`nx_debt.nx` source

↩ module page · 1034 lines · 60482 B
1// nx_debt.nx -- debt-store intake CLI (autonomous-loop design-of-record 2026-07-18, R1).
2// knowledge/store/debt- rows appended by judges/sessions; nx_ws_cycle REFUSES to emit WORK while
3// an open row exists (eat-debt-first mechanized). Row: <epoch>\t<sev1-9>\t<scope>\t<open|eaten>\t<desc>
4//   nx_debt add <sev> <scope> <desc> [prefix]
5//   nx_debt eat <epoch-id-or-index> [prefix]  (epoch col0 exact-match FIRST, index fallback; echoes the row; idempotent)
6//   nx_debt show <epoch-id-or-index> [prefix]  (read-before-eat: echo one row, no mutation)
7//   nx_debt page <offset> <limit> [prefix]     (64KB-safe paged list w/ declared envelope)
8//   nx_debt list [prefix]
9//   nx_debt dedup [apply] [prefix]  (CONSOLIDATE byte-identical OPEN rows: DRY-RUN by default, `apply`
10//     commits; keeps the EARLIEST row of each group and only flips the rest open->eaten -- rule 13
11//     soft-delete, no row is ever removed. ONE sts_seed per run, not one per closure.)
12// Fail-closed: bad sev / out-of-range seq commit NOTHING. flock on <prefix>plock.
13// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
14import "nx_store_seed_lib.nx"
15import "nx_seg_store.nx"
16import "nx_syscalls.nx"
17const DB_MAGIC_1469598103934665603: i64 = 1469598103934665603
18const DB_MAGIC_1099511628211: i64 = 1099511628211
19
20const DB_CAP: i64 = 33554432  // 2026-08-06: was 4 MiB and THE PLANE CROSSED IT -- measured 4,217,666B / 3,326 rows via nx_plane_check while nx_debt page reported total=3311 and show could not find the ~15 NEWEST rows. The 07-29 note predicted the next ceiling was "weeks out"; it arrived in EIGHT DAYS. ***AN APPEND-ONLY PLANE PAST A PREFIX CAP LOSES ITS NEWEST ROWS FIRST, SO THE READER DEGRADES EXACTLY AS NEW WORK ARRIVES*** -- and add/page disagreed by one on `open` (2305 vs 2304) because they read different amounts of the same file. 32 MiB is ~8x current at ~500 rows/wk. ⚠THIS IS THE THIRD RAISE, NOT A FIX: the structural answer is to compare DB_CAP against the actual plane size and REFUSE LOUDLY (or tail-anchor the read) instead of silently returning a prefix -- a cap that can be crossed in silence will be crossed again. Detector now exists: nx_capcliff scan.
21const DB_TAB: i64 = 9
22const DB_NL: i64 = 10
23const DB_STDERR: i64 = 2
24const DB_LOCK_EX: i64 = 2
25const DB_MODE: i64 = 420
26const DB_SPAN: i64 = 16
27const DB_ROWMAX: i64 = 131072  // 2026-08-06: per-row index capacity for the `dedup` verb (~39x the live
28// 3,357-row plane). REFUSES LOUDLY past this rather than deduping a prefix of the plane -- a consolidator
29// that silently saw only part of the plane would report a clean sweep while leaving duplicates behind.
30const DB_PATHCAP: i64 = 256
31const DB_MSGCAP: i64 = 512
32const DB_DESCCAP: i64 = 262144  // 2026-08-06: buffer for the CANONICAL desc (the exact bytes the row will
33// carry) so the dedup comparator and the writer share ONE form. Sized 8x the largest desc observed on the
34// live plane (~2.5KB). REFUSES LOUDLY when exceeded rather than truncating -- per DB_CAP's own law above,
35// a cap that can be crossed in silence will be crossed again, and a SILENTLY TRUNCATED desc would defeat
36// the very dedup this constant exists to make work.
37
38// Pause before the confirming re-read. Long enough for a sibling's sts_seed generation to land, short
39// enough that a genuine refusal is still prompt.
40const DB_RACE_REREAD_MS: i64 = 250
41
42// A "lossy load" verdict has TWO possible causes and the old guard asserted the wrong one AS FACT:
43//   (a) a prior writer really dropped rows -- STABLE, it is still there on the next read; or
44//   (b) A SIBLING IS MID-COMMIT RIGHT NOW -- sts_seed bumps the declared q:n and THEN re-seeds the
45//       plane, so a reader landing inside that window sees a bumped counter with rows not yet visible.
46// MEASURED 2026-07-30 (seq1521): four consecutive refusals on the debt- plane while nx_plane_repair
47// read the SAME plane as fully self-consistent (declared 1510 / found 1510 / beyond 0) and the
48// identical add then SUCCEEDED. declared_qn had moved 1495 -> 1510 between two probes because three
49// sibling workstreams were writing continuously. No data was ever lost.
50//
51// A REAL LOSS DOES NOT HEAL; A RACE DOES. So re-read ONCE and let the plane settle the question.
52// This does NOT relax the guard: if the second read still reports fewer rows than declared, the caller
53// refuses exactly as before. Baking a truncated read back into the plane remains the catastrophe this
54// exists to prevent -- we are removing a FALSE alarm, not the alarm.
55// How far to probe for a free id before refusing. Each probe is one full-plane scan, so this bounds the
56// worst case rather than expressing a policy -- a filing burst deep enough to exhaust it is itself the
57// thing worth refusing over.
58const DB_ID_MAXPROBE: i64 = 4096
59
60// Rows actually PRESENT in the loaded buffer. sts_load_honest increments flags[1] for every row it
61// FINDS, but sts_emit_row is bounded by `cap` -- so once the buffer fills, rows are dropped while the
62// counter keeps counting. nx_plane_repair calls that mismatch ***THE LETHAL ONE*** and REFUSES to
63// reseed on it, because reseeding from a truncated buffer destroys the tail. Same detection here.
64func db_count_rows(buf: *u8, n: i64) -> i64 {
  var r: i64 = 0
  var i: i64 = 0
  while i < n { if buf[i] == (DB_NL as u8) { r = r + 1 } i = i + 1 }
  return r
69}
70
71func db_load_guarded(prefix: *u8, q: *u8, dbf: *i64) -> i64 {
  var n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
  if dbf[1] < dbf[0] {
      sys_sleep_ms(DB_RACE_REREAD_MS)
      n = sts_load_honest(prefix, q, DB_CAP, dbf)
  }
  // ***A READER THAT CANNOT SEE THE WHOLE LEDGER MUST SAY SO.*** Measured 2026-08-06: the plane crossed
  // the old 4 MiB DB_CAP at 4,217,666B / 3,326 rows, and this organ answered `total=3311` and
  // `no row matches` for the ~15 NEWEST rows -- with NO coverage claim anywhere. A correctly-filed row
  // looked permanently lost, and I spent real time diagnosing a WRITE failure that never happened
  // (nx_plane_check was GREEN 3326/3326 the whole time). The sibling reader nx_debt_view always printed
  // capture_truncated + coverage_complete and named the constant to raise -- which is the ONLY reason
  // this was diagnosable at all. THE DECLARATION, NOT THE CAP, IS THE FEATURE: a bigger buffer just moves
  // the cliff, while an announced truncation can never again be mistaken for absence.
