code wiki / _hdl_build / nx_cron_watch.nx
`nx_cron_watch.nx` source

↩ module page · 454 lines · 27337 B
1// nx_cron_watch.nx -- CRON/AUTOMATION FRESHNESS SUPERVISOR (operator: "prevent things like this...
2// supervised"; the next silent-failure class after API-contract drift + lib drift = a scheduled job that
3// SILENTLY STOPS FIRING, e.g. seq22 team_pulse died unnoticed). SOTA = the dead-man's-switch / heartbeat
4// model (Healthchecks.io "expected period + grace time", Cronitor, Dead Man's Snitch): a job pings on its
5// schedule; a check-in missed beyond a grace window -> STALE/alert. Sovereign twist: the heartbeat is each
6// job's own evidence-log `ts=<epoch>` (no external SaaS; evidence-layer native). Data-driven (rule 11):
7// knowledge/registry/cron_heartbeats.tsv rows name<TAB>heartbeat-file<TAB>ts-marker<TAB>max-age-secs<TAB>remediation.
8// max-age = expected-interval + grace. age = now - ts. age>max-age -> STALE. missing ts -> STALE (never fired).
9//   nx_cron_watch check [manifest]   (JSON: per watch fresh/stale + age + verdict GREEN/STALE-DETECTED)
10// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
11import "nx_syscalls.nx"
12// SSOT IS NOW THE SEG-STORE PLANE, NOT THE TSV (standing law "no tsv -- nishi formats", operator
13// 2026-07-20 "get rid of all these tsvs and migrate to native nishi information management").
14import "nx_store_seed_lib.nx"
15
16const CW_CAP: i64 = 262144
17const CW_TAB: i64 = 9
18const CW_NL: i64 = 10
19const CW_HASH: i64 = 35
20const CW_STDERR: i64 = 2
21const CW_SPAN: i64 = 16
22const CW_EXIT_USAGE: i64 = 2
23
24func cw_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(CW_STDERR, s, n); return 0 }
25func cw_vlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
26func cw_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o] = s[i]; o = o + 1; i = i + 1 } return o }
27func cw_catn(d: *u8, o: i64, v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { d[o] = 45 as u8; o = o + 1; m = 0 - m } var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { d[o] = t[k-1-i]; o = o + 1; i = i + 1 } return o }
28func cw_cat_esc(d: *u8, o: i64, q: *u8, s: i64, e: i64) -> i64 { var i: i64 = s; while i < e { var c: i64 = q[i] as i64; if c == 34 { c = 39 } if c == 92 { c = 47 } if c < 32 { c = 32 } d[o] = c as u8; o = o + 1; i = i + 1 } return o }
29// TAIL-READ (2026-08-02, debt 1785708737). This used to read from byte 0 up to `cap`, so once an
30// append-only stamp log grew past CW_CAP the watch only ever saw the HEAD of the file -- and computed
31// "latest" from the OLDEST bytes it could afford. MEASURED: surfsentinel-beat reported last_ts=1784445800
32// (~14.6 DAYS stale) while the log's real tail showed a COMPLETED run 23 minutes earlier. The guard aged
33// BACKWARDS as its subject got healthier, and screamed louder the longer the job ran correctly.
34// A FRESHNESS CHECK MUST READ THE TAIL. Seek to max(0, size-cap) so the newest evidence is always in the
35// window; a file smaller than cap is read whole exactly as before.
36func cw_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let size: i64 = sys_lseek(fd, 0, 2)
  if size > cap { sys_lseek(fd, size - cap, 0) } else { sys_lseek(fd, 0, 0) }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  return n
46}
47// find <marker> substring, then parse the decimal number immediately following it. -1 if not found.
48func cw_num_after(buf: *u8, n: i64, marker: *u8) -> i64 {
  var ml: i64 = 0
  while marker[ml] != (0 as u8) { ml = ml + 1 }
  if ml == 0 { return 0 - 1 }
  var last: i64 = 0 - 1
  var found: i64 = 0
  var i: i64 = 0
  while i + ml <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < ml { if buf[i+j] != marker[j] { ok = 0; j = ml } else { j = j + 1 } }
      if ok == 1 {
          var p: i64 = i + ml
          var v: i64 = 0
          var got: i64 = 0
          var go: i64 = 1
          while go == 1 { if p >= n { go = 0 } else { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); got = 1; p = p + 1 } else { go = 0 } } else { go = 0 } } }
          // LAST MATCH WINS (2026-08-02, debt 1785708737 -- the twin of the tail-read above). This used to
          // `return v` on the FIRST marker found, which is correct only for a single-line stamp file
          // (`date > log`). Every APPEND-only evidence log (`>>`) puts the FRESHEST stamp LAST, so the
          // first match is the OLDEST run -- the watch then reports a healthy hourly job as weeks stale.
