`nx_debt.nx` source

↩ module page · 744 lines · 41037 B
1// nx_debt.nx -- debt-store intake CLI (autonomous-loop design-of-record 2026-07-18, R1).
2// knowledge/store/debt- rows appended by judges/sessions; nx_ws_cycle REFUSES to emit WORK while
3// an open row exists (eat-debt-first mechanized). Row: <epoch>\t<sev1-9>\t<scope>\t<open|eaten>\t<desc>
4//   nx_debt add <sev> <scope> <desc> [prefix]
5//   nx_debt eat <epoch-id-or-index> [prefix]  (epoch col0 exact-match FIRST, index fallback; echoes the row; idempotent)
6//   nx_debt show <epoch-id-or-index> [prefix]  (read-before-eat: echo one row, no mutation)
7//   nx_debt page <offset> <limit> [prefix]     (64KB-safe paged list w/ declared envelope)
8//   nx_debt list [prefix]
9// Fail-closed: bad sev / out-of-range seq commit NOTHING. flock on <prefix>plock.
10// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
11import "nx_store_seed_lib.nx"
12import "nx_seg_store.nx"
13import "nx_syscalls.nx"
14
15const DB_CAP: i64 = 4194304   // 2026-07-29: was 1MB; the plane passed 850KB (~1219 rows, +~500/wk) -- the NEXT silent ceiling was weeks out (re-probe-the-new-boundary law)
16const DB_TAB: i64 = 9
17const DB_NL: i64 = 10
18const DB_STDERR: i64 = 2
19const DB_LOCK_EX: i64 = 2
20const DB_MODE: i64 = 420
21const DB_SPAN: i64 = 16
22const DB_PATHCAP: i64 = 256
23const DB_MSGCAP: i64 = 512
24
25// Pause before the confirming re-read. Long enough for a sibling's sts_seed generation to land, short
26// enough that a genuine refusal is still prompt.
27const DB_RACE_REREAD_MS: i64 = 250
28
29// A "lossy load" verdict has TWO possible causes and the old guard asserted the wrong one AS FACT:
30//   (a) a prior writer really dropped rows -- STABLE, it is still there on the next read; or
31//   (b) A SIBLING IS MID-COMMIT RIGHT NOW -- sts_seed bumps the declared q:n and THEN re-seeds the
32//       plane, so a reader landing inside that window sees a bumped counter with rows not yet visible.
33// MEASURED 2026-07-30 (seq1521): four consecutive refusals on the debt- plane while nx_plane_repair
34// read the SAME plane as fully self-consistent (declared 1510 / found 1510 / beyond 0) and the
35// identical add then SUCCEEDED. declared_qn had moved 1495 -> 1510 between two probes because three
36// sibling workstreams were writing continuously. No data was ever lost.
37//
38// A REAL LOSS DOES NOT HEAL; A RACE DOES. So re-read ONCE and let the plane settle the question.
39// This does NOT relax the guard: if the second read still reports fewer rows than declared, the caller
40// refuses exactly as before. Baking a truncated read back into the plane remains the catastrophe this
41// exists to prevent -- we are removing a FALSE alarm, not the alarm.
42// How far to probe for a free id before refusing. Each probe is one full-plane scan, so this bounds the
43// worst case rather than expressing a policy -- a filing burst deep enough to exhaust it is itself the
44// thing worth refusing over.
45const DB_ID_MAXPROBE: i64 = 4096
46
47func db_load_guarded(prefix: *u8, q: *u8, dbf: *i64) -> i64 {
  var n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
  if dbf[1] < dbf[0] {
      sys_sleep_ms(DB_RACE_REREAD_MS)
      n = sts_load_honest(prefix, q, DB_CAP, dbf)
  }
  return n
54}
55const DB_EXIT_USAGE: i64 = 2
56
57func db_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
58func db_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(DB_STDERR, s, n); return 0 }
59func db_vlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
60func db_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o] = s[i]; o = o + 1; i = i + 1 } return o }
61func db_catn(d: *u8, o: i64, v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 } var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { d[o] = t[k-1-i]; o = o + 1; i = i + 1 } return o }
62func db_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
63func db_le(q: *u8, i: i64, n: i64) -> i64 { var e: i64 = i; var s: i64 = 1; while s == 1 { if e >= n { s = 0 } else { if q[e] == (DB_NL as u8) { s = 0 } else { e = e + 1 } } } return e }
64func db_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 {
  var col: i64 = 0
  var p: i64 = ls
  while col < c {
      var s: i64 = 1
      while s == 1 { if p >= le { return 0 } if q[p] == (DB_TAB as u8) { s = 0 } else { p = p + 1 } }
      p = p + 1
      col = col + 1
  }
  var e: i64 = p
  var s2: i64 = 1
  while s2 == 1 { if e >= le { s2 = 0 } else { if q[e] == (DB_TAB as u8) { s2 = 0 } else { e = e + 1 } } }
  out[0] = p
  out[1] = e
  return 1
79}
80func db_span_lit(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  var i: i64 = 0
  while s + i < e { if lit[i] == (0 as u8) { return 0 } if q[s+i] != lit[i] { return 0 } i = i + 1 }
  if lit[i] != (0 as u8) { return 0 }
  return 1
85}
86// exact-compare q[s..e) against a C-string (used to detect an identical already-filed desc)
87func db_tail_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  let n: i64 = db_vlen(lit)
  if e - s != n { return 0 }
  var i: i64 = 0
  while i < n { if q[s+i] != lit[i] { return 0 } i = i + 1 }
  return 1
93}
94// seq1298: a caller-supplied [prefix] is a STORE PREFIX, not free text -- validate at the intake
95// boundary so a proof-string mistake fails LOUD with the contract, not as a phantom lock failure.