  let got: i64 = db_count_rows(q, n)
  // TWO DIRECTIONS, TWO CAUSES (2026-09-02). A buffer holding FEWER newlines than the loader counted is the truncation
  // above (rows dropped at the cap). A buffer holding MORE newlines than rows is NOT truncation: a row VALUE carries an
  // embedded newline, so the newline census over-counts by one per such row. Measured live: `holds 4301 rows but the
  // loader counted 4300` with DB_CAP at 32 MiB and the plane under 5 MB -- every verb was prefixed with a false
  // DB_CAP alarm naming a constant to raise, for a condition no cap can change. The two verdicts are named separately
  // so a reader never raises a cap to cure a newline, and never ignores a real truncation because the last one was false.
  if got < dbf[1] {
      db_werr("NX-DEBT COVERAGE-TRUNCATED: the read buffer holds " as *u8)
      db_werrn(got)
      db_werr(" rows but the loader counted " as *u8)
      db_werrn(dbf[1])
      db_werr(" -- DB_CAP is too small for this plane, so every verb below is reporting a PREFIX, and the rows it cannot see are the NEWEST ones. Raise DB_CAP in nx_debt.nx (and its hand-copies DL_CAP / IC_CAP / DV_CAPTURE_CAP) and rebuild. Run: nx_capcliff scan\n" as *u8)
  }
  if got > dbf[1] {
      db_werr("NX-DEBT ROW-EMBEDDED-NEWLINE: the read buffer holds " as *u8)
      db_werrn(got)
      db_werr(" newline-delimited lines for " as *u8)
      db_werrn(dbf[1])
      db_werr(" loaded rows -- " as *u8)
      db_werrn(got - dbf[1])
      db_werr(" row value(s) carry an embedded newline (a desc pasted with a line break). Coverage is COMPLETE; line-oriented readers (page/show/find) will see the tail of such a row as a malformed extra line. Not a cap: raising DB_CAP changes nothing. Remedy: nx_plane_repair or re-filing the row with the break removed.\n" as *u8)
  }
  return n
109}
110const DB_EXIT_USAGE: i64 = 2
111
112func db_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
113func db_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(DB_STDERR, s, n); return 0 }
114// stderr number, for the coverage-truncation banner: a warning that cannot print its two disagreeing
115// counts is not evidence, it is a mood.
116func db_werrn(v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 } var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } let b: *u8 = sys_mmap(28); var i: i64 = 0; while i < k { b[i] = t[k-1-i]; i = i + 1 } sys_write(DB_STDERR, b, k); sys_munmap(t, 28); sys_munmap(b, 28); return 0 }
117func db_vlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
118func db_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o] = s[i]; o = o + 1; i = i + 1 } return o }
119func db_catn(d: *u8, o: i64, v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { d[o] = 45 as u8; o = o + 1; m = 0 - m } var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { d[o] = t[k-1-i]; o = o + 1; i = i + 1 } return o }
120func db_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
121func db_le(q: *u8, i: i64, n: i64) -> i64 { var e: i64 = i; var s: i64 = 1; while s == 1 { if e >= n { s = 0 } else { if q[e] == (DB_NL as u8) { s = 0 } else { e = e + 1 } } } return e }
122func db_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 {
  var col: i64 = 0
  var p: i64 = ls
  while col < c {
      var s: i64 = 1
      while s == 1 { if p >= le { return 0 } if q[p] == (DB_TAB as u8) { s = 0 } else { p = p + 1 } }
      p = p + 1
      col = col + 1
  }
  var e: i64 = p
  var s2: i64 = 1
  while s2 == 1 { if e >= le { s2 = 0 } else { if q[e] == (DB_TAB as u8) { s2 = 0 } else { e = e + 1 } } }
  out[0] = p
  out[1] = e
  return 1
137}
138func db_span_lit(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  var i: i64 = 0
  while s + i < e { if lit[i] == (0 as u8) { return 0 } if q[s+i] != lit[i] { return 0 } i = i + 1 }
  if lit[i] != (0 as u8) { return 0 }
  return 1
143}
144// exact-compare q[s..e) against a C-string (used to detect an identical already-filed desc)
145func db_tail_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  let n: i64 = db_vlen(lit)
  if e - s != n { return 0 }
  var i: i64 = 0
  while i < n { if q[s+i] != lit[i] { return 0 } i = i + 1 }
  return 1
151}
152// seq1298: a caller-supplied [prefix] is a STORE PREFIX, not free text -- validate at the intake
153// boundary so a proof-string mistake fails LOUD with the contract, not as a phantom lock failure.
154// Valid: non-empty, fits DB_PATHCAP with room for "plock", ends with '-', chars in [a-z0-9_/-.].
155func db_prefix_ok(a: *u8) -> i64 {
  let n: i64 = db_vlen(a)
  if n < 2 { return 0 }
  if n > DB_PATHCAP - 8 { return 0 }
  if a[n-1] != (45 as u8) { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = a[i] as i64
      var ok: i64 = 0
      if c >= 97 { if c <= 122 { ok = 1 } }
      if c >= 48 { if c <= 57 { ok = 1 } }
      if c == 95 { ok = 1 }
      if c == 47 { ok = 1 }
      if c == 45 { ok = 1 }
      if c == 46 { ok = 1 }
      if ok == 0 { return 0 }
      i = i + 1
  }
  return 1
174}
175func db_take_prefix(a: *u8) -> *u8 {
  if db_prefix_ok(a) == 1 { return a }
  db_werr("DEBT-FAIL bad prefix arg: [prefix] is a STORE PREFIX like knowledge/store/debt- (ends with -, chars [a-z0-9_/-.]) -- NOT free text; eat takes NO proof arg\n" as *u8)
  sys_exit(DB_EXIT_USAGE)
  return a
180}
181func db_lock(prefix: *u8) -> i64 {
  let p: *u8 = sys_mmap(DB_PATHCAP)
  var o: i64 = db_cat(p, 0, prefix)
  o = db_cat(p, o, "plock" as *u8)
  p[o] = 0 as u8
  let fd: i64 = sys_openat_append(p, DB_MODE)
  if fd < 0 {
      // seq1298: name the PATH -- "cannot lock" alone blamed flock when the cause was open-fail
      let m: *u8 = sys_mmap(DB_MSGCAP)
      var mo: i64 = db_cat(m, 0, "DEBT-FAIL lock-file OPEN failed (not flock) path=" as *u8)
      mo = db_cat(m, mo, p)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(DB_STDERR, m, mo)
      return 0 - 1
  }
  sys_flock(fd, DB_LOCK_EX)
  return fd
199}
200// count open rows in a loaded row-buffer
201// ★THE LEDGER MUST BE CLOSEABLE BY CONSTRUCTION, NOT BY PARSING PROSE (2026-07-31).
202// MEASURED THIS SESSION: nx_debtconfirm's rung-5 remainder scan CAUGHT 1785453431 (52 unmigrated seg-store
203// writers) but MISSED 1785445444, which describes the SAME open population in prose containing none of its
204// keywords -- a FALSE CLEAN on an ACTIVE data-loss defect. Widening the keyword list is chasing prose
205// forever; the population of ways to say "not finished" is unbounded.
206// SO INVERT THE DEFAULT: every row carries an explicit machine-readable closure field. A filer who states
207// one keeps it; a filer who states none gets CLOSURE=UNSPECIFIED, which a confirmer reads as PARTIAL and
208// NEVER closes mechanically. Absence of a closure criterion becomes EXPLICIT instead of invisible.
209// Additive (rule 19): existing rows are untouched and every guard above is unchanged.
