code wiki / _hdl_build / nx_docportal_search_seg.nx
`nx_docportal_search_seg.nx` source

↩ module page · 3780 lines · 221880 B
1// nx_docportal_search_seg.nx -- SOVEREIGN seg_store-native onsite search.
2// Operator 2026-07-02: "we dont want to use tsv we want to use nishi ecosystem from the hardware rung up each rung."
3// This RETIRES the derived flat-file bridge (knowledge/index/<domain>_src.tsv -> nx_onsite_index -> separate .idx)
4// for onsite search. It queries the domain's PUBLIC seg_store shard's OWN term postings DIRECTLY:
5//   ss_open(shard) -> per query-term ss_term (current-state postings, tombstone-shadowed) -> ss_hget doc text ->
6//   rank by (# distinct query terms matched, then total term frequency).
7// The store IS the index by construction: ss_write_seg builds .terms for EVERY segment (nx_seg_store:690), so no
8// derived artifact and no flat file appear anywhere in the path. Cross-shard isolation is inherited (a public
9// query ss_open's ONLY the -pub- shard; the -prv- shard's files are never opened). license_tier: ORIGINAL
10//
11// Shard/key format MUST match nx_docportal_lib (dp_prefix/dp_key): prefix "knowledge/store/dp-<domain>-pub-",
12// key "doc:<cid>". Kept inlined (not imported) so this stays a leaf on nx_seg_store alone -> gate-able in isolation.
13import "nx_seg_store.nx"
14import "nx_intlog.nx"   // integer Q10 log2 / idf / tf-saturation -- the BM25 ranking rung's math floor
15import "nx_quicksort.nx" // the canonical sort (same nx_syscalls shim as this closure) -- dss_bm25q_fuse orders the two arms by packed keys
16import "nx_editdist.nx" // bounded Levenshtein -- the typo/did-you-mean rung's math floor
17import "nx_stem.nx"     // Porter-lite stemmer -- query-time dictionary stem-expansion (recall; no index change)
18import "nx_didyoumean.nx" // search rung F4: the one-edit did-you-mean neighbourhood (dss_spell_suggest composes it)
19const DSC_MAGIC_262144: i64 = 262144
20const DSC_MAGIC_2097152: i64 = 2097152
21const DSC_MAGIC_4096: i64 = 4096
22
23// Digit consts for the zero-alloc MSB-first key builders. MUST sit above their first reader
24// (dss_mkkey) -- nx_cc refuses a const used before declaration because it would silently read 0.
25const DSC_PREFIXBUF: i64 = 512
26const DSC_TOKBUF: i64 = 64
27const DSC_POSBUF: i64 = 16
28const DSC_ASCII_0: i64 = 48
29const DSC_DEC: i64 = 10
30
31const DSS_MAGIC_1125899906842597: i64 = 1125899906842597
32const DSS_MAGIC_1024: i64 = 1024
33
34const DSS_MAXTERMS: i64 = 16
35// S7 (2026-09-16) SERVED BM25Q FUSION -- the constants dss_bm25q_fuse packs and scales with (see that function).
36const DSS_BQ_IDXBITS: i64 = 4096            // > DSS_MAXCAND: a candidate index rides in the low bits of one sort key
37const DSS_BQ_SMAX: i64 = 1099511627776       // 2^40, above any score this scorer can produce (16 terms x a 25-bit idf x a 12-bit tfnorm x a 2x proximity factor < 2^31), so (SMAX - score) keeps keys positive and the ascending canonical sort orders scores DESCENDING
38const DSS_BQ_RRF_SCALE: i64 = 16777216       // 2^24: the reciprocal-rank numerator, so 1/(k+r) stays order-preserving as an integer over every rank the candidate cap allows (adjacent ranks at 2048 still differ by 3)
39const DSS_BQ_FMAX: i64 = 16777216            // above any fused sum (two reciprocals of at most SCALE/(k+1) each), so the fused key is positive too
40const DSS_MAXHITS:  i64 = 2048        // per-term candidacy cap. FIVE-CELL MEASUREMENT 2026-07-25 --
                                    // candidacy depth, stage-1 quality and shortlist width are ONE
                                    // joint decision, never three independent knobs (MRR@10):
                                    //   512 /tf-blind    /short-128  = 705
                                    //   2048/tf-blind    /short-128  = 534   depth ALONE hurts
                                    //   2048/impact-aware/short-128  = 648   stage-1 recovers 2/3
                                    //   512 /impact-aware/short-512  = 705   width ALONE is a no-op
                                    //   2048/impact-aware/short-2048 = 721   SHIPPED, new ratchet
                                    // Raising any ONE of the three measured neutral or negative;
                                    // all three together beat the previous best. Change them AS A SET.
50const DSS_MAXCAND:  i64 = 2048        // unique candidate docs cap (same five-cell measurement)
51const DSS_PHRASEHITS: i64 = 512       // phrase candidacy cap -- ss_phrase's internal rank buffers are
                                    // sized for 512+8; the phrase path keeps its own proven bound
53const DSS_POL_SEARCH:  i64 = 1         // owner-consent search bit -- MUST equal nx_docportal_lib DP_USE_PUB_SEARCH
54const DSS_TFSCAN:      i64 = 8192      // per-doc tf-scan cap (perf, 2026-07-24 32768->8192): the TWO per-candidate walks (tf + proximity) dominate WEB latency on large HTML->text docs; tf saturates ~5 so 8KB of leading content keeps ranking (|d| now comes from byte-length, cap-independent), and the rare-term floor + postings-truth keep deep matches findable. 4x less scanning = the p95 win until precomputed-tf-in-postings lands.
55const DSS_SHORT_FLOOR: i64 = 2048      // seq877: min candidates handed to full BM25 (was a bare 128).
                                    // Equal to DSS_MAXCAND, so stage-1 is a pure RANKER and never a
                                    // lossy gate: every candidate gets full BM25. Worth +16 MRR only
                                    // in combination with the deeper pool -- see the five-cell note.
59const DSS_S1_TFK: i64 = 2            // seq871 stage-1 tf saturation constant: weight = idf*tf/(tf+K).
                                     // tf=1 -> 0.33x, tf=2 -> 0.50x, tf=5 -> 0.71x, tf=100 -> 0.98x --
                                     // a keyword-stuffed page gains ~3x over a single mention, NEVER 100x.
                                     // Saturation is the whole point: round 2 proved RAW tf is a spam
                                     // amplifier, so tf informs SELECTION here, never the BM25 score.
64const DSS_RARE_DCOUNT: i64 = 4       // a POSTED term this rare (<=4 docs corpus-wide) gets a tf=1 floor when the scan cap hid it: near-unique terms (names, ids, gate markers) stay findable even at a huge doc's tail, while COMMON terms hidden by the cap stay dropped (deep-boilerplate noise -- the julia-kyoka complaint). Postings are full-doc truth; the floor only restores what they assert.
65const DSS_HOSTCAP:    i64 = 3          // web scope ONLY: max results per host per page (host-crowding cap). Over-cap hits still appear via phase-B overflow -- down-rank, never delete. Site/trusted shards are never capped.
66// ONE DOCUMENT IS ONE RESULT, EVEN WHEN IT IS PUBLISHED UNDER TWENTY HOSTNAMES.
67// MEASURED 2026-08-17 on /search?scope=web&q=diora+baird+nude: 20 of 30 slots were the SAME article --
68// the subject's Wikipedia page in ~20 language editions (en, sv, it, es, an, gv, ast, pt, de, af, ie,
69// ig, pl, tr, simple, uz, knc, nl, fr) plus commons and a File: page. Two existing mechanisms each
70// CORRECTLY declined to catch it, which is why it survived:
71//   - the crawl-time SimHash dedup gate collapses identical TEXT, and these are different LANGUAGES;
72//   - DSS_HOSTCAP counts per HOST, and sv./it./es. are different hosts, so each drew its own quota
73//     of 3. The SERP's own facet line proves the host cap fired exactly as designed: en.wikipedia.org (3).
74// ★★★★★★A CAP KEYED ON THE WRONG IDENTITY IS NOT A WEAK CAP, IT IS A CAP ON SOMETHING NOBODY ASKED
75// ABOUT -- and it reports success while the page fills with one document.
76// 1, not a tuned number: the cap answers "how many times may ONE document appear on ONE page", and any
77// value above 1 is a decision to show the reader the same page twice. Over-cap hits still surface via
78// the phase-B overflow below, so this DOWN-RANKS and never deletes -- the neutrality charter holds.
79const DSS_ENTITYCAP:  i64 = 1
80const DSS_PR_SCALE:   i64 = 1000000000 // == nx_pagerank PR_SCALE; pr: values are ppb ranks in [0, DSS_PR_SCALE]
81const DSS_PR_BOOST:   i64 = 3072       // web authority: score *= (1024 + rank*BOOST/SCALE)/1024 -- a top page (~5e8) ~2.5x
82const DSS_PR_MAXFAC:  i64 = 4096       // cap the authority factor at 4x (no single super-authority page dominates)
83const DSS_TRUST_BOOST: i64 = 2048      // R2c TRUST PRIOR (2026-08-04, debt 1785895889): bounded 2x for a host
                                     // in canonical_seeds.txt -- DATA-DRIVEN from the SAME curated file that
                                     // aims the crawler, never a hardcoded list; dot-suffix matched; gated by
                                     // the SAME R1f salient-idf floor as the PR boost (a trusted host matching
                                     // only function words earns nothing). Ruler-gated ship.
88const DSS_TRUST_MAXH:  i64 = 96        // seed hosts held per query (the file is ~60 rows)
89// CORPUS-DERIVED STOPWORD DISCOUNT (2026-07-23, the toward-Yandex ranking rung): pure BM25 let function
90// words ("how","to","of","the") dominate -- "how to lower blood pressure" returned "How To Guide - NASA"
91// over the 199 hypertension pages that exist. A term appearing in > DSS_STOP_DFPCT% of the corpus is a
92// stopword and its idf (hence its whole ranking contribution, stage-1 AND full BM25) is divided by
93// DSS_STOP_DISCOUNT -- kept as a weak tiebreaker, never zeroed. DERIVED FROM DOCUMENT FREQUENCY, not a
94// hardcoded English list, so it works for every language in the multilingual index. Only active once the
95// corpus is big enough for df to be meaningful (DSS_STOP_MINCORPUS) -- small onsite/gate shards are untouched.
96const DSS_STOP_DFPCT:     i64 = 12     // term in >12% of docs = stopword (Zipf: function words cluster here)
97const DSS_STOP_DISCOUNT:  i64 = 12     // stopword idf /= this (weak tiebreaker, not deleted)
98const DSS_STOP_MINCORPUS: i64 = 1000   // stopword detection only above this doc count (protects tiny corpora)
99const DSS_IDF_Q10_MIN:    i64 = 1      // one quantum of the Q10 fixed point (1/1024): the SMALLEST positive weight a term the
                                     // postings carry can hold. Not a tuning knob -- it is the representation's unit. See the
                                     // idf loop: an everywhere-term used to floor to EXACTLY 0, and a zero idf made every candidate
                                     // a phantom (q=wikipedia total=432336 nresults=0 on 2026-09-13 once write-time dcount exceeded N).
103
104// ---- IS THE PUBLISHED TOTAL AN EXACT COUNT, OR AN ESTIMATE? (2026-08-25) ----------------------------
105// candsat's own declaration below already says it: "candidacy truncated somewhere -> totals become
106// df-derived estimates". The code has always KNOWN the number stops being a count -- it simply never
107// told anyone. So the SERP printed "of 372317 matched" (a df-derived lower bound, from a saturated
108// 2048-candidate pool) in BYTE-IDENTICAL form to "of 201 matched" (an exact enumeration), and the
109// estimate carried MORE apparent precision than the exact figure sitting beside it.
110// ★A CAPPED MEASUREMENT PUBLISHED AS A POPULATION FACT IS THE SAMPLING DEFECT WEARING SIX DIGITS.
111// Announce, never infer: a consumer reads this instead of assuming the total is enumerable.
112static dss_est_g: i64
113func dss_last_estimated() -> i64 { return dss_est_g }
114
115// public shard prefix: knowledge/store/dp-<domain>-pub-  (public search NEVER touches the -prv- shard)
116func dss_prefix(domain: *u8, out: *u8) -> i64 {
  var o: i64 = 0
  let a: *u8 = "knowledge/store/dp-" as *u8
  var i: i64 = 0
  while a[i] != (0 as u8) { out[o] = a[i]; o = o + 1; i = i + 1 }
  i = 0
  while domain[i] != (0 as u8) { out[o] = domain[i]; o = o + 1; i = i + 1 }
  let b: *u8 = "-pub-" as *u8
  i = 0
  while b[i] != (0 as u8) { out[o] = b[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  return o
128}
129
130// build the content-addressed key "doc:<cid>" (null-terminated). Returns length.
131func dss_mkkey(cid: i64, out: *u8) -> i64 {
  out[0] = 100 as u8; out[1] = 111 as u8; out[2] = 99 as u8; out[3] = 58 as u8   // "doc:"
  var o: i64 = 4
  if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o }
  // MSB-FIRST: no scratch buffer, no allocation (2026-07-31 leak fix, debt 1785516350). The old body
  // built digits least-significant-first, which comes out backwards and needed a sys_mmap(24) scratch
  // to reverse through -- never freed, once per key built, on every search request. Output identical.
  var pw: i64 = 1
  var m: i64 = cid
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  out[o] = 0 as u8
  return o
144}
145
146// ============ WEB-SHARD CACHED OPEN (serve-scale rung, 2026-07-23) ============
147// ss_open cost grows with total keys x segments (the live-doc map's shadow probes) -- measured ~0.7s
148// on the bulk-CC web shard, paid PER QUERY because every serve path opened fresh. The web shard is
149// the only scale shard, so its handle is cached process-wide, invalidated by the manifest's
150// (size, mtime-sec) signature. Site shards keep per-request opens (small by design; a single-slot
151// cache would thrash between Host domains). The docportal daemon is FORK-PER-REQUEST: the PARENT
152// pre-warms this cache at startup + refreshes it in the accept loop (dss_web_cache_refresh), so every
153// child inherits the built handle COW and the per-request open cost is ZERO. On reopen the old
154// handle's mappings are not unmapped -- a bounded, rare event (only when new segments ship).
155static dsc_handle: *i64      // cached web-shard handle (0 = not opened yet)
156static dsc_sig:    *i64      // [0]=manifest st_size  [1]=manifest st_mtime-sec
157// ONLY THE PARENT MAY REOPEN (2026-08-15). 0 = request path, MUST NOT reopen; 1 = parent refresh.
158// THE BUG THIS CLOSES, measured live: when a crawler ships a segment the manifest signature changes,
159// and dss_open_maybe_cached's reopen branch was reachable FROM THE CHILD. The parent's own refresh is
160// gated by DAD_REFRESH_MIN_SEC=300 (deferrable to 900), so for up to 5-15 minutes the parent kept
161// serving a handle it knew was stale while EVERY forked child independently paid a full ss_open2 of
162// the 1.59GB shard on the request path. Signature in the daemon log: REQ refresh-skip on every line,
163// REQ done parent_us=252-446 MICROseconds, and REQ child ms=7868-9884 -- sustained, every request.
164// FORK-PER-REQUEST TURNS ONE STALE HANDLE INTO ONE FULL OPEN PER VISITOR: the comment above already
165// said the refresh "runs parent-side, outside the fork", and that was true of the periodic refresh and
166// false of the serve path, which reached the same branch. A CLAIM ABOUT WHERE CODE RUNS IS ONLY TRUE
167// OF THE CALLERS YOU CHECKED.
168// The tradeoff is the one this file already argues for elsewhere: serving a few minutes of slightly
169// stale index is strictly better than not serving at all -- and far better at 8 SECONDS PER REQUEST
170// than at a bounded index lag. The parent's refresh closes the gap on its own schedule.
171static dsc_may_reopen: i64
172func dsc_web_prefix_is(prefix: *u8) -> i64 {
  let wp: *u8 = "knowledge/store/dp-web-pub-" as *u8
  var i: i64 = 0
  while wp[i] != (0 as u8) { if prefix[i] != wp[i] { return 0 } i = i + 1 }
  if prefix[i] == (0 as u8) { return 1 }
  return 0
178}
179// manifest signature -> sig[0]=st_size sig[1]=st_mtime-sec ((0,0) when absent)
180// Buffer sizes promoted out of the call sites (rule 11), 2026-07-31 seg-store handle-leak fix.
181const DSC_PATHBUF: i64 = 560
182const DSC_STATBUF: i64 = 160
183const DSC_SIGBUF: i64 = 32
184func dsc_manifest_sig(prefix: *u8, sig: *i64) -> i64 {
  let mp: *u8 = sys_mmap(DSC_PATHBUF)
  var o: i64 = 0
  o = ss_cat(mp, o, prefix)
  o = ss_cat(mp, o, "manifest.txt" as *u8)
  mp[o] = 0 as u8
  let stb: *u8 = sys_mmap(DSC_STATBUF)
  sig[0] = 0
  sig[1] = 0
  if sys_fstatat(mp, stb) == 0 {
      let szp: *i64 = ((stb as i64) + 48) as *i64    // st_size @ +48 (x86_64 struct stat)
      let mtp: *i64 = ((stb as i64) + 88) as *i64    // st_mtime sec @ +88
      sig[0] = szp[0]
      sig[1] = mtp[0]
  }
  sys_munmap(mp, DSC_PATHBUF)
  sys_munmap(stb, DSC_STATBUF)
  return 0
202}
203// the ONE open the serve paths use: cached for the web shard, plain ss_open for every other prefix
204func dss_open_maybe_cached(prefix: *u8) -> *i64 {
  if dsc_web_prefix_is(prefix) == 0 { return ss_open(prefix) }
  if (dsc_sig as i64) == 0 { dsc_sig = sys_mmap(32) as *i64 }
  let cur: *i64 = sys_mmap(DSC_SIGBUF) as *i64
  dsc_manifest_sig(prefix, cur)
  if (dsc_handle as i64) != 0 { if cur[0] == dsc_sig[0] { if cur[1] == dsc_sig[1] { sys_munmap(cur as *u8, DSC_SIGBUF); return dsc_handle } } }
  // SIGNATURE CHANGED. If we are NOT the parent's refresh, serve the handle we already have rather
  // than pay a multi-second open on someone's request. Only reached when a handle EXISTS -- the very
  // first open (dsc_handle == 0) still proceeds below, so a fresh process or a CLI is unaffected.
  // A CHILD MUST NEVER DO A MULTI-SECOND OPEN ON THE REQUEST PATH.
  if dsc_may_reopen == 0 { if (dsc_handle as i64) != 0 { sys_munmap(cur as *u8, DSC_SIGBUF); return dsc_handle } }
  // RELEASE THE SUPERSEDED HANDLE BEFORE REPLACING IT. Measured 2026-07-31 (debt 1785520503): every
  // manifest change -- i.e. every segguard compaction -- re-opened the web shard and ABANDONED the
  // previous handle, so nx_docportal_ad accumulated 343 anonymous rwx maps totalling 398 GB plus 4275
  // file maps totalling 277 GB (VmSize == VmPeak == 698 GB) and drove box Committed_AS to 12.4x the
  // CommitLimit. ss_close has existed since 2026-07-25; this call site simply never adopted it.
  // Safe across the per-request fork: children forked earlier own separate address spaces, and the
  // refresh runs parent-side (dss_web_cache_refresh) outside the fork.
  // REFUSE BEFORE DESTROY (2026-08-22) -- the lesson cmd_mgmtdeploy banked, applied here.
  // h[0] IS THE SEGMENT COUNT (nx_seg_store.nx:2240 ss_open2 sets h[0]=ns from ss_manifest_dyn), and
  // ss_open2 ALWAYS returns a NON-NULL handle -- sys_mmap of the header cannot fail here -- so every
  // `(h as i64) == 0` guard against this open is STRUCTURALLY DEAD and the real degraded state, ns==0,
  // was never checked. This code used to ss_close the WORKING handle first, then install whatever came
  // back, then record dsc_sig = cur UNCONDITIONALLY. So one transient manifest read destroyed a good
  // handle, installed an EMPTY one, and MEMOISED it against the current signature -- after which every
  // request matched the signature and was served the empty handle, i.e. a confident total=0 search that
  // persisted until the manifest signature changed AGAIN.
  // MEASURED 2026-08-22: ~8 minutes of total=0 on a live index holding 1.8 GB across 17 segments
  // (q=okapi 32->0->32), self-healing only when the next crawl segment landed and moved the signature.
  // It also drove funcheck RED, which demoted hosting+network and swung the estate headline 426->393.
  // Now: open FIRST, keep the working handle if the replacement is empty, and do NOT record the
  // signature -- so the next parent refresh RETRIES instead of waiting for the manifest to move.
  // ss_close is safe on an empty handle: it is null-guarded and its release loop is `while s < ns`.
  // MMAP-SERVE: the web shard is the only large shard -> file-backed maps (usemmap=1) so serving is
  // disk-bound not RAM-bound, shared across forked request-children, and page-cache-warm across restarts.
  // WARM-PRESERVING REOPEN (search plan rung L1, 2026-09-02): hand the previous handle in and RETAIN the key
  // table, so a manifest change that only APPENDS segments (every crawler ship) reuses every warm mapping and
  // live map and pays only for the new rows -- the 10.9 s parent stall measured between accept() and fork()
  // was a FULL rebuild over 2.45 GB. ss_open3 announces SSOPEN INCR/FULL on stderr with its reason.
  // The empty-handle guard below is reachable ONLY on the FULL path (INCR requires ns >= pn > 0), and on the
  // FULL path prev is untouched, so ss_close(nh) there can never free a mapping dsc_handle still owns.
  let nh: *i64 = ss_open_incr(prefix, 1, dsc_handle)
  if nh[0] == 0 { ss_close(nh); sys_munmap(cur as *u8, DSC_SIGBUF); return dsc_handle }
  if (dsc_handle as i64) != 0 { ss_close(dsc_handle) }
  dsc_handle = nh
  dsc_sig[0] = cur[0]
  dsc_sig[1] = cur[1]
  sys_munmap(cur as *u8, DSC_SIGBUF)
  return dsc_handle
253}
254// parent-side pre-warm/refresh: call OUTSIDE the per-request fork. Returns 1 = handle ready.
255func dss_web_cache_refresh() -> i64 {
  let prefix: *u8 = sys_mmap(DSC_PREFIXBUF)
  dss_prefix("web" as *u8, prefix)
  // THIS is the one call site permitted to reopen: it runs in the PARENT, outside the fork, which is
  // exactly what the handle-leak fix below assumes when it calls ss_close on the superseded handle.
  dsc_may_reopen = 1
  let h: *i64 = dss_open_maybe_cached(prefix)
  dsc_may_reopen = 0
  // safe to free: ss_open2 only ss_cat-COPIES prefix into path buffers, it never retains the pointer.
  sys_munmap(prefix, DSC_PREFIXBUF)
  if (h as i64) == 0 { return 0 }
  return 1
267}
268
269// ============ CACHE STATE READERS (2026-08-22) -- pure reads of dsc_handle/dsc_sig, no open, fork-safe.
270// WHY: the empty-open incident served total=0 for ~8 min with nothing saying the index was gone; the guard
271// above keeps the handle, but a consumer cannot tell no-results from no-index unless state is READABLE.
272// h[0] IS the segment count (ss_open2). -1 = UNOPENED, 0 = EMPTY (unreachable after the guard; kept
273// distinct so a regression is VISIBLE), >0 = serving. Readers: search_serve + the sticky gate.
274func dss_web_index_segments() -> i64 {
  if (dsc_handle as i64) == 0 { return 0 - 1 }
  return dsc_handle[0]
277}
278// the memoised manifest signature (size, mtime). TEST THE STATE, NOT THE MESSAGE: refresh returns 1
279// whether or not it recorded the sig, so only this can prove an empty reopen did NOT pin dsc_sig.
280func dss_web_cache_sig(sig: *i64) -> i64 {
  sig[0] = 0
  sig[1] = 0
  if (dsc_sig as i64) == 0 { return 0 }
  sig[0] = dsc_sig[0]
  sig[1] = dsc_sig[1]
  return 1
287}
288
289// ============ QUERY RESULT CACHE (2026-08-14) ============
290// WHY: measured on the LIVE public shard, an identical repeat of q=test recomputed from scratch every
291// time -- 10,602ms then 10,448ms back to back. There was no result memo anywhere in the serve path, so
292// the most common queries (exactly the ones that saturate the daemon and produce the 503s) paid full
293// price on every repeat.
294// SUBSTRATE: sys_mmap_shared (MAP_SHARED|MAP_ANONYMOUS, proven by nx_mmap_shared_gate "child write
295// visible to parent"). This daemon is FORK-PER-REQUEST, so a heap memo dies with the child and a plain
296// static is COW-isolated the moment a child writes it. Only a shared mapping is visible ACROSS request
297// children, and its own header says: allocate in the PARENT before fork. dsq_init() does exactly that.
298// CAPACITY: fixed and direct-mapped. The table CANNOT grow, so this adds a bounded, named resource
299// envelope rather than an unbounded cache that would become the next memory incident.
300// INVALIDATION: a generation word bumped by the parent when the shard handle is ACTUALLY reopened --
301// i.e. exactly when the index changed. No TTL, no second clock, nothing to tune.
302const DSQ_MAXR:  i64 = 30              // max results memoised per entry; >= the SERP page size served
303const DSQ_SLOTS: i64 = 2048            // capacity BOUND (entries). Fixed table => fixed memory.
304const DSQ_ENT_W: i64 = 2                // S11-c: the memoised pin (pinned, cid) so a memo hit announces what it serves
305const DSQ_SLOTW: i64 = 6 + 2 * DSQ_MAXR + DSQ_ENT_W // words/slot: key_head,gen,nres,total,phrase + cids + scores + entity + key_tail
306const DSQ_HDRW:  i64 = 1               // word 0 = current generation
307const DSQ_KEYBUF: i64 = 512
308static dsq_buf: *i64                   // shared table (0 = not armed -> every path stays exactly as before)
309
310// ============ CORRECTION CACHE (2026-08-15) ============
311// WHY, MEASURED LIVE: the result memo above works perfectly -- a repeat zero-result query reports its
312// search time as <1 ms -- and the WALL CLOCK was still 10,417 ms. The did-you-mean correction is called
313// from the RENDER path (nx_docportal_search_serve.nx, `if nres == 0`), entirely OUTSIDE that memo, so a
314// query that finds nothing paid the full dictionary walk on EVERY request no matter how often it was
315// asked. Against the ~15 s edge window that is one hiccup from a 503, and misspelled queries are exactly
316// the ones a user retypes -- so the repeat case is the common case here, not the rare one.
