro: i64 = 0
                  ro = scopy(rrow, ro, dom)
                  rrow[ro] = 95 as u8; ro = ro + 1
                  ro = scopy(rrow, ro, sp)
                  rrow[ro] = 9 as u8; ro = ro + 1
                  ro = scopy(rrow, ro, dom)
                  rrow[ro] = 9 as u8; ro = ro + 1
                  var lc: i64 = q
                  while lc < p1 { rrow[ro] = mbuf[lc]; ro = ro + 1; lc = lc + 1 }
                  rrow[ro] = 9 as u8; ro = ro + 1
                  ro = scopy(rrow, ro, op)
                  rrow[ro] = 9 as u8; ro = ro + 1
                  ro = scopy(rrow, ro, sp)
                  rrow[ro] = 9 as u8; ro = ro + 1
                  if landed == 1 { ro = scopy(rrow, ro, "LANDED" as *u8); land_c = land_c + 1 }
                  else {
                      // DARK: the organ was READ (osrc non-null, olen > 0) and the declaration ruler said absent under a
                      // rule that can judge (the JS rule's abstention is folded to 0 by sd_present_buf and is excluded
                      // through rl[0]). Something shipped at this path under another name; the cell would read OPEN
                      // forever and the capability would be lost to darkness. Still work, now named.
                      var isdark: i64 = 0
                      if (osrc as i64) != 0 { if olen[0] > 0 { if rl[0] != SD_RULE_JSDECL { isdark = 1 } } }
                      if isdark == 1 { ro = scopy(rrow, ro, "DARK" as *u8); dark_c = dark_c + 1 }
                      else { ro = scopy(rrow, ro, "OPEN" as *u8); open_c = open_c + 1 }
                  }
                  rrow[ro] = 10 as u8; ro = ro + 1
                  sys_write(rfd, rrow, ro)
              }
              q = f + 1
          }
      } }
  }
  sys_close(rfd)
  var stored: i64 = 0
  if open_c + land_c + dark_c > 0 {
      av[0] = spe as i64
      av[1] = pfx as i64
      av[2] = "putmany" as *u8 as i64
      av[3] = vactor as i64
      av[4] = recpath as i64
      av[5] = 0
      prl[0] = 0
      let prc: i64 = tr_run_capture(spe, av, obuf, RG_CHILD_CAPTURE_BYTES, prl)
      // PRINT THE STORE OWN WORDS -- capturing a diagnostic and not printing it is the same as
      // not capturing it (this file own banked law).
      if prl[0] > 0 { w(1, "    " as *u8); sys_write(1, obuf, prl[0]) }
      if prc == 0 { stored = open_c + land_c + dark_c }
  }
  w(1, "    contracts OPEN=" as *u8); wn(1, open_c); w(1, " LANDED=" as *u8); wn(1, land_c); w(1, " DARK=" as *u8); wn(1, dark_c)
  w(1, " -> comparewatch- plane rows stored=" as *u8); wn(1, stored)
  w(1, " of " as *u8); wn(1, open_c + land_c + dark_c)
  w(1, " via=putmany-single-commit" as *u8)
  // A PARTITION IS A CLAIM -- PRINT THE VERDICT, DO NOT MAKE THE READER SUBTRACT.
  if stored == open_c + land_c + dark_c { w(1, " partition=RECONCILES\n" as *u8) } else {
      w(1, " partition=SHORTFALL -- the batch did not commit; the store own words are above\n" as *u8)
  }
  return 0
366}
367
368// ---- DEBT STATE SYNC (2026-08-14). The registers on each compare page are AUTHORED prose, but their
369// STATE must not be. This forks the debt tool per domain and writes `<dom>.debtstate` as `id<TAB>state`,
370// so the generator can show what the PLANE says rather than what the page claims.
371// ★THE SPLIT IS DELIBERATE AND WAS SETTLED BY PROBING THE TOOL: the PLANE owns STATE (open/eaten), the
372// PAGE owns NARRATIVE. Regenerating the register wholesale from the plane would destroy the written
373// remedies; pushing page prose into the plane would corrupt the audit trail. So: state only, one way.
374// It also exposes ids that are NOT in the plane at all -- page-local notes wearing the shape of a filed
375// debt -- which is the honest thing to surface rather than let them read as filed work.
376// Line shape from the tool: <index> <epoch-id>\t<sev>\t<scope>\t<state>\t<desc>
377func rg_debtstate(dom: *u8, buf: *u8, cap: i64, out: *u8, ocap: i64) -> i64 {
  let av: *i64 = sys_mmap(64) as *i64
  let ol: *i64 = sys_mmap(16) as *i64
  let ELF: *u8 = "../nx_debt.elf" as *u8
  // ⚠PASS THE PLANE PREFIX EXPLICITLY. The debt tool resolves its store RELATIVE TO CWD, and this organ
  // runs from buildroot where that path does not exist -- so it found zero rows and wrote no file, which
  // is indistinguishable from "this domain has no debt". Same CWD-relative trap as the two knowledge
  // trees, the gate forking "../elf", and the watchlist writing into the wrong tree: FOUR times in one
  // day. ★A TOOL THAT RESOLVES ITS DATA RELATIVE TO CWD IS A TOOL THAT LIES QUIETLY WHEN FORKED.
  av[0] = ELF as i64
  av[1] = "find" as i64
  av[2] = dom as i64
  av[3] = "../knowledge/store/debt-" as i64
  av[4] = 0
  // ⚠DO NOT GATE ON THE EXIT CODE. This is a QUERY, and a query tool's exit status is not a reliable
  // success signal -- it may encode a match count or a no-match. The output is the answer, so parse what
  // came back and let `rows > 0` decide whether anything is written. Gating on rc silently produced no
  // state file at all on the first run, which reads exactly like "this domain has no debt".
  tr_run_capture(ELF, av, buf, cap, ol)
  let n: i64 = ol[0]
  if n <= 0 { return 0 - 1 }
  var oo: i64 = 0
  var p: i64 = 0
  var rows: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (10 as u8) { break } e = e + 1 }
      // id begins after the first space, and runs to the first tab
      var s: i64 = p
      while s < e { if buf[s] == (32 as u8) { break } s = s + 1 }
      if s < e {
          s = s + 1
          var idend: i64 = s
          while idend < e { if buf[idend] == (9 as u8) { break } idend = idend + 1 }
          if idend < e {
              // walk three tab-separated fields to reach state: sev, scope, state
              var f: i64 = 0
              var q: i64 = idend
              var sts: i64 = 0 - 1
              while q < e {
                  if buf[q] == (9 as u8) {
                      f = f + 1
                      if f == 3 { sts = q + 1; q = e } else { q = q + 1 }
                  } else { q = q + 1 }
              }
              if sts > 0 {
                  var ste: i64 = sts
                  while ste < e { if buf[ste] == (9 as u8) { break } ste = ste + 1 }
                  var k: i64 = s
                  while k < idend { if oo < ocap { out[oo] = buf[k]; oo = oo + 1 } k = k + 1 }
                  if oo < ocap { out[oo] = 9 as u8; oo = oo + 1 }
                  k = sts
                  while k < ste { if oo < ocap { out[oo] = buf[k]; oo = oo + 1 } k = k + 1 }
                  if oo < ocap { out[oo] = 10 as u8; oo = oo + 1 }
                  rows = rows + 1
              }
          }
      }
      p = e + 1
  }
  let path: *u8 = sys_mmap(600)
  var po: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
  po = scopy(path, po, dom)
  po = scopy(path, po, ".debtstate" as *u8)
  path[po] = 0 as u8
  if rows > 0 { rg_write_atomic(path, out, oo) }
  return rows
444}
445// ---- ORPHAN CENSUS (2026-08-13, operator: one sota compare capability, no orphans) ----
446// Reconciles the LIVE docroot against every roster that feeds this emitter. Each top-level dir in
447// <droot> must be claimed by exactly one of: regen.list (matrix/sota lane), radar.list (radar lane),
448// or hand.roster (adjudicated hand pages awaiting matrix admission -- a SHRINK-ONLY worklist). An
449// unclaimed dir is an ORPHAN, printed BY NAME with the remedy. Additive by design: the census never
450// turns the core publish RED (a permanently-RED detector is one everyone learns to ignore); new
451// sprawl is loud on every run, and the partition is printed so the parts provably sum. It re-reads
452// the roster files itself because main()'s line loop NUL-terminates lines in its own buffers.