96// Valid: non-empty, fits DB_PATHCAP with room for "plock", ends with '-', chars in [a-z0-9_/-.].
97func db_prefix_ok(a: *u8) -> i64 {
  let n: i64 = db_vlen(a)
  if n < 2 { return 0 }
  if n > DB_PATHCAP - 8 { return 0 }
  if a[n-1] != (45 as u8) { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = a[i] as i64
      var ok: i64 = 0
      if c >= 97 { if c <= 122 { ok = 1 } }
      if c >= 48 { if c <= 57 { ok = 1 } }
      if c == 95 { ok = 1 }
      if c == 47 { ok = 1 }
      if c == 45 { ok = 1 }
      if c == 46 { ok = 1 }
      if ok == 0 { return 0 }
      i = i + 1
  }
  return 1
116}
117func db_take_prefix(a: *u8) -> *u8 {
  if db_prefix_ok(a) == 1 { return a }
  db_werr("DEBT-FAIL bad prefix arg: [prefix] is a STORE PREFIX like knowledge/store/debt- (ends with -, chars [a-z0-9_/-.]) -- NOT free text; eat takes NO proof arg\n" as *u8)
  sys_exit(DB_EXIT_USAGE)
  return a
122}
123func db_lock(prefix: *u8) -> i64 {
  let p: *u8 = sys_mmap(DB_PATHCAP)
  var o: i64 = db_cat(p, 0, prefix)
  o = db_cat(p, o, "plock" as *u8)
  p[o] = 0 as u8
  let fd: i64 = sys_openat_append(p, DB_MODE)
  if fd < 0 {
      // seq1298: name the PATH -- "cannot lock" alone blamed flock when the cause was open-fail
      let m: *u8 = sys_mmap(DB_MSGCAP)
      var mo: i64 = db_cat(m, 0, "DEBT-FAIL lock-file OPEN failed (not flock) path=" as *u8)
      mo = db_cat(m, mo, p)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(DB_STDERR, m, mo)
      return 0 - 1
  }
  sys_flock(fd, DB_LOCK_EX)
  return fd
141}
142// count open rows in a loaded row-buffer
143// ★THE LEDGER MUST BE CLOSEABLE BY CONSTRUCTION, NOT BY PARSING PROSE (2026-07-31).
144// MEASURED THIS SESSION: nx_debtconfirm's rung-5 remainder scan CAUGHT 1785453431 (52 unmigrated seg-store
145// writers) but MISSED 1785445444, which describes the SAME open population in prose containing none of its
146// keywords -- a FALSE CLEAN on an ACTIVE data-loss defect. Widening the keyword list is chasing prose
147// forever; the population of ways to say "not finished" is unbounded.
148// SO INVERT THE DEFAULT: every row carries an explicit machine-readable closure field. A filer who states
149// one keeps it; a filer who states none gets CLOSURE=UNSPECIFIED, which a confirmer reads as PARTIAL and
150// NEVER closes mechanically. Absence of a closure criterion becomes EXPLICIT instead of invisible.
151// Additive (rule 19): existing rows are untouched and every guard above is unchanged.
152func db_find_sub(h: *u8, n: i64, s: *u8) -> i64 {
  var sl: i64 = 0
  while s[sl] != (0 as u8) { sl = sl + 1 }
  var r: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      if i + sl <= n {
          var m: i64 = 1
          var k: i64 = 0
          while k < sl { if h[i+k] != s[k] { m = 0; k = sl } else { k = k + 1 } }
          if m == 1 { r = i; i = n } else { i = i + 1 }
      } else { i = n }
  }
  return r
166}
167
168func db_open_count(q: *u8, n: i64) -> i64 {
  let c3: *i64 = sys_mmap(DB_SPAN) as *i64
  var k: i64 = 0
  var i: i64 = 0
  while i < n {
      let le: i64 = db_le(q, i, n)
      if db_col(q, i, le, 3, c3) == 1 { if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { k = k + 1 } }
      i = le + 1
  }
  return k
178}
179func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { db_werr("usage: nx_debt {add <sev> <scope> <desc> | eat <epoch-id-or-index> | show <epoch-id-or-index> | page <off> <lim> | list} [prefix]\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
  let verb: *u8 = argv[1] as *u8
  var prefix: *u8 = "knowledge/store/debt-" as *u8
  if db_span_lit(verb, 0, db_vlen(verb), "list" as *u8) == 1 {
      if argc > 2 { prefix = db_take_prefix(argv[2] as *u8) }
      let q: *u8 = sys_mmap(DB_CAP)
      // HONEST LOAD (2026-07-25): sts_load stops at the q:n count key with NO signal, so a stale
      // q:n made this verb report total=125 AS FACT while the plane held 734+ rows. sts_load_honest
      // loads IDENTICALLY but also reports declared/loaded/unreachable, so a PARTIAL listing says so.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      var idx: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          let m: *u8 = sys_mmap(DB_MSGCAP)
          var o: i64 = db_catn(m, 0, idx)
          m[o] = 32 as u8
          o = o + 1
          sys_write(1, m, o)
          sys_write(1, ((q as i64) + i) as *u8, le - i)
          sys_write(1, "\n" as *u8, 1)
          idx = idx + 1
          i = le + 1
      }
      let k: i64 = db_open_count(q, n)
      let m2: *u8 = sys_mmap(DB_MSGCAP)
      var o2: i64 = db_cat(m2, 0, "DEBTS total=" as *u8)
      o2 = db_catn(m2, o2, idx)
      o2 = db_cat(m2, o2, " open=" as *u8)
      o2 = db_catn(m2, o2, k)
      o2 = db_cat(m2, o2, " declared_qn=" as *u8)
      o2 = db_catn(m2, o2, dbf[0])
      o2 = db_cat(m2, o2, " loaded=" as *u8)
      o2 = db_catn(m2, o2, dbf[1])