210func db_find_sub(h: *u8, n: i64, s: *u8) -> i64 {
  var sl: i64 = 0
  while s[sl] != (0 as u8) { sl = sl + 1 }
  var r: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      if i + sl <= n {
          var m: i64 = 1
          var k: i64 = 0
          while k < sl { if h[i+k] != s[k] { m = 0; k = sl } else { k = k + 1 } }
          if m == 1 { r = i; i = n } else { i = i + 1 }
      } else { i = n }
  }
  return r
224}
225
226func db_open_count(q: *u8, n: i64) -> i64 {
  let c3: *i64 = sys_mmap(DB_SPAN) as *i64
  var k: i64 = 0
  var i: i64 = 0
  while i < n {
      let le: i64 = db_le(q, i, n)
      if db_col(q, i, le, 3, c3) == 1 { if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { k = k + 1 } }
      i = le + 1
  }
  return k
236}
237func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { db_werr("usage: nx_debt {add <sev> <scope> <desc> | eat <epoch-id-or-index> | note <epoch-id-or-index> <text> | show <epoch-id-or-index> | page <off> <lim> | list} [prefix]\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
  let verb: *u8 = argv[1] as *u8
  var prefix: *u8 = "knowledge/store/debt-" as *u8
  if db_span_lit(verb, 0, db_vlen(verb), "list" as *u8) == 1 {
      if argc > 2 { prefix = db_take_prefix(argv[2] as *u8) }
      let q: *u8 = sys_mmap(DB_CAP)
      // HONEST LOAD (2026-07-25): sts_load stops at the q:n count key with NO signal, so a stale
      // q:n made this verb report total=125 AS FACT while the plane held 734+ rows. sts_load_honest
      // loads IDENTICALLY but also reports declared/loaded/unreachable, so a PARTIAL listing says so.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      var idx: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          let m: *u8 = sys_mmap(DB_MSGCAP)
          var o: i64 = db_catn(m, 0, idx)
          m[o] = 32 as u8
          o = o + 1
          sys_write(1, m, o)
          sys_write(1, ((q as i64) + i) as *u8, le - i)
          sys_write(1, "\n" as *u8, 1)
          idx = idx + 1
          i = le + 1
      }
      let k: i64 = db_open_count(q, n)
      let m2: *u8 = sys_mmap(DB_MSGCAP)
      var o2: i64 = db_cat(m2, 0, "DEBTS total=" as *u8)
      o2 = db_catn(m2, o2, idx)
      o2 = db_cat(m2, o2, " open=" as *u8)
      o2 = db_catn(m2, o2, k)
      o2 = db_cat(m2, o2, " declared_qn=" as *u8)
      o2 = db_catn(m2, o2, dbf[0])
      o2 = db_cat(m2, o2, " loaded=" as *u8)
      o2 = db_catn(m2, o2, dbf[1])
      o2 = db_cat(m2, o2, " unreachable_beyond_qn=" as *u8)
      o2 = db_catn(m2, o2, dbf[2])
      m2[o2] = DB_NL as u8
      o2 = o2 + 1
      sys_write(1, m2, o2)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows are reachable BEYOND the declared q:n; do NOT treat it as the whole corpus, and do NOT run add/eat (they re-seed the plane from this partial buffer)\n" as *u8) }
      sys_exit(0)
      return 0
  }
  // ---------- reseed: THE REPAIR PATH THE FAIL-CLOSED GUARD LACKED ----------
  //
  // ★THE DEADLOCK THIS EXISTS TO BREAK (measured 2026-07-30): a torn write left
  // the plane declaring 1495 rows while holding 1494, so the lossy-load guard
  // refused EVERY add/eat -- correctly, because add/eat re-seed the whole plane
  // and would bake the loss in. But the ONLY way to correct the declared count
  // is a write. **A fail-closed guard with no repair route is not safety, it is
  // a permanent outage** -- and this plane is the ecosystem's coordination
  // ledger, so every lane went read-only with no way back.
  //
  // This verb re-seeds the plane from exactly the rows that ARE reachable, so
  // the declared count becomes the true count. It is EVIDENCE-GATED and can
  // only ever repair an over-declaration:
  //   * REFUSES when rows are reachable BEYOND the declared count -- that is
  //     the orphan case, where re-seeding would genuinely destroy data.
  //   * REFUSES when the plane is already consistent, so it cannot be used as
  //     a routine write path or to paper over a healthy plane.
  // It prints declared/loaded before and the true count after, so the repair is
  // auditable rather than a silent mutation of the SSOT.
  if db_span_lit(verb, 0, db_vlen(verb), "reseed" as *u8) == 1 {
      let lk9: i64 = db_lock(prefix)
      if lk9 < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q9: *u8 = sys_mmap(DB_CAP)
      let f9: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n9: i64 = sts_load_honest(prefix, q9, DB_CAP, f9)
      if f9[2] > 0 { db_werr("DEBT-RESEED REFUSED: rows are reachable BEYOND the declared q:n -- re-seeding would ORPHAN them. This is data loss, not an over-declaration. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      if f9[1] >= f9[0] { db_werr("DEBT-RESEED REFUSED: the plane is already consistent (loaded >= declared); reseed is a REPAIR path, not a write path. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      let m9: *u8 = sys_mmap(DB_MSGCAP)
      var o9: i64 = db_cat(m9, 0, "DEBT-RESEED repairing over-declaration: declared_qn=" as *u8)
      o9 = db_catn(m9, o9, f9[0])
      o9 = db_cat(m9, o9, " loaded=" as *u8)
      o9 = db_catn(m9, o9, f9[1])
      o9 = db_cat(m9, o9, " -- re-seeding from the reachable rows\n" as *u8)
      sys_write(1, m9, o9)
      let c9: i64 = sts_seed(prefix, q9, n9)
      if c9 < 0 { db_werr("DEBT-RESEED FAILED: commit error; plane unchanged\n" as *u8); sys_exit(1); return 1 }
      var p9: i64 = db_cat(m9, 0, "DEBT-RESEED OK rows=" as *u8)
      p9 = db_catn(m9, p9, c9)
      p9 = db_cat(m9, p9, " (declared count now equals the true count; writes unblocked)\n" as *u8)
      sys_write(1, m9, p9)
      sys_exit(0)
      return 0
  }
325
  if db_span_lit(verb, 0, db_vlen(verb), "add" as *u8) == 1 {
      if argc < 5 { db_werr("add needs <sev> <scope> <desc>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 5 { prefix = db_take_prefix(argv[5] as *u8) }
      let sev: *u8 = argv[2] as *u8
      if db_vlen(sev) != 1 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      let sc: i64 = sev[0] as i64
      if sc < 49 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      if sc > 57 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      let scope: *u8 = argv[3] as *u8
      let desc: *u8 = argv[4] as *u8
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      // FAIL-CLOSED GUARD (2026-07-25): add/eat REWRITE THE WHOLE PLANE from this buffer via
      // sts_seed. If the load is PARTIAL that rewrite drops every row past the declared q:n --
      // ~609 rows on the live debt- plane. Refuse instead: commit NOTHING when rows are unreachable.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and add/eat re-seed the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n ON TWO CONSECUTIVE READS (the re-read already ruled out a mid-commit sibling), so this is a real prior-writer drop -- the STS_WCAP ceiling class. Committing would BAKE the loss into the next generation. NOTHING COMMITTED. VERIFY BEFORE BELIEVING IT: run nx_plane_repair <prefix> with NO confirm -- it reads with a 32MiB buffer and will say NOTHING TO REPAIR if the plane is actually intact.\n" as *u8); sys_exit(1); return 1 }
      // CONTENT-IDEMPOTENT (DEC014 mechanized). A transport error is a LOST RESPONSE, not a refused
      // request, so a caller that retries a seemingly-failed add must NOT create a second row.