317// ★★★★★★A CACHE THAT COVERS THE SEARCH BUT NOT THE RENDER LEAVES THE SLOWEST PATH UNCACHED, AND ITS
318// OWN TIMING FIELD REPORTS SUCCESS -- the page said <1 ms while the user waited ten seconds.
319// SAME SUBSTRATE, SAME RULES as the result memo, deliberately: sys_mmap_shared armed in the PARENT
320// (this daemon is fork-per-request, so a static is COW-isolated the moment a child writes it), fixed
321// capacity so memory stays bounded and named, and it SHARES dsq_buf[0] as its generation rather than
322// introducing a second clock -- one reopen invalidates both tables at once.
323const DCC_SLOTS: i64 = 512             // capacity BOUND (entries). Fixed table => fixed memory.
324const DCC_TEXTB: i64 = 64              // bytes of correction text kept per slot
325const DCC_TEXTW: i64 = DCC_TEXTB / 8
326const DCC_SLOTW: i64 = 4 + DCC_TEXTW   // head_key, gen, len, <text words>, tail_key
327static dcc_buf: *i64
328
329// PARENT-side arm. Returns 1 when the table is live. Never called from a child.
330func dsq_init() -> i64 {
  if (dsq_buf as i64) != 0 { return 1 }
  let words: i64 = DSQ_HDRW + DSQ_SLOTS * DSQ_SLOTW
  dsq_buf = sys_mmap_shared(words * 8) as *i64
  if (dsq_buf as i64) == 0 { return 0 }
  dsq_buf[0] = 1
  // Armed at the SAME parent-side point, so there is exactly one place a child can depend on and no
  // second init path to forget. A failure here leaves dcc_buf 0, which every caller treats as
  // "unarmed" and falls through to the uncached original -- slower, never wrong.
  dcc_buf = sys_mmap_shared(DCC_SLOTS * DCC_SLOTW * 8) as *i64
  return 1
341}
342// Invalidate EVERYTHING by moving the generation. O(1): no sweep, no per-entry expiry.
343func dsq_bump() -> i64 {
  if (dsq_buf as i64) == 0 { return 0 }
  dsq_buf[0] = dsq_buf[0] + 1
  return dsq_buf[0]
347}
348func dsq_putn(out: *u8, off: i64, v: i64) -> i64 {
  var o: i64 = off
  if v == 0 { out[o] = DSC_ASCII_0 as u8; return o + 1 }
  var m: i64 = v
  if m < 0 { out[o] = 45 as u8; o = o + 1; m = 0 - m }
  var pw: i64 = 1
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  return o
357}
358// ASCII case bounds for the memo KEY fold (rule 11: named, not inline literals). Deliberately NOT
359// reused from anywhere else -- these exist for exactly one purpose, the cache key, so they can never
360// drift into doubling as a tokeniser constant.
361const DSQ_UPPER_LO: i64 = 65      // 'A'
362const DSQ_UPPER_HI: i64 = 90      // 'Z'
363const DSQ_CASE_DELTA: i64 = 32    // 'a' - 'A'
364// Key over EVERY input that changes the answer. Composes ss_khash -- the estate's incumbent hash --
365// rather than adding a second one (the ss_khash duplicate was already built once by mistake).
366//
367// CASE-FOLD THE KEY ONLY (2026-09-01). MEASURED LIVE, back to back on the same daemon state:
368// q=test served in "<1 ms" while q=Test cost 1396 ms -- and the two 30-result URL lists were
369// BYTE-IDENTICAL. A capitalised repeat was paying a full cold recompute for an answer already
370// sitting in the table, and humans capitalise ("Family Photos").
371// WHY THIS CANNOT CHANGE A RENDERED BYTE: the memo stores doc-ids + scores, never HTML. The echoed
372// query and the snippet highlighting are both re-rendered from the RAW q on every request, so the
373// fold is invisible outside this function.
374// SAFE BY CONTROL, NOT BY HOPE. The hardest case is an operand compared against raw url bytes, and
375// site: is ALREADY case-insensitive: dss_url_host_match lowercases the url side and its host operand
376// is "caller pre-lowercased". VERIFIED LIVE rather than assumed -- site:en.wikipedia.org and
377// site:EN.Wikipedia.ORG returned an identical 30-url list (md5 9bb3ae2a2f12). Free terms fold through
378// ss_fold_cp in the tokeniser anyway.
379// ASCII-ONLY IS DELIBERATE: it is a conservative SUBSET of the tokeniser's Unicode folding, so it can
380// only ever merge keys the search already answers identically. A non-ASCII case pair simply keeps
381// separate keys -- a MISSED hit, never a WRONG one. Widening this to full Unicode folding would need
382// the same live control run against a non-ASCII corpus first.
383func dsq_key(domain: *u8, q: *u8, qn: i64, max: i64, offset: i64, div: i64) -> i64 {
  let kb: *u8 = sys_mmap(DSQ_KEYBUF)
  var o: i64 = 0
  o = ss_cat(kb, o, domain)
  kb[o] = 31 as u8; o = o + 1
  var i: i64 = 0
  while i < qn {
      if o < (DSQ_KEYBUF - 48) {
          var c: i64 = q[i] as i64
          if c >= DSQ_UPPER_LO { if c <= DSQ_UPPER_HI { c = c + DSQ_CASE_DELTA } }
          kb[o] = c as u8
          o = o + 1
      }
      i = i + 1
  }
  kb[o] = 31 as u8; o = o + 1
  o = dsq_putn(kb, o, max);    kb[o] = 31 as u8; o = o + 1
  o = dsq_putn(kb, o, offset); kb[o] = 31 as u8; o = o + 1
  o = dsq_putn(kb, o, div)
  let h: i64 = ss_khash(kb, o)
  sys_munmap(kb, DSQ_KEYBUF)
  if h == 0 { return 1 }   // 0 is the EMPTY sentinel: never hand it back as a live key
  return h
406}
407// PARENT-side refresh that also invalidates the memo IFF the shard actually reopened. Defined here,
408// below both halves, so nothing forward-references: nx_cc reads top-down and a forward const/func is
409// a refusal, not a link step. The daemon calls THIS instead of dss_web_cache_refresh() so the memo
410// can never outlive the index it memoises.
411func dss_refresh_and_invalidate() -> i64 {
  var s0: i64 = 0
  var s1: i64 = 0
  if (dsc_sig as i64) != 0 { s0 = dsc_sig[0]; s1 = dsc_sig[1] }
  let r: i64 = dss_web_cache_refresh()
  if (dsc_sig as i64) != 0 {
      if dsc_sig[0] != s0 { dsq_bump() } else { if dsc_sig[1] != s1 { dsq_bump() } }
  }
  return r
420}
421
422// build the policy key "pol:<cid>" (null-terminated) -- MUST match nx_docportal_lib dp_polkey. Returns length.
423func dss_mkpolkey(cid: i64, out: *u8) -> i64 {
  out[0] = 112 as u8; out[1] = 111 as u8; out[2] = 108 as u8; out[3] = 58 as u8   // "pol:"
  var o: i64 = 4
  if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o }
  // MSB-FIRST: no scratch buffer, no allocation (2026-07-31 leak fix, debt 1785516350). The old body
  // built digits least-significant-first, which comes out backwards and needed a sys_mmap(24) scratch
  // to reverse through -- never freed, once per key built, on every search request. Output identical.
  var pw: i64 = 1
  var m: i64 = cid
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  out[o] = 0 as u8
  return o
436}
437
438// build the source-url key "url:<cid>" (must byte-match the serve layer's dsv_mkurlkey / corpus ci_mkurlkey)
439func dss_mkurlkey(cid: i64, out: *u8) -> i64 {
  out[0] = 117 as u8; out[1] = 114 as u8; out[2] = 108 as u8; out[3] = 58 as u8   // "url:"
  var o: i64 = 4
  if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o }
  // MSB-FIRST: no scratch buffer, no allocation (2026-07-31 leak fix, debt 1785516350). The old body
  // built digits least-significant-first, which comes out backwards and needed a sys_mmap(24) scratch
  // to reverse through -- never freed, once per key built, on every search request. Output identical.
  var pw: i64 = 1
  var m: i64 = cid
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  out[o] = 0 as u8
  return o
452}
453// ---- S12 FRESHNESS (2026-09-17) -------------------------------------------------------------------------------
454// The crawler stores the fetch epoch beside the doc as fe:<cid> (ci_mkfekey). This layer reads it back and turns a
455// result page into three numbers: how many results carry an epoch, the newest epoch, and the median age. An absent
456// row ABSTAINS (-1): it never reads as an age of zero, so a page of pre-S12 documents says "unobserved", not "fresh".
457const DSS_FE_KEY_BYTES: i64 = 32     // "fe:" + 20 decimal digits + NUL
458const DSS_FRESH_SLOTS: i64 = 3       // out[0] observed, out[1] newest epoch, out[2] median age (seconds)
459const DSS_FRESH_MAX: i64 = 64        // ages scratch: a result PAGE, tens of rows; callers cap n here and say so
460// build the fetch-epoch key "fe:<cid>" (byte-matches the corpus layer's ci_mkfekey, as dss_mkurlkey matches ci_mkurlkey)
461func dss_mkfekey(cid: i64, out: *u8) -> i64 {
  out[0] = 102 as u8; out[1] = 101 as u8; out[2] = 58 as u8   // "fe:"
  var o: i64 = 3
  if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o }
  var pw: i64 = 1
  var m: i64 = cid
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  out[o] = 0 as u8
  return o
471}
472static dss_fe_key: *u8
473static dss_fe_pbox: *i64
474static dss_fe_lbox: *i64
475static dss_fe_ages: *i64
476// the fetch epoch stored beside doc <cid>, or -1 when the row is absent or carries no digits. One static key and two
477// boxes: this runs once per result on every request, so it allocates nothing per call.
478func dss_doc_fetch_epoch(h: *i64, cid: i64) -> i64 {
  if (h as i64) == 0 { return 0 - 1 }
  if (dss_fe_key as i64) == 0 { dss_fe_key = sys_mmap(DSS_FE_KEY_BYTES); dss_fe_pbox = sys_mmap(16) as *i64; dss_fe_lbox = sys_mmap(16) as *i64 }
  dss_mkfekey(cid, dss_fe_key)
  if ss_hget(h, dss_fe_key, dss_fe_pbox, dss_fe_lbox) != 1 { return 0 - 1 }
  let p: *u8 = dss_fe_pbox[0] as *u8
  let n: i64 = dss_fe_lbox[0]
  var v: i64 = 0
  var nd: i64 = 0
  var i: i64 = 0
  while i < n { if p[i] >= (48 as u8) { if p[i] <= (57 as u8) { v = v * DSC_DEC + ((p[i] - (48 as u8)) as i64); nd = nd + 1 } } i = i + 1 }
  if nd == 0 { return 0 - 1 }
  return v
491}
492// freshness of a result page: fe[i] = fetch epoch or -1 per result. out[0] = observed (results with an epoch),
493// out[1] = newest epoch (-1 when none), out[2] = median age in seconds over the observed (-1 when none; an even count
494// takes the mean of the two middle ages). Pure over its inputs -- the gate proves it on planted arrays.
495func dss_fresh_stats(fe: *i64, n0: i64, now: i64, out: *i64) -> i64 {
  out[0] = 0; out[1] = 0 - 1; out[2] = 0 - 1
  var n: i64 = n0
  if n > DSS_FRESH_MAX { n = DSS_FRESH_MAX }
  if n <= 0 { return 0 }
  if (dss_fe_ages as i64) == 0 { dss_fe_ages = sys_mmap(8 * DSS_FRESH_MAX) as *i64 }
  var k: i64 = 0
  var i: i64 = 0
  while i < n {
      if fe[i] >= 0 {
          if fe[i] > out[1] { out[1] = fe[i] }
          var a: i64 = now - fe[i]
          if a < 0 { a = 0 }
          var j: i64 = k
          var go: i64 = 1
          while go == 1 { if j > 0 { if dss_fe_ages[j - 1] > a { dss_fe_ages[j] = dss_fe_ages[j - 1]; j = j - 1 } else { go = 0 } } else { go = 0 } }
          dss_fe_ages[j] = a
          k = k + 1
      }
      i = i + 1
  }
  out[0] = k
  if k == 0 { return 0 }
  if (k % 2) == 1 { out[2] = dss_fe_ages[k / 2] } else { out[2] = (dss_fe_ages[k / 2 - 1] + dss_fe_ages[k / 2]) / 2 }
  return 0
520}
521// extract the url's HOST (bytes after "://" up to '/' or ':', lowercased) into out. Returns host length, 0 = none.
522func dss_url_host(u: *u8, ul: i64, out: *u8) -> i64 {
  var hs: i64 = 0 - 1
  var i: i64 = 0
  while i + 2 < ul {
      if u[i] == (58 as u8) { if u[i+1] == (47 as u8) { if u[i+2] == (47 as u8) { hs = i + 3; i = ul } } }
      i = i + 1
  }
  if hs < 0 { out[0] = 0 as u8; return 0 }
  var o: i64 = 0
  var he: i64 = hs
  var go: i64 = 1
  while go == 1 {
      if he >= ul { go = 0 } else {
          if u[he] == (47 as u8) { go = 0 } else { if u[he] == (58 as u8) { go = 0 } else {
              var c: i64 = u[he] as i64
              if c >= 65 { if c <= 90 { c = c + 32 } }
              if o < 250 { out[o] = c as u8; o = o + 1 }
              he = he + 1
          } }
      }
  }
  out[o] = 0 as u8
  return o
545}
546// is this the broad open-web shard? The host-crowding diversity cap applies ONLY to "web": site + trusted
547// shards are single-origin / curated, where capping per host would wrongly hide the owner's own pages.
548func dss_is_web(domain: *u8) -> i64 {
  if domain[0] == (119 as u8) { if domain[1] == (101 as u8) { if domain[2] == (98 as u8) { if domain[3] == (0 as u8) { return 1 } } } }
  return 0
551}
552// cheap host fingerprint for the per-page diversity cap: extract the url's host (reusing dss_url_host) into
553// `scratch`, then a 131-base rolling hash (wrapping i64; collisions across one query's <=512 candidates are
554// negligible). Returns 0 when the doc has no url host (library/relative docs) -> never capped.
555func dss_hosthash(u: *u8, ul: i64, scratch: *u8) -> i64 {
  let hl: i64 = dss_url_host(u, ul, scratch)
  if hl <= 0 { return 0 }
  var hsh: i64 = 0
  var i: i64 = 0
  while i < hl { hsh = hsh * 131 + (scratch[i] as i64); i = i + 1 }
  if hsh == 0 { hsh = 1 }
  return hsh
563}
564// ENTITY fingerprint for DSS_ENTITYCAP: the same document republished under a per-language or
565// per-region subdomain is ONE entity. Key = (host minus its leading label) + (path), and BOTH halves
566// are load-bearing:
567//   - stripping the leading label is what makes en./sv./it..wikipedia.org converge on wikipedia.org;
568//   - requiring the PATH to match is what stops that stripping from over-collapsing. A bare suffix key
569//     would fold bbc.co.uk and guardian.co.uk together (both -> co.uk), which is the classic
570//     public-suffix trap; with the path included, two such hosts merge only when they also serve the
571//     byte-identical path, and at that point they are a duplicate by any reasonable reading.
572// The leading label is dropped ONLY when the host has 3+ labels, so a 2-label host (wikipedia.org) is
573// never reduced to its TLD. That is a STRUCTURAL test on label count, not a tuned threshold, and it
574// needs no public-suffix list -- which this estate does not ship and must not pretend to.
575// ★RESOLVING A NAME IS NOT RESOLVING A THING: this returns a fingerprint, and two docs sharing it are
576// treated as one ENTITY for capping only -- scores and totals are untouched, exactly like the host cap.
577// Returns 0 when the doc has no url host (library/relative docs) -> never capped, same contract as
578// dss_hosthash, so the fail-safe direction is "do nothing".
579func dss_entityhash(u: *u8, ul: i64, scratch: *u8) -> i64 {
  let hl: i64 = dss_url_host(u, ul, scratch)
  if hl <= 0 { return 0 }
  var dots: i64 = 0
  var d: i64 = 0
  while d < hl { if scratch[d] == (46 as u8) { dots = dots + 1 } d = d + 1 }
  var start: i64 = 0
  if dots >= 2 {
      var j: i64 = 0
      var found: i64 = 0
      while j < hl {
          if found == 0 { if scratch[j] == (46 as u8) { start = j + 1; found = 1 } }
          j = j + 1
      }
  }
  var hsh: i64 = 0
  var k: i64 = start
  while k < hl { hsh = hsh * 131 + (scratch[k] as i64); k = k + 1 }
  // Now fold in the PATH, read straight off the url after the "://" host section. Stops at '?' so a
  // tracking query string cannot split one entity into many.
  var hs: i64 = 0 - 1
  var i: i64 = 0
  while i + 2 < ul {
      if u[i] == (58 as u8) { if u[i+1] == (47 as u8) { if u[i+2] == (47 as u8) { hs = i + 3; i = ul } } }
      i = i + 1
  }
  if hs < 0 { return 0 }
  var p: i64 = hs
  var scan: i64 = 1
  while scan == 1 {
      if p >= ul { scan = 0 } else {
          if u[p] == (47 as u8) { scan = 0 } else { p = p + 1 }
      }
  }
  var q: i64 = p
  var pscan: i64 = 1
  while pscan == 1 {
      if q >= ul { pscan = 0 } else {
          if u[q] == (63 as u8) { pscan = 0 } else {
              var c: i64 = u[q] as i64
              if c >= 65 { if c <= 90 { c = c + 32 } }
              hsh = hsh * 131 + c
              q = q + 1
          }
      }
  }
  if hsh == 0 { hsh = 1 }
  return hsh
627}
628// url-cid = the crawler's ci_hash (nx_corpus_ingest) -- the LINK-GRAPH node id (out:/pr: keys). MUST match
629// ci_hash byte-for-byte so serve-time pr:<ci_hash(url)> resolves the authority nx_pagerank_build stored.
630func dss_urlcid(s: *u8, n: i64) -> i64 {
  var h: i64 = DSS_MAGIC_1125899906842597
  var i: i64 = 0
  while i < n { h = (h * 131) + (s[i] as i64); i = i + 1 }
  if h < 0 { h = 0 - h }
  return h & 0x7fffffffffffffff
636}
637// build "pr:<cid>" authority-prior key (MUST match nx_pagerank_build pb_prkey).
638func dss_prkey(cid: i64, out: *u8) -> i64 {
  out[0] = 112 as u8   // p
  out[1] = 114 as u8   // r
  out[2] = 58 as u8    // :
  // MSB-FIRST: zero allocation (2026-07-31, debt 1785516350). Byte-identical incl. the cid==0 case,
  // which the digit walk emits naturally as a single 0 rather than needing a special branch.
  var m: i64 = cid
  var o: i64 = 3
  var pw: i64 = 1
  while m / pw >= DSC_DEC { pw = pw * DSC_DEC }
  while pw > 0 { out[o] = (DSC_ASCII_0 + ((m / pw) % DSC_DEC)) as u8; o = o + 1; pw = pw / DSC_DEC }
  out[o] = 0 as u8
  return o
651}
652// does the url's HOST match `host` (exact or dot-suffix: site:wikipedia.org covers en.wikipedia.org)?
653// Host = url bytes after "://" up to '/' or ':' (lowercased). Returns 1 match / 0 no.
654func dss_url_host_match(u: *u8, ul: i64, host: *u8) -> i64 {
  if ul < 4 { return 0 }
  let hl: i64 = dss_tlen(host)
  if hl == 0 { return 0 }
  // find "://" (absent -> host starts at 0: relative urls have no host -> no match unless ul starts w/ host? treat as no-host, no match)
  var hs: i64 = 0 - 1
  var i: i64 = 0
  while i + 2 < ul {
      if u[i] == (58 as u8) { if u[i+1] == (47 as u8) { if u[i+2] == (47 as u8) { hs = i + 3; i = ul } } }
      i = i + 1
  }
  if hs < 0 { return 0 }
  var he: i64 = hs
  var go: i64 = 1
  while go == 1 {
      if he >= ul { go = 0 } else {
          if u[he] == (47 as u8) { go = 0 } else { if u[he] == (58 as u8) { go = 0 } else { he = he + 1 } }
      }
  }
  let hn: i64 = he - hs
  if hn < hl { return 0 }
  // compare the TAIL of the host with `host` (lowercase both sides)
  var x: i64 = 0
  while x < hl {
      var ca: i64 = u[hs + hn - hl + x] as i64
      if ca >= 65 { if ca <= 90 { ca = ca + 32 } }
      if ca != (host[x] as i64) { return 0 }
      x = x + 1
  }
  if hn == hl { return 1 }
  // longer actual host: the char just before the suffix must be '.' (en.wikipedia.org vs notwikipedia.org)
  if u[hs + hn - hl - 1] == (46 as u8) { return 1 }
  return 0
687}
688// R2b URL-PATH FILTER (2026-08-04, the subreddit/inurl rung): does the url CONTAIN `pat` (caller
689// pre-lowercased) case-insensitively? seganchor=1 additionally requires the byte after the match to be
690// a segment boundary ('/', '?', '#', or end-of-url) so "/r/game" never claims "/r/gamedev". Shares the
691// site: contract: a candidate with no url row is not path-attributable and the caller drops it.
692func dss_url_path_has(u: *u8, ul: i64, pat: *u8, seganchor: i64) -> i64 {
  let pl: i64 = dss_tlen(pat)
  if pl == 0 { return 0 }
  if ul < pl { return 0 }
  var i: i64 = 0
  while i + pl <= ul {
      var m: i64 = 1
      var k: i64 = 0
      while k < pl {
          var ca: i64 = u[i + k] as i64
          if ca >= 65 { if ca <= 90 { ca = ca + 32 } }
          if ca != (pat[k] as i64) { m = 0; k = pl } else { k = k + 1 }
      }
      if m == 1 {
          if seganchor == 0 { return 1 }
          if i + pl >= ul { return 1 }
          let cb: i64 = u[i + pl] as i64
          if cb == 47 { return 1 }
          if cb == 63 { return 1 }
          if cb == 35 { return 1 }
      }
      i = i + 1
  }
  return 0
716}
717// parse the cid out of a "doc:<cid>" key (kp,kl). Returns cid, or -1 if not a doc key.
718func dss_key_cid(kp: *u8, kl: i64) -> i64 {
  if kl < 5 { return 0 - 1 }
  if kp[0] != (100 as u8) { return 0 - 1 }   // 'd'
  if kp[1] != (111 as u8) { return 0 - 1 }   // 'o'
  if kp[2] != (99 as u8)  { return 0 - 1 }   // 'c'
  if kp[3] != (58 as u8)  { return 0 - 1 }   // ':'
  var v: i64 = 0
  var i: i64 = 4
  while i < kl {
      if kp[i] >= (48 as u8) { if kp[i] <= (57 as u8) { v = v * 10 + ((kp[i] - (48 as u8)) as i64) } }
      i = i + 1
  }
  return v
731}
732
733// exact match of a normalized token against a null-terminated term
734func dss_streq(tok: *u8, term: *u8) -> i64 {
  var i: i64 = 0
  while tok[i] != (0 as u8) {
      if tok[i] != term[i] { return 0 }
      i = i + 1
  }
  if term[i] != (0 as u8) { return 0 }
  return 1
742}
743
744// term frequency of `term` in doc[0..dn) using the SAME tokenizer/table the index was built with (tbl prebuilt)
745func dss_tf(doc: *u8, dn: i64, term: *u8, tbl: *u8) -> i64 {
  let tbuf: *u8 = sys_mmap(DSC_TOKBUF)
  let pos: *i64 = sys_mmap(DSC_POSBUF) as *i64
  pos[0] = 0
  var tf: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let l: i64 = ss_tok_next2(doc, dn, pos, tbuf, tbl)
      if l < 0 { go = 0 } else {
          if dss_streq(tbuf, term) == 1 { tf = tf + 1 }
      }
  }
  sys_munmap(tbuf, DSC_TOKBUF)
  sys_munmap(pos as *u8, DSC_POSBUF)
  return tf
760}
761// ONE walk, ALL the statistics: per-term tf into tf_out[0..nterms) AND the doc's total token count |d|
762// (the BM25 length-norm needs it; also kills the old nterms-walks-per-candidate cost). Returns |d|.
763// PER-CALL SCRATCH -> LAZY STATICS, HALF ONE OF TWO (2026-08-14). dss_tf_all is called ONCE PER
764// CANDIDATE from the ranking loop (line ~1678) with DSS_MAXCAND = 2048, mmap'ing THREE buffers per call
765// and freeing none: ~6,100 unfreed mmap syscalls per query. Its sibling dss_prox_all does SEVEN more on
766// the next line. Same law as ts_wn and tg_from_peer the same day.
767// DELIBERATELY HOISTING ONLY THIS FUNCTION IN THIS CHANGE: hoisting BOTH at once on 2026-08-14 made the
768// daemon fault out-of-bounds on every query (503 in <1s, resolve hint 0x483500) and had to be rolled
769// back, and because both moved together the fault was NOT ATTRIBUTABLE to either. One at a time, each
770// verified before the next, is the only way to learn which one is unsafe.
771// TESTABLE WITHOUT PRODUCTION: nx_doc_lexstat.nx:44 calls dss_tf_all directly from a CLI, so this half
772// can be exercised without deploying the search daemon at all.
773// NO ZERO-FILL NEEDED, VERIFIED PER BUFFER: pos[0] is set explicitly; fb[t] is written for t < nterms
774// and read only for t < nterms (and nterms is capped at DSS_MAXTERMS by dss_stem_expand's own
775// `if nt >= DSS_MAXTERMS` guard, checked rather than assumed); tbuf is filled by ss_tok_next2 before any
776// read. SAFE AS STATICS: not recursive, never concurrent with itself, scratch dead on return.
777// S3 (2026-09-04): THE STEM-EXPANSION ABLATION SWITCH. Published evidence says a query rewrite must EARN
778// its place -- LLM query rewriting made the strongest model WORSE on every metric with every technique --
779// and this estate spent a day fixing the ACCOUNTING of stem expansion without ever asking the prior
780// question: does expanding at all beat not expanding? It cannot be asked without a switch.
781// SENSE IS DELIBERATELY "off" NOT "on": an unset static is 0, so the default path is expansion ENABLED,
782// exactly as today, and a build that never calls the setter is byte-identical.