453func rgc_inlist(lst: *u8, ln: i64, name: *u8) -> i64 {
  var p: i64 = 0
  while p < ln {
      var e: i64 = p
      while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
      var i: i64 = 0
      var ok: i64 = 1
      var stop: i64 = 0
      while stop == 0 {
          if p + i >= e { stop = 1 } else {
              let c: i64 = lst[p + i]
              if c == 124 { stop = 1 } else {
                  let nc: i64 = name[i]
                  if nc == 0 { ok = 0; stop = 1 } else {
                      if nc != c { ok = 0; stop = 1 } else { i = i + 1 }
                  }
              }
          }
      }
      if ok == 1 { let nc2: i64 = name[i]; if nc2 == 0 { if i > 0 { return 1 } } }
      p = e + 1
  }
  return 0
476}
477func rg_census(droot: *u8) -> i64 {
  w(1, "  orphan census (docroot dirs vs regen.list + radar.list + hand.roster):\n" as *u8)
  // ALL THREE ROSTERS READ WHOLE. This census decides ORPHAN by absence from these lists, so a capped
  // read is not merely lossy here -- it MANUFACTURES FALSE ORPHANS: a domain whose name sat past the cap
  // would be reported by name as unclaimed sprawl, with a remedy attached, while its roster row existed
  // all along. An absence verdict may never rest on a read that could have been partial.
  let mlen2: *i64 = sys_mmap(16) as *i64
  let rlen2: *i64 = sys_mmap(16) as *i64
  let hlen2: *i64 = sys_mmap(16) as *i64
  let mbuf: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, mlen2)
  let rbuf: *u8 = sys_read_file("knowledge/compare/radar.list" as *u8, rlen2)
  let hbuf: *u8 = sys_read_file("knowledge/compare/hand.roster" as *u8, hlen2)
  var mln: i64 = 0
  var rln: i64 = 0
  var hln: i64 = 0
  if (mbuf as i64) != 0 { mln = mlen2[0] }
  if (rbuf as i64) != 0 { rln = rlen2[0] }
  if (hbuf as i64) != 0 { hln = hlen2[0] }
  if mln <= 0 { w(1, "    CENSUS-UNOBSERVABLE: regen.list unreadable -- refusing to judge orphans\n" as *u8); return 0 - 1 }
  if hln <= 0 { w(1, "    (hand.roster absent -- every unroster'd dir will read ORPHAN)\n" as *u8) }
  let dfd: i64 = sys_openat_rd(droot)
  if dfd < 0 { w(1, "    CENSUS-UNOBSERVABLE: cannot open docroot (withheld, not GREEN)\n" as *u8); return 0 - 1 }
  let dbuf: *u8 = sys_mmap(RG_GETDENTS_BYTES)
  var dirs: i64 = 0
  var inm: i64 = 0
  var inr: i64 = 0
  var inh: i64 = 0
  var orph: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(dfd, dbuf, RG_GETDENTS_BYTES)
      if nr <= 0 { go = 0 } else {
          var o: i64 = 0
          while o < nr {
              let rec: *u8 = (dbuf as i64 + o) as *u8
              let ty: i64 = dirent_type(rec)
              let nm: *u8 = dirent_name(rec)
              let n0: i64 = nm[0]
              if ty == DT_DIR { if n0 != 46 {
                  dirs = dirs + 1
                  if rgc_inlist(mbuf, mln, nm) == 1 { inm = inm + 1 } else {
                  if rgc_inlist(rbuf, rln, nm) == 1 { inr = inr + 1 } else {
                  if rgc_inlist(hbuf, hln, nm) == 1 { inh = inh + 1 } else {
                      orph = orph + 1
                      w(1, "    ORPHAN-DIR " as *u8); w(1, nm)
                      w(1, "  (no roster claims it -- adopt: regen.list+matrix | radar.list+axes | hand.roster row; or retire)\n" as *u8)
                  } } }
              } }
              o = o + dirent_reclen(rec)
          }
      }
  }
  sys_close(dfd)
  w(1, "    census dirs=" as *u8); wn(1, dirs)
  w(1, " matrix=" as *u8); wn(1, inm)
  w(1, " radar=" as *u8); wn(1, inr)
  w(1, " hand=" as *u8); wn(1, inh)
  w(1, " ORPHANS=" as *u8); wn(1, orph)
  let parts: i64 = inm + inr + inh + orph
  if parts == dirs { w(1, "  parts-sum OK\n" as *u8) } else { w(1, "  PARTITION-LEAK parts!=dirs\n" as *u8) }
  return orph
538}
539// ---- FORK FRESHNESS: THE PUBLISHER CHECKS ITS OWN FORKS BEFORE IT PUBLISHES (2026-08-31) ----
540// THE DEFECT, MEASURED TWICE IN ONE DAY. This organ chdirs into the BUILD ROOT and forks the bare path
541// _offc/<gen>.elf, so the publisher of every /compare page executes buildroot/_offc/. But /api/promote
542// writes the SERVING ROOT (and nishihost/_offc); buildroot/_offc updates ONLY via a manual nx_restage.
543// A regen therefore returned published=201 fails=0 verdict=GREEN and CHANGED NOTHING -- every publish
544// line read prev= EQUAL to the new byte count -- because all three generators were a generation behind.
545// FOUR AGENTS EACH VERIFIED THEIR PROMOTE AGAINST THE SERVING ROOT AND/OR nishihost/_offc AND ALL FOUR
546// MISSED THIS COPY. nx_catalog cannot see buildroot/_offc, so every row read BUILT==PROMOTED with_gaps=0
547// VERDICT LIVE -- the clean-looking reading that hid it. The remedy was "remember to nx_restage", which
548// is O(seats) forever, and a law that must be RECALLED at the moment of temptation is not a control.
549//
550// ANNOUNCE, DELIBERATELY -- NOT REFUSE. Read how this receipt is consumed before choosing: `fails` drives
551// verdict=GREEN/RED and this organ EXIT CODE, which the compare beat stamp depends on. Folding fork
552// staleness into `fails` would turn the whole surface RED and, because restage is a MANUAL step, would
553// leave /compare unpublishable until a human intervened -- the permanently-red detector everyone learns
554// to ignore, installed on the estate own headline surface. It is not hypothetical: on the day this
555// shipped, TWO of the four generators were stale, so a refusal would have taken the surface down at once.
556// FAIL DIRECTION, ESTABLISHED BEFORE SHIPPING: this check can only PRINT and only COUNT. It cannot stop a
557// publish that would otherwise succeed, cannot delete, cannot restage. Its worst false positive costs a
558// wrong line of text; a refusal false positive costs the surface.
559// AND AN ANNOUNCEMENT NOBODY READS IS THE ABSTENTION NOBODY READS, so the result is ALSO a NAMED,
560// MACHINE-READABLE FIELD on the summary line and a durable truncate-written status file -- a consumer can
561// branch on the staleness without the publisher becoming a single point of failure for publishing.