      // PROVEN NEED: seq332/333/334 are the SAME edge-availability finding filed THREE times 11
      // seconds apart. An exact-desc match is therefore a NO-OP naming the existing row, not an error.
      // CANONICAL FORM SHARED BY COMPARATOR AND WRITER (2026-08-06). ROOT CAUSE OF A DEAD DEDUP:
      // the writer appended "  CLOSURE=UNSPECIFIED" (21 bytes) to the stored row AFTER this scan had
      // already compared the RAW desc, and db_tail_eq rejects on ANY length mismatch -- so a stored row
      // could NEVER equal the incoming text, and content-idempotence was silently dead for every filer
      // that omits CLOSURE=, i.e. every zero-Claude autofiler.
      // MEASURED 2026-08-06: 152 byte-identical netobs-beat rows on the live plane, each one asserting
      // "this row re-files as DUPLICATE-SKIPPED". PROVEN BOTH WAYS before the fix: a desc WITHOUT
      // CLOSURE= filed twice -> TWO rows; the same desc WITH CLOSURE= filed twice -> DUPLICATE-SKIPPED.
      // One variable, opposite outcomes.
      // ★A COMPARATOR AND A WRITER THAT DISAGREE ABOUT THE CANONICAL FORM OF A RECORD NEVER CONVERGE.
      // Both paths now consume THIS buffer, so they cannot drift apart again BY CONSTRUCTION.
      let cdesc: *u8 = sys_mmap(DB_DESCCAP)
      let cdvl: i64 = db_vlen(desc)
      if cdvl > DB_DESCCAP - 64 { db_werr("DEBT-FAIL desc exceeds DB_DESCCAP -- REFUSED rather than truncated, because a silently shortened desc would defeat the content-idempotent dedup and re-file forever. Shorten the desc or raise DB_DESCCAP deliberately.\n" as *u8); sys_exit(1); return 1 }
      var cdo: i64 = db_cat(cdesc, 0, desc)
      if db_find_sub(desc, cdvl, "CLOSURE=" as *u8) < 0 { cdo = db_cat(cdesc, cdo, "  CLOSURE=UNSPECIFIED" as *u8) }
      let dc: *i64 = sys_mmap(DB_SPAN) as *i64
      let dc3: *i64 = sys_mmap(DB_SPAN) as *i64
      var dupidx: i64 = 0 - 1
      var drow: i64 = 0
      var di: i64 = 0
      while di < n {
          let dle: i64 = db_le(q, di, n)
          if dle > di {
              // 2026-07-29 seq1271: dedup ONLY against OPEN rows. Matching rows of ANY status meant a
              // recurrence of an EATEN debt could never re-file (alarm beats had to carry day-bucket
              // workarounds in their descs). The original intent -- a retry after a transport flake must
              // not double-file -- only ever concerns the just-added OPEN row.
              if db_col(q, di, dle, 4, dc) == 1 { if db_tail_eq(q, dc[0], dle, cdesc) == 1 {
                  if db_col(q, di, dle, 3, dc3) == 1 { if db_span_lit(q, dc3[0], dc3[1], "open" as *u8) == 1 { if dupidx < 0 { dupidx = drow } } }
              } }
              drow = drow + 1
          }
          di = dle + 1
      }
      if dupidx >= 0 {
          let dm: *u8 = sys_mmap(DB_MSGCAP)
          var dmo: i64 = db_cat(dm, 0, "DEBT-DUPLICATE-SKIPPED existing_idx=" as *u8)
          dmo = db_catn(dm, dmo, dupidx)
          dmo = db_cat(dm, dmo, " -- identical desc already filed; add is CONTENT-IDEMPOTENT so a retry after a transport flake is a NO-OP\n" as *u8)
          sys_write(1, dm, dmo)
          sys_exit(0)
          return 0
      }
      let out: *u8 = sys_mmap(DB_CAP)
      var o: i64 = 0
      // 2026-07-31: DO NOT COPY THE WHOLE PLANE IN ORDER TO APPEND ONE ROW.
      // This loop copied all n bytes of the loaded plane into `out` one byte at a time -- ~2.9MB and
      // ~2.9M loop iterations on the live ledger -- and then sts_append_fast below was handed ONLY the
      // new tail (out+n, o-n-1). The copy was DEAD WORK for the append path: nothing downstream reads
      // out[0..n) except db_open_count, which can count the already-loaded `q` instead and add 1 for
      // the row being filed (it is always written `open`).
      // MEASURED BEFORE THIS CHANGE, on a ~2380-row plane: add=5963ms, eat=1590ms, show=98ms -- the
      // supposedly O(1) append was the SLOWEST verb in the tool, and every seat paid ~6s per filing.
      // The seq724 comment below is still true (the WRITE is 47 bytes) -- the cost was never the write.
      // The row is now built at out[0..], so the append is handed out[0..o-1).
      // NOTE the remaining full-plane passes are DELIBERATELY left alone: the dedup scan and the
      // id-probe both genuinely need to read every row, and removing a correctness guard to win
      // latency is the trade this lane exists to refuse. This change removes only work that had no
      // reader at all.
      // AN ID THAT COLLIDES IS NOT AN IDENTITY (measured 2026-07-31). seq1539 correctly retired the
      // POSITIONAL seq because a re-seed made it address a different row -- and replaced it with an
      // epoch that is unique only to ONE SECOND. Two adds inside the same second (a parallel or
      // scripted filing, which is the normal case) get the SAME "STABLE" id; `eat` then fails closed
      // on BOTH, so the tool hands back a close instruction that is guaranteed to fail and the rows
      // become unclosable except by the positional index seq1539 exists to warn against. Proven live:
      // two adds seconds apart both returned id=1785503735, and `show` reported the ambiguity.
      // FIX AT THE SOURCE: while still holding the lock, probe forward to the first id no row uses.
      // The id stays an integer written INTO the row (so it cannot drift) and now genuinely IDENTIFIES
      // one. A bump of a few seconds is irrelevant as a timestamp and preserves ordering.
      var now: i64 = sys_now_realtime_sec()
      let idb: *u8 = sys_mmap(64)
      let cc: *i64 = sys_mmap(DB_SPAN) as *i64
      var probe: i64 = 0
      var freeid: i64 = 0
      while freeid == 0 {
          let ln: i64 = db_catn(idb, 0, now)
          idb[ln] = 0 as u8
          var taken: i64 = 0
          var sc: i64 = 0
          while sc < n {
              let sl: i64 = db_le(q, sc, n)
              if db_col(q, sc, sl, 0, cc) == 1 {
                  if db_span_lit(q, cc[0], cc[1], idb) == 1 { taken = 1 }
              }
              sc = sl + 1
          }
          if taken == 0 { freeid = 1 } else {
              now = now + 1
              probe = probe + 1
              if probe > DB_ID_MAXPROBE { db_werr("DEBT-FAIL cannot allocate a unique id\n" as *u8); sys_exit(1); return 1 }
          }
      }
      o = db_catn(out, o, now)
      out[o] = DB_TAB as u8
      o = o + 1
      out[o] = sev[0]
      o = o + 1
      out[o] = DB_TAB as u8
      o = o + 1
      o = db_cat(out, o, scope)
      out[o] = DB_TAB as u8
      o = o + 1
      o = db_cat(out, o, "open" as *u8)
      out[o] = DB_TAB as u8
      o = o + 1
      // INVERT THE DEFAULT (see db_find_sub above): stamp an explicit closure field when the filer gave
      // none, so "no criterion" is a VALUE in the row rather than something a reader must infer from prose.