783static dss_expand_off: i64
784func dss_set_expand_off(v: i64) -> i64 { dss_expand_off = v; return dss_expand_off }
785// E4 CORPUS SCOPE (2026-09-14): a scope is a url PREFIX every candidate's url row must start with, set per request
786// through dss_set_scope_prefix (empty = no scope, the byte-identical default) and applied in dss_search_off_div on
787// the same candidate pipeline as site: and inurl: -- one url-row read per candidate, never a second engine. The
788// scope word to (domain, prefix) mapping is DATA (knowledge/search_scopes.conf) read by the serve lib.
789static dss_scope_pfx: *u8
790static dss_scope_pfx_n: i64
791func dss_set_scope_prefix(p: *u8, n: i64) -> i64 { dss_scope_pfx = p; dss_scope_pfx_n = n; return n }
792static dss_scope_us: i64                 // microseconds the last scope filter cost (0 when no scope was set)
793func dss_scope_stats() -> i64 { return dss_scope_us }
794// E4 CONTRACT SYMBOL dss_scope_filter: does url u[0..ul) start with the scope prefix? An empty prefix keeps every
795// document (no scope); a url shorter than the prefix cannot carry it.
796func dss_scope_filter(u: *u8, ul: i64, pfx: *u8, pn: i64) -> i64 {
  if pn <= 0 { return 1 }
  if ul < pn { return 0 }
  var i: i64 = 0
  while i < pn { if u[i] != pfx[i] { return 0 } i = i + 1 }
  return 1
802}
803// S5 (2026-09-04) BM25Q query-side saturation lived here as an UNWIRED 3-argument primitive (idf_bm25q(w, qtf, k3)); on
804// 2026-09-16 (rung S7) it was RETIRED in favour of the ONE ruler the harness measured with, nx_intlog.idf_bm25q(idf, qtf)
805// (k fixed at BM25Q_K_Q10 in Q10, qtfsat_q10(1) exactly 1024), and wired into PASS 2 -- two spellings of one arithmetic
806// is the duplicate-ruler defect, and the served copy had no caller (nx_qrels_bench held its only teeth; they moved).
807static dss_tfs_tbuf: *u8
808static dss_tfs_pos:  *i64
809static dss_tfs_fb:   *u8
810func dss_tf_all(doc: *u8, dn: i64, termptrs: *i64, nterms: i64, tbl: *u8, tf_out: *i64) -> i64 {
  if (dss_tfs_tbuf as i64) == 0 { dss_tfs_tbuf = sys_mmap(DSC_TOKBUF) }
  if (dss_tfs_pos  as i64) == 0 { dss_tfs_pos  = sys_mmap(DSC_POSBUF) as *i64 }
  let tbuf: *u8 = dss_tfs_tbuf
  let pos: *i64 = dss_tfs_pos
  pos[0] = 0
  // first-byte discriminator: this loop runs per TOKEN x per TERM over 32KB x 128 candidates -- a
  // one-byte gate before the full compare kills ~96% of the dss_streq calls (the p95 hot path)
  if (dss_tfs_fb as i64) == 0 { dss_tfs_fb = sys_mmap(DSS_MAXTERMS + 8) }
  let fb: *u8 = dss_tfs_fb
  var t0: i64 = 0
  while t0 < nterms {
      tf_out[t0] = 0
      let tp0: *u8 = termptrs[t0] as *u8
      fb[t0] = tp0[0]
      t0 = t0 + 1
  }
  var dl: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let l: i64 = ss_tok_next2(doc, dn, pos, tbuf, tbl)
      if l < 0 { go = 0 } else {
          dl = dl + 1
          let b0: u8 = tbuf[0]
          var t: i64 = 0
          while t < nterms {
              if fb[t] == b0 {
                  if dss_streq(tbuf, termptrs[t] as *u8) == 1 { tf_out[t] = tf_out[t] + 1 }
              }
              t = t + 1
          }
      }
  }
  sys_munmap(tbuf, DSC_TOKBUF)
  sys_munmap(pos as *u8, DSC_POSBUF)
  sys_munmap(fb, DSS_MAXTERMS + 8)
  return dl
847}
848
849// ---- serve-time TERM-PROXIMITY (R1b): query terms that CLUSTER in a doc = more relevant (Buttcher-
850// Clarke-Cormack 2006). Token-ALIGNED: clones dss_tf_all's ss_tok_next2 loop so it matches EXACTLY the
851// tokens BM25 tf matched (a raw-substring version would mis-fire on case/stem/substring-in-word and
852// REGRESS ranking -- the anti-cheat). Records the token INDEX of each query-term hit -> smallest token
853// window containing all PRESENT terms -> strength. <2 present terms -> 0 (ranking unchanged = safety).
854// Does NOT touch the tf/BM25 path; applied as a bounded PASS-2 multiply, mirroring the authority fusion.
855const DSS_PROX_SCALE: i64 = 1024
856const DSS_PROX_WREF:  i64 = 8       // reference window in TOKENS; span << WREF -> near-full strength
857const DSS_PROX_BOOST: i64 = 1024    // max boost: prox=SCALE -> factor 2048/1024 = 2x (bounded, capped)
858const DSS_PROX_OCAP:  i64 = 512     // max query-term occurrences tracked (bounded serve cost)
859const DSS_TITLE_TOKENS: i64 = 6     // R1c: leading tokens treated as the TITLE / lead field
860const DSS_TITLE_BONUS:  i64 = 384   // R1c: per-distinct-term title hit (BM25F-lite), summed then capped at SCALE
861// R1d COORDINATION (2026-07-24): reward docs that match MORE distinct query terms. A doc covering `cov` of
862// `nterms` terms gets factor DSS_COV_FLOOR + (1024-FLOOR)*(cov-1)/(nterms-1): cov==nterms -> 1024 (byte-identical,
863// so single-term queries + full matches are unchanged), cov=1-of-2 -> 256 (0.25x). Multi-term NON-phrase only.
864// This is Lucene-coord's principle and fulfils this module's stated "rank by # distinct terms matched" intent --
865// it stops a rare single-term hit (idf high, tf high) from out-SUMMING a genuine two-term match (e.g. "julia
866// kyoka" no longer ranks Izumi-Kyoka literature pages, and "diora baird" demotes baird-only law-firm pages).
867const DSS_COV_FLOOR:    i64 = 256   // coord factor for a doc matching only the FIRST of >=2 distinct query terms
868// R1h PROVENANCE (2026-09-04). DSS_COV_FLOOR IS DELIBERATELY UNCHANGED and must stay so. The 2026-08-17
869// seat that made this falloff quadratic wrote down why lowering the floor is the wrong fix, and it was
870// right: the defect was never the bar, it was the DENOMINATOR. covfac compares matched idf mass against
871// total idf mass, and both sums ran over the POST-stem-expansion term list, so a rare invented variant
872// like "redding" for the typed word "red" carried a LARGE idf into both sides and the coordination test
873// it exists to fail was satisfied by a word nobody searched for. The owner[] map added this session makes
874// the obligation the terms the USER TYPED and folds every matched surface form back onto its concept, so
875// credit can never exceed obligation. WHEN A CALIBRATED THRESHOLD KEEPS LOSING, FIX THE MECHANISM RATHER
876// THAN MOVE THE NUMBER -- and here the mechanism was one loop bound, in three places, twice already fixed
877// in a sibling loop (R1f, 2026-08-05) and never given to the others.
878func dss_popcount(m: i64) -> i64 { var c: i64 = 0; var x: i64 = m; while x != 0 { c = c + (x & 1); x = x >> 1 } return c }
879// R1e SEARCH-PAGE DE-RANK (2026-07-24): a URL that is itself a SEARCH / QUERY-ECHO page (/search, ?q=, ?s=,
880// ?query=, ?search=) is a query box echoing the query, not content ABOUT it (e.g. jav.guru/?s=julia+kyoka
881// "You searched for julia kyoka"). Half-weight it so real content outranks it WHEN content exists -- but it is
882// NEVER buried: an aggregator that is the best 2-term match available still surfaces (bounded multiply, not a drop).
883const DSS_SEARCHPAGE_PEN: i64 = 512   // 512/1024 = 0.5x on a detected search/query-echo URL (web scope only)
884const DSS_S9_PAGE_KINDS: i64 = 2      // S9: page kinds per coverage level in the precedence key -- content, results page
885const DSS_I64_BYTES: i64 = 8          // bytes per i64 slot (the composite key array)
886const DSS_S9_ENTITY_TERMS: i64 = 2    // S9b: a name lookup is one or two typed words (the slug prior's shape gate)
887// R1f SALIENT-IDF AUTHORITY FLOOR (2026-07-24): a high-PageRank domain earns its authority boost only if it
888// matched >= this fraction (Q10) of the query's CONTENT idf-mass -- not just any peripheral term. Stops
889// science.nasa.gov (matches "pressure" but not the "blood pressure" concept + "how to") riding authority to #1.
890const DSS_AUTH_IDF_MIN: i64 = 512   // 512/1024 = 50% of the query content idf-mass required to earn the PR boost
891func dss_sub_at(u: *u8, n: i64, i: i64, pat: *u8, plen: i64) -> i64 {
  if i + plen > n { return 0 }
  var j: i64 = 0
  while j < plen { if u[i + j] != pat[j] { return 0 } j = j + 1 }
  return 1
896}
897func dss_is_search_url(u: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n {
      if dss_sub_at(u, n, i, "/search" as *u8, 7) == 1 { return 1 }
      if dss_sub_at(u, n, i, "?q=" as *u8, 3) == 1 { return 1 }
      if dss_sub_at(u, n, i, "&q=" as *u8, 3) == 1 { return 1 }
      if dss_sub_at(u, n, i, "?s=" as *u8, 3) == 1 { return 1 }
      if dss_sub_at(u, n, i, "&s=" as *u8, 3) == 1 { return 1 }
      if dss_sub_at(u, n, i, "?query=" as *u8, 7) == 1 { return 1 }
      if dss_sub_at(u, n, i, "?search=" as *u8, 8) == 1 { return 1 }
      i = i + 1
  }
  return 0
910}
911// R1g URL-SLUG ENTITY PRIOR (2026-07-24): a CONTENT query term that IS a whole path segment of the URL
912// (/idols/julia/) -- or a segment prefix ending at a wordbreak (_ - .) as in /wiki/Julia_(novel) -- marks a
913// page ABOUT the entity, not a mere mention. BM25 length-norm buries long authority profile pages under short
914// mention-stubs (measured 2026-07-24: bare "julia" ranked 25 onejav torrent stubs, /idols/julia/ absent from
915// page 0); the slug prior is the entity-understanding counterweight. Applied at most once per candidate, only
916// for terms the candidate MATCHED, never to a search/query-echo URL. Site/gate corpora: the authority block is
917// web-scope-only -> inert there.
918const DSS_SLUG_BOOST:  i64 = 6144   // Q10 6.0x: must clear the mention-wall (measured: ~140 short torrent stubs
                                  // at ~6.1M vs the profile page's ~1.5M BM25 base -- 2x left it below rank 60)
920const DSS_SLUG_MINLEN: i64 = 4      // ignore short segments/terms (/en/, /id/) -- too weak to mark an entity
921// RARITY GATE (measured 2026-07-24): the blanket slug prior REGRESSED the ruler 809->640 by 2x-boosting
922// generic nouns as segments ("survey" -> catalog.ihsn.org, "university" -> mlhmi.org, "pressure" -> nasa).
923// Entity NAMES are rare terms; generic nouns are common. Fire only when the term is in < corpus/RAREK docs
924// (0.2%): julia 0.08% fires; survey/university/pressure/household all miss.
925const DSS_SLUG_RAREK:  i64 = 512
926// R2d KEYWORD-STUFFING PENALTY (2026-08-04, debt 1785895889, MEASURED via nx_doc_lexstat over the
927// live SERP: spam blogspot maxdens=42, listicle 20, REAL content 2-11 incl. a hypertension paper at
928// 11 -- threshold 16 = 45% margin over the strongest legitimate doc). A COMMON term whose scan-tf
929// exceeds DSS_STUFF_DENS/1024 of the doc's tokens reads as stuffing -> ONE bounded 0.5x multiply.
930// RARE terms are EXEMPT (dcnt*DSS_SLUG_RAREK < bign = an entity name; profile/filmography pages
931// legitimately repeat the name -- the July julia work must not regress). Small corpora
932// (bign < DSS_STOP_MINCORPUS) and tiny docs are inert -> every gate fixture stays byte-identical.
933// (Declared BELOW DSS_SLUG_RAREK: module consts must precede their first reader.)
934const DSS_STUFF_DENS: i64 = 16
935const DSS_STUFF_PEN:  i64 = 512
936const DSS_STUFF_MINTOKS: i64 = 64
937func dss_stuff_factor(tf: i64, toks: i64, dcnt: i64, bign: i64) -> i64 {
  if bign < DSS_STOP_MINCORPUS { return DSS_MAGIC_1024 }
  if toks < DSS_STUFF_MINTOKS { return DSS_MAGIC_1024 }
  if dcnt * DSS_SLUG_RAREK < bign { return DSS_MAGIC_1024 }
  if tf * DSS_MAGIC_1024 > toks * DSS_STUFF_DENS { return DSS_STUFF_PEN }
  return DSS_MAGIC_1024
943}
944// R2d BRAND-LABEL EXEMPTION (the 368->297 navigational-regression fix, measured 2026-08-04):
945// a doc whose url HOST carries the query term as a whole '.'/'-'-bounded LABEL is the term's
946// OWNER, not a stuffer -- github.com is legitimately dense in "github", rust-lang.org in "rust".
947// "blood" inside highbloodpressure67.blogspot.com has NO boundary -> the spam stays penalized.
948// (Known honest limitation: a hyphenated keyword domain like blood-pressure-tips.example earns
949// the exemption -- '-' must be a boundary or rust-lang/git-scm class navigation breaks, and the
950// hyphen-domain class is better answered by authority than by this penalty.)
951func dss_host_label_match(u: *u8, ul: i64, term: *u8, scratch: *u8) -> i64 {
  let hl: i64 = dss_url_host(u, ul, scratch)
  if hl <= 0 { return 0 }
  var tl: i64 = 0
  while term[tl] != (0 as u8) { tl = tl + 1 }
  if tl == 0 { return 0 }
  var i: i64 = 0
  while i < hl {
      // label start = position 0 or preceded by '.'/'-'
      var isstart: i64 = 0
      if i == 0 { isstart = 1 } else {
          if scratch[i - 1] == (46 as u8) { isstart = 1 }
          if scratch[i - 1] == (45 as u8) { isstart = 1 }
      }
      if isstart == 1 { if i + tl <= hl {
          var m: i64 = 1
          var k: i64 = 0
          while k < tl { if scratch[i + k] != term[k] { m = 0; k = tl } else { k = k + 1 } }
          if m == 1 {
              // label end = host end or followed by '.'/'-'
              if i + tl == hl { return 1 }
              if scratch[i + tl] == (46 as u8) { return 1 }
              if scratch[i + tl] == (45 as u8) { return 1 }
          }
      } }
      i = i + 1
  }
  return 0
979}
980func dss_lower(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
981// ---- S11 ENTITY PIN (2026-09-17) ---------------------------------------------------------------------------------
982// The operator's REJECT (2026-09-16, "julia kyoka"): the canonical entity page (the javdatabase idol page) was in the
983// candidate set but scored below albums and three results pages, because it says JULIA and the query says julia kyoka.
984// The estate already resolves the alias: nx_entity_dossier picks the canonical landing out of the same search and
985// writes knowledge/status/dossier-<slug>.txt; nx_entity_pin projects those resolutions into ONE served table,
986// knowledge/status/entitypin.tsv (query<TAB>cid<TAB>url<TAB>jp<TAB>authority<TAB>asof), loaded here ONCE and reloaded
987// only when its size or mtime moves (a stat per name-shaped query, never a plane read: the seg-store reader allocates
988// per call and a serving daemon cannot leak per query). A pinned candidate takes a tier band above every S9 tier,
989// derived from the same bases, so it ranks first WHEN it is a candidate; a pin whose page is not a candidate changes
990// nothing and is announced as pinned=0 with the cid, so the miss is visible. Web path only, name-shaped queries only.
991const DSS_ENT_PATH_DEFAULT: *u8 = "knowledge/status/entitypin.tsv"
992const DSS_ENT_MAXROWS: i64 = 4096
993const DSS_ENT_KEYCAP: i64 = 128
994const DSS_ENT_STAT_BYTES: i64 = 256
995const DSS_ENT_STAT_SIZE_OFF: i64 = 48     // st_size in the x86-64 stat buffer
996const DSS_ENT_STAT_MTIME_OFF: i64 = 88    // st_mtim.tv_sec
997const DSS_ENT_READ_CHUNK: i64 = 65536
998const DSS_ENT_TAB: i64 = 9
999const DSS_ENT_NL: i64 = 10
1000const DSS_ENT_SPACE: i64 = 32
1001const DSS_ENT_DIGIT0: i64 = 48
1002const DSS_ENT_DIGIT9: i64 = 57
1003const DSS_ENT_TEN: i64 = 10
1004const DSS_ENT_BOX_SLOTS: i64 = 4
1005static dss_ent_path: *u8
1006static dss_ent_keys: *u8
1007static dss_ent_cids: *i64
1008static dss_ent_n: i64
1009static dss_ent_size: i64
1010static dss_ent_mtime: i64
1011static dss_ent_loaded: i64
1012static dss_ent_box: *i64
1013static dss_ent_buf: *u8        // S11-b: the table's bytes, retained until the next reload (the card fields point into them)
1014static dss_ent_bufcap: i64
1015static dss_ent_uoff: *i64
1016static dss_ent_ulen: *i64
1017static dss_ent_joff: *i64
1018static dss_ent_jlen: *i64
1019static dss_ent_auth: *i64
1020static dss_ent_hit: i64        // the row the last lookup matched, -1 when none
1021func dss_ent_init() -> i64 {
  if dss_ent_loaded == 0 {
      dss_ent_keys = sys_mmap(DSS_ENT_MAXROWS * DSS_ENT_KEYCAP)
      dss_ent_cids = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_box = sys_mmap(DSS_ENT_BOX_SLOTS * DSS_I64_BYTES) as *i64
      dss_ent_uoff = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_ulen = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_joff = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_jlen = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_auth = sys_mmap(DSS_ENT_MAXROWS * DSS_I64_BYTES) as *i64
      dss_ent_bufcap = 0
      dss_ent_hit = 0 - 1
      if (dss_ent_path as i64) == 0 { dss_ent_path = DSS_ENT_PATH_DEFAULT }
      dss_ent_size = 0 - 1
      dss_ent_mtime = 0 - 1
      dss_ent_n = 0
      dss_ent_loaded = 1
  }
  return 0
1040}
1041// a gate points the ranker at a fixture table; the next lookup reloads
1042func dss_ent_set_path(p: *u8) -> i64 { dss_ent_init(); dss_ent_path = p; dss_ent_size = 0 - 1; dss_ent_mtime = 0 - 1; return 0 }
1043func dss_ent_set(pinned: i64, cid: i64) -> i64 { dss_ent_init(); dss_ent_box[0] = pinned; dss_ent_box[1] = cid; return 0 }
1044// ANNOUNCED: out[0] pinned (1 = the resolved page was a candidate and took the top band), out[1] the resolved cid
1045// (0 = no row for this query), out[2] rows in the served table
1046func dss_entity_stats(out: *i64) -> i64 { dss_ent_init(); out[0] = dss_ent_box[0]; out[1] = dss_ent_box[1]; out[2] = dss_ent_n; return 3 }
1047// (re)load the table when the file's size or mtime moved; an absent file empties the table (no pins, no error)
1048func dss_ent_reload() -> i64 {
  dss_ent_init()
  let sb: *u8 = sys_mmap(DSS_ENT_STAT_BYTES)
  var sz: i64 = 0
  var mt: i64 = 0
  if sys_fstatat(dss_ent_path, sb) >= 0 {
      let sp: *i64 = ((sb as i64) + DSS_ENT_STAT_SIZE_OFF) as *i64
      let mp: *i64 = ((sb as i64) + DSS_ENT_STAT_MTIME_OFF) as *i64
      sz = sp[0]
      mt = mp[0]
  }
  sys_munmap(sb, DSS_ENT_STAT_BYTES)
  if sz == dss_ent_size { if mt == dss_ent_mtime { return dss_ent_n } }
  dss_ent_size = sz
  dss_ent_mtime = mt
  dss_ent_n = 0
  if sz <= 0 { return 0 }
  let fd: i64 = sys_openat_rd(dss_ent_path)
  if fd < 0 { return 0 }
  let cap: i64 = sz + 1
  let buf: *u8 = sys_mmap(cap)
  var got: i64 = 0
  var r: i64 = 1
  while r > 0 {
      var want: i64 = cap - got
      if want > DSS_ENT_READ_CHUNK { want = DSS_ENT_READ_CHUNK }
      if want <= 0 { r = 0 } else { r = sys_read(fd, ((buf as i64) + got) as *u8, want); if r > 0 { got = got + r } }
  }
  sys_close(fd)
  let n: i64 = got
  var i: i64 = 0
  while i < n {
      if dss_ent_n >= DSS_ENT_MAXROWS { i = n } else {
          let kd: *u8 = ((dss_ent_keys as i64) + dss_ent_n * DSS_ENT_KEYCAP) as *u8
          var k: i64 = 0
          var go: i64 = 1
          var sawtab: i64 = 0
          while go == 1 {
              if i >= n { go = 0 } else {
                  let c: i64 = buf[i] as i64
                  if c == DSS_ENT_TAB { sawtab = 1; go = 0; i = i + 1 }
                  else { if c == DSS_ENT_NL { go = 0; i = i + 1 } else { if k < DSS_ENT_KEYCAP - 1 { kd[k] = dss_lower(c) as u8; k = k + 1 } i = i + 1 } }
              }
          }
          kd[k] = 0 as u8
          var cid: i64 = 0
          if sawtab == 1 {
              go = 1
              while go == 1 {
                  if i >= n { go = 0 } else {
                      let c2: i64 = buf[i] as i64
                      if c2 >= DSS_ENT_DIGIT0 { if c2 <= DSS_ENT_DIGIT9 { cid = cid * DSS_ENT_TEN + (c2 - DSS_ENT_DIGIT0); i = i + 1 } else { go = 0 } } else { go = 0 }
                  }
              }
              // S11-b: url, jp and authority follow the cid, each up to a TAB (the card's fields, offsets into the retained bytes)
              var uo: i64 = 0; var ul: i64 = 0; var jo: i64 = 0; var jl: i64 = 0; var au: i64 = 0
              if i < n { if buf[i] as i64 == DSS_ENT_TAB {
                  i = i + 1; uo = i
                  go = 1
                  while go == 1 { if i >= n { go = 0 } else { let cu: i64 = buf[i] as i64; if cu == DSS_ENT_TAB { go = 0 } else { if cu == DSS_ENT_NL { go = 0 } else { i = i + 1 } } } }
                  ul = i - uo
                  if i < n { if buf[i] as i64 == DSS_ENT_TAB {
                      i = i + 1; jo = i
                      go = 1
                      while go == 1 { if i >= n { go = 0 } else { let cj: i64 = buf[i] as i64; if cj == DSS_ENT_TAB { go = 0 } else { if cj == DSS_ENT_NL { go = 0 } else { i = i + 1 } } } }
                      jl = i - jo
                      if i < n { if buf[i] as i64 == DSS_ENT_TAB {
                          i = i + 1
                          go = 1
                          while go == 1 { if i >= n { go = 0 } else { let ca: i64 = buf[i] as i64; if ca >= DSS_ENT_DIGIT0 { if ca <= DSS_ENT_DIGIT9 { au = au * DSS_ENT_TEN + (ca - DSS_ENT_DIGIT0); i = i + 1 } else { go = 0 } } else { go = 0 } } }
                      } }
                  } }
              } }
              go = 1
              while go == 1 { if i >= n { go = 0 } else { let c3: i64 = buf[i] as i64; i = i + 1; if c3 == DSS_ENT_NL { go = 0 } } }
              if k > 0 { if cid > 0 { dss_ent_uoff[dss_ent_n] = uo; dss_ent_ulen[dss_ent_n] = ul; dss_ent_joff[dss_ent_n] = jo; dss_ent_jlen[dss_ent_n] = jl; dss_ent_auth[dss_ent_n] = au } }
          }
          if k > 0 { if cid > 0 { dss_ent_cids[dss_ent_n] = cid; dss_ent_n = dss_ent_n + 1 } }
      }
  }
  if dss_ent_bufcap > 0 { sys_munmap(dss_ent_buf, dss_ent_bufcap) }
  dss_ent_buf = buf
  dss_ent_bufcap = cap
  return dss_ent_n
1132}
1133// the typed terms joined by one space, lowercased, against the table; 0 = no row
1134func dss_ent_lookup(termptrs: *i64, onterms: i64) -> i64 {
  if onterms < 1 { return 0 }
  if dss_ent_reload() == 0 { return 0 }
  let key: *u8 = sys_mmap(DSS_ENT_KEYCAP)
  var o: i64 = 0
  var t: i64 = 0
  while t < onterms {
      let tp: *u8 = termptrs[t] as *u8
      if t > 0 { if o < DSS_ENT_KEYCAP - 1 { key[o] = DSS_ENT_SPACE as u8; o = o + 1 } }
      var j: i64 = 0
      while tp[j] != (0 as u8) { if o < DSS_ENT_KEYCAP - 1 { key[o] = dss_lower(tp[j] as i64) as u8; o = o + 1 } j = j + 1 }
      t = t + 1
  }
  key[o] = 0 as u8
  var found: i64 = 0
  dss_ent_hit = 0 - 1
  var r: i64 = 0
  while r < dss_ent_n {
      if found == 0 {
          let kd: *u8 = ((dss_ent_keys as i64) + r * DSS_ENT_KEYCAP) as *u8
          var same: i64 = 1
          var q: i64 = 0
          var go: i64 = 1
          while go == 1 { if kd[q] != key[q] { same = 0; go = 0 } else { if key[q] == (0 as u8) { go = 0 } else { q = q + 1 } } }
          if same == 1 { found = dss_ent_cids[r]; dss_ent_hit = r }
      }
      r = r + 1
  }
  sys_munmap(key, DSS_ENT_KEYCAP)
  return found
1164}
1165// S11-c THE MEMO CARRIES THE PIN. A memoised answer serves the pinned order, so it must announce the pin: the memo slot
1166// keeps (pinned, cid); on a hit the box is restored and the card row re-found by cid (the table may not be loaded in
1167// this child yet, so the reload runs first). Two words, one save, one load, provable without the memo table.