562const RG_FORK_MATRIX: i64 = 0
563const RG_FORK_SOTA: i64 = 1
564const RG_FORK_HUB: i64 = 2
565// the SELFCATALOG status line: ts + three counters, ~80 B measured; 4096 is a reserve for one line (the ratchet named
566// the bare literal 2026-09-02 -- a number without a purpose is a number nobody can re-derive)
567const RG_SELFCAT_STATUS_BYTES: i64 = 4096
568const RG_FORK_BOARD: i64 = 3
569const RG_FORKS: i64 = 4                  // the DENOMINATOR: every generator this organ forks from _offc/
570const RG_PROMOTED_PREFIX: *u8 = "../"    // CWD is the build root; /api/promote installs FLAT at its parent
571const RG_FORKFRESH_STATUS: *u8 = "../knowledge/status/compare_forkfresh.status"
572const RG_FORKSTATUS_BYTES: i64 = 4096    // derived from RG_FORKS rows plus a header, not guessed
573const RG_ELF_SUFFIX_LEN: i64 = 4
574
575static g_rg_fork_fresh: i64
576static g_rg_fork_stale: i64
577static g_rg_fork_unproven: i64
578static g_rg_fork_absent: i64
579static g_rg_fork_checked: i64
580static g_rg_fork_state: *i64
581
582// ONE TABLE OWNS THESE PATHS AND main() FORKS FROM IT (see the MATRIX/SOTA/HUB/BOARD bindings below).
583// A checker holding its own second copy of the path literals would be a duplicate ruler that drifts the
584// day somebody adds a generator -- and the check would then be silently measuring a binary nobody runs.
585// nx_swcompare_gapmap is deliberately NOT in this table: it is already forked from ../ , i.e. from the
586// promoted artifact itself, so checking it would compare a file with itself and manufacture a green.
587func rg_forkpath(idx: i64) -> *u8 {
  if idx == RG_FORK_MATRIX { return "_offc/nx_swcompare_matrix.elf" as *u8 }
  if idx == RG_FORK_SOTA { return "_offc/nx_swcompare_sota.elf" as *u8 }
  if idx == RG_FORK_HUB { return "_offc/nx_swcompare_hub.elf" as *u8 }
  return "_offc/nx_maturity_board.elf" as *u8
592}
593
594// The nx_restage TARGET name, DERIVED from the fork path rather than written a second time.
595func rg_forkname(idx: i64, out: *u8) -> i64 {
  let p: *u8 = rg_forkpath(idx)
  let b: i64 = ff_basename(p)
  var n: i64 = 0
  while p[b + n] != (0 as u8) { n = n + 1 }
  var k: i64 = n - RG_ELF_SUFFIX_LEN
  if k < 0 { k = n }
  var i: i64 = 0
  while i < k { out[i] = p[b + i]; i = i + 1 }
  out[k] = 0 as u8
  return k
606}
607
608// A STDOUT-ONLY ANNOUNCEMENT IN AN ORGAN RUN BY A BEAT IS AN ABSTENTION NOBODY READS -- a cron row that
609// discards its output makes its own finding unobservable. So the same measurement lands in a durable,
610// TRUNCATE-WRITTEN status file with a canonical verdict LAST (never an append-only journal, which any
611// substring check would read as vacuously green forever). It reuses rg_write_atomic, the writer this
612// organ already owns, rather than introducing a second write idiom.
613// ITS SUBJECT IS FORK FRESHNESS AND NOTHING ELSE: a RED here says the publisher is executing a binary
614// that is not the promoted one. That is a true statement about the forks and is deliberately NOT the
615// publish verdict, which keeps its own meaning on this organ own last line.
616// It reads the states RECORDED BY THE SINGLE PASS in rg_forkcheck rather than re-classifying: two passes
617// could straddle a restage and then the printed line and the status file would contradict each other.
618func rg_forkstatus() -> i64 {
  let b: *u8 = sys_mmap(RG_FORKSTATUS_BYTES)
  var o: i64 = 0
  o = scopy(b, o, "ts=" as *u8); o = rgr_num(b, o, sys_now_realtime_sec())
  o = scopy(b, o, "\nsubject=fork-freshness-of-the-compare-generators" as *u8)
  o = scopy(b, o, "\nchecked=" as *u8); o = rgr_num(b, o, g_rg_fork_checked)
  o = scopy(b, o, "\nfresh=" as *u8); o = rgr_num(b, o, g_rg_fork_fresh)
  o = scopy(b, o, "\nstale=" as *u8); o = rgr_num(b, o, g_rg_fork_stale)
  o = scopy(b, o, "\nunproven=" as *u8); o = rgr_num(b, o, g_rg_fork_unproven)
  o = scopy(b, o, "\nabsent=" as *u8); o = rgr_num(b, o, g_rg_fork_absent)
  let nm: *u8 = sys_mmap(FF_PATH_BYTES)
  var i: i64 = 0
  while i < RG_FORKS {
      rg_forkname(i, nm)
      o = scopy(b, o, "\n" as *u8); o = scopy(b, o, ff_state_word(g_rg_fork_state[i]))
      o = scopy(b, o, " " as *u8); o = scopy(b, o, nm)
      i = i + 1
  }
  o = scopy(b, o, "\nverdict=" as *u8)
  if g_rg_fork_stale == 0 { o = scopy(b, o, "GREEN" as *u8) } else { o = scopy(b, o, "RED" as *u8) }
  o = scopy(b, o, "\n" as *u8)
  return rg_write_atomic(RG_FORKFRESH_STATUS, b, o)
640}
641
642// Runs BEFORE anything is published, so the announcement precedes the pages it is about.
643// Returns the STALE count; the caller reports it and does not act on it.
644func rg_forkcheck() -> i64 {
  w(1, "  fork freshness -- the generator copies this publisher ACTUALLY executes, vs the PROMOTED artifacts:\n" as *u8)
  g_rg_fork_state = sys_mmap(RG_FORKS * 8) as *i64
  let fdig: *u8 = sys_mmap(FF_DIGEST_BYTES)
  let rdig: *u8 = sys_mmap(FF_DIGEST_BYTES)
  let fhex: *u8 = sys_mmap(FF_HEX_BYTES)
  let rhex: *u8 = sys_mmap(FF_HEX_BYTES)
  let refp: *u8 = sys_mmap(FF_PATH_BYTES)
  let nm: *u8 = sys_mmap(FF_PATH_BYTES)
  let sz: *i64 = sys_mmap(FF_SIZES_SLOTS * 8) as *i64
  var i: i64 = 0
  while i < RG_FORKS {
      let fp: *u8 = rg_forkpath(i)
      ff_promoted_path(fp, refp, RG_PROMOTED_PREFIX)
      let st: i64 = ff_classify(fp, refp, fdig, rdig, sz)
      g_rg_fork_state[i] = st
      // THE DIRECTION IS DERIVED ONCE, BESIDE THE CLASSIFICATION AND AT THE SAME SCOPE AS THE STATE IT
      // QUALIFIES, so the printed remedy and the recorded state can never straddle two measurements.