      // 2026-08-06: that stamping now happens EXACTLY ONCE, into cdesc, BEFORE the dedup scan. The bytes
      // committed here are therefore byte-identical to the text the comparator matched against. Re-deriving
      // the suffix at this point (the old shape) is what silently killed content-idempotence for 152 rows.
      o = db_cat(out, o, cdesc)
      out[o] = DB_NL as u8
      o = o + 1
      // O(1) APPEND (2026-07-30, seq724 fix). Was sts_seed(prefix,out,o) which REWRITES THE WHOLE PLANE
      // -- 1.4MB of disk writes to file one row. The new row is out[n..o-1] (out[0..n) is the loaded plane,
      // out[o-1] is the trailing newline), so only those bytes need committing. Measured on a 2000-row
      // plane: 47 bytes written instead of 210969. EVERY GUARD ABOVE IS UNCHANGED -- db_load_guarded, the
      // partial-load refusal, the lossy refusal and the content-idempotent dedup all still run, because
      // dedup genuinely needs the full read. ONLY THE WRITE CHANGED. Two defect classes die BY
      // CONSTRUCTION: a partial load can no longer drop rows (nothing is rewritten), and ordinals no
      // longer shift (a re-seed RE-SEGMENTS rows; an append touches no existing key). NOTE the eat path
      // below KEEPS sts_seed on purpose -- it MODIFIES an existing row and must rewrite.
      let cnt: i64 = sts_append_fast(prefix, out, o - 1)
      if cnt < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      // `out` now holds ONLY the new row, so the open tally comes from the loaded plane `q` plus the
      // row just filed (it is always written `open`). The eat path below still counts `out` because
      // there `out` genuinely IS the whole rewritten plane.
      let k: i64 = db_open_count(q, n) + 1
      let m: *u8 = sys_mmap(DB_MSGCAP)
      // seq1539 -- HAND BACK A STABLE HANDLE. `seq` is cnt-1: a ROW ORDINAL, not an identity. A re-seed
      // that RE-SEGMENTS rows (any row containing a newline splits) shifts every ordinal after it, so a
      // seq issued before the re-seed silently addresses a DIFFERENT row afterwards -- that is exactly how
      // `nx_debt eat <seq>` closed another lane's row today. The epoch in col0 is the row's real identity:
      // it is written INTO the row, so it cannot drift. Echo it FIRST and name it `id`, and label seq as
      // what it is, so the obvious copy-paste closes the right row.
      var mo: i64 = db_cat(m, 0, "DEBT-ADDED id=" as *u8)
      mo = db_catn(m, mo, now)
      mo = db_cat(m, mo, " (STABLE -- close with: nx_debt eat " as *u8)
      mo = db_catn(m, mo, now)
      mo = db_cat(m, mo, ") seq=" as *u8)
      mo = db_catn(m, mo, cnt - 1)
      mo = db_cat(m, mo, " (POSITIONAL -- shifts on re-seed, do NOT close by this) open=" as *u8)
      mo = db_catn(m, mo, k)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      sys_exit(0)
      return 0
  }
  // ---- dedup: CONSOLIDATE byte-identical OPEN rows (2026-08-06) -------------------------------
  // WHY THIS EXISTS: `add` is content-idempotent, but that guard was DEAD for every filer that omits
  // CLOSURE= (the writer stamped the closure field AFTER the comparator ran -- root-caused and fixed
  // above). While it was dead, zero-Claude autofilers piled up byte-identical rows: 152 netobs-beat
  // rows on the live plane, ~11% of gating[open,sev>=6]. The add-path fix stops the BLEEDING; this
  // verb cleans the WOUND.
  // ★A FIX THAT STOPS NEW DUPLICATES DOES NOT REMOVE THE OLD ONES -- THE BACKLOG IS ITS OWN TASK.
  // SAFE BY CONSTRUCTION: DRY-RUN unless argv[2]=="apply"; only ever flips status open->eaten (rule 13
  // soft-delete -- no row is ever removed and the text survives verbatim); ALWAYS keeps the EARLIEST
  // row of each group so a group can never be fully closed; ONE sts_seed commits, so N closures cost
  // ONE plane rewrite instead of N (151 sequential eats would rewrite the whole plane 151 times).
  if db_span_lit(verb, 0, db_vlen(verb), "dedup" as *u8) == 1 {
      var apply: i64 = 0
      if argc > 2 { if db_span_lit(argv[2] as *u8, 0, db_vlen(argv[2] as *u8), "apply" as *u8) == 1 { apply = 1 } }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and dedup re-seeds the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n on two consecutive reads. Committing would BAKE the loss in. NOTHING COMMITTED. Verify with nx_plane_repair <prefix> and NO confirm.\n" as *u8); sys_exit(1); return 1 }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let hs: *i64 = sys_mmap(DB_ROWMAX * 8) as *i64
      let dss: *i64 = sys_mmap(DB_ROWMAX * 8) as *i64
      let dee: *i64 = sys_mmap(DB_ROWMAX * 8) as *i64
      let opn: *i64 = sys_mmap(DB_ROWMAX * 8) as *i64
      let dupf: *i64 = sys_mmap(DB_ROWMAX * 8) as *i64
      let k3: *i64 = sys_mmap(DB_SPAN) as *i64
      let k4: *i64 = sys_mmap(DB_SPAN) as *i64
      var rows: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          if le > i {
              if rows >= DB_ROWMAX { db_werr("DEBT-REFUSED plane exceeds DB_ROWMAX -- REFUSED rather than deduping a PREFIX of the plane, because a partial sweep reports clean while duplicates remain behind it. Raise DB_ROWMAX deliberately.\n" as *u8); sys_exit(1); return 1 }
              var isop: i64 = 0
              if db_col(q, i, le, 3, k3) == 1 { if db_span_lit(q, k3[0], k3[1], "open" as *u8) == 1 { isop = 1 } }
              var s0: i64 = i
              if db_col(q, i, le, 4, k4) == 1 { s0 = k4[0] }
              // desc is the LAST column and may itself contain tabs, so its span runs to the LINE END --
              // exactly the span `add`'s comparator uses (db_tail_eq(q, dc[0], dle, ...)). Using db_col's
              // own column end here would compare a TRUNCATED desc and merge rows that merely share a
              // prefix -- a consolidator that over-matches destroys distinct findings.
              var hv: i64 = DB_MAGIC_1469598103934665603
              var t: i64 = s0
              while t < le { hv = hv ^ (q[t] as i64); hv = hv * DB_MAGIC_1099511628211; t = t + 1 }
              hs[rows] = hv
              dss[rows] = s0
              dee[rows] = le
              opn[rows] = isop
              dupf[rows] = 0
              rows = rows + 1
          }
          i = le + 1
      }
      var groups: i64 = 0
      var marked: i64 = 0
      var a: i64 = 0
      while a < rows {
          if opn[a] == 1 { if dupf[a] == 0 {
              var found: i64 = 0
              let la: i64 = dee[a] - dss[a]
              var b: i64 = a + 1
              while b < rows {
                  if opn[b] == 1 { if dupf[b] == 0 { if hs[b] == hs[a] { if dee[b] - dss[b] == la {
                      // hash+length are only a PREFILTER; the commit decision is a full byte compare.