1168func dss_ent_hit_by_cid(cid: i64) -> i64 {
  dss_ent_hit = 0 - 1
  if cid <= 0 { return 0 - 1 }
  if dss_ent_reload() == 0 { return 0 - 1 }
  var r: i64 = 0
  while r < dss_ent_n { if dss_ent_hit < 0 { if dss_ent_cids[r] == cid { dss_ent_hit = r } } r = r + 1 }
  return dss_ent_hit
1175}
1176func dss_ent_memo_save(w: *i64) -> i64 { dss_ent_init(); w[0] = dss_ent_box[0]; w[1] = dss_ent_box[1]; return 0 }
1177func dss_ent_memo_load(w: *i64) -> i64 {
  dss_ent_set(w[0], w[1])
  if w[0] == 1 { dss_ent_hit_by_cid(w[1]) }
  return 0
1181}
1182// S11-b THE CARD: the matched row's jp name (which = DSS_ENT_FIELD_JP) or canonical url (DSS_ENT_FIELD_URL) copied into
1183// dst, NUL-terminated, at most cap-1 bytes; 0 when no row matched or the pin did not fire. Announced beside the pin.
1184const DSS_ENT_FIELD_JP: i64 = 0
1185const DSS_ENT_FIELD_URL: i64 = 1
1186func dss_entity_field(which: i64, dst: *u8, cap: i64) -> i64 {
  dss_ent_init()
  dst[0] = 0 as u8
  if dss_ent_box[0] != 1 { return 0 }
  if dss_ent_hit < 0 { return 0 }
  var off: i64 = dss_ent_joff[dss_ent_hit]
  var len: i64 = dss_ent_jlen[dss_ent_hit]
  if which == DSS_ENT_FIELD_URL { off = dss_ent_uoff[dss_ent_hit]; len = dss_ent_ulen[dss_ent_hit] }
  if len > cap - 1 { len = cap - 1 }
  if len < 0 { len = 0 }
  var i: i64 = 0
  while i < len { dst[i] = dss_ent_buf[off + i]; i = i + 1 }
  dst[len] = 0 as u8
  return len
1200}
1201func dss_entity_titles() -> i64 {
  dss_ent_init()
  if dss_ent_box[0] != 1 { return 0 }
  if dss_ent_hit < 0 { return 0 }
  return dss_ent_auth[dss_ent_hit]
1206}
1207// does the null-terminated lowercase term equal the URL path segment starting at u[i] (whole segment, or a
1208// prefix ending at / ? _ - . )? URL side is case-folded.
1209func dss_slug_seg_eq(u: *u8, n: i64, i: i64, term: *u8) -> i64 {
  var j: i64 = 0
  while term[j] != (0 as u8) {
      if i + j >= n { return 0 }
      if dss_lower(u[i + j] as i64) != (term[j] as i64) { return 0 }
      j = j + 1
  }
  if j < DSS_SLUG_MINLEN { return 0 }
  if i + j >= n { return 1 }
  let c: i64 = u[i + j] as i64
  if c == 47 { return 1 }
  if c == 63 { return 1 }
  if c == 95 { return 1 }
  if c == 45 { return 1 }
  if c == 46 { return 1 }
  return 0
1225}
1226// scan the URL PATH (after the scheme+host) for any '/'-anchored segment equal to term; stop at the query string.
1227func dss_slug_match_term(u: *u8, n: i64, term: *u8) -> i64 {
  var s: i64 = 0
  var k: i64 = 0
  while k + 2 < n { if u[k]==(58 as u8) { if u[k+1]==(47 as u8) { if u[k+2]==(47 as u8) { s = k + 3; k = n } } } k = k + 1 }
  var i: i64 = s
  while i < n {
      if u[i] == (63 as u8) { return 0 }
      if u[i] == (47 as u8) { if dss_slug_seg_eq(u, n, i + 1, term) == 1 { return 1 } }
      i = i + 1
  }
  return 0
1238}
1239// PER-CALL ALLOCATION HERE IS REAL DEBT (8 mmaps x DSS_MAXCAND candidates, never unmapped) AND IT IS
1240// STILL OPEN -- but the reason recorded on 2026-08-14 for not fixing it WAS WRONG, and the correction
1241// matters more than the debt. See debt 1786768400.
1242//
1243// ⛔THE 2026-08-14 CLAIM -- "dss_prox_all CANNOT be hoisted to lazy statics; the SECOND call SIGSEGVs,
1244// reproduced outside production via nx_doc_lexstat" -- IS REFUTED BY MEASUREMENT, not merely doubted.
1245// 2026-08-15, with the hoist applied and the probe opening the shard the way the SERVE PATH does:
1246// SIX consecutive calls on a real web cid returned byte-identical rows, no fault on call 2 or any later
1247// call (bytes=56792 tokens=1083 prox=0, six times).
1248// WHY THE OLD VERDICT WAS WRONG, mechanism named: nx_doc_lexstat called ss_open, which is
1249// ss_open2(prefix, 0) = READ-ALL into anonymous memory. The live web shard's largest segment is 1.58 GB
1250// .docs + 490 MB .idx + 376 MB .pos across 14 segments, so that probe ran with GBs resident and no
1251// headroom. The hoist's eight RETAINED buffers were enough to tip it over on the second call, and an
1252// unchecked failing mmap then surfaced as SIGSEGV at a PAGE-ALIGNED address -- "one page past a
1253// mapping", which is exactly what a failed mapping dereference looks like. The probe has since been
1254// fixed to ss_open2(prefix, 1) (the mmap-backed opener the daemon uses via ss_open_cached).
1255// ★★★★★★THE HOIST WAS NEVER THE DEFECT -- IT WAS A MEMORY-PRESSURE AMPLIFIER INSIDE AN INSTRUMENT
1256// THAT OPENED ITS SUBJECT DIFFERENTLY FROM THE THING IT CLAIMED TO MEASURE. A page-aligned fault
1257// address is a signature of allocation failure, not of stale reused state; I read it as the latter and
1258// theorised for a day about pos[1] in a code path the process was dying before it could misuse.
1259// ⚠NOT YET PROVEN, AND THE REASON THIS IS STILL REVERTED: the 2026-08-14 PRODUCTION incident (hoisting
1260// all TEN buffers -- tf_all's 3 plus these 7 -- took /search down; rollback restored it) had a real
1261// control, so that causal link stands and is NOT explained by the probe's read-all problem. The daemon
1262// is a different process shape (fork-per-request, ss_open_cached). tf_all's 3 were later hoisted alone
1263// and SHIPPED SAFELY, so the residual suspicion is specific to these 7 under fork.
1264// ⇒ NEXT: prove it in the DAEMON shape before deploying -- the probe verdict is necessary, not
1265// sufficient. Only then take the ~14,300 unfreed mmaps per query.
1266// R1i-b (2026-09-04): THE SINGLE-VARIABLE RERUN OF A FAILED EXPERIMENT. R1i folded FOUR quantities in
1267// this function onto concepts at once -- the base denominator, the presence count, the adjacency span and
1268// the title hits -- and measured WORSE on every metric (ndcg 553->540, mrr 599->589, rank1 8->7), so it
1269// was reverted byte-exact. Because it moved four variables it could not say which one cost the 13 permil.
1270// THE HYPOTHESIS THE FAILURE ITSELF SUGGESTS: the two questions were conflated. WHOSE terms define the
1271// query's coverage is a question about CONCEPTS; WHICH terms may occupy the adjacency window is a question
1272// about SURFACE FORMS, and a variant genuinely is evidence of aboutness -- "ice creams" near "sorbet" is
1273// a real signal, so removing variants from `present` and from the span plausibly threw away the gain.
1274// SO THIS MOVES ONE VARIABLE: the base denominator only. present, minspan and tseen keep counting every
1275// surface form exactly as they do today; no constant is touched; and if this also fails to beat 553/8 it
1276// is reverted and Q2 stops trying to fix proximity, because the two candidate halves will both have been
1277// measured and neither will have paid.
1278// R1i-b REVERTED IN SOURCE 2026-09-04, AND THE ARTIFACT WAS ALREADY REVERTED HOURS EARLIER. It moved one
1279// variable -- the base denominator from nterms to onterms -- and its ONLY supporting evidence was the
1280// judged set reading 553->581 ndcg and 8->10 rank1. S6 has since withdrawn those figures: the set is
1281// graded by pure lexical term presence and measured against a lexical ranker, so judge_family equals
1282// ranker_family and nx_qrels_bench now REFUSES to publish an absolute metric from it. The contrary
1283// evidence stands unretracted: the pre-declared accept rule required all four conditions and P4 went
1284// 5/5 to 4/5, because the rank-1 document for "hot dog" became a Lemmy user profile titled "Javascript
1285// is disabled. Actions will not work." carrying "hot" nine times and "dog" zero times.
1286// ★AN EXPERIMENT WHOSE SUPPORTING MEASUREMENT IS LATER WITHDRAWN IS NOT NEUTRAL, IT IS UNSUPPORTED --
1287// and it does not get to keep the ground it took while its evidence was believed.
1288// ---- L0: tf, PROXIMITY AND THE TITLE FIELD FROM THE POSTINGS (2026-09-14, contract symbol dss_tf_postings) ----
1289// THE DEFECT: stage 2 walked up to DSS_MAXCAND candidate documents over the multi-GB .docs mmap (a tf pass and
1290// a proximity pass per candidate, DSS_TFSCAN bytes each). Warm that is 375 ms; cold it is one random read per
1291// candidate on the array -- MEASURED 5.9-12.7 s on the public SERP, and 13 of the last 14 hourly search-query
1292// journeys FAILED the 3000 ms bar (knowledge/status/uat.jrnl, 2026-09-14). THE INDEX ALREADY HOLDS THE ANSWER:
1293// the NXQ1 positions sidecar (seg-<id>.pos) stores, per (term, doc), every emitted-token index, written by the
1294// SAME ss_tok_next2 tokenizer the walk uses, so tf-in-head, the title hits (position < DSS_TITLE_TOKENS) and the
1295// occurrence stream the proximity window consumes are all readable from the index without touching .docs.
1296// .docs is now read only for the final page's snippets (serve side).
1297// HEAD WINDOW: the walk bounded itself in BYTES (DSS_TFSCAN=8192) as a head-of-document quality prior -- the
1298// 2026-07-25 ruler run proved FULL-doc tf rewards keyword spam (MRR@10 701->566, reverted). The index cannot
1299// know which token sits at byte 8192, so the head is bounded in the index's own unit: DSS_HEADTOK emitted
1300// tokens. DERIVED, not tuned: 8192 bytes / about 6.4 bytes per emitted token (word plus separator, one-character
1301// words invisible to both tokenizers) = 1280. A/B'd on the judged set (nx_qrels_bench promoted vs staged, same
1302// index) before deploy; the accept rule is declared on search.plan before the run.
1303// FALL-BACK BY CONSTRUCTION: a candidate whose segment has no .pos (pre-phrase format), whose key cannot be
1304// located, or whose posting walk meets a malformed byte keeps the old head scan (cand_l0[c] == 0), so behaviour
1305// on those candidates is byte-identical to before.
1306const DSS_HEADTOK: i64 = 1280
1307const DSS_L0_OCC:  i64 = 512       // per-candidate occurrence cap == DSS_PROX_OCAP (the same window the walk kept)
1308const DSS_L0_TSHIFT: i64 = 32      // packed occurrence key = position * DSS_L0_TSHIFT + term (DSS_MAXTERMS < 32)
1309static dss_l0_box: *i64            // [0]=covered [1]=walked [2]=segments without .pos, per query (announced by the API)
1310// ---- S7 (2026-09-16) SERVED BM25Q FUSION -- contract symbol dss_bm25q_fuse ----------------------------------------
1311// The harness (nx_beir_eval, search S5) measured the sovereign lexical arms on BRIGHT: plain per-occurrence BM25 149
1312// permil, BM25Q (query-term frequency saturated, nx_intlog idf_bm25q) 155, their RRF fusion 155; on the long subset
1313// 141 / 147 / 148 -- fusion is the robust arm (BM25Q alone loses on economics and psychology, fusion loses less).
1314// The served scorer WAS the plain arm: dss_search_off_div tokenizes the query without deduping, so a typed term
1315// repeated r times is r entries in termptrs and PASS 2 adds its idf r times -- exactly the arm the harness calls
1316// plain, so the measured gain applies here, and the leaderboard row (which names the fused arm) is honest only once
1317// this is the served path.
1318// MECHANISM: PASS 2 accumulates a SECOND score per candidate (scq) in the SAME walk -- at a term's FIRST occurrence it
1319// adds idf_bm25q(w, qcnt) * tfnorm, at every later occurrence of the same string nothing -- then dss_bm25q_fuse ranks
1320// the candidates by both scores, fuses the two orders by reciprocal rank (k = RRF_K_STD, the harness's k), and
1321// REASSIGNS THE PLAIN SCORE MULTISET over the fused order: the j-th candidate in fused order takes the j-th largest
1322// plain score. Every downstream stage (coordination, authority, trust, the search-page penalty, the slug prior, the
1323// exact-precedence selection) multiplies or compares cand_score and is untouched; the API's score scale is unchanged.
1324// IDENTITY BY CONSTRUCTION: qtfsat_q10(1) == 1024 exactly, so when no typed term repeats scq == sc for every
1325// candidate, both orders are one order, RRF is monotone in a shared rank, ties resolve to the plain rank, and the
1326// reassignment maps every candidate to its own score -- moved == 0 and the bytes served are the bytes served before
1327// this rung. A two-candidate swap is an RRF tie and resolves to the plain order (the harness fuses the same way);
1328// three or more candidates can move.
1329// ANNOUNCED: dss_bm25q_stats -> (repeats, moved), printed by the API as bm25q.repeats / bm25q.moved on every answer,
1330// reset at query start and on the memo path, so a feature that changed nothing says so.
1331static dss_bq_box: *i64
1332func dss_bq_set(repeats: i64, moved: i64) -> i64 {
  if (dss_bq_box as i64) == 0 { dss_bq_box = sys_mmap(16) as *i64 }
  dss_bq_box[0] = repeats
  dss_bq_box[1] = moved
  return 0
1337}
1338func dss_bm25q_stats(out: *i64) -> i64 {
  if (dss_bq_box as i64) == 0 { dss_bq_box = sys_mmap(16) as *i64 }
  out[0] = dss_bq_box[0]
  out[1] = dss_bq_box[1]
  return 2
1343}
1344// qfirst[t] = 1 at the first entry carrying that term string and 0 at every later duplicate; qcnt[t] = how many
1345// entries carry it (meaningful at the first). Returns the number of distinct terms that occur more than once.
1346func dss_qtf_map(termptrs: *i64, nterms: i64, qfirst: *i64, qcnt: *i64) -> i64 {
  var repeats: i64 = 0
  var a: i64 = 0
  while a < nterms {
      qfirst[a] = 1
      qcnt[a] = 1
      var b: i64 = 0
      while b < a { if dss_streq(termptrs[a] as *u8, termptrs[b] as *u8) == 1 { qfirst[a] = 0; b = a } else { b = b + 1 } }
      a = a + 1
  }
  a = 0
  while a < nterms {
      if qfirst[a] == 1 {
          var c: i64 = 1
          var d: i64 = a + 1
          while d < nterms { if dss_streq(termptrs[a] as *u8, termptrs[d] as *u8) == 1 { c = c + 1 } d = d + 1 }
          qcnt[a] = c
          if c > 1 { repeats = repeats + 1 }
      }
      a = a + 1
  }
  return repeats
1368}
1369// Fuse plain[] (the served BM25 arm) with q[] (the BM25Q arm) over n candidates IN PLACE: plain[] leaves holding its
1370// own multiset of scores permuted into the RRF-fused order. Candidates with plain <= 0 (disqualified or unscored) do
1371// not participate and keep their value. Returns how many participants sit at a different position in fused order
1372// than in plain order (0 = the fusion was the identity).
1373func dss_bm25q_fuse(plain: *i64, q: *i64, n: i64) -> i64 {
  var np: i64 = 0
  var i: i64 = 0
  while i < n { if plain[i] > 0 { np = np + 1 } i = i + 1 }
  if np < 3 { return 0 }   // one or two participants never move: a pair swap is an RRF tie resolved to the plain order
  let ka: *i64 = sys_mmap(np * 8) as *i64
  let kb: *i64 = sys_mmap(np * 8) as *i64
  let kf: *i64 = sys_mmap(np * 8) as *i64
  let porder: *i64 = sys_mmap(np * 8) as *i64
  let sorted: *i64 = sys_mmap(np * 8) as *i64
  let rq: *i64 = sys_mmap(n * 8) as *i64
  var j: i64 = 0
  i = 0
  while i < n {
      if plain[i] > 0 {
          var qv: i64 = q[i]
          if qv < 0 { qv = 0 }
          ka[j] = (DSS_BQ_SMAX - plain[i]) * DSS_BQ_IDXBITS + i
          kb[j] = (DSS_BQ_SMAX - qv) * DSS_BQ_IDXBITS + i
          j = j + 1
      }
      i = i + 1
  }
  nx_quicksort(ka, np)
  nx_quicksort(kb, np)
  j = 0
  while j < np {
      let ia: i64 = ka[j] % DSS_BQ_IDXBITS
      porder[j] = ia
      sorted[j] = plain[ia]
      let ib: i64 = kb[j] % DSS_BQ_IDXBITS
      rq[ib] = j
      j = j + 1
  }
  j = 0
  while j < np {
      let cj: i64 = porder[j]
      let rqj: i64 = rq[cj]
      let f: i64 = DSS_BQ_RRF_SCALE / (RRF_K_STD + 1 + j) + DSS_BQ_RRF_SCALE / (RRF_K_STD + 1 + rqj)
      kf[j] = (DSS_BQ_FMAX - f) * DSS_BQ_IDXBITS + j
      j = j + 1
  }
  nx_quicksort(kf, np)
  var moved: i64 = 0
  j = 0
  while j < np {
      let pr: i64 = kf[j] % DSS_BQ_IDXBITS
      let cp: i64 = porder[pr]
      plain[cp] = sorted[j]
      if pr != j { moved = moved + 1 }
      j = j + 1
  }
  sys_munmap(ka as *u8, np * 8)
  sys_munmap(kb as *u8, np * 8)
  sys_munmap(kf as *u8, np * 8)
  sys_munmap(porder as *u8, np * 8)
  sys_munmap(sorted as *u8, np * 8)
  sys_munmap(rq as *u8, n * 8)
  return moved
1432}
1433func dss_l0_stats(out: *i64) -> i64 {
  if (dss_l0_box as i64) == 0 { dss_l0_box = sys_mmap(32) as *i64 }
  out[0] = dss_l0_box[0]; out[1] = dss_l0_box[1]; out[2] = dss_l0_box[2]
  return 3
1437}
1438// PHASE TIMERS (2026-09-14, the instrument the L3 rung needs BEFORE a pruner is designed). One box of
1439// microseconds per stage of the LAST query, stamped inside dss_search_off_div and dss_tf_postings and read
1440// by the API (dss_phase_stats). A slow answer then names its own phase: after L0 the cold cost of a
1441// two-common-term query (the hourly search-query journey, 3.8-15 s) has three candidates -- the stage-1
1442// key reads out of the .docs mmap, the per-candidate .keys lookups, and the L0 position decode -- and
1443// only a measurement separates them. Slots: 0 prep (tokenize, expand, idf) | 1 stage-1 candidacy |
1444// 2 consent/site/path filters | 3 shortlist | 4 L0 locate | 5 L0 decode+prox | 6 residual walk |
1445// 7 BM25 + coordination | 8 authority | 9 drop+hostdiv+dedup | 10 selection | 11 total | 12 candidates
1446// after stage 1 | 13 memo hit (1 = served from the result cache, no phase ran). Advisory, never a verdict.
1447const DSS_PH_SLOTS: i64 = 16
1448static dss_ph_box: *i64
1449static dss_adj_last: i64   // S9b: 1 when the last dss_prox_score call found every present TYPED term inside a window of present-1 tokens (adjacent)
1450static dss_adj_ntyped: i64 // S9c: the pre-expansion term count the caller sets; adjacency ignores stem variants (indices at or above it)
1451// S9c ADJACENCY OVER TYPED TERMS ONLY. The first cut judged adjacency over every present term, expansions included,
1452// and the judged set collapsed (ice cream 65536 -> 0, red wine 47433 -> 0): the relevant page carries a stem variant
1453// elsewhere, which widened the window and denied the flag, while a junk page carrying only the bigram kept it. The same
1454// bounded sliding window, over the typed occurrences only; a page must carry at least two typed terms to be adjacent.
1455func dss_adj_typed(opos: *i64, oidx: *i64, nocc: i64, ntyped: i64, endtok: i64) -> i64 {
  if ntyped < 2 { return 0 }
  let cnt: *i64 = sys_mmap(DSS_MAXTERMS * DSS_I64_BYTES) as *i64
  var z: i64 = 0
  while z < ntyped { cnt[z] = 0; z = z + 1 }
  var present: i64 = 0
  var r0: i64 = 0
  while r0 < nocc { let t0: i64 = oidx[r0]; if t0 < ntyped { if cnt[t0] == 0 { present = present + 1 } cnt[t0] = cnt[t0] + 1 } r0 = r0 + 1 }
  if present < 2 { sys_munmap(cnt as *u8, DSS_MAXTERMS * DSS_I64_BYTES); return 0 }
  z = 0
  while z < ntyped { cnt[z] = 0; z = z + 1 }
  var distinct: i64 = 0
  var lft: i64 = 0
  var minspan: i64 = endtok + 1
  var r: i64 = 0
  while r < nocc {
      let tr: i64 = oidx[r]
      if tr < ntyped {
          if cnt[tr] == 0 { distinct = distinct + 1 }
          cnt[tr] = cnt[tr] + 1
          var win: i64 = 1
          while win == 1 {
              if distinct != present { win = 0 } else {
                  if lft > r { win = 0 } else {
                      let tl: i64 = oidx[lft]
                      if tl < ntyped {
                          let span: i64 = opos[r] - opos[lft]
                          if span < minspan { minspan = span }
                          cnt[tl] = cnt[tl] - 1
                          if cnt[tl] == 0 { distinct = distinct - 1 }
                      }
                      lft = lft + 1
                  }
              }
          }
      }
      r = r + 1
  }
  sys_munmap(cnt as *u8, DSS_MAXTERMS * DSS_I64_BYTES)
  if minspan == present - 1 { return 1 }
  return 0
1496}
1497func dss_ph_init() -> i64 {
  if (dss_ph_box as i64) == 0 { dss_ph_box = sys_mmap(8 * DSS_PH_SLOTS) as *i64 }
  var z: i64 = 0
  while z < DSS_PH_SLOTS { dss_ph_box[z] = 0; z = z + 1 }
  return 0
1502}
1503func dss_ph_fin(tsel: i64, t0: i64) -> i64 {
  if (dss_ph_box as i64) == 0 { dss_ph_box = sys_mmap(8 * DSS_PH_SLOTS) as *i64 }
  let n: i64 = sys_now_us()
  dss_ph_box[10] = n - tsel
  dss_ph_box[11] = n - t0
  return 0
1509}
1510func dss_phase_stats(out: *i64) -> i64 {
  if (dss_ph_box as i64) == 0 { dss_ph_box = sys_mmap(8 * DSS_PH_SLOTS) as *i64 }
  var z: i64 = 0
  while z < DSS_PH_SLOTS { out[z] = dss_ph_box[z]; z = z + 1 }
  return DSS_PH_SLOTS
1515}
1516// ONE proximity + title arithmetic for BOTH the head scan and the postings path (extracted from dss_prox_all,
1517// arithmetic unchanged): opos/oidx = the occurrence stream in position order, present = distinct terms seen,
1518// tseen[t] = 1 when term t occurs before DSS_TITLE_TOKENS, endtok = one past the last position the stream could hold.
1519func dss_prox_score(opos: *i64, oidx: *i64, nocc: i64, present: i64, tseen: *i64, nterms: i64, endtok: i64) -> i64 {
  var thits: i64 = 0
  var tj: i64 = 0
  while tj < nterms { if tseen[tj] == 1 { thits = thits + 1 } tj = tj + 1 }
  var title_bonus: i64 = thits * DSS_TITLE_BONUS
  if title_bonus > DSS_PROX_SCALE { title_bonus = DSS_PROX_SCALE }
  dss_adj_last = 0
  var prox: i64 = 0
  if present >= 2 {
      let cnt: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
      var zz: i64 = 0
      while zz < nterms { cnt[zz] = 0; zz = zz + 1 }
      var distinct: i64 = 0
      var lft: i64 = 0
      var minspan: i64 = endtok + 1
      var r: i64 = 0
      while r < nocc {
          let tr: i64 = oidx[r]
          if cnt[tr] == 0 { distinct = distinct + 1 }
          cnt[tr] = cnt[tr] + 1
          // bounded left cursor: lft can never legitimately pass r (the 2026-08-14 out-of-bounds lesson)
          var win: i64 = 1
          while win == 1 {
              if distinct != present { win = 0 } else {
                  if lft > r { win = 0 } else {
                      let span: i64 = opos[r] - opos[lft]
                      if span < minspan { minspan = span }
                      let tl: i64 = oidx[lft]
                      cnt[tl] = cnt[tl] - 1
                      if cnt[tl] == 0 { distinct = distinct - 1 }
                      lft = lft + 1
                  }
              }
          }
          r = r + 1
      }
      let base: i64 = (present * DSS_PROX_SCALE) / nterms
      prox = (base * DSS_PROX_WREF) / (DSS_PROX_WREF + minspan)
      sys_munmap(cnt as *u8, DSS_MAXTERMS * 8)
  }
  var total: i64 = prox + title_bonus
  if total > DSS_PROX_SCALE { total = DSS_PROX_SCALE }
  dss_adj_last = dss_adj_typed(opos, oidx, nocc, dss_adj_ntyped, endtok)   // S9c: typed terms only
  return total
1563}
1564// Resolve a candidate key to (segment, docidx, value length) with the SAME newest-first key search ss_hget
1565// performs, then the .post header's ascending entry-offset table (docidx -> entry offset in .docs). Returns 1
1566// with outs[0]=segment outs[1]=docidx outs[2]=vlen, or 0 when the caller must fall back to the walk.
1567func dss_l0_locate(h: *i64, key: *u8, outs: *i64, vo: *i64, vl: *i64) -> i64 {
  let ns: i64 = h[0]
  var s: i64 = ns - 1
  var s_lo: i64 = 0
  // FAST PATH (2026-09-14): the retained key table names the newest segment holding the key in one probe, so the
  // newest-first walk collapses to exactly that segment -- the same segment the walk would have stopped at.