      // It is FF_DIR_NA by construction for every non-STALE row, so deriving it unconditionally is safe.
      let dir: i64 = ff_direction(st, sz)
      rg_forkname(i, nm)
      g_rg_fork_checked = g_rg_fork_checked + 1
      w(1, "    " as *u8); w(1, ff_state_word(st)); w(1, " " as *u8); w(1, fp)
      if sz[0] >= 0 { w(1, " " as *u8); wn(1, sz[0]); w(1, "B" as *u8) }
      w(1, "\n" as *u8)
      if st == FF_FRESH { g_rg_fork_fresh = g_rg_fork_fresh + 1 }
      if st == FF_UNPROVEN {
          g_rg_fork_unproven = g_rg_fork_unproven + 1
          w(1, "      COULD NOT LOOK: no readable promoted artifact at " as *u8); w(1, refp)
          w(1, " -- this is NOT a finding that the fork is stale, and NOT a licence to trust it.\n" as *u8)
      }
      if st == FF_NOFORK {
          g_rg_fork_absent = g_rg_fork_absent + 1
          w(1, "      the fork target itself is unreadable -- the fork will fail on its own below.\n" as *u8)
      }
      if st == FF_STALE {
          g_rg_fork_stale = g_rg_fork_stale + 1
          ff_hex(fdig, fhex, FF_DIGEST_BYTES)
          ff_hex(rdig, rhex, FF_DIGEST_BYTES)
          w(1, "      RUNS     " as *u8); w(1, fhex); w(1, "\n" as *u8)
          w(1, "      PROMOTED " as *u8); w(1, rhex); w(1, "  (" as *u8); w(1, refp); w(1, " " as *u8); wn(1, sz[1]); w(1, "B)\n" as *u8)
          w(1, "      EVERY PAGE BELOW IS PUBLISHED BY THE COPY ON THE RUNS LINE, NOT BY WHAT WAS PROMOTED.\n" as *u8)
          // THE REMEDY BRANCHES ON THE DIRECTION, BECAUSE THE TWO DIRECTIONS WANT OPPOSITE ACTIONS.
          // This line used to print "nx_restage" UNCONDITIONALLY. That was correct for a fork that is
          // BEHIND and was THE CAPABILITY-DESTROYING ACTION for a fork that is AHEAD -- and the check
          // had already measured both digests and both sizes, so the comparison that decides it was in
          // hand the whole time and only the message failed to use it. Caught live on nx_maturity_board
          // by a publish owner who measured before obeying its instrument.
          // IT STILL ONLY ANNOUNCES. It does not refuse and must not: 2 of 4 generators were stale the
          // day this check shipped, and a refusal would have taken /compare down.
          w(1, "      DIRECTION " as *u8); w(1, ff_direction_word(dir))
          w(1, "  (fork " as *u8); wn(1, sz[0]); w(1, "B vs promoted " as *u8); wn(1, sz[1]); w(1, "B)\n" as *u8)
          if ff_restage_is_safe(dir) == 1 {
              w(1, "      REMEDY: nx_restage " as *u8); w(1, nm); w(1, "   (nothing else updates buildroot/_offc)\n" as *u8)
          }
          if dir == FF_DIR_AHEAD {
              w(1, "      DO NOT RESTAGE. The executing copy is LARGER than the promoted artifact, so it may\n" as *u8)
              w(1, "      carry runs the promoted one lacks, and a restage would overwrite exactly those.\n" as *u8)
              w(1, "      REMEDY: nx_contentdiff " as *u8); w(1, refp); w(1, " " as *u8); w(1, fp); w(1, "\n" as *u8)
              w(1, "      and if the fork proves a superset, REBUILD FROM SOURCE AND PROMOTE FORWARD so the\n" as *u8)
              w(1, "      promoted artifact GAINS it. Never restage backward. If the source can no longer\n" as *u8)
              w(1, "      rebuild what the fork carries, BANK THE FORK first -- it is unreproducible.\n" as *u8)
          }
          if dir == FF_DIR_UNDECIDED {
              w(1, "      UNDECIDED: the two artifacts are the SAME SIZE and still differ, so size cannot say\n" as *u8)
              w(1, "      which way, and restaging on a guess is a coin flip over a destructive action.\n" as *u8)
              w(1, "      WHAT WOULD SETTLE IT: nx_contentdiff in BOTH directions between\n" as *u8)
              w(1, "        " as *u8); w(1, refp); w(1, " and " as *u8); w(1, fp); w(1, "\n" as *u8)
              w(1, "      -- whichever side loses no runs is the one that is behind. If neither loses runs,\n" as *u8)
              w(1, "      the delta is code-only (a string ruler is blind to it) and nx_behaveprobe on a real\n" as *u8)
              w(1, "      workload is the instrument that decides.\n" as *u8)
          }
          if dir == FF_DIR_NA {
              w(1, "      DIRECTION UNAVAILABLE: a size was not measured, so NO remedy is named here rather\n" as *u8)
              w(1, "      than naming one that could be the destructive direction.\n" as *u8)
          }
      }
      i = i + 1
  }
  // A PARTITION IS A CLAIM: CHECK THE PARTS SUM, AND PRINT THE SUM.
  let parts: i64 = g_rg_fork_fresh + g_rg_fork_stale + g_rg_fork_unproven + g_rg_fork_absent
  w(1, "    forkchecked=" as *u8); wn(1, g_rg_fork_checked)
  w(1, " fresh=" as *u8); wn(1, g_rg_fork_fresh)
  w(1, " stale=" as *u8); wn(1, g_rg_fork_stale)
  w(1, " unproven=" as *u8); wn(1, g_rg_fork_unproven)
  w(1, " absent=" as *u8); wn(1, g_rg_fork_absent)
  w(1, " parts_sum=" as *u8); wn(1, parts)
  if parts == g_rg_fork_checked { w(1, " partition=RECONCILED\n" as *u8) } else { w(1, " partition=LEAK\n" as *u8) }
  if rg_forkstatus() != 0 { w(1, "    (status file not written -- the stdout announcement above still stands)\n" as *u8) }
  return g_rg_fork_stale
734}
735
736// ---- EC17 (ecosystem rung): THE ENGINE GRADES ITSELF, every run ----
737// Measured 2026-09-01 before this existed: of the organs that publish and rank the boards, the gap map
738// was PROMOTED-UNREGISTERED, the maturity board PROMOTED-UNREGISTERED and behind its own staged binary,
739// the fleet ranker REGISTERED-DARK, the flywheel beat PROMOTED-UNREGISTERED, and nx_comparestale is
740// REGISTERED and AUTHORISED while having no source and no binary at all. The surface that measures the
741// estate was the estate's own worst instance of the pattern it measures. Membership is DECLARED in
742// knowledge/compare/engine.roster (never a name pattern); each row is graded by clb_classify -- the same
743// ladder every board row gets -- and every gap prints WITH ITS REMEDY. Announces and counts, never
744// refuses: 6 of the engine's own organs carried gaps the day this shipped, and folding that into the
745// publish verdict would have taken the headline surface down until a human intervened -- the permanently
746// red detector, installed on /compare itself. UNPROVEN is its own exit: a missing roster publishes NO
747// counts, because zero-members-zero-gaps would be the vacuous green wearing a self-audit's name.