          // That is why the single-line watches (planeguard/guardcheck) read correctly while the appending
          // ones (surfsentinel) did not: first==last only when there is one line.
          if got == 1 { last = v; found = 1 }
      }
      i = i + 1
  }
  if found == 1 { return last }
  return 0 - 1
77}
78func cw_le(q: *u8, i: i64, n: i64) -> i64 { var e: i64 = i; var s: i64 = 1; while s == 1 { if e >= n { s = 0 } else { if q[e] == (CW_NL as u8) { s = 0 } else { e = e + 1 } } } return e }
79func cw_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 {
  var col: i64 = 0
  var p: i64 = ls
  while col < c {
      var s: i64 = 1
      while s == 1 { if p >= le { return 0 } if q[p] == (CW_TAB as u8) { s = 0 } else { p = p + 1 } }
      p = p + 1
      col = col + 1
  }
  var e: i64 = p
  var s2: i64 = 1
  while s2 == 1 { if e >= le { s2 = 0 } else { if q[e] == (CW_TAB as u8) { s2 = 0 } else { e = e + 1 } } }
  out[0] = p
  out[1] = e
  return 1
94}
95func cw_cstr(q: *u8, s: i64, e: i64, dst: *u8) -> i64 { var i: i64 = 0; while s + i < e { dst[i] = q[s+i]; i = i + 1 } dst[i] = 0 as u8; return i }
96func cw_atoi_span(q: *u8, s: i64, e: i64) -> i64 { var v: i64 = 0; var i: i64 = s; while i < e { let c: i64 = q[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
97func cw_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
98func cw_pn(v: i64) -> i64 {
  let t: *u8 = sys_mmap(28)
  var m: i64 = v
  var k: i64 = 0
  if m <= 0 { t[0] = 48 as u8; k = 1 } else { while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } }
  let b: *u8 = sys_mmap(28)
  var i: i64 = 0
  while i < k { b[i] = t[k-1-i]; i = i + 1 }
  sys_write(1, b, k)
  return 0
108}
109func cw_has(q: *u8, n: i64, ned: *u8, nl: i64) -> i64 {
  if nl <= 0 { return 0 }
  if n < nl { return 0 }
  var i: i64 = 0
  while i <= n - nl {
      var j: i64 = 0
      var m: i64 = 1
      while j < nl { if q[i+j] != ned[j] { m = 0; j = nl } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
121}
122// Extract the first nx_<identifier> from a cron row. Stops at the first non-identifier byte, so
123// "/nishihost/nx_buildroot_guard.cron.sh" and "./nx_barcheck.elf" both yield the bare organ name --
124// which is the token the heartbeat manifest's remediation text actually names.
125func cw_token(q: *u8, ls: i64, le: i64, dst: *u8) -> i64 {
  var i: i64 = ls
  while i + 3 <= le {
      if q[i] == (110 as u8) { if q[i+1] == (120 as u8) { if q[i+2] == (95 as u8) {
          var k: i64 = 0
          var p: i64 = i
          while p < le {
              let c: i64 = q[p] as i64
              var ok: i64 = 0
              if c >= 97 { if c <= 122 { ok = 1 } }
              if c >= 48 { if c <= 57 { ok = 1 } }
              if c == 95 { ok = 1 }
              if ok == 0 { p = le } else { dst[k] = q[p]; k = k + 1; p = p + 1 }
          }
          dst[k] = 0 as u8
          return k
      } } }
      i = i + 1
  }
  return 0
145}
146
147// ROW-SCOPED declaration check. The first cut used the flat cw_has over the whole manifest, which
148// would have counted a `covers=` token appearing in a COMMENT -- and this file's header comments do
149// mention organ names. That is the same looseness as the heuristic it replaces, only tighter, so
150// calling it EXACT would have been an overclaim on my own instrument. This walks DATA ROWS ONLY
151// (leading '#' skipped) and requires the token inside one of them.