                      var same: i64 = 1
                      var u: i64 = 0
                      while u < la { if q[dss[a] + u] != q[dss[b] + u] { same = 0; u = la } else { u = u + 1 } }
                      if same == 1 { dupf[b] = 1; marked = marked + 1; found = 1 }
                  } } } }
                  b = b + 1
              }
              if found == 1 { groups = groups + 1 }
          } }
          a = a + 1
      }
      let m: *u8 = sys_mmap(DB_MSGCAP)
      var mo: i64 = 0
      if apply == 0 {
          mo = db_cat(m, 0, "DEBT-DEDUP DRY-RUN rows=" as *u8)
          mo = db_catn(m, mo, rows)
          mo = db_cat(m, mo, " groups=" as *u8)
          mo = db_catn(m, mo, groups)
          mo = db_cat(m, mo, " would_eat=" as *u8)
          mo = db_catn(m, mo, marked)
          mo = db_cat(m, mo, " (earliest row of every group is KEPT open; NOTHING COMMITTED) -- apply with: nx_debt dedup apply [prefix]\n" as *u8)
          sys_write(1, m, mo)
          sys_exit(0)
          return 0
      }
      let out: *u8 = sys_mmap(DB_CAP)
      var o: i64 = 0
      var r2: i64 = 0
      var i2: i64 = 0
      while i2 < n {
          let le2: i64 = db_le(q, i2, n)
          var sub: i64 = 0
          if le2 > i2 { if dupf[r2] == 1 { if db_col(q, i2, le2, 3, k3) == 1 { sub = 1 } } }
          if sub == 1 {
              var t4: i64 = i2
              while t4 < k3[0] { out[o] = q[t4]; o = o + 1; t4 = t4 + 1 }
              o = db_cat(out, o, "eaten" as *u8)
              var t5: i64 = k3[1]
              while t5 < le2 { out[o] = q[t5]; o = o + 1; t5 = t5 + 1 }
          } else {
              var t6: i64 = i2
              while t6 < le2 { out[o] = q[t6]; o = o + 1; t6 = t6 + 1 }
          }
          out[o] = DB_NL as u8
          o = o + 1
          if le2 > i2 { r2 = r2 + 1 }
          i2 = le2 + 1
      }
      let cnt2: i64 = sts_seed(prefix, out, o)
      if cnt2 < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      let kk: i64 = db_open_count(out, o)
      mo = db_cat(m, 0, "DEBT-DEDUP APPLIED groups=" as *u8)
      mo = db_catn(m, mo, groups)
      mo = db_cat(m, mo, " eaten=" as *u8)
      mo = db_catn(m, mo, marked)
      mo = db_cat(m, mo, " rows=" as *u8)
      mo = db_catn(m, mo, cnt2)
      mo = db_cat(m, mo, " open=" as *u8)
      mo = db_catn(m, mo, kk)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "eat" as *u8) == 1 {
      if argc < 3 { db_werr("eat needs <seq>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      // FAIL-CLOSED GUARD (2026-07-25): add/eat REWRITE THE WHOLE PLANE from this buffer via
      // sts_seed. If the load is PARTIAL that rewrite drops every row past the declared q:n --
      // ~609 rows on the live debt- plane. Refuse instead: commit NOTHING when rows are unreachable.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and add/eat re-seed the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n ON TWO CONSECUTIVE READS (the re-read already ruled out a mid-commit sibling), so this is a real prior-writer drop -- the STS_WCAP ceiling class. Committing would BAKE the loss into the next generation. NOTHING COMMITTED. VERIFY BEFORE BELIEVING IT: run nx_plane_repair <prefix> with NO confirm -- it reads with a 32MiB buffer and will say NOTHING TO REPAIR if the plane is actually intact.\n" as *u8); sys_exit(1); return 1 }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let c0: *i64 = sys_mmap(DB_SPAN) as *i64
      var target: i64 = 0 - 1
      var idmatches: i64 = 0
      var ridx: i64 = 0
      var scan: i64 = 0
      while scan < n {
          let sle: i64 = db_le(q, scan, n)
          if db_col(q, scan, sle, 0, c0) == 1 { if db_span_lit(q, c0[0], c0[1], argv[2] as *u8) == 1 { idmatches = idmatches + 1; target = ridx } }
          ridx = ridx + 1
          scan = sle + 1
      }
      if idmatches > 1 { db_werr("DEBT-FAIL ambiguous epoch id matches multiple rows (fail-closed; eat by index instead)\n" as *u8); sys_exit(1); return 1 }
      if idmatches == 0 { target = db_atoi(argv[2] as *u8) }
      let out: *u8 = sys_mmap(DB_CAP)
      let c3: *i64 = sys_mmap(DB_SPAN) as *i64
      var o: i64 = 0
      var idx: i64 = 0
      var hit: i64 = 0
      var already: i64 = 0
      var ea: i64 = 0
      var eb: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var sub: i64 = 0
          if idx == target {
              if db_col(q, i, le, 3, c3) == 1 {
                  if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { sub = 1 } else { already = 1 }
                  hit = 1
                  ea = i
                  eb = le
              }
          }
          if sub == 1 {
              var t: i64 = i
              while t < c3[0] { out[o] = q[t]; o = o + 1; t = t + 1 }
              o = db_cat(out, o, "eaten" as *u8)
              var t2: i64 = c3[1]
              while t2 < le { out[o] = q[t2]; o = o + 1; t2 = t2 + 1 }
          } else {
              var t3: i64 = i
              while t3 < le { out[o] = q[t3]; o = o + 1; t3 = t3 + 1 }
          }
          out[o] = DB_NL as u8
          o = o + 1
          idx = idx + 1
          i = le + 1
      }
      if hit == 0 { db_werr("DEBT-FAIL no row matches epoch-id or index (nothing committed)\n" as *u8); sys_exit(1); return 1 }
      if already == 1 { db_puts("DEBT-EATEN already (idempotent)\n" as *u8); db_puts("ROW: " as *u8); sys_write(1, ((q as i64) + ea) as *u8, eb - ea); sys_write(1, "\n" as *u8, 1); sys_exit(0); return 0 }
      let cnt: i64 = sts_seed(prefix, out, o)
      if cnt < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      let k: i64 = db_open_count(out, o)
      let m: *u8 = sys_mmap(DB_MSGCAP)
      // ★LEAD WITH THE IDENTITY, NOT THE POSITION (seq1539's affordance half). The eat resolved by
      // epoch, but v1 of this line printed "idx=<pos>" FIRST -- so the number an operator copied out
      // of a success message was the one that shifts on the next re-seed. That is how I closed a
      // sibling's row. The stable id leads; the position is labelled as the throwaway it is.