748func rg_selfcatalog() -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let rb: *u8 = sys_read_file("knowledge/compare/engine.roster" as *u8, lp)
  if (rb as i64) == 0 { w(1, "SELFCATALOG UNPROVEN -- engine.roster missing; the engine publishes ungraded this run\n" as *u8); return 3 }
  let rn: i64 = lp[0]
  if rn <= 0 { w(1, "SELFCATALOG UNPROVEN -- engine.roster empty\n" as *u8); return 3 }
  let ads: *i64 = sys_mmap(CLB_N * 8) as *i64
  clb_load(ads)
  var members: i64 = 0
  var full: i64 = 0
  var gaps: i64 = 0
  let tok: *u8 = sys_mmap(CLB_TOK_CAP)
  let remp: *i64 = sys_mmap(8) as *i64
  var p: i64 = 0
  while p < rn {
      var e: i64 = p
      while e < rn { if rb[e] == (10 as u8) { break } e = e + 1 }
      var t: i64 = e
      if t > p { if rb[t-1] == (13 as u8) { t = t - 1 } }
      rb[t] = 0 as u8
      let nm: *u8 = ((rb as i64) + p) as *u8
      p = e + 1
      if nm[0] != (0 as u8) { if nm[0] != (35 as u8) {
          members = members + 1
          tok[0] = 0 as u8
          remp[0] = "" as *u8 as i64
          let ful: i64 = clb_classify(nm, ads, tok, remp)
          if ful == CLB_FULL { full = full + 1 } else {
              gaps = gaps + 1
              w(1, "  SELFCATALOG-GAP " as *u8); w(1, nm); w(1, " " as *u8); w(1, tok)
              let rr: *u8 = remp[0] as *u8
              if rr[0] != (0 as u8) { w(1, " -- " as *u8); w(1, rr) }
              w(1, "\n" as *u8)
          }
      } }
  }
  w(1, "SELFCATALOG members=" as *u8); wn(1, members)
  w(1, " full=" as *u8); wn(1, full)
  w(1, " gaps=" as *u8); wn(1, gaps)
  w(1, " (partition: full+gaps=members) -- the surface that grades the estate, graded by its own ruler\n" as *u8)
  let sb: *u8 = sys_mmap(RG_SELFCAT_STATUS_BYTES)
  var so: i64 = 0
  so = scopy(sb, so, "ts=" as *u8); so = rgr_num(sb, so, sys_now_realtime_sec())
  so = scopy(sb, so, " members=" as *u8); so = rgr_num(sb, so, members)
  so = scopy(sb, so, " full=" as *u8); so = rgr_num(sb, so, full)
  so = scopy(sb, so, " gaps=" as *u8); so = rgr_num(sb, so, gaps)
  so = scopy(sb, so, "\nverdict=" as *u8)
  if gaps == 0 { so = scopy(sb, so, "GREEN" as *u8) } else { so = scopy(sb, so, "AMBER" as *u8) }
  sb[so] = 10 as u8; so = so + 1
  rg_write_atomic("../knowledge/status/compare_selfcatalog.status" as *u8, sb, so)
  return 0
799}
800
801// Selected runs retain domain gates and receipts. Aggregate views have a separate scope.
802const RG_SCOPE_PATH_BYTES: i64 = 600
803func rg_scope_len(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  return n
807}
808func rg_scope_list(name: *u8, n: i64) -> *u8 {
  let b: *u8 = sys_mmap(n + 2)
  scopy(b, 0, name)
  b[n] = 10 as u8
  b[n + 1] = 0 as u8
  return b
814}
815func rg_scope_receipt(droot: *u8, domain: *u8, pubs: i64, fails: i64) -> i64 {
  let path: *u8 = sys_mmap(RG_SCOPE_PATH_BYTES)
  var p: i64 = scopy(path, 0, droot)
  p = scopy(path, p, domain)
  p = scopy(path, p, "/scope.json" as *u8)
  path[p] = 0 as u8
  let b: *u8 = sys_mmap(RG_SCOPE_PATH_BYTES + RG_SCOPE_PATH_BYTES)
  var o: i64 = scopy(b, 0, "{\"schema\":1,\"record_kind\":\"last_domain_scoped_run\",\"scope\":\"domain\",\"domain\":\"" as *u8)
  o = scopy(b, o, domain)
  o = scopy(b, o, "\",\"aggregates_refreshed_by_this_run\":false,\"published\":" as *u8)
  o = rgr_num(b, o, pubs)
  o = scopy(b, o, ",\"fails\":" as *u8)
  o = rgr_num(b, o, fails)
  o = scopy(b,o,",\"audit_failures\":" as *u8);o=rgr_num(b,o,g_rg_receipt_failures)
  o = scopy(b,o,",\"published_evidence_incomplete\":" as *u8);o=rgr_num(b,o,g_rg_published_incomplete)
  o = scopy(b,o,",\"receipt_extra_reserve_bytes\":0" as *u8)
  o = scopy(b, o, ",\"ts\":" as *u8)
  o = rgr_num(b, o, sys_now_realtime_sec())
  o = scopy(b, o, "}\n" as *u8)
  return rg_write_atomic(path, b, o)
835}
836// These finalizers are shared by the real run and the isolated subprocess gate.
837func rg_published_count(successful:i64)->i64 {return successful+g_rg_published_incomplete}
838func rg_exit_verdict(fails:i64)->i64 {
  if fails == 0 && g_rg_receipt_failures==0 { w(1, " verdict=GREEN (measured fresh from source; atomic hot-swap; MCP+REST single source)\n" as *u8); sys_exit(0); return 0 }
  w(1, " verdict=RED\n" as *u8); sys_exit(1); return 1
841}
842func main(argc: i64, argv: *i64) -> i64 {
  var broot: *u8 = "buildroot" as *u8
  var droot: *u8 = "../sites/nishifamily/compare/" as *u8
  if argc >= 2 { broot = argv[1] as *u8 }
  if argc >= 3 { droot = argv[2] as *u8 }
  var selected: *u8 = 0 as *u8
  var selected_len: i64 = 0
  if argc > 3 {
      if argc != 5 {
          w(1, "USAGE: nx_compare_regen [buildroot [docroot]] | nx_compare_regen buildroot docroot --domain name\n" as *u8)
          sys_exit(2); return 2
      }
      let opt: *u8 = argv[3] as *u8
      if cscope_roster_count("--domain\n" as *u8, 9, opt, rg_scope_len(opt)) != 1 {
          w(1, "USAGE: expected --domain name; no publication started\n" as *u8)
          sys_exit(2); return 2
      }
      selected = argv[4] as *u8
      selected_len = cscope_validate_name(selected, RG_SCOPE_PATH_BYTES - 1)
      if selected_len < 1 {
          w(1, "REFUSED-SCOPE: invalid domain name; no publication started\n" as *u8)
          sys_exit(2); return 2
      }
      if rg_scope_len(droot) + selected_len + rg_scope_len("/frontier/index.html.new" as *u8) + 1 > RG_SCOPE_PATH_BYTES {
          w(1, "REFUSED-SCOPE: output path exceeds existing emitter path bound\n" as *u8)
          sys_exit(2); return 2
      }
      if rg_scope_len("knowledge/compare/" as *u8) + selected_len + rg_scope_len(".debtstate.new" as *u8) + 1 > RG_SCOPE_PATH_BYTES {
          w(1, "REFUSED-SCOPE: source path exceeds existing emitter path bound\n" as *u8)
          sys_exit(2); return 2
      }
  }
  w(1, "=== NX-COMPARE-REGEN -- re-measure + atomically republish the compare surface (gate-checked) ===\n" as *u8)
  // NAME THE PATH YOU ACTUALLY TRIED. This printed the literal word "buildroot" while chdir'ing whatever
  // argv[1] held, so a caller who passed a DOMAIN (a reasonable guess -- every sibling compare tool takes
  // one) got "cannot chdir buildroot" and went looking for a broken build root. The message named a
  // subject the code was not operating on, which costs the reader exactly the investigation an error
  // exists to save them. argv[1] is the BUILD ROOT; this organ regenerates the WHOLE surface.