152// THE MANIFEST SOURCE, PLANE-FIRST. nx_tsv_migrate seeded knowledge/store/cronwatch- from the tsv and
153// ROUND-TRIP VERIFIED it (13 data rows in, 13 back, verified=1). Reading the plane FIRST is the whole
154// point: a migration whose READER still opens the old file has produced a MIRROR, not an SSOT, and a
155// mirror is just a second thing to drift. That is exactly the trap F871 hit -- landmine- sat as a
156// mirror until the reader moved, and rung 2 had to INVERT it.
157// THE TSV FALLBACK STAYS until the file is retired. This can therefore never be the change that blinds
158// the supervisor: an absent or empty plane degrades to the previous behaviour instead of reporting
159// zero watches, which for a dead-man's-switch would read GREEN while watching nothing.
160// srcout[0]: 1 = plane, 0 = tsv. ANNOUNCED by the callers -- a monitor that will not say where its
161// truth came from is one silent migration away from watching a file nobody updates any more.
162func cw_manifest(out: *u8, cap: i64, srcout: *i64) -> i64 {
  let n: i64 = sts_load("knowledge/store/cronwatch-" as *u8, out, cap)
  if n > 0 { srcout[0] = 1; return n }
  srcout[0] = 0
  return cw_read("knowledge/registry/cron_heartbeats.tsv" as *u8, out, cap)
167}
168// declared: an okverdict= marker longer than this is truncated, which would make the containment test
169// unreliable -- 256 is far beyond any verdict sentinel in the estate (the longest today is 13 chars).
170const CW_MARKCAP: i64 = 256
171
172// Find `key` in hay and copy the token that follows it (up to whitespace) into out. Returns the token
173// length, or 0 if the key is absent. Used for the row-level okverdict= declaration.
174func cw_tok_after(hay: *u8, hn: i64, key: *u8, out: *u8, cap: i64) -> i64 {
  var kl: i64 = 0
  while key[kl] != (0 as u8) { kl = kl + 1 }
  if kl == 0 { return 0 }
  if hn < kl { return 0 }
  var i: i64 = 0
  while i <= hn - kl {
      var m: i64 = 1
      var c: i64 = 0
      while c < kl {
          if hay[i + c] != key[c] { m = 0; c = kl } else { c = c + 1 }
      }
      if m == 1 {
          var j: i64 = i + kl
          var w: i64 = 0
          var go: i64 = 1
          while go == 1 {
              if j >= hn { go = 0 } else {
                  if w >= cap - 1 { go = 0 } else {
                      let ch: i64 = hay[j] as i64
                      if ch <= 32 { go = 0 } else { out[w] = hay[j]; w = w + 1; j = j + 1 }
                  }
              }
          }
          out[w] = 0 as u8
          return w
      }
      i = i + 1
  }
  return 0
204}
205
206func cw_row_declares(man: *u8, mn: i64, needle: *u8, nl: i64) -> i64 {
  var i: i64 = 0
  while i < mn {
      let le: i64 = cw_le(man, i, mn)
      if le > i { if man[i] != (CW_HASH as u8) {
          if cw_has(((man as i64) + i) as *u8, le - i, needle, nl) == 1 { return 1 }
      } }
      i = le + 1
  }
  return 0
216}
217func main(argc: i64, argv: *i64) -> i64 {
  // ---- verb `cover`: THE DENOMINATOR CHECK ----------------------------------------------------
  // `check` answers "are the jobs I was TOLD to watch fresh?" and returns GREEN over a hand-kept list.
  // MEASURED 2026-08-06: it watched 9 while cron.reg scheduled ~62, so 53 jobs could stop firing and
  // every board still read GREEN -- a monitor reporting on its manifest, not on the fleet. This verb
  // makes the DENOMINATOR the scheduler's own SSOT: every non-comment cron.reg row must map to a
  // watched job, and the ones that do not are NAMED.