  // Absent from the table = absent from every .keys (the walk would return 0 too). No table = the walk.
  let hl9: i64 = ss_hlocate(h, key, ss_len(key), outs)
  if hl9 == 0 { return 0 }
  if hl9 == 1 { s = outs[0]; s_lo = outs[0] }
  while s >= s_lo {
      let r: i64 = ss_idx_find(h[1 + 8 * s] as *u8, h[2 + 8 * s], key, vo, vl)
      if r == 2 { return 0 }
      if r == 1 {
          if h[4 + 8 * s] < vo[0] + vl[0] { return 0 }
          let pb: *u8 = h[7 + 8 * s] as *u8
          let psz: i64 = h[8 + 8 * s]
          if psz < 8 { return 0 }
          let nd: i64 = ss_r32(pb, 4)
          if nd <= 0 { return 0 }
          if 8 + 4 * nd > psz { return 0 }
          let voff: i64 = vo[0]
          var lo: i64 = 0
          var hi: i64 = nd - 1
          var found: i64 = 0 - 1
          while lo <= hi {
              let mid: i64 = lo + (hi - lo) / 2
              if ss_r32(pb, 8 + 4 * mid) <= voff { found = mid; lo = mid + 1 } else { hi = mid - 1 }
          }
          if found < 0 { return 0 }
          if found + 1 < nd { if ss_r32(pb, 8 + 4 * (found + 1)) <= voff { return 0 } }
          outs[0] = s; outs[1] = found; outs[2] = vl[0]
          return 1
      }
      s = s - 1
  }
  return 0
1604}
1605// dss_tf_postings: fill tfmat (tf within DSS_HEADTOK), cand_prox, cand_capped and cand_dl for every candidate the
1606// postings can serve; cand_l0[c] = 1 marks it so stage 2 skips the .docs walk. Returns the covered count.
1607func dss_tf_postings(prefix: *u8, h: *i64, cand_cid: *i64, ncand: i64, termptrs: *i64, nterms: i64, tfmat: *i64, cand_prox: *i64, cand_capped: *i64, cand_dl: *i64, cand_l0: *i64, cand_phrase: *i64) -> i64 {
  if (dss_l0_box as i64) == 0 { dss_l0_box = sys_mmap(32) as *i64 }
  dss_l0_box[0] = 0; dss_l0_box[1] = ncand; dss_l0_box[2] = 0
  if (dss_ph_box as i64) == 0 { dss_ph_box = sys_mmap(8 * DSS_PH_SLOTS) as *i64 }
  let ph_l0a: i64 = sys_now_us()
  let ns: i64 = h[0]
  if ns <= 0 { return 0 }
  if ncand <= 0 { return 0 }
  if nterms <= 0 { return 0 }
  if nterms >= DSS_L0_TSHIFT { return 0 }
  // 1. locate every candidate (index only: .keys binary search + .post header table, no .docs page)
  let cseg: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let cdid: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let keyb: *u8 = sys_mmap(64)
  let locs: *i64 = sys_mmap(32) as *i64
  let vo: *i64 = sys_mmap(16) as *i64
  let vl: *i64 = sys_mmap(16) as *i64
  var c: i64 = 0
  while c < ncand {
      cand_l0[c] = 0
      cseg[c] = 0 - 1
      dss_mkkey(cand_cid[c], keyb)
      if dss_l0_locate(h, keyb, locs, vo, vl) == 1 { cseg[c] = locs[0]; cdid[c] = locs[1]; cand_dl[c] = locs[2] }
      c = c + 1
  }
  let ph_l0b: i64 = sys_now_us()
  dss_ph_box[4] = ph_l0b - ph_l0a
  // 2. group candidates by segment, ascending docidx within a segment (the posting walk is then a merge)
  let sstart: *i64 = sys_mmap(8 * (ns + 2)) as *i64
  let scount: *i64 = sys_mmap(8 * (ns + 2)) as *i64
  let fill: *i64 = sys_mmap(8 * (ns + 2)) as *i64
  let order: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  c = 0
  while c < ncand { if cseg[c] >= 0 { scount[cseg[c]] = scount[cseg[c]] + 1 } c = c + 1 }
  var acc: i64 = 0
  var s: i64 = 0
  while s < ns { sstart[s] = acc; acc = acc + scount[s]; s = s + 1 }
  c = 0
  while c < ncand {
      if cseg[c] >= 0 {
          let sg: i64 = cseg[c]
          var k: i64 = sstart[sg] + fill[sg]
          var mv: i64 = 1
          while mv == 1 {
              if k > sstart[sg] { if cdid[order[k - 1]] > cdid[c] { order[k] = order[k - 1]; k = k - 1 } else { mv = 0 } } else { mv = 0 }
          }
          order[k] = c
          fill[sg] = fill[sg] + 1
      }
      c = c + 1
  }
  // 3. per segment: lockstep walk of .post (ascending docidx) and NXQ1 (one position run per posting) for every
  //    query term, decoding positions for candidate docs and skipping the rest; sequential over two small sidecars
  let occ: *i64 = sys_mmap(DSS_MAXCAND * DSS_L0_OCC * 8) as *i64
  let nocc: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let ok: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let np9: *u8 = sys_mmap(512)
  let szp9: *i64 = sys_mmap(16) as *i64
  let outs: *i64 = sys_mmap(32) as *i64
  let pv: *i64 = sys_mmap(16) as *i64
  let qv: *i64 = sys_mmap(16) as *i64
  let sp2: *i64 = sys_mmap(8) as *i64
  let ns2: i64 = ss_manifest_dyn(prefix, sp2)
  let segs: *i64 = sp2[0] as *i64
  // PREFETCH PASS (2026-09-14, from the phase timers: the decode below read 0.07-1.07 s cold, one cold burst
  // per (segment, term)). Map every needed .pos first and hand the kernel each query term's whole position
  // block per segment (offset table: [this term, next term)), so the decode reads warm and the disk services
  // the blocks together. Advisory: computes nothing; the decode below is unchanged and reads the same bytes.
  let qbs: *i64 = sys_mmap(8 * (ns + 2)) as *i64
  let qszs: *i64 = sys_mmap(8 * (ns + 2)) as *i64
  var sp9: i64 = 0
  while sp9 < ns {
      qbs[sp9] = 0
      qszs[sp9] = 0
      if scount[sp9] > 0 { if sp9 < ns2 {
          var op: i64 = 0
          op = ss_cat(np9, op, prefix)
          op = ss_cat(np9, op, segs[sp9] as *u8)
          op = ss_cat(np9, op, ".pos" as *u8)
          np9[op] = 0 as u8
          szp9[0] = 0
          let qbp: *u8 = ss_loadfile(np9, szp9, 1)
          qbs[sp9] = qbp as i64
          qszs[sp9] = szp9[0]
          if (qbp as i64) != 0 { if szp9[0] >= 8 { if qbp[0] == (78 as u8) { if qbp[2] == (81 as u8) {
              let ntp: i64 = ss_r32(qbp, 4)
              let qbasep: i64 = 8 + 4 * ntp
              var tp9: i64 = 0
              while tp9 < nterms {
                  let odp: i64 = ss_terms_ordinal_h(h, sp9, termptrs[tp9] as *u8, outs)
                  if odp >= 0 { if odp < ntp { if 8 + 4 * odp + 4 <= szp9[0] {
                      let bst: i64 = qbasep + ss_r32(qbp, 8 + 4 * odp)
                      var ben: i64 = szp9[0]
                      if odp + 1 < ntp { if 8 + 4 * (odp + 1) + 4 <= szp9[0] { ben = qbasep + ss_r32(qbp, 8 + 4 * (odp + 1)) } }
                      if ben > szp9[0] { ben = szp9[0] }
                      if ben > bst {
                          let ba: i64 = (qbp as i64) + bst
                          let bal: i64 = (ba / DSC_MAGIC_4096) * DSC_MAGIC_4096
                          sys_madvise(bal as *u8, (ba - bal) + (ben - bst), 3)
                      }
                  } } }
                  tp9 = tp9 + 1
              }
          } } } }
      } }
      sp9 = sp9 + 1
  }
  s = 0
  while s < ns {
      if scount[s] > 0 { if s < ns2 {
          var o9: i64 = 0
          o9 = ss_cat(np9, o9, prefix)
          o9 = ss_cat(np9, o9, segs[s] as *u8)
          o9 = ss_cat(np9, o9, ".pos" as *u8)
          np9[o9] = 0 as u8
          szp9[0] = 0
          let qb: *u8 = qbs[s] as *u8   // mapped once by the prefetch pass above (no second map per query)
          let qsz: i64 = qszs[s]
          var haveq: i64 = 0
          if (qb as i64) != 0 { if qsz >= 8 { if qb[0] == (78 as u8) { if qb[2] == (81 as u8) { haveq = 1 } } } }
          if haveq == 0 { dss_l0_box[2] = dss_l0_box[2] + 1 } else {
              let nt: i64 = ss_r32(qb, 4)
              let qbase: i64 = 8 + 4 * nt
              let tb: *u8 = h[5 + 8 * s] as *u8
              let tsz: i64 = h[6 + 8 * s]
              let pb: *u8 = h[7 + 8 * s] as *u8
              let psz: i64 = h[8 + 8 * s]
              let cend: i64 = sstart[s] + scount[s]
              var ci0: i64 = sstart[s]
              while ci0 < cend {
                  let cc: i64 = order[ci0]
                  ok[cc] = 1
                  nocc[cc] = 0
                  cand_capped[cc] = 0
                  var z: i64 = 0
                  while z < nterms { tfmat[cc * DSS_MAXTERMS + z] = 0; z = z + 1 }
                  ci0 = ci0 + 1
              }
              var bad: i64 = 0
              var t: i64 = 0
              while t < nterms {
                  let od: i64 = ss_terms_ordinal_h(h, s, termptrs[t] as *u8, outs)   // sampled window (2026-09-14): one page, not log2(n) cold ones
                  if od >= 0 { if od < nt {
                      let dcount: i64 = outs[2]
                      pv[0] = outs[0]
                      if 8 + 4 * od + 4 > qsz { bad = 1 } else { qv[0] = qbase + ss_r32(qb, 8 + 4 * od) }
                      var prev: i64 = 0
                      var ci: i64 = sstart[s]
                      var i: i64 = 0
                      var go: i64 = 1
                      if bad == 1 { go = 0 }
                      while go == 1 {
                          if i >= dcount { go = 0 } else { if ci >= cend { go = 0 } else {
                              if pv[0] >= psz { bad = 1; go = 0 } else { if qv[0] >= qsz { bad = 1; go = 0 } else {
                                  prev = prev + ss_vr(pb, pv)
                                  let np: i64 = ss_vr(qb, qv)
                                  var adv: i64 = 1
                                  while adv == 1 { if ci < cend { if cdid[order[ci]] < prev { ci = ci + 1 } else { adv = 0 } } else { adv = 0 } }
                                  var hit: i64 = 0 - 1
                                  if ci < cend { if cdid[order[ci]] == prev { hit = order[ci] } }
                                  var cum: i64 = 0
                                  var tf: i64 = 0
                                  var k2: i64 = 0
                                  while k2 < np {
                                      if qv[0] >= qsz { bad = 1; go = 0; k2 = np } else {
                                          cum = cum + ss_vr(qb, qv)
                                          if hit >= 0 { if cum < DSS_HEADTOK {
                                              tf = tf + 1
                                              if nocc[hit] < DSS_L0_OCC { occ[hit * DSS_L0_OCC + nocc[hit]] = cum * DSS_L0_TSHIFT + t; nocc[hit] = nocc[hit] + 1 }
                                          } }
                                          k2 = k2 + 1
                                      }
                                  }
                                  if hit >= 0 { if bad == 0 {
                                      tfmat[hit * DSS_MAXTERMS + t] = tf
                                      if np > tf { cand_capped[hit] = 1 }
                                  } }
                                  i = i + 1
                              } }
                          } }
                      }
                  } }
                  if bad == 1 { t = nterms } else { t = t + 1 }
              }
              if bad == 1 {
                  var cb: i64 = sstart[s]
                  while cb < cend { ok[order[cb]] = 0; cb = cb + 1 }
              }
          }
      } }
      s = s + 1
  }
  // 4. proximity + title from the occurrence stream, then hand the candidate to PASS 2 as covered
  let opos: *i64 = sys_mmap(DSS_L0_OCC * 8) as *i64
  let oidx: *i64 = sys_mmap(DSS_L0_OCC * 8) as *i64
  let tseen: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  var covered: i64 = 0
  c = 0
  while c < ncand {
      if ok[c] == 1 {
          let n: i64 = nocc[c]
          let base: i64 = c * DSS_L0_OCC
          // the stream arrives as one ascending run per term; insertion sort merges the runs into position order
          var a: i64 = 1
          while a < n {
              let kv: i64 = occ[base + a]
              var b: i64 = a - 1
              var mv2: i64 = 1
              while mv2 == 1 { if b >= 0 { if occ[base + b] > kv { occ[base + b + 1] = occ[base + b]; b = b - 1 } else { mv2 = 0 } } else { mv2 = 0 } }
              occ[base + b + 1] = kv
              a = a + 1
          }
          var z2: i64 = 0
          while z2 < nterms { tseen[z2] = 0; z2 = z2 + 1 }
          var present: i64 = 0
          var z3: i64 = 0
          while z3 < nterms { if tfmat[c * DSS_MAXTERMS + z3] > 0 { present = present + 1 } z3 = z3 + 1 }
          var q: i64 = 0
          while q < n {
              let kv2: i64 = occ[base + q]
              opos[q] = kv2 / DSS_L0_TSHIFT
              oidx[q] = kv2 % DSS_L0_TSHIFT
              if opos[q] < DSS_TITLE_TOKENS { tseen[oidx[q]] = 1 }
              q = q + 1
          }
          cand_prox[c] = dss_prox_score(opos, oidx, n, present, tseen, nterms, DSS_HEADTOK)
          cand_phrase[c] = dss_adj_last   // S9b: the core just left the adjacency flag for this candidate
          cand_l0[c] = 1
          covered = covered + 1
      }
      c = c + 1
  }
  dss_l0_box[0] = covered
  dss_l0_box[1] = ncand - covered
  dss_ph_box[5] = sys_now_us() - ph_l0b
  return covered
1843}
1844func dss_prox_all(doc: *u8, dn: i64, termptrs: *i64, nterms: i64, tbl: *u8) -> i64 {
  if nterms < 1 { return 0 }
  let tbuf: *u8 = sys_mmap(DSC_TOKBUF)
  let pos: *i64 = sys_mmap(DSC_POSBUF) as *i64
  pos[0] = 0
  let fb: *u8 = sys_mmap(DSS_MAXTERMS + 8)
  let seen: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let tseen: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64   // R1c: query term seen in the TITLE (lead tokens)
  var t0: i64 = 0
  while t0 < nterms {
      let tp0: *u8 = termptrs[t0] as *u8
      fb[t0] = tp0[0]
      seen[t0] = 0
      tseen[t0] = 0
      t0 = t0 + 1
  }
  let opos: *i64 = sys_mmap(DSS_PROX_OCAP * 8) as *i64
  let oidx: *i64 = sys_mmap(DSS_PROX_OCAP * 8) as *i64
  var nocc: i64 = 0
  var present: i64 = 0
  var tokidx: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let l: i64 = ss_tok_next2(doc, dn, pos, tbuf, tbl)
      if l < 0 { go = 0 } else {
          let b0: u8 = tbuf[0]
          var t: i64 = 0
          while t < nterms {
              if fb[t] == b0 {
                  if dss_streq(tbuf, termptrs[t] as *u8) == 1 {
                      if nocc < DSS_PROX_OCAP { opos[nocc] = tokidx; oidx[nocc] = t; nocc = nocc + 1 }
                      if seen[t] == 0 { seen[t] = 1; present = present + 1 }
                      if tokidx < DSS_TITLE_TOKENS { tseen[t] = 1 }   // R1c: a hit in the title/lead field
                  }
              }
              t = t + 1
          }
          tokidx = tokidx + 1
          if nocc >= DSS_PROX_OCAP { go = 0 }
      }
  }
  // R1c TITLE-FIELD BONUS + R1b PROXIMITY: ONE arithmetic core, dss_prox_score (L0, 2026-09-14), shared with the
  // postings-scored path so the walk and the index can never disagree on the formula. The BOUNDED LEFT CURSOR
  // (2026-08-14 out-of-bounds lesson) and the R1i-b coverage denominator live there unchanged.
  let total: i64 = dss_prox_score(opos, oidx, nocc, present, tseen, nterms, tokidx)
  // 7 function-level scratch buffers freed here (the core frees its own cnt inside its block).
  sys_munmap(tbuf, DSC_TOKBUF)
  sys_munmap(pos as *u8, DSC_POSBUF)
  sys_munmap(fb, DSS_MAXTERMS + 8)
  sys_munmap(seen as *u8, DSS_MAXTERMS * 8)
  sys_munmap(tseen as *u8, DSS_MAXTERMS * 8)
  sys_munmap(opos as *u8, DSS_PROX_OCAP * 8)
  sys_munmap(oidx as *u8, DSS_PROX_OCAP * 8)
  return total
1898}
1899
1900// DID-YOU-MEAN: for each query term UNKNOWN to the shard (dcount 0), scan the index's OWN sorted term
1901// dictionary (ss_term_at -- the .terms blobs ARE the dictionary, no derived artifact) for the closest
1902// term within edit distance 2, tiebroken by highest segment dcount. Writes the corrected query
1903// (space-joined, known terms kept) into out; returns its length, or 0 when nothing needed/found.
1904// MEMOISED did-you-mean. Wraps the walk below exactly the way dss_search_off wraps dss_search_off_div,
1905// so the shapes match and there is one idiom in this file rather than two.
1906// FAIL-SAFE TOWARD THE INCUMBENT: every bypass runs the ORIGINAL call unchanged, so an unarmed table,
1907// an empty query or an over-long correction can only ever behave exactly as before.
1908// KEY: composes dsq_key (which composes ss_khash -- the estate's incumbent hash) with max = -1 as the
1909// CORRECTION marker, so a correction key can never be mistaken for a result key even if the two tables
1910// are ever merged. No second hash function.
1911func dss_correct(domain: *u8, q: *u8, qn: i64, out: *u8, outcap: i64) -> i64 {
  if (dcc_buf as i64) == 0 { return dss_correct_raw(domain, q, qn, out, outcap) }
  if (dsq_buf as i64) == 0 { return dss_correct_raw(domain, q, qn, out, outcap) }
  if qn <= 0               { return dss_correct_raw(domain, q, qn, out, outcap) }
  let key: i64 = dsq_key(domain, q, qn, 0 - 1, 0, 0)
  var slot: i64 = key % DCC_SLOTS
  if slot < 0 { slot = 0 - slot }
  let base: i64 = slot * DCC_SLOTW
  let tailw: i64 = base + DCC_SLOTW - 1
  let gen: i64 = dsq_buf[0]
  // TORN-WRITE GUARD, identical rules to the result memo: the key is written at BOTH ends of the slot,
  // head LAST. A reader accepts only when head, tail and generation all agree, so a slot caught
  // mid-write by a sibling child fails to a MISS and recomputes. No lock; the failure direction is
  // "do the work again", never "serve another query's suggestion".
  if dcc_buf[base] == key { if dcc_buf[tailw] == key { if dcc_buf[base + 1] == gen {
      let n: i64 = dcc_buf[base + 2]
      if n >= 0 { if n <= DCC_TEXTB { if n < outcap {
          let src: *u8 = (dcc_buf as i64 + (base + 3) * 8) as *u8
          var i: i64 = 0
          while i < n { out[i] = src[i]; i = i + 1 }
          out[n] = 0 as u8
          return n
      } } }
  } } }
  let n2: i64 = dss_correct_raw(domain, q, qn, out, outcap)
  // A ZERO-LENGTH ANSWER IS A REAL ANSWER AND MUST BE CACHED. "No suggestion exists" costs the same
  // full dictionary walk as a hit, so declining to store it would leave the most common zero-result
  // case -- genuine nonsense, which matches nothing -- paying full price forever.
  if n2 >= 0 { if n2 <= DCC_TEXTB {
      dcc_buf[base] = 0                      // claim: invalidate before mutating the payload
      let dst: *u8 = (dcc_buf as i64 + (base + 3) * 8) as *u8
      var j: i64 = 0
      while j < n2 { dst[j] = out[j]; j = j + 1 }
      dcc_buf[base + 2] = n2
      dcc_buf[base + 1] = gen
      dcc_buf[tailw] = key
      dcc_buf[base] = key                    // publish LAST
  } }
  return n2
1950}
1951
1952func dss_correct_raw(domain: *u8, q: *u8, qn: i64, out: *u8, outcap: i64) -> i64 {
  let prefix: *u8 = sys_mmap(512)
  dss_prefix(domain, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  if (h as i64) == 0 { return 0 }
  let tbl: *u8 = sys_mmap(272)
  ss_tok_table(tbl)
  let termstore: *u8 = sys_mmap(DSS_MAXTERMS * 64)
  let termptrs: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  var nterms: i64 = 0
  let qpos: *i64 = sys_mmap(16) as *i64
  qpos[0] = 0
  let tb: *u8 = sys_mmap(64)
  var qgo: i64 = 1
  while qgo == 1 {
      let l: i64 = ss_tok_next2(q, qn, qpos, tb, tbl)
      if l < 0 { qgo = 0 } else {
          if nterms < DSS_MAXTERMS {
              let dst: *u8 = (termstore as i64 + nterms * 64) as *u8
              var i: i64 = 0
              while tb[i] != (0 as u8) { dst[i] = tb[i]; i = i + 1 }
              dst[i] = 0 as u8
              termptrs[nterms] = dst as i64
              nterms = nterms + 1
          }
      }
  }
  if nterms == 0 { return 0 }
  let fixstore: *u8 = sys_mmap(DSS_MAXTERMS * 64)
  var corrected: i64 = 0
  let tpb: *i64 = sys_mmap(16) as *i64
  let tlb: *i64 = sys_mmap(16) as *i64
  let dcb: *i64 = sys_mmap(16) as *i64
  var t: i64 = 0
  while t < nterms {
      let term: *u8 = termptrs[t] as *u8
      let fix: *u8 = (fixstore as i64 + t * 64) as *u8
      var fi: i64 = 0
      while term[fi] != (0 as u8) { fix[fi] = term[fi]; fi = fi + 1 }
      fix[fi] = 0 as u8
      if ss_term_dcount(h, term) <= 0 {
          let tl0: i64 = fi
          var bestd: i64 = 3
          var bestdc: i64 = 0 - 1
          let ns: i64 = h[0]
          var s: i64 = 0
          while s < ns {
              let tc: i64 = ss_term_count(h, s)
              // FIRST-CHAR RUN BOUND (2026-08-12): this walk used to visit EVERY dictionary entry
              // of every segment (13.5M entries on the web shard) computing ed_bounded -- the
              // measured 5.6-8s zero-hit floor. Bound it to the sorted run sharing the query
              // term's FIRST BYTE (ss_term_lb pw=1): typo corrections overwhelmingly preserve the
              // first character. DOCUMENTED IMPRECISION: a correction whose first character
              // differs from the typo's ("uantum" -> "quantum") is now out of scope -- that loss
              // is the price of retiring the full walk, chosen over sampling or a time-box
              // because it is DETERMINISTIC (same query, same answer, always). The acceptance
              // test inside the run is unchanged. The run's pages are prefetched like
              // dss_stem_expand's (offset stripe 256KB cap, entry window 2MB cap).
              var e: i64 = ss_term_lb(h, s, term, 1)
              if e < tc {
                  let ctb: *u8 = h[5 + 8 * s] as *u8
                  let ctn: i64 = ss_r32(ctb, 4)
                  let cto: i64 = (ctb as i64) + 8 + 4 * e
                  var ctl: i64 = ((ctb as i64) + 8 + 4 * ctn) - cto
                  if ctl > DSC_MAGIC_262144 { ctl = DSC_MAGIC_262144 }
                  if ctl > 0 {
                      let cal0: i64 = (cto / DSC_MAGIC_4096) * DSC_MAGIC_4096
                      sys_madvise(cal0 as *u8, (cto - cal0) + ctl, 3)
                  }
                  let ceo: i64 = (ctb as i64) + 8 + 4 * ctn + ss_r32(ctb, 8 + 4 * e)
                  var cew: i64 = DSC_MAGIC_2097152
                  let ctsz: i64 = h[6 + 8 * s]
                  if ceo + cew > (ctb as i64) + ctsz { cew = (ctb as i64) + ctsz - ceo }
                  if cew > 0 {
                      let cal1: i64 = (ceo / DSC_MAGIC_4096) * DSC_MAGIC_4096
                      sys_madvise(cal1 as *u8, (ceo - cal1) + cew, 3)
                  }
              }
              while e < tc {
                  if ss_term_at(h, s, e, tpb, tlb, dcb) == 1 {
                      var inrun: i64 = 1
                      if tlb[0] > 0 { let cdt: *u8 = tpb[0] as *u8; if cdt[0] != term[0] { inrun = 0 } }
                      if inrun == 0 { e = tc } else {
                          let d: i64 = ed_bounded(term, tl0, tpb[0] as *u8, tlb[0], 2)
                          var better: i64 = 0
                          if d < bestd { better = 1 }
                          if d == bestd { if dcb[0] > bestdc { better = 1 } }
                          if d <= 2 { if better == 1 {
                              bestd = d
                              bestdc = dcb[0]
                              let cp: *u8 = tpb[0] as *u8
                              var x: i64 = 0
                              while x < tlb[0] { fix[x] = cp[x]; x = x + 1 }
                              fix[tlb[0]] = 0 as u8
                          } }
                      }
                  }
                  e = e + 1
              }
              s = s + 1
          }
          if bestd <= 2 { corrected = corrected + 1 }
      }
      t = t + 1
  }
  if corrected == 0 { return 0 }
  // assemble the corrected query
  var o: i64 = 0
  t = 0
  while t < nterms {
      if t > 0 { if o < outcap { out[o] = 32 as u8; o = o + 1 } }
      let fx: *u8 = (fixstore as i64 + t * 64) as *u8
      var x2: i64 = 0
      while fx[x2] != (0 as u8) { if o < outcap { out[o] = fx[x2]; o = o + 1 } x2 = x2 + 1 }
      t = t + 1
  }
  if o < outcap { out[o] = 0 as u8 }
  sys_munmap(prefix, DSC_PREFIXBUF)
  sys_munmap(tbl, 272)
  sys_munmap(termstore, DSS_MAXTERMS * 64)
  sys_munmap(termptrs as *u8, DSS_MAXTERMS * 8)
  sys_munmap(qpos as *u8, DSC_POSBUF)
  sys_munmap(tb, DSC_TOKBUF)
  sys_munmap(fixstore, DSS_MAXTERMS * 64)
  sys_munmap(tpb as *u8, DSC_POSBUF)
  sys_munmap(tlb as *u8, DSC_POSBUF)
  sys_munmap(dcb as *u8, DSC_POSBUF)
  return o
2080}
2081// ============ SEARCH RUNG F4: DID-YOU-MEAN ON EVERY ANSWER (2026-09-18) ============
2082// The zero-hit corrector above speaks only when a query finds NOTHING, and a misspelling the open web also makes finds a
2083// handful of pages -- so its line never appeared for the typos people actually type. dss_spell_suggest offers it on
2084// every answer: each RARE free-text word is replaced by its COMMONEST one-edit neighbour when that neighbour is COMMON
2085// (nx_didyoumean dym_suggest: the neighbourhood generated and looked up exactly; rare and common are the two sides of the
2086// midpoint of the ranker's own idf scale over the live document count). An all-common query costs one exact lookup per
2087// word; only a rare word pays for its neighbourhood. This wrapper supplies the one open every serve path uses (cached for
2088// the web shard; a site shard it opened is closed again) and the ranker's own term cap as the word bound, and
2089// dss_spell_stats publishes how the answer was reached (the DYM_ST_ slots). The zero-hit corrector is untouched: a caller
2090// that finds nothing and is offered nothing here still asks dss_correct, exactly as before.