  // TRY THE CALLER'S CWD FIRST, THEN ANCHOR AS A FALLBACK. Both the build root and the docroot here
  // are CWD-relative, so this organ only ever ran correctly from the estate root -- i.e. from the
  // beat's own `cd`. Every other launcher (nx_job_run, the MCP surface) hands it a different CWD,
  // where this chdir fails and the organ reports a broken BUILD ROOT when the real subject is the
  // WORKING DIRECTORY -- a message naming a subject the code was not operating on, which is the very
  // defect the comment above already records. ep_anchor binds that ONE act instead of asking every
  // caller to remember it. Ordered as a FALLBACK and never as a precondition: a caller passing a
  // relative build root reachable from its own CWD keeps its exact present meaning, so no currently
  // working invocation can change behaviour.
  var moved: i64 = sys_chdir(broot)
  if moved != 0 {
      let anch: i64 = ep_anchor()
      if anch == 1 { w(1, "  anchored to the estate root (the caller's CWD held no build root)\n" as *u8) }
      moved = sys_chdir(broot)
  }
  if moved != 0 {
      w(1, "FAIL: cannot chdir " as *u8); w(1, broot)
      w(1, " -- argv[1] is the BUILD ROOT; use buildroot docroot --domain name for a selected domain\n" as *u8)
      sys_exit(1); return 1
  }
  if selected_len > 0 {
      let sl: *i64 = sys_mmap(16) as *i64
      let sr: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, sl)
      if cscope_roster_count(sr, sl[0], selected, selected_len) != 1 {
          w(1, "REFUSED-SCOPE: domain must occur exactly once in regen.list; no publication started\n" as *u8)
          sys_exit(2); return 2
      }
      w(1, "SCOPE domain=" as *u8); w(1, selected)
      w(1, " aggregates_refreshed_by_this_run=0; unrelated domain and aggregate passes excluded\n" as *u8)
  }
  // ---- ADMISSION + SINGLETON, before a single fork (2026-09-02; rationale beside rg_lease_run) ----
  let ioa: *i64 = sys_mmap(16) as *i64
  var rg_budget: i64 = IOA_UNREADABLE
  if ioa_measure(ioa) == 0 { rg_budget = ioa_spawn_budget(ioa[0], ioa[1], IOA_BLOCKED_PER_CPU, IOA_RESERVE_SLOTS) }
  if rg_budget == 0 {
      w(1, "REFUSED-IO-STORM procs_blocked=" as *u8); wn(1, ioa[1]); w(1, " ncpu=" as *u8); wn(1, ioa[0])
      w(1, " sample=instant blocked_per_cpu=" as *u8); wn(1, IOA_BLOCKED_PER_CPU); w(1, " reserve_slots=" as *u8); wn(1, IOA_RESERVE_SLOTS)
      w(1, " -- configured spawn budget is zero. This proxy does not establish sustained storage saturation or predict completion cost. No publication started. Build admission may use different evidence; retry through this publisher admission after pressure changes.\n" as *u8)
      sys_exit(RG_EXIT_STORM); return RG_EXIT_STORM
  }
  if rg_budget < 0 { w(1, "  io-admission UNOBSERVABLE (/proc/stat unreadable) -- proceeding, as the clock does\n" as *u8) }
  // ---- THE CLASS BOUND (hub-spoke, 2026-09-03). The ioadmit check above is INSTANTANEOUS and per-caller: a
  // burst of beats can each read "not stormed" and proceed, the storm being their SUM. hio_admit counts the
  // heavy producers RUNNING across every launch surface against the width derived from knowledge/heavyio.conf,
  // with the storm witness as its second conjunct. DEFER -> named refusal on the clock's requeue code;
  // UNOBSERVABLE -> announced, proceed (a periodic publisher must never be silenced by a missing conf). The
  // conf lives at the estate root and CWD is the build root here, so the ../ twin is tried first.
  let hio: *i64 = sys_mmap(32) as *i64
  var hv: i64 = hio_admit_conf("../knowledge/heavyio.conf" as *u8, hio)
  if hv == HIO_UNOBSERVABLE { hv = hio_admit(hio) }
  hio_announce(1, hv, hio)
  if hv == HIO_DEFER {
      w(1, "REFUSED-HEAVYIO: the heavy-I/O class bound is reached (running > width, or the storm line) -- a regen started now only deepens it. Re-fire when the HEAVYIO line reads ADMIT\n" as *u8)
      sys_exit(RG_EXIT_STORM); return RG_EXIT_STORM
  }
  g_rg_lease_owner = sys_mmap(64)
  var lo: i64 = scopy(g_rg_lease_owner, 0, "regen-" as *u8)
  lo = rgr_num(g_rg_lease_owner, lo, sys_now_realtime_sec())
  g_rg_lease_owner[lo] = 0 as u8
  let lout: *u8 = sys_mmap(RG_LEASE_CAP)
  let lrc: i64 = rg_lease_run("acquire" as *u8, lout)
  if lrc == RG_EXIT_BUSY {
      w(1, "REFUSED-ALREADY-RUNNING: another nx_compare_regen holds lease " as *u8); w(1, RG_LEASE_NAME); w(1, " -- " as *u8); w(1, lout)
      w(1, "\n  two regens at once double the array's fsync load and publish nothing sooner; wait for the holder or its TTL.\n" as *u8)
      g_rg_lease_owner = 0 as *u8
      sys_exit(RG_EXIT_BUSY); return RG_EXIT_BUSY
  }
  if lrc != 0 { w(1, "  lease UNAVAILABLE (nx_lease rc=" as *u8); wn(1, lrc); w(1, ") -- proceeding unleased rather than blocking the publish on a broken lock\n" as *u8); g_rg_lease_owner = 0 as *u8 }
  if lrc == 0 { w(1, "  lease compare-regen held by " as *u8); w(1, g_rg_lease_owner); w(1, " (ttl " as *u8); w(1, RG_LEASE_TTL_S); w(1, " s; a second regen is refused until release)\n" as *u8) }
  // BOUND FROM THE FORK TABLE, NOT RE-TYPED. rg_forkcheck iterates that same table, so the binary it
  // checks and the binary this loop forks CANNOT diverge -- which is the whole point: a checker holding
  // its own copy of these literals would go quietly out of date the day a generator is added or moved.
  let MATRIX: *u8 = rg_forkpath(RG_FORK_MATRIX)
  let SOTA: *u8 = rg_forkpath(RG_FORK_SOTA)
  let HUB: *u8 = rg_forkpath(RG_FORK_HUB)
  // IN THE PATH, BEFORE ANY PAGE IS WRITTEN. Announces and counts; it never refuses (see the reasoning
  // above rg_forkpath). The pages published below are published by whatever this just measured.
  rg_forkcheck()
  // EC17: and the engine grades ITSELF before publishing anything -- announces and counts, never refuses
  rg_selfcatalog()
  let sprobe: *u8 = sys_mmap(600)
  let cap: i64 = RG_EMIT_CAPTURE_BYTES
  let out: *u8 = sys_mmap(cap)
  let llen0: *i64 = sys_mmap(16) as *i64
  var sota_c: i64 = 0
  var sota_matrix_c: i64 = 0
  var lst: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, llen0)
  if (lst as i64) == 0 { w(1, "FAIL: regen.list missing\n" as *u8); rg_lease_release(); sys_exit(1); return 1 }
  var ln: i64 = llen0[0]
  if selected_len > 0 { lst = rg_scope_list(selected, selected_len); ln = selected_len + 1 }
  if ln <= 0 { w(1, "FAIL: regen.list empty\n" as *u8); rg_lease_release(); sys_exit(1); return 1 }
  // DEBT STATE FIRST, before any page is emitted -- a sync that runs after the emit loop would leave
  // every page showing the PREVIOUS run's state, which is the quiet one-run lag that makes a dashboard
  // wrong exactly when someone acts on it.
  w(1, "  debt state sync (plane owns state, page owns narrative):\n" as *u8)
  let dsbuf: *u8 = sys_mmap(RG_CHILD_CAPTURE_BYTES)
  let dsout: *u8 = sys_mmap(RG_DEBTSTATE_BYTES)
  let dlen0: *i64 = sys_mmap(16) as *i64
  var dlst: *u8 = sys_read_file("knowledge/compare/regen.list" as *u8, dlen0)
  if selected_len > 0 { dlst = rg_scope_list(selected, selected_len); dlen0[0] = selected_len + 1 }
  var dln: i64 = 0
  if (dlst as i64) != 0 { dln = dlen0[0] }
  var dsdom: i64 = 0
  var dsrows: i64 = 0
  var dp: i64 = 0
  while dp < dln {
      var de: i64 = dp
      while de < dln { if dlst[de] == (10 as u8) { break } de = de + 1 }
      dlst[de] = 0 as u8
      let dd: *u8 = (dlst as i64 + dp) as *u8
      dp = de + 1
      if dd[0] == (0 as u8) { } else { if dd[0] == (35 as u8) { } else {
          // ONLY domains that declare a plan render a debt register, so only they need the sync.