  // ENVELOPE -- CORRECTED 2026-08-06 ON ITS OWN FIRST RUN. The draft claimed `unwatched` was a LOWER
  // BOUND. That was WRONG and the first run refuted it, so the claim is retracted here rather than left
  // standing. The join is a NAME HEURISTIC and is unreliable in BOTH directions:
  //   OVER-reports the gap: surfsentinel-beat DOES watch nx_surfsentinel.cron.sh, but the manifest names
  //     it "nx_plan_run.elf surfsentinel", which carries no nx_surfsentinel token -> reads UNWATCHED.
  //   UNDER-reports the gap: a remediation string that merely MENTIONS an organ counts as covered.
  // AND THE DENOMINATOR IS STILL INCOMPLETE, which is the same defect this verb was built to expose:
  // cron.reg is only ONE of TWO schedulers. The clock store (knowledge/store/clockjobs-) schedules
  // netobs-beat and evidence-beat, which have no cron.reg row at all -- which is why `watched` here (6)
  // is smaller than the manifest's live watch count (9). This verb therefore measures CRON-ROW coverage
  // ONLY, and the ratio is INDICATIVE, never exact.
  // THE FIX THAT WOULD MAKE IT EXACT: give cron_heartbeats.tsv an explicit column naming the scheduled
  // row each watch covers, so the join is a DECLARED LINK instead of a string guess -- the same move as
  // re-keying a plane by column name instead of ordinal. Until then this number is a floor-lit estimate
  // and is labelled as one. A row with no nx_ token is counted separately as unmatchable.
  if argc > 1 {
      let v0: *u8 = argv[1] as *u8
      if v0[0] == (99 as u8) { if v0[1] == (111 as u8) {
          let reg: *u8 = sys_mmap(CW_CAP)
          let rn: i64 = cw_read("cron.reg" as *u8, reg, CW_CAP)
          if rn <= 0 { cw_werr("CW-FAIL cron.reg unreadable -- coverage is UNDEFINED, refusing to print a ratio\n" as *u8); sys_exit(1); return 1 }
          let man2: *u8 = sys_mmap(CW_CAP)
          let msrc2: *i64 = sys_mmap(CW_SPAN) as *i64
          let mn2: i64 = cw_manifest(man2, CW_CAP, msrc2)
          if mn2 <= 0 { cw_werr("CW-FAIL heartbeat manifest unreadable -- coverage UNDEFINED\n" as *u8); sys_exit(1); return 1 }
          let tok: *u8 = sys_mmap(256)
          // HOISTED OUT OF THE LOOP DELIBERATELY. An mmap per iteration is the exact defect that took
          // 28.5GB of a 36GB host in nx_ts_lumadiff -- at PAGE granularity every loop turn leaks 4096B.
          let dbuf: *u8 = sys_mmap(320)
          var sched: i64 = 0
          var cov: i64 = 0
          var unw: i64 = 0
          var notok: i64 = 0
          var decl: i64 = 0
          var guess: i64 = 0
          var ri: i64 = 0
          cw_p("=== nx_cron_watch cover -- scheduled rows (cron.reg) vs watched jobs (cron_heartbeats.tsv) ===\n" as *u8)
          while ri < rn {
              let rle: i64 = cw_le(reg, ri, rn)
              if rle > ri {
                  if reg[ri] != (CW_HASH as u8) {
                      sched = sched + 1
                      let tl: i64 = cw_token(reg, ri, rle, tok)
                      if tl == 0 {
                          notok = notok + 1
                          cw_p("  NO-TOKEN  (row names no nx_ organ; cannot be joined)\n" as *u8)
                      } else {
                          // DECLARED LINK FIRST (2026-08-06). This verb's own envelope named the fix and
                          // then went on guessing: `covers=<token>` in a manifest row is an EXPLICIT claim
                          // that this watch covers that scheduled row, and it cannot be satisfied by prose
                          // that merely mentions the organ. The bare-substring heuristic is KEPT as a
                          // fallback so no existing row regresses (rule 19) -- but the two are now COUNTED
                          // SEPARATELY and both printed, because a coverage number that blends proof with
                          // guesswork is not a coverage number.
                          // ★AN INSTRUMENT THAT CANNOT SAY WHICH PART OF ITS ANSWER IS A GUESS IS REPORTING
                          // CONFIDENCE IT HAS NOT EARNED.
