nx_degmode_gate.nx source
↩ module page · 176 lines · 11519 B
1// nx_degmode_gate.nx -- THE GATE FOR GRACEFUL DEGRADATION, 2026-09-03.
2//
3// SUBJECT: dm_admit / dm_class_of / dm_deferral_state / dm_recover in-process. Pure functions over
4// declared inputs, so this gate is deterministic on any host and never reads the live box -- which
5// matters because the live box is currently IN the degraded state, and a gate that read it could not be
6// told apart from one hardcoded to agree.
7//
8// T4 IS THE POSITIVE CONTROL AND IT IS LOAD-BEARING. T2/T3 assert that work is DEFERRED, and a ladder
9// that deferred everything would pass both. T4 requires every class to be admitted when health is GREEN,
10// so the deny teeth can only pass on a ladder that actually discriminates.
11//
12// T5 IS THE `pr_mode` DEFECT, CAUGHT IN ADVANCE. The live estate has a route table where an
13// unrecognised mode silently returns the PERMISSIVE value, so a mistyped `gated` downgrades a
14// fail-closed route to an open one with no diagnostic. T5 requires an UNDECLARED target to resolve to
15// the LEAST essential class -- the restrictive direction -- and T6 requires that default to be
16// DISTINGUISHABLE from a real declaration, so a caller can say it defaulted rather than silently apply it.
17//
18// T10 IS THE STEADY-STATE GUARD, AND IT IS THE ONE MOST LIKELY TO BE LEFT OUT. A host that was never
19// degraded produces an all-GREEN sample window; a recovery detector that fires on that would re-arm
20// something that never went down. Requiring evidence of a prior fault is what makes the edge an EDGE.
21//
22// T11 IS THE FLAP GUARD, WHICH THE ESTATE'S OWN RECORD DEMANDS: in the Oct-2025 us-east-1 event, health
23// checks alternating between failing and healthy drove automatic failover that removed HEALTHY capacity,
24// and the fix that worked was disabling the automation. An alternating window must NOT read as recovered.
25//
26// Teeth, in order:
27// T1 RED admits E1 restore-capability work -- the whole point of not grounding.
28// T2 RED defers E3 bulk work.
29// T3 AMBER admits E2 but defers E3, so the ladder has three distinct behaviours and not two.
30// T4 POSITIVE CONTROL: GREEN admits every class.
31// T5 an UNDECLARED target resolves to the LEAST essential class, never the permissive one.
32// T6 the undeclared default is DISTINGUISHABLE from a declaration (0 vs a real class).
33// T7 a declared class is read exactly, and an exact-name rule does not leak across a prefix.
34// T8 UNOBSERVABLE ABSTAINS FROM TIGHTENING: it admits every class rather than blocking a host that
35// simply has no such cache. The caller's load bar is untouched and still applies.
36// T9 the MEL clock: within the category it is LIVE, past it EXPIRED, and category A is UNSET.
37// T10 STEADY-STATE GUARD: an all-clear window with no prior fault is NOT a recovery.
38// T11 FLAP GUARD: an alternating window is NOT a recovery.
39// T12 the empty-set denominator: too few samples cannot answer the question at all.
40// T13 ANTI-VACUITY: a genuine RED-then-clear edge DOES recover, so T10-T12 are not passing on a
41// detector that always refuses.
42//
43// MEASURED 13/13 GREEN 2026-09-03. T7 EARNED ITS PLACE ON THE FIRST RUN: it caught a real parser defect
44// where the row marker was tested with a helper that demands a field terminator, so NO row ever matched
45// and every lookup fell through to the undeclared default. Because that default is E3, the failure was
46// SILENT AND SAFE-LOOKING -- everything simply became least-essential.
47// BITE: the harness returned INCONCLUSIVE for a NAMED reason (the laptop nx_gate_bite runs only
48// operators 1/2a/2b, and its 14 comparison sites never reached dm_admit's decision line). The bite was
49// therefore done BY HAND: planting the ground-stop-removal defect -- RED admits every class -- took this
50// gate 13/13 GREEN to 11/13 RED, exactly two teeth, restore byte-identical by cmp.
51// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
52import "nx_syscalls.nx"
53import "nx_gate_verdict.nx"
54import "nx_degmode_lib.nx"
55
56const DG_BUF: i64 = 4096
57const DG_SAMP: i64 = 16
58
59// A fixture declaration table assembled in memory -- never a file, so this gate shares no path with any
60// production conf and cannot be silenced by one going stale.