          // Forking the debt tool for all 48 domains cost 48 full reads of a 3,930-row plane on every
          // beat to serve one page. A feature that works and hammers the box is still a defect.
          var pl: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8)
          pl = scopy(sprobe, pl, dd)
          pl = scopy(sprobe, pl, ".plan" as *u8)
          sprobe[pl] = 0 as u8
          let pfd2: i64 = sys_openat_rd(sprobe)
          if pfd2 >= 0 {
              sys_close(pfd2)
              let dr: i64 = rg_debtstate(dd, dsbuf, RG_CHILD_CAPTURE_BYTES, dsout, RG_DEBTSTATE_BYTES)
              if dr > 0 { dsdom = dsdom + 1; dsrows = dsrows + dr }
          }
      } }
  }
  w(1, "    domains with filed debt=" as *u8); wn(1, dsdom)
  w(1, " rows=" as *u8); wn(1, dsrows); w(1, "\n" as *u8)
  let target: *u8 = sys_mmap(600)
  let ol: *i64 = sys_mmap(16) as *i64
  var fails: i64 = 0
  var pubs: i64 = 0
  var p: i64 = 0
  while p < ln {
      var e: i64 = p
      while e < ln { if lst[e] == (10 as u8) { break } e = e + 1 }
      lst[e] = 0 as u8
      let dom: *u8 = (lst as i64 + p) as *u8
      p = e + 1
      if dom[0] == (0 as u8) { } else { if dom[0] == (35 as u8) { } else {
          w(1, "  domain " as *u8); w(1, dom); w(1, ":\n" as *u8)
          // a <dom>.sota file promotes the domain to the SOTA generator (N competitors, quantitative,
          // categorized); otherwise the 4-column matrix generator. Same CLI shape, same gate contract.
          var gen: *u8 = MATRIX
          var so: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); so = scopy(sprobe, so, dom); so = scopy(sprobe, so, ".sota" as *u8); sprobe[so] = 0 as u8
          let sfd: i64 = sys_openat_rd(sprobe)
          // ONE ASSEMBLER (2026-09-02): a sota-class domain is rendered by the MATRIX generator too, which now
          // composes the SOTA field from nx_swcompare_sota_lib. The census below still counts the class;
          // the SOTA fork path stays declared (and fork-fresh-checked) until the second generator is retired.
          if sfd >= 0 { sys_close(sfd); gen = MATRIX; w(1, "    (sota-class: N-competitor quantitative -- rendered by the one assembler)\n" as *u8)
              // census (2026-08-23): a sota-class domain that ALSO carries a .matrix now renders its watch
              // contracts on the page (nx_swcompare_lib watch_pass) -- count the population that reaches.
              sota_c = sota_c + 1
              var mpo: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); mpo = scopy(sprobe, mpo, dom); mpo = scopy(sprobe, mpo, ".matrix" as *u8); sprobe[mpo] = 0 as u8
              let mfd: i64 = sys_openat_rd(sprobe)
              if mfd >= 0 { sys_close(mfd); sota_matrix_c = sota_matrix_c + 1; w(1, "    (carries a .matrix: watch contracts rendered, measured)\n" as *u8) }
          }
          let grc: i64 = rg_run(gen, dom, 0 as *u8, out, cap, ol)
          if grc != 0 {
              w(1, "    GATE RED -- refusing to publish this domain\n" as *u8)
              // PRINT THE GENERATOR'S OWN WORDS (2026-08-07). rg_run already CAPTURED the reason
              // into `out` and this branch threw it away, so every refusal read as an unexplained
              // GATE RED and the only way to learn why was to guess. I guessed twice today (a
              // buildroot/ path prefix, then a missing @verdict) and was wrong twice, on a domain
              // whose generator had been naming the real cause all along.
              // ★A GATE THAT REPORTS A FAILURE WITHOUT ITS DIAGNOSTIC IS UNACTIONABLE -- the law was
              //  already written in nx_cc_equiv_gate's own comments; this loop had not adopted it.
              // ★CAPTURING A DIAGNOSTIC AND NOT PRINTING IT IS THE SAME AS NOT CAPTURING IT.
              if ol[0] > 0 {
                  w(1, "    --- generator said ---\n" as *u8)
                  sys_write(1, out, ol[0])
                  w(1, "    --- end ---\n" as *u8)
              }
              fails = fails + 1
          } else {
              rg_scaffold(droot, dom)   // create the domain docroot dir if new (fixes WRITE-FAIL on first publish)
              var o: i64 = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/api.json" as *u8); target[o] = 0 as u8
              if rg_emit(gen, dom, "json" as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
              o = scopy(target, 0, droot); o = scopy(target, o, dom); o = scopy(target, o, "/index.html" as *u8); target[o] = 0 as u8
              if rg_emit(gen, dom, "html" as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
              // FRONTIER door (2026-08-05, debt 1785937893): a <dom>.axes file promotes the domain to ALSO
              // publish its researcher-fed frontier radar via the gapmap generator -- same gate contract as
              // matrix/sota. FAIL-SAFE by design: a RED frontier gate (banks absent / vacuous momentum) skips
              // LOUDLY without failing the core publish; the radar is additive, its gate is its own.
              var ax: i64 = scopy(sprobe, 0, "knowledge/compare/" as *u8); ax = scopy(sprobe, ax, dom); ax = scopy(sprobe, ax, ".axes" as *u8); sprobe[ax] = 0 as u8
              let axfd: i64 = sys_openat_rd(sprobe)
              if axfd >= 0 { sys_close(axfd)
                  // promoted-elf path (nishihost root, CWD is buildroot): /api/build + /api/promote place it -- API-pure staging
                  let GAPMAP: *u8 = "../nx_swcompare_gapmap.elf" as *u8
                  let gfd2: i64 = sys_openat_rd(GAPMAP)
                  if gfd2 < 0 { w(1, "    frontier SKIPPED (nx_swcompare_gapmap.elf not promoted -- /api/build + /api/promote it)\n" as *u8) } else { sys_close(gfd2)
                      let frc: i64 = rg_run(GAPMAP, dom, 0 as *u8, out, cap, ol)
                      if frc != 0 { w(1, "    frontier gate RED (corpus banks absent or vacuous) -- skipping frontier, core artifacts stand\n" as *u8) } else {
                          var fo: i64 = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier" as *u8); target[fo] = 0 as u8
                          sys_mkdir(target, 493)
                          fo = scopy(target, 0, droot); fo = scopy(target, fo, dom); fo = scopy(target, fo, "/frontier/index.html" as *u8); target[fo] = 0 as u8
                          if rg_emit(GAPMAP, dom, "html" as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
                      }
                  }
              }
          }
      } }
  }
  if selected_len == 0 {
  // RADAR PASS (2026-08-08). The .axes/gapmap radar domains are NOT in regen.list and have no
  // .matrix/.sota source, so the loop above cannot carry them: it runs MATRIX/SOTA FIRST and a missing
  // source prints "GATE RED -- refusing to publish this domain" and fails the whole run. They were
  // therefore hand-published, and went 20-21 DAYS STALE while every one of them still served HTTP 200,
  // so the liveness sentinel reported them perfectly healthy the entire time.