                          var dl: i64 = cw_cat(dbuf, 0, "covers=" as *u8)
                          var ti: i64 = 0
                          while ti < tl { dbuf[dl] = tok[ti]; dl = dl + 1; ti = ti + 1 }
                          dbuf[dl] = 0 as u8
                          if cw_row_declares(man2, mn2, dbuf, dl) == 1 { cov = cov + 1; decl = decl + 1 } else {
                              if cw_has(man2, mn2, tok, tl) == 1 { cov = cov + 1; guess = guess + 1 } else {
                                  unw = unw + 1
                                  cw_p("  UNWATCHED  " as *u8); cw_p(tok); cw_p("\n" as *u8)
                              }
                          }
                      }
                  }
              }
              ri = rle + 1
          }
          cw_p("\n  scheduled=" as *u8); cw_pn(sched)
          cw_p("  watched=" as *u8); cw_pn(cov)
          cw_p("  unwatched=" as *u8); cw_pn(unw)
          cw_p("  unmatchable=" as *u8); cw_pn(notok)
          cw_p("  declared=" as *u8); cw_pn(decl)
          cw_p("  guessed=" as *u8); cw_pn(guess)
          if sched > 0 { cw_p("  coverage_permil=" as *u8); cw_pn((cov * 1000) / sched) }
          if sched > 0 { cw_p("  DECLARED_permil=" as *u8); cw_pn((decl * 1000) / sched) }
          cw_p("\n  ENVELOPE: TWO JOINS, COUNTED SEPARATELY. `declared` counts rows matched by an explicit\n" as *u8)
          cw_p("  covers=<token> inside a DATA ROW of the manifest (comments excluded, so a token mentioned\n" as *u8)
          cw_p("  in prose cannot satisfy it) -- that half is EXACT. `guessed` counts rows matched\n" as *u8)
          cw_p("  only by the legacy name heuristic, and is the ONLY part of coverage_permil you should\n" as *u8)
          cw_p("  distrust. DECLARED_permil is the number that has been EARNED rather than estimated.\n" as *u8)
          cw_p("  TO TURN A GUESS INTO A FACT: add `covers=<nx_token>` to that watch's remediation field.\n" as *u8)
          cw_p("  Legacy heuristic detail, unreliable in BOTH directions -- a watch whose remediation\n" as *u8)
          cw_p("  names the job without an nx_ token reads UNWATCHED (surfsentinel-beat does), and a string\n" as *u8)
          cw_p("  that merely mentions an organ reads watched. cron.reg is also only ONE of TWO schedulers:\n" as *u8)
          cw_p("  the clock store carries netobs/evidence beats with no cron row, so `watched` here is lower\n" as *u8)
          cw_p("  than the manifest's live watch count. This ratio is INDICATIVE, not exact; an explicit\n" as *u8)
          cw_p("  scheduled-row column in cron_heartbeats.tsv would make the join a DECLARED LINK, not a guess.\n" as *u8)
          if unw == 0 { if notok == 0 { cw_p("VERDICT=GREEN (every scheduled row maps to a watched job)\n" as *u8); sys_exit(0); return 0 } }
          cw_p("VERDICT=GAP (a scheduled job can stop firing without any watch going stale)\n" as *u8)
          sys_exit(1); return 1
      } }
  }
320
  // single verb (check); argv[1] optionally overrides the manifest path if it looks like a path
  var mpath: *u8 = "knowledge/registry/cron_heartbeats.tsv" as *u8
  var mexpl: i64 = 0
  if argc > 2 { mpath = argv[2] as *u8; mexpl = 1 }
  let man: *u8 = sys_mmap(CW_CAP)
  let msrc: *i64 = sys_mmap(CW_SPAN) as *i64
  msrc[0] = 0
  // AN EXPLICIT PATH ARGUMENT STILL WINS. Gates and probes point this verb at fixture manifests, and
  // silently reading the production plane instead would make every such run a lie about what it
  // tested -- the same class as a gate that writes to the path it measures.
  var mn: i64 = 0
  if mexpl == 1 { mn = cw_read(mpath, man, CW_CAP) } else { mn = cw_manifest(man, CW_CAP, msrc) }
  if mn <= 0 { cw_werr("CW-FAIL manifest empty or unreadable\n" as *u8); sys_exit(1); return 1 }
  let now: i64 = sys_now_realtime_sec()
  // SELF-STAMP -- THE SUPERVISOR HAD NO DEAD-MAN'S-SWITCH OF ITS OWN. nx_cron_watch is scheduled in
  // cron.reg and read UNWATCHED in its OWN cover report: if it stopped firing, nothing would notice,
  // and every board would go on reading GREEN off a manifest that nobody was checking any more. The
  // instrument that exists to catch silent stoppage was the one thing whose silent stoppage was
  // invisible.