      o2 = db_cat(m2, o2, " unreachable_beyond_qn=" as *u8)
      o2 = db_catn(m2, o2, dbf[2])
      m2[o2] = DB_NL as u8
      o2 = o2 + 1
      sys_write(1, m2, o2)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows are reachable BEYOND the declared q:n; do NOT treat it as the whole corpus, and do NOT run add/eat (they re-seed the plane from this partial buffer)\n" as *u8) }
      sys_exit(0)
      return 0
  }
  // ---------- reseed: THE REPAIR PATH THE FAIL-CLOSED GUARD LACKED ----------
  //
  // ★THE DEADLOCK THIS EXISTS TO BREAK (measured 2026-07-30): a torn write left
  // the plane declaring 1495 rows while holding 1494, so the lossy-load guard
  // refused EVERY add/eat -- correctly, because add/eat re-seed the whole plane
  // and would bake the loss in. But the ONLY way to correct the declared count
  // is a write. **A fail-closed guard with no repair route is not safety, it is
  // a permanent outage** -- and this plane is the ecosystem's coordination
  // ledger, so every lane went read-only with no way back.
  //
  // This verb re-seeds the plane from exactly the rows that ARE reachable, so
  // the declared count becomes the true count. It is EVIDENCE-GATED and can
  // only ever repair an over-declaration:
  //   * REFUSES when rows are reachable BEYOND the declared count -- that is
  //     the orphan case, where re-seeding would genuinely destroy data.
  //   * REFUSES when the plane is already consistent, so it cannot be used as
  //     a routine write path or to paper over a healthy plane.
  // It prints declared/loaded before and the true count after, so the repair is
  // auditable rather than a silent mutation of the SSOT.
  if db_span_lit(verb, 0, db_vlen(verb), "reseed" as *u8) == 1 {
      let lk9: i64 = db_lock(prefix)
      if lk9 < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q9: *u8 = sys_mmap(DB_CAP)
      let f9: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n9: i64 = sts_load_honest(prefix, q9, DB_CAP, f9)
      if f9[2] > 0 { db_werr("DEBT-RESEED REFUSED: rows are reachable BEYOND the declared q:n -- re-seeding would ORPHAN them. This is data loss, not an over-declaration. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      if f9[1] >= f9[0] { db_werr("DEBT-RESEED REFUSED: the plane is already consistent (loaded >= declared); reseed is a REPAIR path, not a write path. NOTHING COMMITTED.\n" as *u8); sys_exit(1); return 1 }
      let m9: *u8 = sys_mmap(DB_MSGCAP)
      var o9: i64 = db_cat(m9, 0, "DEBT-RESEED repairing over-declaration: declared_qn=" as *u8)
      o9 = db_catn(m9, o9, f9[0])
      o9 = db_cat(m9, o9, " loaded=" as *u8)
      o9 = db_catn(m9, o9, f9[1])
      o9 = db_cat(m9, o9, " -- re-seeding from the reachable rows\n" as *u8)
      sys_write(1, m9, o9)
      let c9: i64 = sts_seed(prefix, q9, n9)
      if c9 < 0 { db_werr("DEBT-RESEED FAILED: commit error; plane unchanged\n" as *u8); sys_exit(1); return 1 }
      var p9: i64 = db_cat(m9, 0, "DEBT-RESEED OK rows=" as *u8)
      p9 = db_catn(m9, p9, c9)
      p9 = db_cat(m9, p9, " (declared count now equals the true count; writes unblocked)\n" as *u8)
      sys_write(1, m9, p9)
      sys_exit(0)
      return 0
  }
267
  if db_span_lit(verb, 0, db_vlen(verb), "add" as *u8) == 1 {
      if argc < 5 { db_werr("add needs <sev> <scope> <desc>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 5 { prefix = db_take_prefix(argv[5] as *u8) }
      let sev: *u8 = argv[2] as *u8
      if db_vlen(sev) != 1 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      let sc: i64 = sev[0] as i64
      if sc < 49 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      if sc > 57 { db_werr("DEBT-FAIL sev must be 1..9\n" as *u8); sys_exit(1); return 1 }
      let scope: *u8 = argv[3] as *u8
      let desc: *u8 = argv[4] as *u8
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      // FAIL-CLOSED GUARD (2026-07-25): add/eat REWRITE THE WHOLE PLANE from this buffer via
      // sts_seed. If the load is PARTIAL that rewrite drops every row past the declared q:n --
      // ~609 rows on the live debt- plane. Refuse instead: commit NOTHING when rows are unreachable.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and add/eat re-seed the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n ON TWO CONSECUTIVE READS (the re-read already ruled out a mid-commit sibling), so this is a real prior-writer drop -- the STS_WCAP ceiling class. Committing would BAKE the loss into the next generation. NOTHING COMMITTED. VERIFY BEFORE BELIEVING IT: run nx_plane_repair <prefix> with NO confirm -- it reads with a 32MiB buffer and will say NOTHING TO REPAIR if the plane is actually intact.\n" as *u8); sys_exit(1); return 1 }
      // CONTENT-IDEMPOTENT (DEC014 mechanized). A transport error is a LOST RESPONSE, not a refused
      // request, so a caller that retries a seemingly-failed add must NOT create a second row.