  // (STAR)LIVENESS AND FRESHNESS ARE DIFFERENT QUESTIONS -- A 200 SAYS NOTHING ABOUT AGE.
  // SAFE HALF ONLY: this emits <dom>/api.json and NOTHING ELSE. Those paths mostly 404 today so the
  // write cannot clobber anything; regenerating their HTML from .axes COULD destroy curated content
  // (/compare/crm is a 13,169 B hand-authored page) and is deliberately NOT done here.
  // ADDITIVE LIKE THE FRONTIER DOOR: a radar failure is reported LOUDLY but does NOT increment fails,
  // because the radar must never be able to turn the core publish RED (and with it the beat's stamp).
  w(1, "  radar pass:\n" as *u8)
  let rlen0: *i64 = sys_mmap(16) as *i64
  let rlst: *u8 = sys_read_file("knowledge/compare/radar.list" as *u8, rlen0)
  var rln: i64 = 0
  if (rlst as i64) != 0 { rln = rlen0[0] }
  if rln <= 0 { w(1, "    SKIPPED (no radar.list in this buildroot)\n" as *u8) } else {
      let RGAP: *u8 = "../nx_swcompare_gapmap.elf" as *u8
      let rgfd: i64 = sys_openat_rd(RGAP)
      if rgfd < 0 { w(1, "    SKIPPED (nx_swcompare_gapmap.elf not promoted)\n" as *u8) } else { sys_close(rgfd)
          var rp: i64 = 0
          while rp < rln {
              var re: i64 = rp
              while re < rln { if rlst[re] == (10 as u8) { break } re = re + 1 }
              rlst[re] = 0 as u8
              let rdom: *u8 = (rlst as i64 + rp) as *u8
              rp = re + 1
              if rdom[0] == (0 as u8) { } else { if rdom[0] == (35 as u8) { } else {
                  w(1, "    domain " as *u8); w(1, rdom); w(1, ":\n" as *u8)
                  rg_scaffold(droot, rdom)
                  var ro: i64 = scopy(target, 0, droot); ro = scopy(target, ro, rdom); ro = scopy(target, ro, "/api.json" as *u8); target[ro] = 0 as u8
                  let radar_emit:i64=rg_emit(RGAP, rdom, "json" as *u8, 123, 400, target, out, cap)
                  if radar_emit == 0 { pubs = pubs + 1 } else { if radar_emit==(0-6) {fails=fails+1} w(1, "      radar emission failed; published/evidence state shown above\n" as *u8) }
              } }
          }
      }
  }
  rg_census(droot)
  rg_watchlist(droot)
  w(1, "  hub:\n" as *u8)
  // The hub/openapi regenerate FROM the registry. On the NAS the registry is DELIBERATELY not synced
  // (it is multi-session contended on the laptop; regenerating from a stale snapshot would clobber
  // parallel additions) -> absent registry = SKIP hub cleanly, matrices-only regen. Laptop publishes hub.
  let regchk: i64 = sys_openat_rd("knowledge/compare/registry" as *u8)
  if regchk < 0 {
      w(1, "    SKIPPED (registry not synced here; hub + openapi are laptop-published by design)\n" as *u8)
  } else { sys_close(regchk)
  let hrc: i64 = rg_run(HUB, 0 as *u8, 0 as *u8, out, cap, ol)
  if hrc != 0 { w(1, "    HUB GATE RED -- refusing to publish hub\n" as *u8); fails = fails + 1 } else {
      var o2: i64 = scopy(target, 0, droot); o2 = scopy(target, o2, "api.json" as *u8); target[o2] = 0 as u8
      if rg_emit(HUB, "json" as *u8, 0 as *u8, 123, 400, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
      o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "index.html" as *u8); target[o2] = 0 as u8
      if rg_emit(HUB, "html" as *u8, 0 as *u8, 60, RG_HTML_MIN_BYTES, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
      o2 = scopy(target, 0, droot); o2 = scopy(target, o2, "openapi.json" as *u8); target[o2] = 0 as u8
      if rg_emit(HUB, "openapi" as *u8, 0 as *u8, 123, 800, target, out, cap) == 0 { pubs = pubs + 1 } else { fails = fails + 1 }
  } }
  // MATURITY BOARD (2026-07-16, operator "the high scores are liars without a maturity analysis"):
  // every regen re-grades ALL matrix domains with the evidence-capped census and republishes
  // /compare/maturity (presence vs honest maturity + inflation ratio). The board writes atomically
  // itself (same .nxnew+rename discipline) and FAILS CLOSED below 10 graded domains.
  w(1, "  maturity board:\n" as *u8)
  let BOARD: *u8 = rg_forkpath(RG_FORK_BOARD)
  let bfd: i64 = sys_openat_rd(BOARD)
  if bfd < 0 { w(1, "    SKIPPED (board organ not staged in this buildroot)\n" as *u8) } else { sys_close(bfd)
      let brc: i64 = rg_run(BOARD, 0 as *u8, 0 as *u8, out, cap, ol)
      if brc != 0 { w(1, "    MATURITY-BOARD RED -- refusing\n" as *u8); fails = fails + 1 }
      else { w(1, "    published /compare/maturity (evidence-capped census over every matrix domain)\n" as *u8); pubs = pubs + 1 }
  }
  } else {
      pubs=rg_published_count(pubs)
      if rg_scope_receipt(droot, selected, pubs, fails) != 0 {
          w(1, "SCOPE-RECEIPT-FAIL: domain publication cannot claim complete scope metadata\n" as *u8)
          fails = fails + 1
      }
      w(1, "SCOPE-COMPLETE domain=" as *u8); w(1, selected)
      w(1, " aggregates_refreshed_by_this_run=0; full-surface freshness not claimed\n" as *u8)
  }
  w(1, "  sota-class domains=" as *u8); wn(1, sota_c); w(1, " with_matrix=" as *u8); wn(1, sota_matrix_c); w(1, " (watch contracts rendered on those pages; the rest have no contracts to render)\n" as *u8)
  w(1,"  audit_failures=" as *u8);wn(1,g_rg_receipt_failures);w(1," published_evidence_incomplete=" as *u8);wn(1,g_rg_published_incomplete);w(1," reserve_extra_bytes=0 (no additional estate reserve; bavail advisory)\n" as *u8)
  if selected_len==0 {pubs=rg_published_count(pubs)}
  rg_lease_release()   // every publish is done; a second regen may now start (2026-09-02)
  w(1, "REGEN published=" as *u8); wn(1, pubs); w(1, " fails=" as *u8); wn(1, fails)
  if selected_len > 0 { w(1, " scope=domain aggregates_refreshed_by_this_run=0" as *u8) } else { w(1, " scope=full" as *u8) }
  // THE NAMED FIELDS A CONSUMER BRANCHES ON, so the fork check is not an announcement nobody reads.
  // Placed BEFORE verdict= deliberately: this estate judges by the LAST line and anchors by POSITION,
  // so verdict must remain the final token here. STRICTLY ADDITIVE -- none of these touch `fails`, so
  // no run that passed before can fail now. forkstale>0 beside verdict=GREEN is the honest and intended
  // reading: the surface published, AND it published from a binary that is not the promoted one.
  w(1, " forkchecked=" as *u8); wn(1, g_rg_fork_checked)
  w(1, " forkfresh=" as *u8); wn(1, g_rg_fork_fresh)
  w(1, " forkstale=" as *u8); wn(1, g_rg_fork_stale)
  w(1, " forkunproven=" as *u8); wn(1, g_rg_fork_unproven)
  w(1, " forkabsent=" as *u8); wn(1, g_rg_fork_absent)
  return rg_exit_verdict(fails)
1179}
nx_compare_regen_scoped.nx source

`nx_compare_regen_scoped.nx` source