  // ⚠HONEST LIMIT, STATED RATHER THAN PAPERED OVER: A SUPERVISOR CANNOT FULLY SUPERVISE ITSELF. If
  // this organ never runs it never writes this stamp AND never reads it, so the row can only ever go
  // stale-but-unread. This closes the PARTIAL case -- the organ runs by some path while its schedule
  // row is inert -- and the TOTAL-death case is left to an EXTERNAL prober, which is named in the
  // cron-watch-self remediation. A guard whose blind spot is documented is worth far more than one
  // whose blind spot is discovered during an outage.
  let stb: *u8 = sys_mmap(CW_SPAN * 8)
  var so: i64 = cw_cat(stb, 0, "cron_watch ts=" as *u8)
  so = cw_catn(stb, so, now)
  stb[so] = 10 as u8
  so = so + 1
  let stfd: i64 = sys_openat_wr("knowledge/status/cron_watch.stamp" as *u8, 0x1a4)
  if stfd >= 0 { sys_write(stfd, stb, so); sys_close(stfd) }
  let fbuf: *u8 = sys_mmap(CW_CAP)
  let fpath: *u8 = sys_mmap(512)
  let tmark: *u8 = sys_mmap(64)
  let c0: *i64 = sys_mmap(CW_SPAN) as *i64
  let c1: *i64 = sys_mmap(CW_SPAN) as *i64
  let c2: *i64 = sys_mmap(CW_SPAN) as *i64
  let c3: *i64 = sys_mmap(CW_SPAN) as *i64
  let c4: *i64 = sys_mmap(CW_SPAN) as *i64
  let out: *u8 = sys_mmap(CW_CAP)
  var o: i64 = 0
  o = cw_cat(out, o, "{\"verb\":\"check\",\"epoch\":" as *u8)
  o = cw_catn(out, o, now)
  // DECLARE THE SOURCE. During a registry migration the single most valuable field is which copy
  // was actually read: "plane" means the seg-store is authoritative, "tsv" means the plane was
  // empty or absent and this run FELL BACK. Without it, the day someone edits the retired tsv and
  // sees no effect is a debugging session instead of one glance.
  o = cw_cat(out, o, ",\"manifest_src\":\"" as *u8)
  if msrc[0] == 1 { o = cw_cat(out, o, "plane" as *u8) } else { o = cw_cat(out, o, "tsv" as *u8) }
  o = cw_cat(out, o, "\"" as *u8)
  o = cw_cat(out, o, ",\"watches\":[" as *u8)
  var total: i64 = 0
  var stale: i64 = 0
  var unhealthycnt: i64 = 0
  let rembuf: *u8 = sys_mmap(CW_CAP)
  let okbuf: *u8 = sys_mmap(CW_MARKCAP)
  var emitted: i64 = 0
  var i: i64 = 0
  while i < mn {
      let le: i64 = cw_le(man, i, mn)
      if le > i { if (man[i] as i64) != CW_HASH {
          if cw_col(man, i, le, 0, c0) == 1 { if cw_col(man, i, le, 1, c1) == 1 { if cw_col(man, i, le, 2, c2) == 1 { if cw_col(man, i, le, 3, c3) == 1 {
              cw_cstr(man, c1[0], c1[1], fpath)
              cw_cstr(man, c2[0], c2[1], tmark)
              let maxage: i64 = cw_atoi_span(man, c3[0], c3[1])
              total = total + 1
              let fn: i64 = cw_read(fpath, fbuf, CW_CAP)
              var ts: i64 = 0 - 1
              if fn > 0 { ts = cw_num_after(fbuf, fn, tmark) }
              var age: i64 = 0 - 1
              var fresh: i64 = 0
              if ts >= 0 { age = now - ts; if age < 0 { age = 0 } if age <= maxage { fresh = 1 } }
              if fresh == 0 { stale = stale + 1 }
              // OUTCOME, not just liveness. A row may declare okverdict=<marker> in its remediation
              // column (same convention as covers=); if it does, the evidence file must CONTAIN that
              // marker or the watch is UNHEALTHY even while perfectly fresh.