      // PROVEN NEED: seq332/333/334 are the SAME edge-availability finding filed THREE times 11
      // seconds apart. An exact-desc match is therefore a NO-OP naming the existing row, not an error.
      let dc: *i64 = sys_mmap(DB_SPAN) as *i64
      let dc3: *i64 = sys_mmap(DB_SPAN) as *i64
      var dupidx: i64 = 0 - 1
      var drow: i64 = 0
      var di: i64 = 0
      while di < n {
          let dle: i64 = db_le(q, di, n)
          if dle > di {
              // 2026-07-29 seq1271: dedup ONLY against OPEN rows. Matching rows of ANY status meant a
              // recurrence of an EATEN debt could never re-file (alarm beats had to carry day-bucket
              // workarounds in their descs). The original intent -- a retry after a transport flake must
              // not double-file -- only ever concerns the just-added OPEN row.
              if db_col(q, di, dle, 4, dc) == 1 { if db_tail_eq(q, dc[0], dle, desc) == 1 {
                  if db_col(q, di, dle, 3, dc3) == 1 { if db_span_lit(q, dc3[0], dc3[1], "open" as *u8) == 1 { if dupidx < 0 { dupidx = drow } } }
              } }
              drow = drow + 1
          }
          di = dle + 1
      }
      if dupidx >= 0 {
          let dm: *u8 = sys_mmap(DB_MSGCAP)
          var dmo: i64 = db_cat(dm, 0, "DEBT-DUPLICATE-SKIPPED existing_idx=" as *u8)
          dmo = db_catn(dm, dmo, dupidx)
          dmo = db_cat(dm, dmo, " -- identical desc already filed; add is CONTENT-IDEMPOTENT so a retry after a transport flake is a NO-OP\n" as *u8)
          sys_write(1, dm, dmo)
          sys_exit(0)
          return 0
      }
      let out: *u8 = sys_mmap(DB_CAP)
      var o: i64 = 0
      // 2026-07-31: DO NOT COPY THE WHOLE PLANE IN ORDER TO APPEND ONE ROW.
      // This loop copied all n bytes of the loaded plane into `out` one byte at a time -- ~2.9MB and
      // ~2.9M loop iterations on the live ledger -- and then sts_append_fast below was handed ONLY the
      // new tail (out+n, o-n-1). The copy was DEAD WORK for the append path: nothing downstream reads
      // out[0..n) except db_open_count, which can count the already-loaded `q` instead and add 1 for
      // the row being filed (it is always written `open`).
      // MEASURED BEFORE THIS CHANGE, on a ~2380-row plane: add=5963ms, eat=1590ms, show=98ms -- the
      // supposedly O(1) append was the SLOWEST verb in the tool, and every seat paid ~6s per filing.
      // The seq724 comment below is still true (the WRITE is 47 bytes) -- the cost was never the write.
      // The row is now built at out[0..], so the append is handed out[0..o-1).
      // NOTE the remaining full-plane passes are DELIBERATELY left alone: the dedup scan and the
      // id-probe both genuinely need to read every row, and removing a correctness guard to win
      // latency is the trade this lane exists to refuse. This change removes only work that had no
      // reader at all.
      // AN ID THAT COLLIDES IS NOT AN IDENTITY (measured 2026-07-31). seq1539 correctly retired the
      // POSITIONAL seq because a re-seed made it address a different row -- and replaced it with an
      // epoch that is unique only to ONE SECOND. Two adds inside the same second (a parallel or
      // scripted filing, which is the normal case) get the SAME "STABLE" id; `eat` then fails closed
      // on BOTH, so the tool hands back a close instruction that is guaranteed to fail and the rows
      // become unclosable except by the positional index seq1539 exists to warn against. Proven live:
      // two adds seconds apart both returned id=1785503735, and `show` reported the ambiguity.
      // FIX AT THE SOURCE: while still holding the lock, probe forward to the first id no row uses.