61const DG_CONF: *u8 = "class|nx_cachewatch|E1|the organ that diagnoses the fault\nclass|nx_seat_boot|E2|in-flight seat work\nclass|nx_compare_rank_fleet|E3|fleet sweep\n"
62
63func dg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
64
65func main(argc: i64, argv: *i64) -> i64 {
66 let ctr: *i64 = gv_ctr()
67 gv_head("nx_degmode gate -- shed by essentiality instead of grounding, and re-arm only on a proven edge" as *u8)
68
69 let conf: *u8 = DG_CONF
70 let cn: i64 = dg_slen(conf)
71
72 // ---- T1/T2 the RED ladder ----
73 let a_e1_red: i64 = dm_admit(DM_E1, DM_H_RED)
74 let a_e3_red: i64 = dm_admit(DM_E3, DM_H_RED)
75 gv_puts(" [T1] RED: E1=" as *u8); gv_num(a_e1_red)
76 gv_puts(" E3=" as *u8); gv_num(a_e3_red); gv_puts("\n" as *u8)
77 gv_check("RED-still-admits-E1-restore-capability-work (a ground stop refuses even the fix for its own fault)" as *u8, (a_e1_red == DM_ADMIT) as i64, ctr)
78 gv_check("RED-defers-E3-bulk-work" as *u8, (a_e3_red == DM_DEFER) as i64, ctr)
79
80 // ---- T3 the AMBER rung is genuinely distinct ----
81 let a_e2_amb: i64 = dm_admit(DM_E2, DM_H_AMBER)
82 let a_e3_amb: i64 = dm_admit(DM_E3, DM_H_AMBER)
83 let a_e2_red: i64 = dm_admit(DM_E2, DM_H_RED)
84 gv_puts(" [T3] AMBER: E2=" as *u8); gv_num(a_e2_amb)
85 gv_puts(" E3=" as *u8); gv_num(a_e3_amb)
86 gv_puts(" RED: E2=" as *u8); gv_num(a_e2_red); gv_puts("\n" as *u8)
87 var t3: i64 = 0
88 if a_e2_amb == DM_ADMIT { if a_e3_amb == DM_DEFER { if a_e2_red == DM_DEFER { t3 = 1 } } }
89 gv_check("AMBER-is-a-DISTINCT-rung-admitting-E2-while-RED-defers-it (three behaviours, not a rebadged two)" as *u8, t3, ctr)
90
91 // ---- T4 POSITIVE CONTROL ----
92 var t4: i64 = 0
93 if dm_admit(DM_E1, DM_H_GREEN) == DM_ADMIT {
94 if dm_admit(DM_E2, DM_H_GREEN) == DM_ADMIT {
95 if dm_admit(DM_E3, DM_H_GREEN) == DM_ADMIT { t4 = 1 }
96 }
97 }
98 gv_puts(" [T4] GREEN admits E1,E2,E3 -> " as *u8); gv_num(t4); gv_puts("\n" as *u8)
99 gv_check("POSITIVE-CONTROL-GREEN-admits-every-class (without this a ladder that deferred everything passes T2 and T3)" as *u8, t4, ctr)
100
101 // ---- T5/T6 the undeclared default ----
102 let und: i64 = dm_class_of(conf, cn, "nx_never_declared_anywhere" as *u8)
103 let und_decl: i64 = dm_class_declared(conf, cn, "nx_never_declared_anywhere" as *u8)
104 gv_puts(" [T5] undeclared -> class=" as *u8); gv_num(und)
105 gv_puts(" (E3=" as *u8); gv_num(DM_E3); gv_puts(") declared_marker=" as *u8); gv_num(und_decl); gv_puts("\n" as *u8)
106 gv_check("an-UNDECLARED-target-resolves-to-the-LEAST-essential-class-never-the-permissive-one (the live pr_mode defect, refused in advance)" as *u8, (und == DM_E3) as i64, ctr)
107 gv_check("the-undeclared-default-is-DISTINGUISHABLE-from-a-declaration-so-a-caller-can-say-it-defaulted" as *u8, (und_decl == 0) as i64, ctr)
108
109 // ---- T7 exact declaration, no prefix leak ----
110 let c1: i64 = dm_class_of(conf, cn, "nx_cachewatch" as *u8)
111 let leak: i64 = dm_class_declared(conf, cn, "nx_cachewatch_gate" as *u8)
112 let c3: i64 = dm_class_of(conf, cn, "nx_compare_rank_fleet" as *u8)
113 gv_puts(" [T7] nx_cachewatch=" as *u8); gv_num(c1)
114 gv_puts(" nx_compare_rank_fleet=" as *u8); gv_num(c3)
115 gv_puts(" prefix_leak_marker=" as *u8); gv_num(leak); gv_puts("\n" as *u8)
116 var t7: i64 = 0
117 if c1 == DM_E1 { if c3 == DM_E3 { if leak == 0 { t7 = 1 } } }
118 gv_check("a-declared-class-is-read-EXACTLY-and-a-longer-name-does-not-inherit-a-shorter-ones-declaration" as *u8, t7, ctr)
119
120 // ---- T8 UNOBSERVABLE abstains from tightening ----
121 var t8: i64 = 0
122 if dm_admit(DM_E1, DM_H_UNOBS) == DM_ADMIT {
123 if dm_admit(DM_E2, DM_H_UNOBS) == DM_ADMIT {