2091static dss_spell_box: *i64
2092func dss_spell_stats(out: *i64) -> i64 {
  var i: i64 = 0
  while i < DYM_ST_SLOTS {
      if (dss_spell_box as i64) == 0 { out[i] = 0 } else { out[i] = dss_spell_box[i] }
      i = i + 1
  }
  return DYM_ST_SLOTS
2099}
2100// THE MEMO is the zero-hit corrector's own table under its own rules: the same torn-write guard (the key at both ends of
2101// the slot, the head written LAST), the same generation word (one reopen invalidates every table at once), keyed through
2102// dsq_key with max = -2 so a suggestion key can never be read as a correction (-1) or a result key (>= 0). dym_suggest
2103// lower-cases its whole answer, so the answer is a function of the case-folded query the key is built from. Only an
2104// answer whose rare-word walk ran is stored (an all-common query costs less than the memo), never an abstention. On a hit
2105// the stats carry docs, common_df, memo = 1 and the microseconds; the walk counters read 0 because no walk ran.
2106const DSS_SPELL_MARK: i64 = 0 - 2
2107func dss_spell_suggest(domain: *u8, q: *u8, qn: i64, out: *u8, outcap: i64) -> i64 {
  let t0: i64 = sys_now_us()
  if (dss_spell_box as i64) == 0 { dss_spell_box = sys_mmap(8 * DYM_ST_SLOTS) as *i64 }
  let prefix: *u8 = sys_mmap(DSC_PREFIXBUF)
  dss_prefix(domain, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  let web: i64 = dsc_web_prefix_is(prefix)
  sys_munmap(prefix, DSC_PREFIXBUF)
  var armed: i64 = 1
  if (dcc_buf as i64) == 0 { armed = 0 }
  if (dsq_buf as i64) == 0 { armed = 0 }
  if (h as i64) == 0 { armed = 0 }
  if qn <= 0 { armed = 0 }
  var key: i64 = 0
  var base: i64 = 0
  var tailw: i64 = 0
  if armed == 1 {
      key = dsq_key(domain, q, qn, DSS_SPELL_MARK, 0, 0)
      var slot: i64 = key % DCC_SLOTS
      if slot < 0 { slot = 0 - slot }
      base = slot * DCC_SLOTW
      tailw = base + DCC_SLOTW - 1
      let gen: i64 = dsq_buf[0]
      if dcc_buf[base] == key { if dcc_buf[tailw] == key { if dcc_buf[base + 1] == gen {
          let n0: i64 = dcc_buf[base + 2]
          if n0 >= 0 { if n0 <= DCC_TEXTB { if n0 < outcap {
              let src: *u8 = (dcc_buf as i64 + (base + 3) * 8) as *u8
              var i: i64 = 0
              while i < n0 { out[i] = src[i]; i = i + 1 }
              out[n0] = 0 as u8
              var z: i64 = 0
              while z < DYM_ST_SLOTS { dss_spell_box[z] = 0; z = z + 1 }
              let mdocs: i64 = ss_doc_count(h)
              dss_spell_box[DYM_ST_DOCS] = mdocs
              dss_spell_box[DYM_ST_MID] = dym_mid(mdocs)
              dss_spell_box[DYM_ST_MEMO] = 1
              dss_spell_box[DYM_ST_US] = sys_now_us() - t0
              if web == 0 { ss_close(h) }
              return n0
          } } }
      } } }
  }
  let n: i64 = dym_suggest(h, q, qn, DSS_MAXTERMS, out, outcap, dss_spell_box)
  if armed == 1 { if dss_spell_box[DYM_ST_RARE] > 0 { if dss_spell_box[DYM_ST_ABSTAIN] == 0 { if n <= DCC_TEXTB {
      let gen2: i64 = dsq_buf[0]
      dcc_buf[base] = 0
      let dst: *u8 = (dcc_buf as i64 + (base + 3) * 8) as *u8
      var j: i64 = 0
      while j < n { dst[j] = out[j]; j = j + 1 }
      dcc_buf[base + 2] = n
      dcc_buf[base + 1] = gen2
      dcc_buf[tailw] = key
      dcc_buf[base] = key
  } } } }
  if (h as i64) != 0 { if web == 0 { ss_close(h) } }
  return n
2163}
2164// SUGGEST: rank the dictionary's completions of `pfx` by summed dcount (the store's own statistics; no
2165// derived artifact). Fills up to `maxn` NUL-terminated terms packed into out (64 bytes apart); returns n.
2166func dss_suggest(domain: *u8, pfx: *u8, pn: i64, out: *u8, maxn: i64) -> i64 {
  if pn < 1 { return 0 }
  let prefix: *u8 = sys_mmap(512)
  dss_prefix(domain, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  if (h as i64) == 0 { return 0 }
  let cand: *u8 = sys_mmap(64 * 40)
  let cdc: *i64 = sys_mmap(64 * 8) as *i64
  var nc: i64 = 0
  let tpb: *i64 = sys_mmap(16) as *i64
  let tlb: *i64 = sys_mmap(16) as *i64
  let dcb: *i64 = sys_mmap(16) as *i64
  let ns: i64 = h[0]
  var s: i64 = 0
  while s < ns {
      let tc: i64 = ss_term_count(h, s)
      var e: i64 = 0
      while e < tc {
          if ss_term_at(h, s, e, tpb, tlb, dcb) == 1 {
              if tlb[0] >= pn { if tlb[0] < 39 {
                  let tp: *u8 = tpb[0] as *u8
                  var m: i64 = 1
                  var x: i64 = 0
                  while x < pn { if tp[x] != pfx[x] { m = 0; x = pn } else { x = x + 1 } }
                  if m == 1 {
                      // merge into candidates (dedup across segments, dcounts summed)
                      var f: i64 = 0 - 1
                      var c: i64 = 0
                      while c < nc {
                          let cb: *u8 = (cand as i64 + c * 40) as *u8
                          var eq: i64 = 1
                          var y: i64 = 0
                          while y < tlb[0] { if cb[y] != tp[y] { eq = 0; y = tlb[0] } else { y = y + 1 } }
                          if eq == 1 { if cb[tlb[0]] == (0 as u8) { f = c } }
                          c = c + 1
                      }
                      if f >= 0 { cdc[f] = cdc[f] + dcb[0] }
                      else { if nc < 64 {
                          let nb: *u8 = (cand as i64 + nc * 40) as *u8
                          var y2: i64 = 0
                          while y2 < tlb[0] { nb[y2] = tp[y2]; y2 = y2 + 1 }
                          nb[tlb[0]] = 0 as u8
                          cdc[nc] = dcb[0]
                          nc = nc + 1
                      } }
                  }
              } }
          }
          e = e + 1
      }
      s = s + 1
  }
  // top maxn by dcount (selection)
  let used: *u8 = sys_mmap(64)
  var uz: i64 = 0
  while uz < nc { used[uz] = 0 as u8; uz = uz + 1 }
  var outn: i64 = 0
  while outn < maxn {
      var best: i64 = 0 - 1
      var bdc: i64 = 0 - 1
      var c2: i64 = 0
      while c2 < nc {
          if used[c2] == (0 as u8) { if cdc[c2] > bdc { bdc = cdc[c2]; best = c2 } }
          c2 = c2 + 1
      }
      if best < 0 { return outn }
      used[best] = 1 as u8
      let sb: *u8 = (cand as i64 + best * 40) as *u8
      let db: *u8 = (out as i64 + outn * 64) as *u8
      var y3: i64 = 0
      while sb[y3] != (0 as u8) { db[y3] = sb[y3]; y3 = y3 + 1 }
      db[y3] = 0 as u8
      outn = outn + 1
  }
  sys_munmap(prefix, DSC_PREFIXBUF)
  sys_munmap(cand, 64 * 40)
  sys_munmap(cdc as *u8, 64 * 8)
  sys_munmap(tpb as *u8, DSC_POSBUF)
  sys_munmap(tlb as *u8, DSC_POSBUF)
  sys_munmap(dcb as *u8, DSC_POSBUF)
  sys_munmap(used, DSC_TOKBUF)
  return outn
2248}
2249func dss_tlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
2250// STEM EXPANSION (recall; the sota_stemming rung, ZERO index change): for query term `term`, scan the live
2251// term dictionary (ss_term_at over each segment's .terms) for terms whose Porter-lite stem == stem(term),
2252// appending each NEW dictionary term (not already in the term list) to termstore/termptrs. Bounded by
2253// DSS_MAXTERMS. Returns the (possibly grown) term count. `orig_nterms` = the pre-expansion count (only
2254// those get stem-expanded, so we never expand an already-added variant).
2255// R1h (2026-09-04): `owner` is the CONCEPT MAP -- owner[t] is the index of the ORIGINAL query term that
2256// spawned term t (identity for t < orig_nterms). Stem expansion appends surface forms of a concept the
2257// user typed ONCE; before this map every downstream consumer treated each form as an INDEPENDENT query
2258// term, which inverted the ranking three ways: (1) a RARE variant carries a HIGHER idf than the common
2259// word the user actually typed, so matching "redding" outscored matching "red"; (2) each variant took its
2260// own bit in the coverage mask, so a document matching one variant of one concept looked like a document
2261// covering the query; (3) totidf summed the variants, so the coordination denominator was inflated by
2262// words nobody searched for. MEASURED 2026-09-04 on the live web shard: q="red wine" returned
2263// "Dave Redding otra baja para McLaren" at rank 1 -- a document containing NEITHER "red" NOR "wine" as a
2264// whole word. This mirrors the R1f denominator fix at the authority floor, which fixed exactly this for
2265// totcidf and was never applied to its siblings. ★A FIX THAT LIVES IN ONE LOOP AND NOT ITS SIBLINGS IS
2266// HALF A FIX, AND THE MISSING HALF IS INVISIBLE UNTIL SOMETHING RANKS ON IT.
2267func dss_stem_expand(h: *i64, termstore: *u8, termptrs: *i64, nterms: i64, orig_nterms: i64, owner: *i64) -> i64 {
  var nt: i64 = nterms
  let stemq: *u8 = sys_mmap(DSC_TOKBUF)
  let stemc: *u8 = sys_mmap(DSC_TOKBUF)
  let tpb: *i64 = sys_mmap(DSC_POSBUF) as *i64
  let tlb: *i64 = sys_mmap(DSC_POSBUF) as *i64
  let dcb: *i64 = sys_mmap(DSC_POSBUF) as *i64
  let cbuf: *u8 = sys_mmap(DSC_TOKBUF)
  var qt: i64 = 0
  while qt < orig_nterms {
      let term: *u8 = termptrs[qt] as *u8
      let qsn: i64 = nx_stem(term, dss_tlen(term), stemq)
      // prefix-prune width: Porter only strips/mutates SUFFIXES, so a dict term sharing this stem must
      // share the stem's leading bytes. Comparing the first min(qsn,3) bytes skips ~99% of the dictionary
      // BEFORE the expensive per-term stem -- the fix for the query-time dictionary-scan cost.
      var pw: i64 = qsn
      if pw > 3 { pw = 3 }
      // DERIVED RUN BOUND (L5, 2026-09-14). The phase timers named this walk as 0.33-0.40 s of every cold
      // query, CPU in nx_stem per run entry (a prefetch pass over the same run measured no gain). Porter
      // rewrites SUFFIXES only, so a dictionary term whose stem EQUALS stemq shares stemq's first qsn-1 bytes
      // (y to i and biliti to ble can differ in the stem's last byte, never earlier). Widening the key from
      // 3 to qsn-1 bytes therefore walks a SUBSET of the old run that still holds every match: the expansion
      // set is byte-identical by construction. Not an argument: nx_stem_bound_gate walks EVERY term of EVERY
      // live segment with this same nx_stem and counts violations (26258430 terms, 32 segments, 0 violations
      // on 2026-09-14). Stems shorter than 5 bytes keep the old width: qsn-1 <= 3 would change nothing.
      if qsn - 1 > pw { pw = qsn - 1 }
      let ns: i64 = h[0]
      // PREFETCH PASS (2026-09-14, from the phase timers: prep read 0.32-0.40 s cold with the run prefetch below
      // issued one segment at a time right before its own walk). Lower-bound every segment's run FIRST and hand
      // the kernel all of them, so the walks below read warm together. The walk and its acceptance test are
      // unchanged and each walk starts at the same lower bound: expansion stays byte-identical.
      let epre: *i64 = sys_mmap(8 * (ns + 1)) as *i64
      var sp: i64 = 0
      while sp < ns {
          let tcp: i64 = ss_term_count(h, sp)
          let ep: i64 = ss_term_lb(h, sp, stemq, pw)
          epre[sp] = ep
          if ep < tcp {
              let ptbp: *u8 = h[5 + 8 * sp] as *u8
              let ptnp: i64 = ss_r32(ptbp, 4)
              let poffp: i64 = (ptbp as i64) + 8 + 4 * ep
              var potlp: i64 = ((ptbp as i64) + 8 + 4 * ptnp) - poffp
              if potlp > DSC_MAGIC_262144 { potlp = DSC_MAGIC_262144 }
              if potlp > 0 {
                  let pal0p: i64 = (poffp / DSC_MAGIC_4096) * DSC_MAGIC_4096
                  sys_madvise(pal0p as *u8, (poffp - pal0p) + potlp, 3)
              }
              let peop: i64 = (ptbp as i64) + 8 + 4 * ptnp + ss_r32(ptbp, 8 + 4 * ep)
              var pewp: i64 = DSC_MAGIC_2097152
              let ptszp: i64 = h[6 + 8 * sp]
              if peop + pewp > (ptbp as i64) + ptszp { pewp = (ptbp as i64) + ptszp - peop }
              if pewp > 0 {
                  let pal1p: i64 = (peop / DSC_MAGIC_4096) * DSC_MAGIC_4096
                  sys_madvise(pal1p as *u8, (peop - pal1p) + pewp, 3)
              }
          }
          sp = sp + 1
      }
      var s: i64 = 0
      while s < ns {
          if nt >= DSS_MAXTERMS { s = ns } else {
              let tc: i64 = ss_term_count(h, s)
              // SORTED-DICTIONARY PREFIX RUN (perf, 2026-08-08). Every term carrying this prefix sits in
              // ONE contiguous run, because ss_build_terms merge-sorts the dictionary. Binary-search that
              // run's START (ss_term_lb) and stop at its END, instead of walking all tc terms for EVERY
              // query term. The terms examined and the acceptance test are unchanged, so the expansion is
              // byte-identical; only the walk changes, from O(dictionary) to O(log dictionary + run).
              // The prefix gate below could make the scan ~99% cheaper but never asymptotically cheaper --
              // measured 2026-08-08, this scan cost ~3.0s PER QUERY TERM on the live web shard.
              var e: i64 = epre[s]   // the same lower bound, computed once in the prefetch pass above
              // RUN PREFETCH (2026-08-12): the run walk below faults its .terms pages one at a time
              // on a cold mmap -- the same serial-fault chain PASS 0 retires for .docs. Hand the
              // kernel the run's offset-table stripe (capped 256KB) and a bounded window of entry
              // bytes (capped 2MB) up front; a run longer than the window just resumes faulting
              // serially past it -- strictly no worse than before. The walk and its acceptance
              // test are unchanged: expansion stays byte-identical.
              if e < tc {
                  let ptb: *u8 = h[5 + 8 * s] as *u8
                  let ptn: i64 = ss_r32(ptb, 4)
                  let poff: i64 = (ptb as i64) + 8 + 4 * e
                  var potl: i64 = ((ptb as i64) + 8 + 4 * ptn) - poff
                  if potl > DSC_MAGIC_262144 { potl = DSC_MAGIC_262144 }
                  if potl > 0 {
                      let pal0: i64 = (poff / DSC_MAGIC_4096) * DSC_MAGIC_4096
                      sys_madvise(pal0 as *u8, (poff - pal0) + potl, 3)
                  }
                  let peo: i64 = (ptb as i64) + 8 + 4 * ptn + ss_r32(ptb, 8 + 4 * e)
                  var pew: i64 = DSC_MAGIC_2097152
                  let ptsz: i64 = h[6 + 8 * s]
                  if peo + pew > (ptb as i64) + ptsz { pew = (ptb as i64) + ptsz - peo }
                  if pew > 0 {
                      let pal1: i64 = (peo / DSC_MAGIC_4096) * DSC_MAGIC_4096
                      sys_madvise(pal1 as *u8, (peo - pal1) + pew, 3)
                  }
              }
              while e < tc {
                  if nt >= DSS_MAXTERMS { e = tc } else {
                      if ss_term_at(h, s, e, tpb, tlb, dcb) == 1 {
                          let dtp: *u8 = tpb[0] as *u8
                          // cheap prefix gate
                          var pfxok: i64 = 0
                          if tlb[0] >= pw {
                              pfxok = 1
                              var pk: i64 = 0
                              while pk < pw { if dtp[pk] != stemq[pk] { pfxok = 0; pk = pw } else { pk = pk + 1 } }
                          }
                          // END OF THE RUN: sorted order guarantees no LATER term in this segment can
                          // carry the prefix, so stop instead of walking the tail. Guarded on pw > 0
                          // because an empty prefix means "no prefix" -- lb returned 0 and every term
                          // must still be considered, exactly as before.
                          if pfxok == 0 { if pw > 0 { e = tc } }
                          if pfxok == 1 { if tlb[0] < 40 {
                              // copy the dict term (NUL-terminate), stem it, compare stems
                              var ci: i64 = 0
                              while ci < tlb[0] { cbuf[ci] = dtp[ci]; ci = ci + 1 }
                              cbuf[tlb[0]] = 0 as u8
                              let csn: i64 = nx_stem(cbuf, tlb[0], stemc)
                              var samestem: i64 = 0
                              if csn == qsn {
                                  samestem = 1
                                  var x: i64 = 0
                                  while x < qsn { if stemc[x] != stemq[x] { samestem = 0; x = qsn } else { x = x + 1 } }
                              }
                              if samestem == 1 {
                                  // already in the term list?
                                  var dup: i64 = 0
                                  var y: i64 = 0
                                  while y < nt { if dss_streq(cbuf, termptrs[y] as *u8) == 1 { dup = 1; y = nt } else { y = y + 1 } }
                                  if dup == 0 {
                                      let dst: *u8 = (termstore as i64 + nt * 64) as *u8
                                      var z: i64 = 0
                                      while z < tlb[0] { dst[z] = cbuf[z]; z = z + 1 }
                                      dst[tlb[0]] = 0 as u8
                                      termptrs[nt] = dst as i64
                                      owner[nt] = qt   // R1h: this surface form belongs to ORIGINAL term qt
                                      nt = nt + 1
                                  }
                              }
                          } }
                      }
                      e = e + 1
                  }
              }
              s = s + 1
          }
      }
      qt = qt + 1
  }
  sys_munmap(stemq, DSC_TOKBUF)
  sys_munmap(stemc, DSC_TOKBUF)
  sys_munmap(tpb as *u8, DSC_POSBUF)
  sys_munmap(tlb as *u8, DSC_POSBUF)
  sys_munmap(dcb as *u8, DSC_POSBUF)
  sys_munmap(cbuf, DSC_TOKBUF)
  return nt
2422}
2423// THE SOVEREIGN SEARCH (paged). (domain, query, offset) -> up to `max` ranked cids + scores STARTING at
2424// rank `offset` (0 = the top); totalout[0] = total consent-passing candidates (the "about N results"
2425// figure + the pager's has-more truth); totalout[1] = phrase exactness (2 = no phrase in the query,
2426// 1 = "quoted phrase" enforced with positional adjacency everywhere, 0 = a pre-phrase segment degraded
2427// to AND -- compaction upgrades it). Returns nresults emitted; -2 = a live segment lacks .terms.
2428// QUERY SYNTAX: +term is REQUIRED (AND); -term is EXCLUDED (NOT); "quoted words" is a PHRASE (adjacent,
2429// in order, via the NXQ1 positions sidecar; phrase terms also score normally); site:<host> scopes results
2430// to pages whose url:<cid> host matches (dot-suffix: site:wikipedia.org covers en.wikipedia.org).
2431// Q0 CONTRACT (dss_owner_map, /compare/search): the CONCEPT MAP. owner[t] = index of the ORIGINAL term that
2432// spawned surface form t; identity for every term the user typed, and dss_stem_expand fills the appended
2433// range. Declared as its own symbol so the board's watch row measures the mechanism that shipped 2026-09-04
2434// instead of reading it DARK -- the loop it replaces was byte-for-byte this identity fill.
2435func dss_owner_map(owner: *i64, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { owner[i] = i; i = i + 1 }
  return n
2439}
2440// POSTED-TERM tf FLOOR (Q10, 2026-09-13). The postings are full-doc truth: a term the .post/.imp list says
2441// is IN this document has tf >= 1 by construction. The capped head scan (DSS_TFSCAN) returns 0 for a term
2442// that lives past the cap, and before this floor that 0 DISQUALIFIED a +required term and zeroed the score
2443// of a plain one -- MEASURED on the live shard 2026-09-13: q=kyoka total=25 nresults=0 and q=+julia +kyoka
2444// total=11 nresults=0, i.e. "N matched, nothing shown". The old floor also demanded dcount <= DSS_RARE_DCOUNT,
2445// a rarity gate that let a 25-document term vanish; the posting itself is the evidence and needs no rarity to
2446// be believed. tf=1 on a long document scores LOW under BM25 length normalisation (a tail match loses to
2447// head matches exactly as before) -- findable, never promoted. Documents under the scan cap (capped == 0)
2448// and terms the postings do not carry are untouched, so the gate corpora are byte-identical.
2449func dss_posted_floor(tf: i64, capped: i64, posted: i64, dcount: i64) -> i64 {
  if tf > 0 { return tf }
  if capped == 0 { return 0 }
  if posted == 0 { return 0 }
  if dcount < 1 { return 0 }
  return 1
2455}
2456// Q8 CONTRACT (dss_exact_precedence): a document containing the words the user TYPED ranks above one that
2457// contains only stem variants of them, whatever the BM25 magnitude -- a TIER, not a coefficient (a discount
2458// constant here would be a magic number nobody could justify; a lexicographic key needs none).
2459// exa/exb = count of typed (original, non-excluded) query terms present as whole words; sca/scb = scores.
2460// Returns 1 when (exa, sca) ranks strictly above (exb, scb). The callers set every ex to 0 unless expansion
2461// actually ADDED variants, so +/- operator queries, phrase queries and the gate corpora are byte-identical.
2462// MEASURED 2026-09-13: q=ice cream ranked "cake icing" (icing<-ice, cream present) at #1 over the Library of
2463// Congress "Ice Cream" page. The 09-04 idf/coverage fixes bound a variant's WEIGHT, but a variant-only
2464// document could still tie a typed-word document on every remaining signal (title bonus, proximity, slug).
2465func dss_exact_precedence(exa: i64, sca: i64, exb: i64, scb: i64) -> i64 {
  if exa > exb { return 1 }
  if exa < exb { return 0 }
  if sca > scb { return 1 }
  return 0
2470}
2471func dss_search_off_div(domain: *u8, q: *u8, qn: i64, cids_out: *i64, scores_out: *i64, max: i64, offset: i64, totalout: *i64, webdiv: i64) -> i64 {
  totalout[0] = 0
  totalout[1] = 2
  dss_ph_init()
  dss_bq_set(0, 0)   // S7: bm25q.repeats / bm25q.moved read 0 until this query fuses (and stay 0 on a memo hit)
  dss_ent_set(0, 0)  // S11: entity.pinned / entity.cid read 0 until a name-shaped query looks the table up
  let ph_t0: i64 = sys_now_us()
  var ph_t: i64 = ph_t0
  let prefix: *u8 = sys_mmap(512)
  dss_prefix(domain, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  if (h as i64) == 0 { return 0 }   // empty/absent shard -> no results (also the cross-shard isolation guarantee)
  let tbl: *u8 = sys_mmap(272)
  ss_tok_table(tbl)
  // site:<host> FIELD FILTER (the faceted-search rung): parse + STRIP the clause up front so its tokens
  // ("site", the host words) never reach scoring; the host lands in sitehost (lowercased) and filters
  // candidates against their url:<cid> rows below. qq/qqn = the stripped query all downstream scans use.
  let sitehost: *u8 = sys_mmap(256)
  sitehost[0] = 0 as u8
  let qq: *u8 = sys_mmap(qn + 8)
  var qqn: i64 = 0
  var si0: i64 = 0
  while si0 < qn {
      var issite: i64 = 0
      if si0 + 5 <= qn {
          var bnd: i64 = 0
          if si0 == 0 { bnd = 1 } else { if tbl[q[si0 - 1]] == (0 as u8) { bnd = 1 } }
          if bnd == 1 {
              if q[si0] == (115 as u8) { if q[si0+1] == (105 as u8) { if q[si0+2] == (116 as u8) { if q[si0+3] == (101 as u8) { if q[si0+4] == (58 as u8) { issite = 1 } } } } }
          }
      }
      if issite == 1 {
          var hj: i64 = si0 + 5
          var hw: i64 = 0
          var hgo: i64 = 1
          while hgo == 1 {
              if hj >= qn { hgo = 0 } else {
                  var hc: i64 = q[hj] as i64
                  if hc == 32 { hgo = 0 } else {
                      if hc >= 65 { if hc <= 90 { hc = hc + 32 } }
                      if hw < 250 { sitehost[hw] = hc as u8; hw = hw + 1 }
                      hj = hj + 1
                  }
              }
          }
          sitehost[hw] = 0 as u8
          si0 = hj
      } else {
          qq[qqn] = q[si0]
          qqn = qqn + 1
          si0 = si0 + 1
      }
  }
  qq[qqn] = 0 as u8
  // R2b URL-SCOPE UNDERSTANDING (2026-08-04, operator: "search reddit and a specific subreddit brings
  // barely anything back"): two query idioms scope results by URL PATH, sharing one filter below.