      // The id stays an integer written INTO the row (so it cannot drift) and now genuinely IDENTIFIES
      // one. A bump of a few seconds is irrelevant as a timestamp and preserves ordering.
      var now: i64 = sys_now_realtime_sec()
      let idb: *u8 = sys_mmap(64)
      let cc: *i64 = sys_mmap(DB_SPAN) as *i64
      var probe: i64 = 0
      var freeid: i64 = 0
      while freeid == 0 {
          let ln: i64 = db_catn(idb, 0, now)
          idb[ln] = 0 as u8
          var taken: i64 = 0
          var sc: i64 = 0
          while sc < n {
              let sl: i64 = db_le(q, sc, n)
              if db_col(q, sc, sl, 0, cc) == 1 {
                  if db_span_lit(q, cc[0], cc[1], idb) == 1 { taken = 1 }
              }
              sc = sl + 1
          }
          if taken == 0 { freeid = 1 } else {
              now = now + 1
              probe = probe + 1
              if probe > DB_ID_MAXPROBE { db_werr("DEBT-FAIL cannot allocate a unique id\n" as *u8); sys_exit(1); return 1 }
          }
      }
      o = db_catn(out, o, now)
      out[o] = DB_TAB as u8
      o = o + 1
      out[o] = sev[0]
      o = o + 1
      out[o] = DB_TAB as u8
      o = o + 1
      o = db_cat(out, o, scope)
      out[o] = DB_TAB as u8
      o = o + 1
      o = db_cat(out, o, "open" as *u8)
      out[o] = DB_TAB as u8
      o = o + 1
      o = db_cat(out, o, desc)
      // INVERT THE DEFAULT (see db_find_sub above): stamp an explicit closure field when the filer gave
      // none, so "no criterion" is a VALUE in the row rather than something a reader must infer from prose.
      var dl: i64 = 0
      while desc[dl] != (0 as u8) { dl = dl + 1 }
      if db_find_sub(desc, dl, "CLOSURE=" as *u8) < 0 { o = db_cat(out, o, "  CLOSURE=UNSPECIFIED" as *u8) }
      out[o] = DB_NL as u8
      o = o + 1
      // O(1) APPEND (2026-07-30, seq724 fix). Was sts_seed(prefix,out,o) which REWRITES THE WHOLE PLANE
      // -- 1.4MB of disk writes to file one row. The new row is out[n..o-1] (out[0..n) is the loaded plane,
      // out[o-1] is the trailing newline), so only those bytes need committing. Measured on a 2000-row
      // plane: 47 bytes written instead of 210969. EVERY GUARD ABOVE IS UNCHANGED -- db_load_guarded, the
      // partial-load refusal, the lossy refusal and the content-idempotent dedup all still run, because
      // dedup genuinely needs the full read. ONLY THE WRITE CHANGED. Two defect classes die BY
      // CONSTRUCTION: a partial load can no longer drop rows (nothing is rewritten), and ordinals no
      // longer shift (a re-seed RE-SEGMENTS rows; an append touches no existing key). NOTE the eat path
      // below KEEPS sts_seed on purpose -- it MODIFIES an existing row and must rewrite.
      let cnt: i64 = sts_append_fast(prefix, out, o - 1)
      if cnt < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      // `out` now holds ONLY the new row, so the open tally comes from the loaded plane `q` plus the
      // row just filed (it is always written `open`). The eat path below still counts `out` because
      // there `out` genuinely IS the whole rewritten plane.
      let k: i64 = db_open_count(q, n) + 1
      let m: *u8 = sys_mmap(DB_MSGCAP)
      // seq1539 -- HAND BACK A STABLE HANDLE. `seq` is cnt-1: a ROW ORDINAL, not an identity. A re-seed
      // that RE-SEGMENTS rows (any row containing a newline splits) shifts every ordinal after it, so a
      // seq issued before the re-seed silently addresses a DIFFERENT row afterwards -- that is exactly how
      // `nx_debt eat <seq>` closed another lane's row today. The epoch in col0 is the row's real identity:
      // it is written INTO the row, so it cannot drift. Echo it FIRST and name it `id`, and label seq as
      // what it is, so the obvious copy-paste closes the right row.
      var mo: i64 = db_cat(m, 0, "DEBT-ADDED id=" as *u8)
      mo = db_catn(m, mo, now)
      mo = db_cat(m, mo, " (STABLE -- close with: nx_debt eat " as *u8)
      mo = db_catn(m, mo, now)
      mo = db_cat(m, mo, ") seq=" as *u8)
      mo = db_catn(m, mo, cnt - 1)
      mo = db_cat(m, mo, " (POSITIONAL -- shifts on re-seed, do NOT close by this) open=" as *u8)
      mo = db_catn(m, mo, k)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "eat" as *u8) == 1 {
      if argc < 3 { db_werr("eat needs <seq>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let lk: i64 = db_lock(prefix)
      if lk < 0 { db_werr("DEBT-FAIL cannot lock\n" as *u8); sys_exit(1); return 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      // FAIL-CLOSED GUARD (2026-07-25): add/eat REWRITE THE WHOLE PLANE from this buffer via
      // sts_seed. If the load is PARTIAL that rewrite drops every row past the declared q:n --
      // ~609 rows on the live debt- plane. Refuse instead: commit NOTHING when rows are unreachable.