      let ce: *i64 = sys_mmap(DB_SPAN) as *i64
      db_puts("DEBT-EATEN id=" as *u8)
      if db_col(q, ea, eb, 0, ce) == 1 { sys_write(1, ((q as i64) + ce[0]) as *u8, ce[1] - ce[0]) }
      var mo: i64 = db_cat(m, 0, " at_idx=" as *u8)
      mo = db_catn(m, mo, target)
      mo = db_cat(m, mo, " (POSITIONAL -- do NOT reuse) open=" as *u8)
      mo = db_catn(m, mo, k)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      db_puts("ROW: " as *u8)
      sys_write(1, ((q as i64) + ea) as *u8, eb - ea)
      sys_write(1, "\n" as *u8, 1)
      sys_exit(0)
      return 0
  }
  // NOTE (2026-09-02): append progress to a row WITHOUT closing it -- the verb the estate lacked when a lane had addressed
  // a cross-lane debt for ONE domain (measurement-lab order, row 1788360545) and could only choose between eating another
  // lane's row or leaving no trace. Same schema, same readers: the text is appended to the DESC column as
  // " || NOTE <epoch>: <text>", so dashboards keep parsing positionally and `show` prints it. Same fail-closed
  // guards and the same whole-plane re-seed as eat; an exact repeat of the last note is a no-op (idempotent).
  if db_span_lit(verb, 0, db_vlen(verb), "note" as *u8) == 1 {
      if argc < 4 { db_werr("note needs <epoch-id-or-index> <text>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 4 { prefix = db_take_prefix(argv[4] as *u8) }
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and note re-seeds the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n on two consecutive reads. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let c0: *i64 = sys_mmap(DB_SPAN) as *i64
      var target: i64 = 0 - 1
      var idmatches: i64 = 0
      var ridx: i64 = 0
      var scan: i64 = 0
      while scan < n {
          let sle: i64 = db_le(q, scan, n)
          if db_col(q, scan, sle, 0, c0) == 1 { if db_span_lit(q, c0[0], c0[1], argv[2] as *u8) == 1 { idmatches = idmatches + 1; target = ridx } }
          ridx = ridx + 1
          scan = sle + 1
      }
      if idmatches > 1 { db_werr("DEBT-FAIL ambiguous epoch id matches multiple rows (fail-closed; note by index instead)\n" as *u8); sys_exit(1); return 1 }
      if idmatches == 0 { target = db_atoi(argv[2] as *u8) }
      let text: *u8 = argv[3] as *u8
      let out: *u8 = sys_mmap(DB_CAP)
      let c4: *i64 = sys_mmap(DB_SPAN) as *i64
      var o: i64 = 0
      var idx: i64 = 0
      var hit: i64 = 0
      var same: i64 = 0
      var ea: i64 = 0
      var eb: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var sub: i64 = 0
          if idx == target { if db_col(q, i, le, 4, c4) == 1 { sub = 1; hit = 1; ea = i; eb = le } }
          if sub == 1 {
              // idempotent: if the desc already ENDS with this exact text (a retried note after a dropped response), commit nothing new
              let tl: i64 = db_vlen(text)
              if c4[1] - c4[0] >= tl { if db_span_lit(q, c4[1] - tl, c4[1], text) == 1 { same = 1 } }
              var t: i64 = i
              while t < c4[1] { out[o] = q[t]; o = o + 1; t = t + 1 }
              if same == 0 {
                  o = db_cat(out, o, " || NOTE " as *u8)
                  o = db_catn(out, o, sys_now_realtime_sec())
                  o = db_cat(out, o, ": " as *u8)
                  o = db_cat(out, o, text)
              }
              var t2: i64 = c4[1]
              while t2 < le { out[o] = q[t2]; o = o + 1; t2 = t2 + 1 }
          } else {
              var t3: i64 = i
              while t3 < le { out[o] = q[t3]; o = o + 1; t3 = t3 + 1 }
          }
          out[o] = DB_NL as u8
          o = o + 1
          idx = idx + 1
          i = le + 1
      }
      if hit == 0 { db_werr("DEBT-FAIL no row matches epoch-id or index (nothing committed)\n" as *u8); sys_exit(1); return 1 }
      if same == 1 { db_puts("DEBT-NOTED already (idempotent)\n" as *u8); sys_exit(0); return 0 }
      let cnt: i64 = sts_seed(prefix, out, o)
      if cnt < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      let ce: *i64 = sys_mmap(DB_SPAN) as *i64
      db_puts("DEBT-NOTED id=" as *u8)
      if db_col(q, ea, eb, 0, ce) == 1 { sys_write(1, ((q as i64) + ce[0]) as *u8, ce[1] - ce[0]) }
      let m: *u8 = sys_mmap(DB_MSGCAP)
      var mo: i64 = db_cat(m, 0, " at_idx=" as *u8)
      mo = db_catn(m, mo, target)
      mo = db_cat(m, mo, " (POSITIONAL -- do NOT reuse) rows=" as *u8)
      mo = db_catn(m, mo, cnt)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "page" as *u8) == 1 {
      if argc < 4 { db_werr("page needs <offset> <limit>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 4 { prefix = db_take_prefix(argv[4] as *u8) }
      let off: i64 = db_atoi(argv[2] as *u8)
      let lim: i64 = db_atoi(argv[3] as *u8)
      let q: *u8 = sys_mmap(DB_CAP)
      // READ-ONLY VERB: WARN, NEVER REFUSE. The two guards below were copy-pasted here from the
      // add/eat paths -- comment and all -- but `page` COMMITS NOTHING, so "committing would BAKE
      // the loss / NOTHING COMMITTED" was never true of it. The effect was that during any
      // contention window the board became UNREADABLE: the one verb you reach for to diagnose a
      // sick plane exited 1 and printed no rows. Refusing to READ is strictly worse than showing a
      // possibly-incomplete view, because a read cannot damage anything. So surface the anomaly on
      // stderr and STILL PRINT what is reachable. (seq1521/1532)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-WARN partial load: rows are reachable BEYOND the declared q:n. Showing what loaded; this verb commits nothing. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8) }
      if dbf[1] < dbf[0] { db_werr("DEBT-WARN lossy load: loaded fewer rows than the declared q:n on two consecutive reads. Showing what loaded; this verb commits nothing, so it cannot bake the loss. Run nx_plane_repair <prefix> with NO confirm to check whether the plane is actually damaged.\n" as *u8) }
      var idx: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var pr: i64 = 0
          if idx >= off { if shown < lim { pr = 1 } }
          if pr == 1 {
              let m: *u8 = sys_mmap(DB_MSGCAP)
              var o: i64 = db_catn(m, 0, idx)
              m[o] = 32 as u8
              o = o + 1
              sys_write(1, m, o)
              sys_write(1, ((q as i64) + i) as *u8, le - i)
              sys_write(1, "\n" as *u8, 1)
              shown = shown + 1
          }
          idx = idx + 1
          i = le + 1
      }
      let k: i64 = db_open_count(q, n)
      let m2: *u8 = sys_mmap(DB_MSGCAP)
      var o2: i64 = db_cat(m2, 0, "DEBTS-PAGE off=" as *u8)
      o2 = db_catn(m2, o2, off)
      o2 = db_cat(m2, o2, " lim=" as *u8)
      o2 = db_catn(m2, o2, lim)
      o2 = db_cat(m2, o2, " shown=" as *u8)
      o2 = db_catn(m2, o2, shown)
      o2 = db_cat(m2, o2, " total=" as *u8)
      o2 = db_catn(m2, o2, idx)
      o2 = db_cat(m2, o2, " open=" as *u8)
      o2 = db_catn(m2, o2, k)
      m2[o2] = DB_NL as u8
      o2 = o2 + 1
      sys_write(1, m2, o2)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "sev" as *u8) == 1 {
      // sev <minsev> [prefix] -- OPEN rows with sev >= minsev over the WHOLE corpus, in-organ.