  //   inurl:<frag> -- explicit operator, ANY site: keep candidates whose url contains <frag>.
  //   r/<name>     -- the universal subreddit idiom: implies site:reddit.com (only when no explicit
  //                   site: clause was given) + segment-anchored path /r/<name>; the bare name stays
  //                   in the query as a scoring term. Without this rewrite the tokenizer's 2-char
  //                   floor dropped the "r" and the whole scoping intent of "r/StableDiffusion"
  //                   silently died -- the query degraded to a bag of boilerplate-matchable words.
  // First clause of each kind wins; queries carrying neither are BYTE-IDENTICAL downstream (ruler-safe).
  let pathpat: *u8 = sys_mmap(256)
  pathpat[0] = 0 as u8
  var seganchor: i64 = 0
  let qr: *u8 = sys_mmap(qqn + 16)
  var qrn: i64 = 0
  var pi0: i64 = 0
  while pi0 < qqn {
      var bnd2: i64 = 0
      if pi0 == 0 { bnd2 = 1 } else { if tbl[qq[pi0 - 1]] == (0 as u8) { bnd2 = 1 } }
      var consumed: i64 = 0
      // inurl:<frag>
      if bnd2 == 1 { if pathpat[0] == (0 as u8) { if pi0 + 6 <= qqn {
          if qq[pi0] == (105 as u8) { if qq[pi0+1] == (110 as u8) { if qq[pi0+2] == (117 as u8) { if qq[pi0+3] == (114 as u8) { if qq[pi0+4] == (108 as u8) { if qq[pi0+5] == (58 as u8) {
              var fj: i64 = pi0 + 6
              var fw: i64 = 0
              var fgo: i64 = 1
              while fgo == 1 {
                  if fj >= qqn { fgo = 0 } else {
                      var fc: i64 = qq[fj] as i64
                      if fc == 32 { fgo = 0 } else {
                          if fc >= 65 { if fc <= 90 { fc = fc + 32 } }
                          if fw < 250 { pathpat[fw] = fc as u8; fw = fw + 1 }
                          fj = fj + 1
                      }
                  }
              }
              pathpat[fw] = 0 as u8
              seganchor = 0
              if fw > 0 { consumed = 1; pi0 = fj }
          } } } } } }
      } } }
      // r/<name> (subreddit idiom): name = [A-Za-z0-9_]{2,30}
      if consumed == 0 { if bnd2 == 1 { if pathpat[0] == (0 as u8) { if pi0 + 3 < qqn {
          var isr: i64 = 0
          if qq[pi0] == (114 as u8) { isr = 1 }
          if qq[pi0] == (82 as u8) { isr = 1 }
          if isr == 1 { if qq[pi0+1] == (47 as u8) {
              var nj: i64 = pi0 + 2
              var nlen: i64 = 0
              var ngo: i64 = 1
              while ngo == 1 {
                  if nj >= qqn { ngo = 0 } else {
                      let nc: i64 = qq[nj] as i64
                      var isw: i64 = 0
                      if nc >= 97 { if nc <= 122 { isw = 1 } }
                      if nc >= 65 { if nc <= 90 { isw = 1 } }
                      if nc >= 48 { if nc <= 57 { isw = 1 } }
                      if nc == 95 { isw = 1 }
                      if isw == 1 { nlen = nlen + 1; nj = nj + 1 } else { ngo = 0 }
                  }
              }
              if nlen >= 2 { if nlen <= 30 {
                  pathpat[0] = 47 as u8    // '/'
                  pathpat[1] = 114 as u8   // 'r'
                  pathpat[2] = 47 as u8    // '/'
                  var nz: i64 = 0
                  while nz < nlen {
                      var vc: i64 = qq[pi0 + 2 + nz] as i64
                      if vc >= 65 { if vc <= 90 { vc = vc + 32 } }
                      pathpat[3 + nz] = vc as u8
                      nz = nz + 1
                  }
                  pathpat[3 + nlen] = 0 as u8
                  seganchor = 1
                  if sitehost[0] == (0 as u8) {
                      let rh: *u8 = "reddit.com" as *u8
                      var rz: i64 = 0
                      while rh[rz] != (0 as u8) { sitehost[rz] = rh[rz]; rz = rz + 1 }
                      sitehost[rz] = 0 as u8
                  }
                  var cz: i64 = 0
                  while cz < nlen { qr[qrn] = qq[pi0 + 2 + cz]; qrn = qrn + 1; cz = cz + 1 }
                  consumed = 1
                  pi0 = nj
              } }
          } }
      } } } }
      if consumed == 0 {
          qr[qrn] = qq[pi0]
          qrn = qrn + 1
          pi0 = pi0 + 1
      }
  }
  var qc9: i64 = 0
  while qc9 < qrn { qq[qc9] = qr[qc9]; qc9 = qc9 + 1 }
  qqn = qrn
  qq[qqn] = 0 as u8
  // R6 BARE-site: FALSE-ZERO FIX (2026-08-05, debt 1785934453): a site:-only query stripped to
  // zero terms and hit the nterms==0 return -- an unconditional 0 indistinguishable from "host
  // absent", which poisoned every coverage census taken with bare site:. When the residual query
  // holds NO token characters and a site: clause was given, synthesize the host's own labels as
  // the query ("commoncrawl org" for site:commoncrawl.org): pages carry their host's brand
  // labels, so this returns an HONEST lower-bound listing through the NORMAL pipeline -- BM25,
  // authority, consent (pol:) checks all apply, purged docs stay purged. True url:-walk
  // enumeration remains the debt's next rung. Queries with any real term are byte-identical.
  if sitehost[0] != (0 as u8) {
      var r6only: i64 = 1
      var r6i: i64 = 0
      while r6i < qqn { if tbl[qq[r6i]] != (0 as u8) { r6only = 0; r6i = qqn } else { r6i = r6i + 1 } }
      if r6only == 1 {
          qqn = 0
          var r6j: i64 = 0
          while sitehost[r6j] != (0 as u8) {
              var r6c: i64 = sitehost[r6j] as i64
              if r6c == 46 { r6c = 32 }
              if r6c == 45 { r6c = 32 }
              qq[qqn] = r6c as u8
              qqn = qqn + 1
              r6j = r6j + 1
          }
          qq[qqn] = 0 as u8
      }
  }
  // tokenize the query with the index's OWN tokenizer so terms align exactly with the postings
  let termstore: *u8 = sys_mmap(DSS_MAXTERMS * 64)
  let termptrs: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  var nterms: i64 = 0
  let qpos: *i64 = sys_mmap(16) as *i64
  qpos[0] = 0
  let tb: *u8 = sys_mmap(64)
  var qgo: i64 = 1
  while qgo == 1 {
      let l: i64 = ss_tok_next2(qq, qqn, qpos, tb, tbl)
      if l < 0 { qgo = 0 } else {
          if nterms < DSS_MAXTERMS {
              let dst: *u8 = (termstore as i64 + nterms * 64) as *u8
              var i: i64 = 0
              while tb[i] != (0 as u8) { dst[i] = tb[i]; i = i + 1 }
              dst[i] = 0 as u8
              termptrs[nterms] = dst as i64
              nterms = nterms + 1
          }
      }
  }
  if nterms == 0 { return 0 }
  // +term REQUIRED / -term EXCLUDED masks: '+' and '-' are separators to the tokenizer (never reach
  // the term list), so scan the RAW query -- at a token boundary they mark the NEXT token as required
  // (AND) or excluded (NOT). A '-' INSIDE a word (e-mail) is not a boundary and stays inert.
  let reqmask: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let exclmask: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  var rz: i64 = 0
  while rz < nterms { reqmask[rz] = 0; exclmask[rz] = 0; rz = rz + 1 }
  let rtok: *u8 = sys_mmap(64)
  let rpos: *i64 = sys_mmap(16) as *i64
  var qi: i64 = 0
  while qi < qqn {
      var op: i64 = 0
      if qq[qi] == (43 as u8) { op = 1 }
      if qq[qi] == (45 as u8) { op = 2 }
      if op != 0 {
          var boundary: i64 = 0
          if qi == 0 { boundary = 1 } else { if tbl[qq[qi - 1]] == (0 as u8) { boundary = 1 } }
          if boundary == 1 { if qi + 1 < qqn { if tbl[qq[qi + 1]] != (0 as u8) {
              rpos[0] = qi + 1
              let rl: i64 = ss_tok_next2(qq, qqn, rpos, rtok, tbl)
              if rl >= 2 {
                  var tt2: i64 = 0
                  while tt2 < nterms {
                      if dss_streq(rtok, termptrs[tt2] as *u8) == 1 {
                          if op == 1 { reqmask[tt2] = 1 } else { exclmask[tt2] = 1 }
                      }
                      tt2 = tt2 + 1
                  }
              }
          } } }
      }
      qi = qi + 1
  }
  // "quoted phrase" parse over the RAW query (quotes are tokenizer separators, so the terms list is
  // unaffected -- the phrase only narrows CANDIDACY). First quoted pair honored; 2..8 terms.
  let phterms: *u8 = sys_mmap(8 * 64)
  let phptrs: *i64 = sys_mmap(8 * 8) as *i64
  var nph: i64 = 0
  var q1: i64 = 0 - 1
  var q2: i64 = 0 - 1
  var qi2: i64 = 0
  while qi2 < qqn {
      if qq[qi2] == (34 as u8) {
          if q1 < 0 { q1 = qi2 } else { if q2 < 0 { q2 = qi2 } }
      }
      qi2 = qi2 + 1
  }
  if q1 >= 0 { if q2 > q1 + 1 {
      let ppos: *i64 = sys_mmap(16) as *i64
      ppos[0] = q1 + 1
      let ptok: *u8 = sys_mmap(64)
      var pgo: i64 = 1
      while pgo == 1 {
          if ppos[0] >= q2 { pgo = 0 } else {
              let pl: i64 = ss_tok_next2(qq, q2, ppos, ptok, tbl)
              if pl < 0 { pgo = 0 } else {
                  if nph < 8 {
                      let pdst: *u8 = (phterms as i64 + nph * 64) as *u8
                      var px: i64 = 0
                      while ptok[px] != (0 as u8) { pdst[px] = ptok[px]; px = px + 1 }
                      pdst[px] = 0 as u8
                      phptrs[nph] = pdst as i64
                      nph = nph + 1
                  }
              }
          }
      }
  } }
  // STEM EXPANSION (recall; the sota_stemming rung) -- only for plain OR queries. A phrase needs exact
  // adjacency; a query carrying +required/-excluded operators has exact term semantics; expanding those
  // would blur the operator. Runs BEFORE idf so the added variants get real idf weights (a variant match
  // scores its own idf*tf, ranking below an exact match but above a non-match). reqmask/exclmask stay
  // sized to the ORIGINAL terms -- variants are never required/excluded (they are pure OR recall).
  var hasop0: i64 = 0
  var opz: i64 = 0
  while opz < nterms { if reqmask[opz] == 1 { hasop0 = 1 } if exclmask[opz] == 1 { hasop0 = 1 } opz = opz + 1 }
  let r1g_onterms: i64 = nterms   // R1g: ORIGINAL term count (pre-stem-expansion) -- the entity-shape gate
  // R1h: owner[t] = index of the ORIGINAL term that spawned t. Identity for the terms the user actually
  // typed; dss_stem_expand fills the appended range. Declared UNCONDITIONALLY (even when nothing expands)
  // so every downstream loop can read it without a branch, and the no-expansion path stays provably
  // byte-identical because owner[t] == t there.
  let owner: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  dss_owner_map(owner, DSS_MAXTERMS)   // Q0 contract symbol: the identity fill every typed term keeps
  let ph_e0: i64 = sys_now_us()   // prep sub-phase 14 = stem expansion (L5 instrument, 2026-09-14: two cuts to this walk moved prep by nothing, so prep is timed in parts before a third guess)
  if nph < 2 { if hasop0 == 0 { if dss_expand_off == 0 {
      nterms = dss_stem_expand(h, termstore, termptrs, nterms, nterms, owner)
  } } }
  dss_ph_box[14] = sys_now_us() - ph_e0
  // idf per term (stage-1 needs it): the store's own persisted statistics -- covers expanded variants too.
  // dcnt[] kept alongside: the rare-term tf-floor (DSS_RARE_DCOUNT) needs the raw document frequency.
  let ph_d0: i64 = sys_now_us()   // prep sub-phase 15 = the per-query document count walk over every .keys entry (L5 instrument)
  let bign: i64 = ss_doc_count(h)
  dss_ph_box[15] = sys_now_us() - ph_d0
  let idf: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let dcnt: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  // stopword threshold = DSS_STOP_DFPCT% of the corpus (0 disables when the corpus is too small)
  var stopdf: i64 = 0
  if bign >= DSS_STOP_MINCORPUS { stopdf = (bign * DSS_STOP_DFPCT) / 100 }
  var ti0: i64 = 0
  while ti0 < nterms {
      let nt0: i64 = ss_term_dcount(h, termptrs[ti0] as *u8)
      dcnt[ti0] = nt0
      var v0: i64 = idf_q10(bign, nt0)
      // corpus-derived stopword discount: a term in >DSS_STOP_DFPCT% of docs loses ranking weight so
      // content terms drive the result (fixes function-word domination; language-agnostic by construction)
      if stopdf > 0 { if nt0 > stopdf { v0 = v0 / DSS_STOP_DISCOUNT } }
      // EVERYWHERE-TERM FLOOR (2026-09-13). idf_q10 floors at EXACTLY 0 once a term's dcount reaches N+1, and
      // write-time dcount counts every re-committed version of a page, so after the crawler re-fetched its
      // hosts across 183 unfolded segments "wikipedia" read dcount=432,336 against 371,080 documents. A zero
      // idf made every candidate a phantom (the drop below removes score-0 rows) and q=wikipedia, q=+wikipedia
      // and q=wikipedia org all answered total>0 nresults=0 -- proven on the OLD binary as a control, so it is
      // the statistic, not a scorer change. A term the postings carry for a document is evidence that the
      // document is about it at least a little; it keeps the representation's smallest positive weight so
      // those documents stay rankable by tf, length-norm, proximity, slug and authority. A term in NO document
      // (dcount 0) keeps idf 0, so T18b (no zero-score noise) is untouched.
      if v0 < DSS_IDF_Q10_MIN { if nt0 >= 1 { v0 = DSS_IDF_Q10_MIN } }
      idf[ti0] = v0
      ti0 = ti0 + 1
  }
  let cand_cid: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let cand_matched: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let cand_tmask: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64   // bit t set = postings say term t is IN this doc (full-doc truth)
  var ncand: i64 = 0
  var candsat: i64 = 0   // 1 = candidacy truncated somewhere -> totals become df-derived estimates
  let satbox: *i64 = sys_mmap(16) as *i64
  let kp: *i64 = sys_mmap(DSS_MAXHITS * 8) as *i64
  let kl: *i64 = sys_mmap(DSS_MAXHITS * 8) as *i64
  let ktf: *i64 = sys_mmap(DSS_MAXHITS * 8) as *i64   // WAND rung: per-hit tf from the .imp sidecar
  // NOTE (2026-07-25, ruler-refuted): overlaying the sidecar's TRUE full-doc tf into stage-2 BM25
  // (max with the DSS_TFSCAN-capped scan) measured MRR@10 701 -> 566 and was REVERTED: full-doc tf
  // rewards long keyword-dense boilerplate (tf-spam), while the scan cap doubles as a head-of-doc
  // quality prior. Sidecar tf stays candidacy-only until learned-sparse impact weights replace raw tf.
  // IMPLICIT PHRASE CANDIDACY: TRIED 2026-08-15, MEASURED, REVERTED. An additive ss_phrase pass over
  // ALL nterms scored MRR@10 582->580 and navigational 358->353 on the judged set, so it failed its
  // pre-declared accept rule and was removed rather than argued down as noise.
  // TWO causes, both known, so the next attempt is not a guess:
  //  (1) WRONG SPAN. It demanded every query term adjacent in order. "diana rider naked" has no such
  //      3-gram; the entity is the BIGRAM "diana rider" and "naked" is a modifier outside it. The
  //      proof run that worked was a 2-term quoted query. Phrase candidacy must walk SUB-SPANS.
  //  (2) STOLEN IMMUNITY. It copied cand_tmask=0 from the quoted path. That flag makes a candidate
  //      SKIP the coordination factor below. A quoted phrase earns that (it matched exactly); an
  //      AND-degraded candidate does not, so the pass injected docs immune to the partial-match
  //      penalty and they displaced better ones. Set a real tmask, or do not bypass coordination.
  let ph_n0: i64 = sys_now_us()
  dss_ph_box[0] = ph_n0 - ph_t
  ph_t = ph_n0
  if nph >= 2 {
      // PHRASE candidacy: only docs where the quoted terms are adjacent in order (per-segment NXQ1
      // ladder; sidecar-less segments degrade to AND and clear the exact flag). Dedup cids: the
      // manifest's dup-line wart can walk a segment twice.
      let prefix0: *u8 = sys_mmap(512)
      dss_prefix(domain, prefix0)
      let ebox: *i64 = sys_mmap(16) as *i64
      let np2: i64 = ss_phrase(prefix0, h, phptrs, nph, kp, kl, DSS_PHRASEHITS, ebox)
      if np2 == (0 - 2) { return 0 - 2 }
      totalout[1] = ebox[0]
      var j2: i64 = 0
      while j2 < np2 {
          let cid2: i64 = dss_key_cid(kp[j2] as *u8, kl[j2])
          if cid2 >= 0 {
              var f2: i64 = 0 - 1
              var c9: i64 = 0
              while c9 < ncand { if cand_cid[c9] == cid2 { f2 = c9 } c9 = c9 + 1 }
              if f2 < 0 { if ncand < DSS_MAXCAND { cand_cid[ncand] = cid2; cand_matched[ncand] = 1; cand_tmask[ncand] = 0; ncand = ncand + 1 } }
          }
          j2 = j2 + 1
      }
  } else {
      // candidate accumulation via per-term postings (OR) -- EXCLUDED terms contribute no candidates.
      // cand_matched accumulates the STAGE-1 score: sum of matched-term idfs straight from the
      // postings (no doc reads) -- the cheap ranking that picks the stage-2 shortlist.
      // RAREST-TERM-FIRST (2026-07-24, the "toy-grade" candidacy fix): process terms by ASCENDING document
      // frequency. A common term ("julia", hundreds of postings) must NOT saturate DSS_MAXCAND before the
      // rare DISCRIMINATIVE terms ("measurements", "idols") claim their slots -- otherwise the ONE page that
      // best matches the rare terms (the entity's profile) never enters the candidate set and is unrankable
      // at any score. Ordering is candidacy-only: the OR score/tmask are order-independent (commutative sums),
      // so this is byte-identical on any query whose candidates all fit under the cap (e.g. the gate corpus).
      let torder: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
      var norder: i64 = 0
      var to0: i64 = 0
      while to0 < nterms { if exclmask[to0] == 0 { torder[norder] = to0; norder = norder + 1 } to0 = to0 + 1 }
      var oi: i64 = 1
      while oi < norder {
          let keyt: i64 = torder[oi]
          var oj: i64 = oi - 1
          var moving: i64 = 1
          while moving == 1 {
              if oj >= 0 { if dcnt[torder[oj]] > dcnt[keyt] { torder[oj + 1] = torder[oj]; oj = oj - 1 } else { moving = 0 } } else { moving = 0 }
          }
          torder[oj + 1] = keyt
          oi = oi + 1
      }
      var oidx: i64 = 0
      while oidx < norder {
          let t: i64 = torder[oidx]
          // IMPACT-ORDERED candidacy (2026-07-25, WAND rung, seq606): the per-term cap keeps the
          // HIGHEST-tf postings (an entity's profile page has the highest tf of its name), not the
          // first 512 in doc-id order. -3 = shard not yet .imp-upgraded -> exact legacy behavior.
          var usedimp: i64 = 1   // seq871: ktf[] is only meaningful on the impact path
          var nm: i64 = ss_term_top(prefix, h, termptrs[t] as *u8, kp, kl, ktf, DSS_MAXHITS, satbox)
          // candidacy SATURATION (2026-07-25 honest-total rung): trust the READER's own truncation
          // flag (build-capped list / collect / emit) -- NOT dcnt>nm, which false-positives on any
          // shard with shadowed re-committed docs (write-time dcount counts stale versions; the
          // dup-segment gate fixture proved it). A full candidate table saturates too.
          if satbox[0] == 1 { candsat = 1 }
          if ncand >= DSS_MAXCAND { candsat = 1 }
          if nm == (0 - 3) { usedimp = 0; nm = ss_term(h, termptrs[t] as *u8, kp, kl, DSS_MAXHITS) }
          if nm == (0 - 2) { return 0 - 2 }
          var j: i64 = 0
          while j < nm {
              let cid: i64 = dss_key_cid(kp[j] as *u8, kl[j])
              if cid >= 0 {
                  // IMPACT-AWARE STAGE-1 (seq871): the shortlist score weights each matched term's idf
                  // by a SATURATING tf factor carried in the impact list. The old sum-of-idf was
                  // tf-BLIND, so among candidates matching the SAME terms the shortlist kept whichever
                  // was walked first -- which is exactly why a 4x deeper candidate pool ranked WORSE
                  // (measured 705->534: nsf.gov fell out of the shortlist and became unrankable).
                  // Saturating, never linear: see DSS_S1_TFK. Fallback (no .imp) keeps the legacy sum.
                  var s1w: i64 = idf[t]
                  if usedimp == 1 { let tfv: i64 = ktf[j]; if tfv > 0 { s1w = (idf[t] * tfv) / (tfv + DSS_S1_TFK) } }
                  var f: i64 = 0 - 1
                  var c: i64 = 0
                  // FIND-OR-APPEND -- and it appends ONLY on the f < 0 arm below, so cand_cid holds no
                  // duplicates BY INDUCTION: the first match is the only match. This scan nonetheless ran
                  // to ncand every single time. At web saturation (ncand = DSS_MAXCAND = 2048) that is
                  // ~2048 x 2048 comparisons PER TERM, and stem expansion multiplies the term count --
                  // measured 2026-08-25 as one driver of 3.4-14.7 s cold web queries. Stopping at the
                  // match is BEHAVIOUR-IDENTICAL, not a ranking change: same f, same append, same order.
                  // Exit via a FLAG. Writing the sentinel into `c` itself would destroy the cursor -- the
                  // idiom nx_srclint hunts, which has erased the answer four times in this estate.
                  var cgo: i64 = 1
                  while cgo == 1 {
                      if c >= ncand { cgo = 0 } else {
                          if cand_cid[c] == cid { f = c; cgo = 0 } else { c = c + 1 }
                      }
                  }
                  if f < 0 {
                      if ncand < DSS_MAXCAND { cand_cid[ncand] = cid; cand_matched[ncand] = s1w; cand_tmask[ncand] = 1 << t; ncand = ncand + 1 }
                  } else {
                      cand_matched[f] = cand_matched[f] + s1w
                      cand_tmask[f] = cand_tmask[f] | (1 << t)
                  }
              }
              j = j + 1
          }
          oidx = oidx + 1
      }
  }
  if ncand == 0 { return 0 }
  let ph_n1: i64 = sys_now_us()
  dss_ph_box[1] = ph_n1 - ph_t
  dss_ph_box[12] = ncand
  ph_t = ph_n1
  // OWNER-CONSENT at query time. The retired tsv emitter enforced DP_USE_PUB_SEARCH at EMISSION (an
  // unflagged doc never entered <domain>_src.tsv); the store-native path enforces it LIVE per hit, so a
  // consent amendment takes effect at once (the docportal_lib doctrine). A candidate whose stored
  // pol:<cid> row LACKS the search bit is dropped; an ABSENT pol: row stays searchable -- that matches
  // dp_default_policy(PUBLIC) and covers migrated/legacy shards whose docs were consent-derived already.
  let polkey: *u8 = sys_mmap(64)
  let pp: *i64 = sys_mmap(16) as *i64
  let pl: *i64 = sys_mmap(16) as *i64
  var wkeep: i64 = 0
  var rcand: i64 = 0
  while rcand < ncand {
      dss_mkpolkey(cand_cid[rcand], polkey)
      var keep: i64 = 1
      if ss_hget(h, polkey, pp, pl) == 1 {
          var fv: i64 = 0
          let fp: *u8 = pp[0] as *u8
          var fi: i64 = 0
          while fi < pl[0] { let ch: i64 = fp[fi] as i64; if ch >= 48 { if ch <= 57 { fv = fv * 10 + (ch - 48) } } fi = fi + 1 }
          if (fv & DSS_POL_SEARCH) == 0 { keep = 0 }
      }
      if keep == 1 {
          cand_cid[wkeep] = cand_cid[rcand]
          cand_matched[wkeep] = cand_matched[rcand]
          cand_tmask[wkeep] = cand_tmask[rcand]
          wkeep = wkeep + 1
      }
      rcand = rcand + 1
  }
  ncand = wkeep
  if ncand == 0 { return 0 }
  // site:<host> filter (the faceted rung): keep only candidates whose url:<cid> row's host matches
  // (dot-suffix). Docs WITHOUT a url row (library texts) are not site-attributable -> dropped when a
  // site: clause is present. Runs BEFORE totals so "N matched" stays honest. Cheap: ss_hget per
  // candidate, no doc reads.
  if sitehost[0] != (0 as u8) {
      let sukey: *u8 = sys_mmap(64)
      let sup: *i64 = sys_mmap(16) as *i64
      let sul: *i64 = sys_mmap(16) as *i64
      var wsite: i64 = 0
      var rsite: i64 = 0
      while rsite < ncand {
          var skeep: i64 = 0
          dss_mkurlkey(cand_cid[rsite], sukey)
          if ss_hget(h, sukey, sup, sul) == 1 { if sul[0] > 0 {
              if dss_url_host_match(sup[0] as *u8, sul[0], sitehost) == 1 { skeep = 1 }
          } }
          if skeep == 1 {
              cand_cid[wsite] = cand_cid[rsite]
              cand_matched[wsite] = cand_matched[rsite]
              cand_tmask[wsite] = cand_tmask[rsite]
              wsite = wsite + 1
          }
          rsite = rsite + 1
      }
      ncand = wsite
      if ncand == 0 { return 0 }
  }
  // E4 CORPUS SCOPE filter: same contract as site: -- candidates whose url row does not START with the scope
  // prefix (or that have no url row) drop BEFORE totals, so the count stays honest; the cost is timed into
  // dss_scope_us so the done-rule (scope under 10 ms) is a measurement, not a claim.
  if dss_scope_pfx_n > 0 {
      let sc_t0: i64 = sys_now_us()
      let scukey: *u8 = sys_mmap(64)
      let scup: *i64 = sys_mmap(16) as *i64
      let scul: *i64 = sys_mmap(16) as *i64
      var wsc: i64 = 0
      var rsc: i64 = 0
      while rsc < ncand {
          var sckeep: i64 = 0
          dss_mkurlkey(cand_cid[rsc], scukey)
          if ss_hget(h, scukey, scup, scul) == 1 { if scul[0] > 0 {
              if dss_scope_filter(scup[0] as *u8, scul[0], dss_scope_pfx, dss_scope_pfx_n) == 1 { sckeep = 1 }
          } }
          if sckeep == 1 {
              cand_cid[wsc] = cand_cid[rsc]
              cand_matched[wsc] = cand_matched[rsc]
              cand_tmask[wsc] = cand_tmask[rsc]
              wsc = wsc + 1
          }
          rsc = rsc + 1
      }
      ncand = wsc
      dss_scope_us = sys_now_us() - sc_t0
      if ncand == 0 { return 0 }
  }
  // R2b URL-PATH filter (inurl: / r/<subreddit>): same contract as site: -- candidates whose url row
  // lacks the pattern (or that have no url row at all) drop BEFORE totals, so "N matched" stays honest.
  if pathpat[0] != (0 as u8) {
      let pukey: *u8 = sys_mmap(64)
      let pup: *i64 = sys_mmap(16) as *i64
      let pul: *i64 = sys_mmap(16) as *i64
      var wpath: i64 = 0
      var rpath: i64 = 0
      while rpath < ncand {
          var pkeep: i64 = 0
          dss_mkurlkey(cand_cid[rpath], pukey)
          if ss_hget(h, pukey, pup, pul) == 1 { if pul[0] > 0 {
              if dss_url_path_has(pup[0] as *u8, pul[0], pathpat, seganchor) == 1 { pkeep = 1 }
          } }
          if pkeep == 1 {
              cand_cid[wpath] = cand_cid[rpath]
              cand_matched[wpath] = cand_matched[rpath]
              cand_tmask[wpath] = cand_tmask[rpath]
              wpath = wpath + 1
          }
          rpath = rpath + 1
      }
      ncand = wpath
      if ncand == 0 { return 0 }
  }
  let ph_n2: i64 = sys_now_us()
  dss_ph_box[2] = ph_n2 - ph_t
  ph_t = ph_n2
  // the honest "N matched" (all consent-passing candidates) BEFORE the shortlist caps the set.