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-REFUSED partial load: rows are reachable BEYOND the declared q:n and add/eat re-seed the WHOLE plane from this buffer, so committing would ORPHAN them. NOTHING COMMITTED. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8); sys_exit(1); return 1 }
      if dbf[1] < dbf[0] { db_werr("DEBT-REFUSED lossy load: loaded FEWER rows than the declared q:n ON TWO CONSECUTIVE READS (the re-read already ruled out a mid-commit sibling), so this is a real prior-writer drop -- the STS_WCAP ceiling class. Committing would BAKE the loss into the next generation. NOTHING COMMITTED. VERIFY BEFORE BELIEVING IT: run nx_plane_repair <prefix> with NO confirm -- it reads with a 32MiB buffer and will say NOTHING TO REPAIR if the plane is actually intact.\n" as *u8); sys_exit(1); return 1 }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let c0: *i64 = sys_mmap(DB_SPAN) as *i64
      var target: i64 = 0 - 1
      var idmatches: i64 = 0
      var ridx: i64 = 0
      var scan: i64 = 0
      while scan < n {
          let sle: i64 = db_le(q, scan, n)
          if db_col(q, scan, sle, 0, c0) == 1 { if db_span_lit(q, c0[0], c0[1], argv[2] as *u8) == 1 { idmatches = idmatches + 1; target = ridx } }
          ridx = ridx + 1
          scan = sle + 1
      }
      if idmatches > 1 { db_werr("DEBT-FAIL ambiguous epoch id matches multiple rows (fail-closed; eat by index instead)\n" as *u8); sys_exit(1); return 1 }
      if idmatches == 0 { target = db_atoi(argv[2] as *u8) }
      let out: *u8 = sys_mmap(DB_CAP)
      let c3: *i64 = sys_mmap(DB_SPAN) as *i64
      var o: i64 = 0
      var idx: i64 = 0
      var hit: i64 = 0
      var already: i64 = 0
      var ea: i64 = 0
      var eb: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var sub: i64 = 0
          if idx == target {
              if db_col(q, i, le, 3, c3) == 1 {
                  if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { sub = 1 } else { already = 1 }
                  hit = 1
                  ea = i
                  eb = le
              }
          }
          if sub == 1 {
              var t: i64 = i
              while t < c3[0] { out[o] = q[t]; o = o + 1; t = t + 1 }
              o = db_cat(out, o, "eaten" as *u8)
              var t2: i64 = c3[1]
              while t2 < le { out[o] = q[t2]; o = o + 1; t2 = t2 + 1 }
          } else {
              var t3: i64 = i
              while t3 < le { out[o] = q[t3]; o = o + 1; t3 = t3 + 1 }
          }
          out[o] = DB_NL as u8
          o = o + 1
          idx = idx + 1
          i = le + 1
      }
      if hit == 0 { db_werr("DEBT-FAIL no row matches epoch-id or index (nothing committed)\n" as *u8); sys_exit(1); return 1 }
      if already == 1 { db_puts("DEBT-EATEN already (idempotent)\n" as *u8); db_puts("ROW: " as *u8); sys_write(1, ((q as i64) + ea) as *u8, eb - ea); sys_write(1, "\n" as *u8, 1); sys_exit(0); return 0 }
      let cnt: i64 = sts_seed(prefix, out, o)
      if cnt < 0 { db_werr("DEBT-FAIL commit error\n" as *u8); sys_exit(1); return 1 }
      let k: i64 = db_open_count(out, o)
      let m: *u8 = sys_mmap(DB_MSGCAP)
      // ★LEAD WITH THE IDENTITY, NOT THE POSITION (seq1539's affordance half). The eat resolved by
      // epoch, but v1 of this line printed "idx=<pos>" FIRST -- so the number an operator copied out
      // of a success message was the one that shifts on the next re-seed. That is how I closed a
      // sibling's row. The stable id leads; the position is labelled as the throwaway it is.
      let ce: *i64 = sys_mmap(DB_SPAN) as *i64
      db_puts("DEBT-EATEN id=" as *u8)
      if db_col(q, ea, eb, 0, ce) == 1 { sys_write(1, ((q as i64) + ce[0]) as *u8, ce[1] - ce[0]) }
      var mo: i64 = db_cat(m, 0, " at_idx=" as *u8)
      mo = db_catn(m, mo, target)
      mo = db_cat(m, mo, " (POSITIONAL -- do NOT reuse) open=" as *u8)
      mo = db_catn(m, mo, k)
      m[mo] = DB_NL as u8
      mo = mo + 1
      sys_write(1, m, mo)
      db_puts("ROW: " as *u8)
      sys_write(1, ((q as i64) + ea) as *u8, eb - ea)
      sys_write(1, "\n" as *u8, 1)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "page" as *u8) == 1 {
      if argc < 4 { db_werr("page needs <offset> <limit>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 4 { prefix = db_take_prefix(argv[4] as *u8) }
      let off: i64 = db_atoi(argv[2] as *u8)
      let lim: i64 = db_atoi(argv[3] as *u8)
      let q: *u8 = sys_mmap(DB_CAP)
      // READ-ONLY VERB: WARN, NEVER REFUSE. The two guards below were copy-pasted here from the
      // add/eat paths -- comment and all -- but `page` COMMITS NOTHING, so "committing would BAKE
      // the loss / NOTHING COMMITTED" was never true of it. The effect was that during any