              // MEASURED 2026-08-07: the mgmt API was unreachable for ~25 minutes and this monitor
              // reported api-contract-probe FRESH for the whole outage -- because it read only ts=
              // and ignored the VERDICT= the probe was honestly writing
              // ("VERDICT=UNKNOWN api-contract probe-fetch-failed ... fail-static").
              // ★★★★★THE INSTRUMENT REPORTED CORRECTLY AND THE MONITOR READ THE WRONG FIELD.
              // ★A DEAD-MAN'S-SWITCH ANSWERS "DID IT RUN", NEVER "DID IT PASS" -- SO ASK BOTH.
              // Declared GOOD rather than BAD deliberately: anything that is not the ok marker counts
              // as unhealthy, including failure states nobody has enumerated yet. Fail-closed.
              // IMPRECISION, DECLARED: the scan covers the file's READ WINDOW, not strictly the newest
              // record. For the single-line rotating stamps these rows point at those are identical;
              // for an append-only log with history they are not, and an older GREEN still present in
              // the window would mask a later failure. Rows without okverdict= behave EXACTLY as
              // before, so this is additive and no existing watch changes meaning.
              var unhealthy: i64 = 0
              if cw_col(man, i, le, 4, c4) == 1 {
                  cw_cstr(man, c4[0], c4[1], rembuf)
                  var rl: i64 = 0
                  while rembuf[rl] != (0 as u8) { rl = rl + 1 }
                  let okm: i64 = cw_tok_after(rembuf, rl, "okverdict=" as *u8, okbuf, CW_MARKCAP)
                  if okm > 0 {
                      if fn <= 0 { unhealthy = 1 } else {
                          if cw_has(fbuf, fn, okbuf, okm) == 0 { unhealthy = 1 }
                      }
                  }
              }
              if unhealthy == 1 { unhealthycnt = unhealthycnt + 1 }
              if emitted > 0 { o = cw_cat(out, o, "," as *u8) }
              o = cw_cat(out, o, "{\"name\":\"" as *u8)
              o = cw_cat_esc(out, o, man, c0[0], c0[1])
              o = cw_cat(out, o, "\",\"last_ts\":" as *u8)
              o = cw_catn(out, o, ts)
              o = cw_cat(out, o, ",\"age_secs\":" as *u8)
              o = cw_catn(out, o, age)
              o = cw_cat(out, o, ",\"max_age\":" as *u8)
              o = cw_catn(out, o, maxage)
              o = cw_cat(out, o, ",\"fresh\":" as *u8)
              o = cw_catn(out, o, fresh)
              o = cw_cat(out, o, ",\"unhealthy\":" as *u8)
              o = cw_catn(out, o, unhealthy)
              if fresh == 0 { if cw_col(man, i, le, 4, c4) == 1 { o = cw_cat(out, o, ",\"remediation\":\"" as *u8); o = cw_cat_esc(out, o, man, c4[0], c4[1]); o = cw_cat(out, o, "\"" as *u8) } }
              o = cw_cat(out, o, "}" as *u8)
              emitted = emitted + 1
          } } } }
      } }
      i = le + 1
  }
  o = cw_cat(out, o, "],\"total\":" as *u8)
  o = cw_catn(out, o, total)
  o = cw_cat(out, o, ",\"stale\":" as *u8)
  o = cw_catn(out, o, stale)
  o = cw_cat(out, o, ",\"verdict\":\"" as *u8)
  if stale == 0 { o = cw_cat(out, o, "GREEN" as *u8) } else { o = cw_cat(out, o, "STALE-DETECTED" as *u8) }
  o = cw_cat(out, o, "\",\"envelope\":\"manifest + each heartbeat/stamp file read bounded per CW_CAP; a job whose evidence exceeds the cap reads TRUNCATED and could be misjudged stale/fresh -- declared per the scale-law (F846), never silent\"}\n" as *u8)
  sys_write(1, out, o)
  sys_exit(0)
  return 0
454}
nx_cron_watch.nx source

`nx_cron_watch.nx` source