      // 2026-07-29: nx_debt_view's 512KB fork-capture went blind past ~734 rows, so its sev hunt
      // silently missed sev-8 rows. The eat-most-important-first pointer must see EVERYTHING;
      // this verb walks the same honest load list/page use -- no fork, no capture cap.
      if argc < 3 { db_werr("sev needs <minsev>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let minsev: i64 = db_atoi(argv[2] as *u8)
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows exist beyond the declared q:n\n" as *u8) }
      let sp: *i64 = sys_mmap(DB_SPAN) as *i64
      let c3: *i64 = sys_mmap(DB_SPAN) as *i64
      var idx: i64 = 0
      var hit: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var ok: i64 = 0
          if db_col(q, i, le, 3, c3) == 1 { if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { ok = 1 } }
          if ok == 1 {
              var sv: i64 = 0
              if db_col(q, i, le, 1, sp) == 1 { if sp[1] - sp[0] == 1 { let c: i64 = q[sp[0]]; if c >= 49 { if c <= 57 { sv = c - 48 } } } }
              if sv >= minsev {
                  hit = hit + 1
                  if shown < 40 {
                      let m: *u8 = sys_mmap(DB_MSGCAP)
                      var o: i64 = db_catn(m, 0, idx)
                      m[o] = 32 as u8
                      o = o + 1
                      sys_write(1, m, o)
                      var rl: i64 = le - i
                      var tr: i64 = 0
                      if rl > 700 { rl = 700; tr = 1 }
                      sys_write(1, ((q as i64) + i) as *u8, rl)
                      if tr == 1 { sys_write(1, "...[ROW-TRUNC-700]" as *u8, 18) }
                      sys_write(1, "\n" as *u8, 1)
                      shown = shown + 1
                  }
              }
          }
          idx = idx + 1
          i = le + 1
      }
      let m3: *u8 = sys_mmap(DB_MSGCAP)
      var o3: i64 = db_cat(m3, 0, "DEBTS-SEV min=" as *u8)
      o3 = db_catn(m3, o3, minsev)
      o3 = db_cat(m3, o3, " matched=" as *u8)
      o3 = db_catn(m3, o3, hit)
      o3 = db_cat(m3, o3, " shown=" as *u8)
      o3 = db_catn(m3, o3, shown)
      o3 = db_cat(m3, o3, " total=" as *u8)
      o3 = db_catn(m3, o3, idx)
      o3 = db_cat(m3, o3, " cap-40-shown row-trunc-700" as *u8)
      m3[o3] = DB_NL as u8
      o3 = o3 + 1
      sys_write(1, m3, o3)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "find" as *u8) == 1 {
      // find <substr> [prefix] -- any-status substring scan over the WHOLE corpus, in-organ (same
      // rationale as sev: the fork-captured view was blind past ~734 rows).
      if argc < 3 { db_werr("find needs <substr>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let pat: *u8 = argv[2] as *u8
      var pl: i64 = 0
      while pat[pl] != (0 as u8) { pl = pl + 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows exist beyond the declared q:n\n" as *u8) }
      var idx: i64 = 0
      var hit: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var mth: i64 = 0
          if pl > 0 {
              var j: i64 = i
              while j + pl <= le {
                  var k2: i64 = 0
                  var eq: i64 = 1
                  while k2 < pl { if q[j + k2] != pat[k2] { eq = 0; k2 = pl } else { k2 = k2 + 1 } }
                  if eq == 1 { mth = 1; j = le } else { j = j + 1 }
              }
          }
          if mth == 1 {
              hit = hit + 1
              if shown < 40 {
                  let m: *u8 = sys_mmap(DB_MSGCAP)
                  var o: i64 = db_catn(m, 0, idx)
                  m[o] = 32 as u8
                  o = o + 1
                  sys_write(1, m, o)
                  var rl: i64 = le - i
                  var tr: i64 = 0
                  if rl > 700 { rl = 700; tr = 1 }
                  sys_write(1, ((q as i64) + i) as *u8, rl)
                  if tr == 1 { sys_write(1, "...[ROW-TRUNC-700]" as *u8, 18) }
                  sys_write(1, "\n" as *u8, 1)
                  shown = shown + 1
              }
          }
          idx = idx + 1
          i = le + 1
      }
      let m4: *u8 = sys_mmap(DB_MSGCAP)
      var o4: i64 = db_cat(m4, 0, "DEBTS-FIND matched=" as *u8)
      o4 = db_catn(m4, o4, hit)
      o4 = db_cat(m4, o4, " shown=" as *u8)
      o4 = db_catn(m4, o4, shown)
      o4 = db_cat(m4, o4, " total=" as *u8)
      o4 = db_catn(m4, o4, idx)
      o4 = db_cat(m4, o4, " cap-40-shown row-trunc-700" as *u8)
      m4[o4] = DB_NL as u8
      o4 = o4 + 1
      sys_write(1, m4, o4)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "show" as *u8) == 1 {
      if argc < 3 { db_werr("show needs <epoch-id-or-index>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let q: *u8 = sys_mmap(DB_CAP)
      // READ-ONLY VERB: WARN, NEVER REFUSE -- `show` commits nothing, so the write-path refusal that
      // was copy-pasted here (comment and all) could only ever HIDE the row you asked to read.
      // (seq1521/1532)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-WARN partial load: rows are reachable BEYOND the declared q:n. Showing anyway; this verb commits nothing.\n" as *u8) }
      if dbf[1] < dbf[0] { db_werr("DEBT-WARN lossy load: loaded fewer rows than the declared q:n on two consecutive reads. Showing anyway; this verb commits nothing. Run nx_plane_repair <prefix> with NO confirm to check for real damage.\n" as *u8) }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let c0: *i64 = sys_mmap(DB_SPAN) as *i64
      var target: i64 = 0 - 1
      var idmatches: i64 = 0
      var ridx: i64 = 0
      var scan: i64 = 0
      while scan < n {
          let sle: i64 = db_le(q, scan, n)
          if db_col(q, scan, sle, 0, c0) == 1 { if db_span_lit(q, c0[0], c0[1], argv[2] as *u8) == 1 { idmatches = idmatches + 1; target = ridx } }
          ridx = ridx + 1
          scan = sle + 1
      }
      if idmatches == 0 { target = db_atoi(argv[2] as *u8) }
      var idx: i64 = 0
      var hit: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          if idx == target {
              hit = 1
              let m: *u8 = sys_mmap(DB_MSGCAP)
              var o: i64 = db_cat(m, 0, "ROW idx=" as *u8)
              o = db_catn(m, o, idx)
              m[o] = 32 as u8
              o = o + 1
              sys_write(1, m, o)
              sys_write(1, ((q as i64) + i) as *u8, le - i)
              sys_write(1, "\n" as *u8, 1)
          }
          idx = idx + 1
          i = le + 1
      }
      if idmatches > 1 { db_puts("NOTE: epoch id ambiguous (multiple rows); showed LAST match; eat would REFUSE\n" as *u8) }
      if hit == 0 { db_werr("DEBT-FAIL no row matches\n" as *u8); sys_exit(1); return 1 }
      sys_exit(0)
      return 0
  }
  db_werr("usage: nx_debt {add <sev> <scope> <desc> | eat <epoch-id-or-index> | note <epoch-id-or-index> <text> | show <epoch-id-or-index> | page <off> <lim> | list} [prefix]\n" as *u8)
  sys_exit(DB_EXIT_USAGE)
  return DB_EXIT_USAGE
1034}
nx_debt.nx source

`nx_debt.nx` source