      // contention window the board became UNREADABLE: the one verb you reach for to diagnose a
      // sick plane exited 1 and printed no rows. Refusing to READ is strictly worse than showing a
      // possibly-incomplete view, because a read cannot damage anything. So surface the anomaly on
      // stderr and STILL PRINT what is reachable. (seq1521/1532)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-WARN partial load: rows are reachable BEYOND the declared q:n. Showing what loaded; this verb commits nothing. Run nx_debt list for declared_qn vs unreachable_beyond_qn.\n" as *u8) }
      if dbf[1] < dbf[0] { db_werr("DEBT-WARN lossy load: loaded fewer rows than the declared q:n on two consecutive reads. Showing what loaded; this verb commits nothing, so it cannot bake the loss. Run nx_plane_repair <prefix> with NO confirm to check whether the plane is actually damaged.\n" as *u8) }
      var idx: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var pr: i64 = 0
          if idx >= off { if shown < lim { pr = 1 } }
          if pr == 1 {
              let m: *u8 = sys_mmap(DB_MSGCAP)
              var o: i64 = db_catn(m, 0, idx)
              m[o] = 32 as u8
              o = o + 1
              sys_write(1, m, o)
              sys_write(1, ((q as i64) + i) as *u8, le - i)
              sys_write(1, "\n" as *u8, 1)
              shown = shown + 1
          }
          idx = idx + 1
          i = le + 1
      }
      let k: i64 = db_open_count(q, n)
      let m2: *u8 = sys_mmap(DB_MSGCAP)
      var o2: i64 = db_cat(m2, 0, "DEBTS-PAGE off=" as *u8)
      o2 = db_catn(m2, o2, off)
      o2 = db_cat(m2, o2, " lim=" as *u8)
      o2 = db_catn(m2, o2, lim)
      o2 = db_cat(m2, o2, " shown=" as *u8)
      o2 = db_catn(m2, o2, shown)
      o2 = db_cat(m2, o2, " total=" as *u8)
      o2 = db_catn(m2, o2, idx)
      o2 = db_cat(m2, o2, " open=" as *u8)
      o2 = db_catn(m2, o2, k)
      m2[o2] = DB_NL as u8
      o2 = o2 + 1
      sys_write(1, m2, o2)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "sev" as *u8) == 1 {
      // sev <minsev> [prefix] -- OPEN rows with sev >= minsev over the WHOLE corpus, in-organ.
      // 2026-07-29: nx_debt_view's 512KB fork-capture went blind past ~734 rows, so its sev hunt
      // silently missed sev-8 rows. The eat-most-important-first pointer must see EVERYTHING;
      // this verb walks the same honest load list/page use -- no fork, no capture cap.
      if argc < 3 { db_werr("sev needs <minsev>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let minsev: i64 = db_atoi(argv[2] as *u8)
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows exist beyond the declared q:n\n" as *u8) }
      let sp: *i64 = sys_mmap(DB_SPAN) as *i64
      let c3: *i64 = sys_mmap(DB_SPAN) as *i64
      var idx: i64 = 0
      var hit: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var ok: i64 = 0
          if db_col(q, i, le, 3, c3) == 1 { if db_span_lit(q, c3[0], c3[1], "open" as *u8) == 1 { ok = 1 } }
          if ok == 1 {
              var sv: i64 = 0
              if db_col(q, i, le, 1, sp) == 1 { if sp[1] - sp[0] == 1 { let c: i64 = q[sp[0]]; if c >= 49 { if c <= 57 { sv = c - 48 } } } }
              if sv >= minsev {
                  hit = hit + 1
                  if shown < 40 {
                      let m: *u8 = sys_mmap(DB_MSGCAP)
                      var o: i64 = db_catn(m, 0, idx)
                      m[o] = 32 as u8
                      o = o + 1
                      sys_write(1, m, o)
                      var rl: i64 = le - i
                      var tr: i64 = 0
                      if rl > 700 { rl = 700; tr = 1 }
                      sys_write(1, ((q as i64) + i) as *u8, rl)
                      if tr == 1 { sys_write(1, "...[ROW-TRUNC-700]" as *u8, 18) }
                      sys_write(1, "\n" as *u8, 1)
                      shown = shown + 1
                  }
              }
          }
          idx = idx + 1
          i = le + 1
      }
      let m3: *u8 = sys_mmap(DB_MSGCAP)
      var o3: i64 = db_cat(m3, 0, "DEBTS-SEV min=" as *u8)
      o3 = db_catn(m3, o3, minsev)
      o3 = db_cat(m3, o3, " matched=" as *u8)
      o3 = db_catn(m3, o3, hit)
      o3 = db_cat(m3, o3, " shown=" as *u8)
      o3 = db_catn(m3, o3, shown)
      o3 = db_cat(m3, o3, " total=" as *u8)
      o3 = db_catn(m3, o3, idx)
      o3 = db_cat(m3, o3, " cap-40-shown row-trunc-700" as *u8)
      m3[o3] = DB_NL as u8
      o3 = o3 + 1
      sys_write(1, m3, o3)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "find" as *u8) == 1 {
      // find <substr> [prefix] -- any-status substring scan over the WHOLE corpus, in-organ (same
      // rationale as sev: the fork-captured view was blind past ~734 rows).