124 if dm_admit(DM_E3, DM_H_UNOBS) == DM_ADMIT { t8 = 1 }
125 }
126 }
127 gv_puts(" [T8] UNOBSERVABLE admits every class -> " as *u8); gv_num(t8); gv_puts("\n" as *u8)
128 gv_check("UNOBSERVABLE-ABSTAINS-FROM-TIGHTENING-rather-than-blocking-every-host-that-has-no-such-cache (the callers load bar is untouched and still refuses)" as *u8, t8, ctr)
129
130 // ---- T9 the MEL clock ----
131 let live: i64 = dm_deferral_state(DM_CAT_C_S - 1, DM_CAT_C_S)
132 let expd: i64 = dm_deferral_state(DM_CAT_C_S, DM_CAT_C_S)
133 let unset: i64 = dm_deferral_state(100, 0)
134 gv_puts(" [T9] within=" as *u8); gv_num(live)
135 gv_puts(" at_limit=" as *u8); gv_num(expd)
136 gv_puts(" categoryA=" as *u8); gv_num(unset); gv_puts("\n" as *u8)
137 var t9: i64 = 0
138 if live == DM_CLOCK_LIVE { if expd == DM_CLOCK_EXPIRED { if unset == DM_CLOCK_UNSET { t9 = 1 } } }
139 gv_check("the-MEL-clock-is-LIVE-within-its-category-EXPIRED-at-the-limit-and-UNSET-for-category-A (a deferral with no expiry is how a day passes with nobody deciding)" as *u8, t9, ctr)
140
141 // ---- recovery windows ----
142 let s: *i64 = sys_mmap(DG_SAMP * 8) as *i64
143
144 var i: i64 = 0
145 while i < 6 { s[i] = DM_H_GREEN; i = i + 1 }
146 let r_steady: i64 = dm_recover(s, 6, DM_RECOVER_CONSECUTIVE, DM_RECOVER_MIN_SAMPLES)
147 gv_puts(" [T10] all-clear window, no prior fault -> recover=" as *u8); gv_num(r_steady); gv_puts("\n" as *u8)
148 gv_check("STEADY-STATE-GUARD-an-all-clear-window-with-no-prior-fault-is-NOT-a-recovery" as *u8, (r_steady == 0) as i64, ctr)
149
150 s[0] = DM_H_RED; s[1] = DM_H_GREEN; s[2] = DM_H_RED
151 s[3] = DM_H_GREEN; s[4] = DM_H_RED; s[5] = DM_H_GREEN
152 let r_flap: i64 = dm_recover(s, 6, DM_RECOVER_CONSECUTIVE, DM_RECOVER_MIN_SAMPLES)
153 gv_puts(" [T11] alternating window -> recover=" as *u8); gv_num(r_flap); gv_puts("\n" as *u8)
154 gv_check("FLAP-GUARD-an-alternating-window-is-NOT-a-recovery (alternating health checks drove the Oct-2025 failover that removed healthy capacity)" as *u8, (r_flap == 0) as i64, ctr)
155
156 s[0] = DM_H_RED; s[1] = DM_H_GREEN; s[2] = DM_H_GREEN
157 let r_few: i64 = dm_recover(s, 3, DM_RECOVER_CONSECUTIVE, DM_RECOVER_MIN_SAMPLES)
158 gv_puts(" [T12] 3 samples against a minimum of " as *u8); gv_num(DM_RECOVER_MIN_SAMPLES)
159 gv_puts(" -> recover=" as *u8); gv_num(r_few); gv_puts("\n" as *u8)
160 gv_check("the-EMPTY-SET-DENOMINATOR-too-few-observations-cannot-answer-the-question-at-all" as *u8, (r_few == 0) as i64, ctr)
161
162 s[0] = DM_H_RED; s[1] = DM_H_RED; s[2] = DM_H_GREEN
163 s[3] = DM_H_GREEN; s[4] = DM_H_GREEN
164 let r_edge: i64 = dm_recover(s, 5, DM_RECOVER_CONSECUTIVE, DM_RECOVER_MIN_SAMPLES)
165 gv_puts(" [T13] RED,RED then 3 clear -> recover=" as *u8); gv_num(r_edge); gv_puts("\n" as *u8)
166 gv_check("ANTI-VACUITY-a-genuine-fault-then-sustained-clear-DOES-re-arm (without this T10 T11 and T12 pass on a detector that never recovers)" as *u8, (r_edge == 1) as i64, ctr)
167
168 gv_kv("red_admits_e1" as *u8, a_e1_red)
169 gv_kv("red_defers_e3" as *u8, a_e3_red)
170 gv_kv("undeclared_class" as *u8, und)
171 gv_kv("recover_on_edge" as *u8, r_edge)
172 gv_kv("recover_on_flap" as *u8, r_flap)
173 gv_kv("recover_consecutive_required" as *u8, DM_RECOVER_CONSECUTIVE)
174
175 return gv_verdict("degmode" as *u8, ctr, "graceful degradation proven as a decidable function: essentiality sheds bulk while restore-capability work still builds, an undeclared target falls to the least essential class rather than the permissive one, the MEL clock expires, and re-arming requires a proven edge that a flap and a steady state both fail" as *u8)
176}