      if argc < 3 { db_werr("find needs <substr>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let pat: *u8 = argv[2] as *u8
      var pl: i64 = 0
      while pat[pl] != (0 as u8) { pl = pl + 1 }
      let q: *u8 = sys_mmap(DB_CAP)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = sts_load_honest(prefix, q, DB_CAP, dbf)
      if dbf[2] > 0 { db_werr("DEBT-TRUNCATED-LOAD this listing is PARTIAL -- rows exist beyond the declared q:n\n" as *u8) }
      var idx: i64 = 0
      var hit: i64 = 0
      var shown: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          var mth: i64 = 0
          if pl > 0 {
              var j: i64 = i
              while j + pl <= le {
                  var k2: i64 = 0
                  var eq: i64 = 1
                  while k2 < pl { if q[j + k2] != pat[k2] { eq = 0; k2 = pl } else { k2 = k2 + 1 } }
                  if eq == 1 { mth = 1; j = le } else { j = j + 1 }
              }
          }
          if mth == 1 {
              hit = hit + 1
              if shown < 40 {
                  let m: *u8 = sys_mmap(DB_MSGCAP)
                  var o: i64 = db_catn(m, 0, idx)
                  m[o] = 32 as u8
                  o = o + 1
                  sys_write(1, m, o)
                  var rl: i64 = le - i
                  var tr: i64 = 0
                  if rl > 700 { rl = 700; tr = 1 }
                  sys_write(1, ((q as i64) + i) as *u8, rl)
                  if tr == 1 { sys_write(1, "...[ROW-TRUNC-700]" as *u8, 18) }
                  sys_write(1, "\n" as *u8, 1)
                  shown = shown + 1
              }
          }
          idx = idx + 1
          i = le + 1
      }
      let m4: *u8 = sys_mmap(DB_MSGCAP)
      var o4: i64 = db_cat(m4, 0, "DEBTS-FIND matched=" as *u8)
      o4 = db_catn(m4, o4, hit)
      o4 = db_cat(m4, o4, " shown=" as *u8)
      o4 = db_catn(m4, o4, shown)
      o4 = db_cat(m4, o4, " total=" as *u8)
      o4 = db_catn(m4, o4, idx)
      o4 = db_cat(m4, o4, " cap-40-shown row-trunc-700" as *u8)
      m4[o4] = DB_NL as u8
      o4 = o4 + 1
      sys_write(1, m4, o4)
      sys_exit(0)
      return 0
  }
  if db_span_lit(verb, 0, db_vlen(verb), "show" as *u8) == 1 {
      if argc < 3 { db_werr("show needs <epoch-id-or-index>\n" as *u8); sys_exit(DB_EXIT_USAGE); return DB_EXIT_USAGE }
      if argc > 3 { prefix = db_take_prefix(argv[3] as *u8) }
      let q: *u8 = sys_mmap(DB_CAP)
      // READ-ONLY VERB: WARN, NEVER REFUSE -- `show` commits nothing, so the write-path refusal that
      // was copy-pasted here (comment and all) could only ever HIDE the row you asked to read.
      // (seq1521/1532)
      let dbf: *i64 = sys_mmap(DB_MSGCAP) as *i64
      let n: i64 = db_load_guarded(prefix, q, dbf)
      if dbf[2] > 0 { db_werr("DEBT-WARN partial load: rows are reachable BEYOND the declared q:n. Showing anyway; this verb commits nothing.\n" as *u8) }
      if dbf[1] < dbf[0] { db_werr("DEBT-WARN lossy load: loaded fewer rows than the declared q:n on two consecutive reads. Showing anyway; this verb commits nothing. Run nx_plane_repair <prefix> with NO confirm to check for real damage.\n" as *u8) }
      if n <= 0 { db_werr("DEBT-FAIL store empty\n" as *u8); sys_exit(1); return 1 }
      let c0: *i64 = sys_mmap(DB_SPAN) as *i64
      var target: i64 = 0 - 1
      var idmatches: i64 = 0
      var ridx: i64 = 0
      var scan: i64 = 0
      while scan < n {
          let sle: i64 = db_le(q, scan, n)
          if db_col(q, scan, sle, 0, c0) == 1 { if db_span_lit(q, c0[0], c0[1], argv[2] as *u8) == 1 { idmatches = idmatches + 1; target = ridx } }
          ridx = ridx + 1
          scan = sle + 1
      }
      if idmatches == 0 { target = db_atoi(argv[2] as *u8) }
      var idx: i64 = 0
      var hit: i64 = 0
      var i: i64 = 0
      while i < n {
          let le: i64 = db_le(q, i, n)
          if idx == target {
              hit = 1
              let m: *u8 = sys_mmap(DB_MSGCAP)
              var o: i64 = db_cat(m, 0, "ROW idx=" as *u8)
              o = db_catn(m, o, idx)
              m[o] = 32 as u8
              o = o + 1
              sys_write(1, m, o)
              sys_write(1, ((q as i64) + i) as *u8, le - i)
              sys_write(1, "\n" as *u8, 1)
          }
          idx = idx + 1
          i = le + 1
      }
      if idmatches > 1 { db_puts("NOTE: epoch id ambiguous (multiple rows); showed LAST match; eat would REFUSE\n" as *u8) }
      if hit == 0 { db_werr("DEBT-FAIL no row matches\n" as *u8); sys_exit(1); return 1 }
      sys_exit(0)
      return 0
  }
  db_werr("usage: nx_debt {add <sev> <scope> <desc> | eat <epoch-id-or-index> | show <epoch-id-or-index> | page <off> <lim> | list} [prefix]\n" as *u8)
  sys_exit(DB_EXIT_USAGE)
  return DB_EXIT_USAGE
744}
nx_debt.nx source

`nx_debt.nx` source