  // HONEST-TOTAL rung (2026-07-25, operator: "when do we get more than a few hundred results"): when
  // candidacy SATURATED, the walk count under-states reality -- the store's own per-term df (dcnt,
  // exact, corpus-wide) is a true lower bound on the OR-union match count, so report the largest
  // content-term df instead. Estimate applies ONLY to plain OR queries (no site:, no phrase, no
  // +/- operators -- those narrow the set below df). Unsaturated queries keep the exact count, so
  // small shards and every gate fixture are byte-identical. Downstream drops (score-0, url-dedup)
  // SUBTRACT from this total instead of resetting it to the shortlist remnant -- the old behavior
  // displayed ~128 "matched" on ANY corpus, which was the shortlist size, not the match count.
  var matched_total: i64 = ncand
  // RESET PER CALL: this is a LAST-CALL fact and must describe THIS query, not a previous one. A sticky
  // announce would mark every later exact total as an estimate, which is the same defect inverted.
  dss_est_g = 0
  if candsat == 1 { if sitehost[0] == (0 as u8) { if pathpat[0] == (0 as u8) { if nph < 2 { if hasop0 == 0 {
      var dfm: i64 = 0
      var dft: i64 = 0
      while dft < nterms {
          if exclmask[dft] == 0 { if dcnt[dft] > dfm { dfm = dcnt[dft] } }
          dft = dft + 1
      }
      // The flag is set HERE, on the assignment, not merely on candsat: saturation alone does not make
      // the total an estimate -- it only does so when the df-derived figure actually REPLACES the
      // enumerated one. Flagging on candsat would over-report, and an announce that cries estimate on
      // exact answers gets ignored exactly as fast as one that never fires.
      if dfm > matched_total { matched_total = dfm; dss_est_g = 1 }
  } } } } }
  totalout[0] = matched_total
  // STAGE-1 SHORTLIST (WAND / BlockMax two-stage retrieval -- the sota_* BlockMax pattern): cand_matched
  // holds the CHEAP postings-only score (summed matched-term idf, ZERO doc reads). Full BM25 below reads
  // each survivor's TEXT (the p95 cost on many-candidate queries), so cap survivors to the top
  // (offset+max+margin) by stage-1 score. Deep pagination widens the shortlist so it stays correct;
  // the common first pages get 4x fewer doc walks. Phrase candidates carry a flat stage-1 score but are
  // already adjacency-narrowed (rarely > shortn), so this is a no-op for them.
  // MEASURED 2026-07-24: trimming this pool (54 vs 126) cut only ~17% latency but dropped MRR 834->809 -- the
  // p95 web cost is NOT the candidate count, it's page-faults on the cold 2.4GB mmap (stage-1 postings + serve
  // reads). Real speed = the precomputed-tf-in-postings + compact per-doc sidecar rung. Kept the WIDE, correct
  // shortlist (quality first): offset+max+margin, deep pages widen it.
  // SHORTLIST FLOOR (seq877, 2026-07-25): the round-4 three-point measurement isolated THIS as the
  // depth blocker -- the pool grew 4x while the sieve handed to full BM25 stayed 128, so more
  // candidates had to be discriminated by a same-size filter. Floor raised to DSS_SHORT_FLOOR: at
  // the shipping depth (DSS_MAXCAND=512) that means EVERY candidate gets full BM25 and the cheap
  // stage-1 stops being a lossy gate at all. Costs one doc read per extra candidate -- ruler AND
  // latency gated, because paying 4x the reads for a flat number is not an improvement.
  var shortn: i64 = offset + max + 96
  if shortn < DSS_SHORT_FLOOR { shortn = DSS_SHORT_FLOOR }
  if ncand > shortn {
      var ssel: i64 = 0
      while ssel < shortn {
          var best: i64 = ssel
          var sj: i64 = ssel + 1
          while sj < ncand {
              if cand_matched[sj] > cand_matched[best] { best = sj }
              sj = sj + 1
          }
          if best != ssel {
              let tc: i64 = cand_cid[ssel]; cand_cid[ssel] = cand_cid[best]; cand_cid[best] = tc
              let tm: i64 = cand_matched[ssel]; cand_matched[ssel] = cand_matched[best]; cand_matched[best] = tm
              let tk: i64 = cand_tmask[ssel]; cand_tmask[ssel] = cand_tmask[best]; cand_tmask[best] = tk
          }
          ssel = ssel + 1
      }
      ncand = shortn
  }
  let ph_n3: i64 = sys_now_us()
  dss_ph_box[3] = ph_n3 - ph_t
  ph_t = ph_n3
  // RANKING (the BM25/IDF rung, integer-only): stage-2 reranks the shortlist with FULL BM25 --
  // score(d) = SUM idf_q10(N,n_t) * tfnorm_q10(tf, |d|/avgdl). idf[] was computed pre-candidacy.
  let cand_score: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let keybuf: *u8 = sys_mmap(64)
  let dptr: *i64 = sys_mmap(16) as *i64
  let dlen: *i64 = sys_mmap(16) as *i64
  // PASS 1 -- one walk per candidate: all term tfs + doc token length (the BM25 |d| statistic)
  let tfmat: *i64 = sys_mmap(DSS_MAXCAND * DSS_MAXTERMS * 8) as *i64
  let cand_dl: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let cand_toks: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64   // R2d: pass-1 token count (was discarded)
  let cand_capped: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let cand_prox: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64   // R1b: per-candidate term-proximity strength
  let cand_phrase: *i64 = sys_mmap(DSS_MAXCAND * DSS_I64_BYTES) as *i64   // S9b: 1 when every present query term sits adjacent (the name as typed)
  let cand_ex: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64     // Q8: typed-form cover count per candidate (the exact-precedence tier key)
  // S9 ENTITY DISCRIMINATORS (2026-09-17, operator probe julia kyoka): the precedence key is COMPOSITE and derived --
  // (typed content coverage, content-before-search-page, typed-form cover), then score. No coefficient anywhere.
  // Seeded from cand_ex for every scope; the web-scope authority pass rewrites it once the url is known.
  let cand_tier: *i64 = sys_mmap(DSS_MAXCAND * DSS_I64_BYTES) as *i64
  // PASS 0 -- PREFETCH (2026-08-12): batch madvise(MADV_WILLNEED) over every shortlisted
  // candidate's doc extent BEFORE the serial tf/prox walks below. The p95 web cost is page faults
  // on the cold multi-GB .docs mmap paid ONE AT A TIME inside PASS 1 (measured 2026-08-12 on the
  // live web shard: 1,350 candidates = 8.7s cold; the SAME term set site:-filtered to 290
  // just-read candidates = 375ms -- the delta IS the serial fault chain). WILLNEED hands the
  // kernel the whole extent list up front so the disk services batched readahead instead.
  // Ranking is BYTE-IDENTICAL by construction: this pass computes nothing; PASS 1 reads the same
  // bytes, just warm. sys_madvise is advisory -- its return value is deliberately ignored (worst
  // case = exactly the old cold behaviour). The ss_hget here also pre-walks the .keys binary
  // search, so PASS 1's own hget rides warm index pages too.
  // L0 (2026-09-14, contract symbol dss_tf_postings): score from the POSTINGS first. Every candidate it covers
  // skips both the prefetch and the .docs walk below; the walk runs only for the residue (a segment without
  // .pos, an unlocatable key, a malformed run). The API announces covered/walked per query (dss_l0_stats).
  let cand_l0: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  dss_adj_ntyped = r1g_onterms   // S9c: adjacency is judged over the typed terms only, on both proximity paths below
  dss_tf_postings(prefix, h, cand_cid, ncand, termptrs, nterms, tfmat, cand_prox, cand_capped, cand_dl, cand_l0, cand_phrase)
  var p0: i64 = 0
  while p0 < ncand {
      dss_mkkey(cand_cid[p0], keybuf)
      if cand_l0[p0] == 0 { if ss_hget(h, keybuf, dptr, dlen) == 1 {
          var pn: i64 = dlen[0]
          if pn > DSS_TFSCAN { pn = DSS_TFSCAN }
          let pa: i64 = dptr[0]
          let pal: i64 = (pa / DSC_MAGIC_4096) * DSC_MAGIC_4096
          sys_madvise(pal as *u8, (pa - pal) + pn, 3)
      } }
      p0 = p0 + 1
  }
  var dlsum: i64 = 0
  var c1: i64 = 0
  while c1 < ncand {
      dss_mkkey(cand_cid[c1], keybuf)
      var dl: i64 = 0
      if cand_l0[c1] == 1 { dl = cand_dl[c1] } else {
      cand_capped[c1] = 0
      cand_prox[c1] = 0
      if ss_hget(h, keybuf, dptr, dlen) == 1 {
          // scan-cap the tf walk: term frequencies saturate (k1=1.2) and the leading text carries the
          // relevant occurrences, so bounding the per-doc walk to DSS_TFSCAN bytes caps the query cost on
          // pathological docs (1MB wiki dumps) with negligible ranking impact. This is now the FALLBACK path:
          // dss_tf_postings above serves every candidate the index can (the perf store rung, landed 2026-09-14).
          var dn: i64 = dlen[0]
          if dn > DSS_TFSCAN { dn = DSS_TFSCAN; cand_capped[c1] = 1 }
          cand_toks[c1] = dss_tf_all(dptr[0] as *u8, dn, termptrs, nterms, tbl, (tfmat as i64 + c1 * DSS_MAXTERMS * 8) as *i64)   // fills tf_out; R2d keeps the token-|d| return
          cand_prox[c1] = dss_prox_all(dptr[0] as *u8, dn, termptrs, nterms, tbl)   // R1b: token-aligned proximity, same pass semantics as tf
          cand_phrase[c1] = dss_adj_last   // S9b: dss_prox_all ends in dss_prox_score, which left the adjacency flag
          // |d| = the doc's BYTE length (from ss_hget -- cap-INDEPENDENT, no extra scan): the shrunk tf-scan cap
          // no longer distorts length-norm, and |d|/avgdl is scale-invariant so BM25 b-norm is preserved (2026-07-24).
          dl = dlen[0]
      }
      }
      cand_dl[c1] = dl
      dlsum = dlsum + dl
      c1 = c1 + 1
  }
  let ph_n6: i64 = sys_now_us()
  dss_ph_box[6] = (ph_n6 - ph_t) - dss_ph_box[4] - dss_ph_box[5]
  ph_t = ph_n6
  // avgdl over the CANDIDATE SET (self-consistent per query; corpus-persisted avgdl = the store-rung
  // refinement, conceded in the census). Guard: never 0.
  var avgdl: i64 = dlsum / ncand
  if avgdl < 1 { avgdl = 1 }
  // S7 (2026-09-16): the BM25Q arm rides the same PASS 2 walk -- see dss_bm25q_fuse. qfirst/qcnt are taken over the
  // typed+expanded term list exactly as PASS 2 sees it, so a variant duplicated by a repeated typed term saturates too.
  let qfirst: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let qcnt: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let bq_repeats: i64 = dss_qtf_map(termptrs, nterms, qfirst, qcnt)
  let cand_scq: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  // PASS 2 -- FULL BM25 (b=0.75): score = SUM idf * tfnorm(tf, 1024*|d|/avgdl); +term still disqualifies
  var c2: i64 = 0
  while c2 < ncand {
      let tfrow: *i64 = (tfmat as i64 + c2 * DSS_MAXTERMS * 8) as *i64
      let normq10: i64 = (cand_dl[c2] * DSS_MAGIC_1024) / avgdl
      var sc: i64 = 0
      var scq: i64 = 0   // S7: the BM25Q arm of this candidate (equal to sc whenever no typed term repeats)
      var reqok: i64 = 1
      var excov: i64 = 0   // Q8: typed (original, non-excluded) terms present as whole words in this candidate
      var tt: i64 = 0
      while tt < nterms {
          var tf: i64 = tfrow[tt]
          // POSTED-TERM tf FLOOR (Q10, 2026-09-13 -- was the RARE-TERM floor gated on DSS_RARE_DCOUNT): the
          // postings are full-doc truth, so a term they carry has tf >= 1 even when the capped head scan
          // never reached it. Rarity is no longer a condition -- see dss_posted_floor for the measurement.
          tf = dss_posted_floor(tf, cand_capped[c2], cand_tmask[c2] & (1 << tt), dcnt[tt])
          // Q8: count the TYPED forms present (owner[tt] == tt for tt < r1g_onterms); variants never count.
          if tt < r1g_onterms { if exclmask[tt] == 0 { if tf > 0 { excov = excov + 1 } } }
          if reqmask[tt] == 1 { if tf == 0 { reqok = 0 } }
          if exclmask[tt] == 1 {
              if tf > 0 { reqok = 0 }   // -term PRESENT disqualifies (boolean NOT)
          } else {
              // R1h: score a surface form at its CONCEPT's idf, NEVER its own. idf[tt] gave a RARE
              // stem variant a HIGHER weight than the common word the user typed -- so matching
              // "redding" beat matching "red", and q="red wine" ranked a McLaren story containing
              // neither word at #1. owner[tt] == tt for every term the user typed, so this is
              // byte-identical whenever nothing expanded.
              // R1h-b, MEASURED CORRECTION TO R1h THE SAME SESSION. Taking idf[owner[tt]] alone was
              // wrong in the OTHER direction: it caps a RARER variant at its concept (the defect --
              // "redding" must not outscore the typed "red") but it also PROMOTES a COMMONER variant
              // up to its concept's weight, handing an inexact match more credit than it had before.
              // MEASURED on the live deploy: single-term queries reordered and got WORSE -- q=python
              // returned "The Seventh Python" where +python (which disables expansion) returns
              // "Python documentation by version | Python.org", and q=wikipedia returned "Wikispecies"
              // against +wikipedia's "Wikipedia:About". The control that proved it is plain-vs-plus,
              // because expansion runs ONLY when the query carries no +/- operator.
              // THE RULE, AND IT NEEDS NO NEW CONSTANT TO CALIBRATE: a surface form the user did not
              // type is worth no more than its concept AND no more than itself. min() bounds it in
              // BOTH directions, so a rare variant cannot outrank the typed word and a common variant
              // cannot inherit weight it never earned. ★A DISCOUNT CONSTANT HERE WOULD BE A MAGIC
              // NUMBER NOBODY COULD JUSTIFY; A MINIMUM IS DERIVED FROM THE TWO IDFS ALREADY IN HAND.
              // Byte-identical for every typed term, because owner[tt] == tt makes both arms equal.
              var w_r1h: i64 = idf[owner[tt]]
              if idf[tt] < w_r1h { w_r1h = idf[tt] }
              sc = sc + w_r1h * tfnorm_q10(tf, normq10)
              if qfirst[tt] == 1 { scq = scq + idf_bm25q(w_r1h, qcnt[tt]) * tfnorm_q10(tf, normq10) }   // S7: once per distinct term, its idf saturated by its query frequency
          }
          tt = tt + 1
      }
      if reqok == 0 { sc = 0 - 1 }   // a missing REQUIRED or present EXCLUDED term disqualifies outright
      if reqok == 0 { scq = 0 - 1 }   // S7: the second arm is disqualified with the first
      // R1b PROXIMITY BOOST: bounded multiply on POSITIVE scores only (mirrors the PageRank authority
      // fusion below); clustered query terms rank higher. prox=0 (single-term / no-cluster) -> factor
      // 1024 -> NO CHANGE, so single-term queries + non-clustered docs are byte-identical to before.
      if sc > 0 { let pf: i64 = DSS_MAGIC_1024 + (cand_prox[c2] * DSS_PROX_BOOST) / DSS_PROX_SCALE; sc = (sc * pf) / DSS_MAGIC_1024 }
      if scq > 0 { let pfq: i64 = DSS_MAGIC_1024 + (cand_prox[c2] * DSS_PROX_BOOST) / DSS_PROX_SCALE; scq = (scq * pfq) / DSS_MAGIC_1024 }   // S7: the same proximity factor on the second arm
      cand_score[c2] = sc
      cand_scq[c2] = scq
      // Q8: the tier key is live ONLY when expansion added variants; otherwise 0 for every candidate, so the
      // selection below degenerates to pure score order (byte-identical for operator, phrase and gate queries).
      if nterms > r1g_onterms { cand_ex[c2] = excov } else { cand_ex[c2] = 0 }
      cand_tier[c2] = cand_ex[c2]   // S9: non-web scopes keep the Q8 key exactly (byte-identical fixtures)
      c2 = c2 + 1
  }
  // S7 (2026-09-16): fuse the two arms BEFORE coordination -- rank permutation, plain score multiset preserved,
  // the identity when no typed term repeats (dss_bm25q_fuse). Announced per query as bm25q.repeats / bm25q.moved.
  var bq_moved: i64 = 0
  if bq_repeats > 0 { bq_moved = dss_bm25q_fuse(cand_score, cand_scq, ncand) }
  dss_bq_set(bq_repeats, bq_moved)
  // R1d COORDINATION -- IDF-WEIGHTED (2026-07-24 upgrade, ruler-driven): down-weight docs that cover less of
  // the query's IDF-MASS. Matching the rare/salient terms (e.g. "blood pressure") counts FAR more than matching
  // common ones ("how"/"to"). covfac = FLOOR + (1024-FLOOR)*matched_idf/total_idf; FULL idf coverage -> 1024
  // (byte-identical, so single-term queries + full matches -- incl. the #1 canonical entity -- are UNCHANGED).
  // The nx_web_relevance_bench ruler demanded this: every loss was an NL query where function-word/boilerplate
  // matches out-ranked salient-term content (blood-pressure -> nasa how-to; nsf -> spam). Multi-term NON-phrase.
  if nph < 2 { if nterms >= 2 {
      var totidf: i64 = 0; var ti: i64 = 0
      // R1h: the OBLIGATION is the idf mass of the terms the USER TYPED. Summing over `nterms` counted
      // every stem variant, inflating the coordination denominator with words nobody searched for. This
      // is the exact mirror of the R1f denominator fix already applied to totcidf at the authority floor
      // -- that fix was made in ONE loop and never given to its siblings.
      while ti < r1g_onterms { if exclmask[ti] == 0 { totidf = totidf + idf[ti] } ti = ti + 1 }
      if totidf > 0 {
          var cc: i64 = 0
          while cc < ncand {
              if cand_score[cc] > 0 { if cand_tmask[cc] != 0 {
                  var mi: i64 = 0; var mt: i64 = 0
                  // R1h: CREDIT EACH CONCEPT ONCE. Fold every matched surface form onto the ORIGINAL
                  // term that spawned it, then add that term's idf a single time. Before this, each
                  // variant contributed its OWN idf, so a document matching three morphological variants
                  // of ONE concept accumulated credit as though it had covered three concepts -- it could
                  // meet or exceed totidf and skip the coordination penalty entirely. Credit can now
                  // never exceed the obligation, so covfac is a true ratio in [FLOOR, 1024].
                  var omask: i64 = 0
                  while mt < nterms { if (cand_tmask[cc] & (1 << mt)) != 0 { if exclmask[mt] == 0 { omask = omask | (1 << owner[mt]) } } mt = mt + 1 }
                  var mo: i64 = 0
                  while mo < r1g_onterms { if (omask & (1 << mo)) != 0 { mi = mi + idf[mo] } mo = mo + 1 }
                  if mi < totidf {
                      // COVERAGE FALLS OFF QUADRATICALLY, NOT LINEARLY. The linear form let a document
                      // matching almost NONE of the query's idf-mass keep a large share of its BM25:
                      // at ~10% coverage the factor was 256 + 768*0.10 = 333, i.e. a third of full
                      // score, so a page stuffed with the one COMMON term only needed ~3x the term
                      // frequency of a genuine match to outrank it.
                      // MEASURED 2026-08-17 on the operator's own report: /search?scope=web&q=diora+
                      // baird+nude put Rokeby Venus and four porn-spam pages -- matching ONLY "nude",
                      // with zero relation to the person -- above the one genuinely relevant article.
                      // The rare terms carry the intent; a document missing them is not a weak answer,
                      // it is a different subject.
                      // SQUARING THE RATIO IS A MECHANISM CHANGE, NOT A RETUNE, and that is deliberate:
                      // ★★★★★WHEN A CALIBRATED THRESHOLD KEEPS LOSING, FIX THE MECHANISM RATHER THAN
                      // MOVE THE NUMBER -- lowering DSS_COV_FLOOR would have bought the same penalty at
                      // low coverage while ALSO punishing honest partial matches in the middle of the
                      // range, and it would have needed a new value nobody could justify.
                      // FULL COVERAGE IS BYTE-IDENTICAL (mi==totidf -> 1024), so single-term queries,
                      // phrase queries and every full match are provably unchanged -- the same
                      // no-op-at-the-top property the linear form was written to have.
                      // Range safety: idf sums here are O(1e4), so mi*mi is O(1e8) and the numerator
                      // O(1e11) -- decades inside i64, no widening needed.
                      let covfac: i64 = DSS_COV_FLOOR + ((DSS_MAGIC_1024 - DSS_COV_FLOOR) * mi * mi) / (totidf * totidf)
                      cand_score[cc] = (cand_score[cc] * covfac) / DSS_MAGIC_1024
                  }
              } }
              cc = cc + 1
          }
      }
  } }
  let ph_n7: i64 = sys_now_us()
  dss_ph_box[7] = ph_n7 - ph_t
  ph_t = ph_n7
  // P1 AUTHORITY FUSION (web scope only): multiply each candidate's BM25 by a PageRank prior. Resolve the page
  // node: content_cid -> url:<cid> -> ci_hash(url) [== the crawler's out:/pr: node id] -> pr:<cid>. rank in
  // [0,DSS_PR_SCALE] ppb -> factor = 1024 + rank*BOOST/SCALE (capped DSS_PR_MAXFAC). No pr: row (or non-web) = 1x,
  // so this is ADDITIVE authority ON TOP of relevance -- and makes the host-diversity cap a FLOOR, not the signal.
  if webdiv == 1 {
      let aukey: *u8 = sys_mmap(64)
      let aup: *i64 = sys_mmap(16) as *i64
      let aul: *i64 = sys_mmap(16) as *i64
      let apkey: *u8 = sys_mmap(64)
      let app: *i64 = sys_mmap(16) as *i64
      let apl: *i64 = sys_mmap(16) as *i64
      // TOPICAL-RELEVANCE FLOOR (seq636 fix, 2026-07-23): authority may only boost docs that matched a
      // CONTENT (non-stopword) query term. Otherwise a high-authority domain (science.nasa.gov "How To
      // Guide", wikipedia, bbc) matching ONLY function words (how/to) rode a 4x boost above the actual
      // hypertension pages. contentmask = bits of non-excluded terms that are NOT corpus-derived stopwords
      // (dcnt <= stopdf). Authority now breaks TIES AMONG RELEVANT docs, never overrides relevance. In the
      // gate/onsite corpora stopword detection is off (stopdf=0) -> every term is content -> the floor is a
      // no-op = byte-identical there. Phrase candidates (tmask=0) keep authority (phrase already ensures
      // relevance).
      var contentmask: i64 = 0
      var totcidf: i64 = 0
      var tcm: i64 = 0
      while tcm < nterms {
          if exclmask[tcm] == 0 {
              var iscontent: i64 = 1
              if stopdf > 0 { if dcnt[tcm] > stopdf { iscontent = 0 } }
              // R1f DENOMINATOR FIX (2026-08-05): totcidf once summed EVERY term incl. the
              // stem-expanded variants, so on natural-lang queries no doc could reach
              // DSS_AUTH_IDF_MIN of the mass and the whole authority/trust branch was DEAD CODE
              // (proven by two byte-invisible deploys, 2026-08-04). The OBLIGATION (denominator)
              // now covers only the ORIGINAL terms; the CREDIT (contentmask -> mcidf) still spans
              // variants, so a doc can earn the floor by matching a variant. Pattern queries and
              // the gate corpora do not stem-expand -> byte-identical there.
              if iscontent == 1 { contentmask = contentmask | (1 << tcm); if tcm < r1g_onterms { totcidf = totcidf + idf[tcm] } }
          }
          tcm = tcm + 1
      }
      // NAVIGATIONAL COVERAGE (2026-09-14, mechanism CORRECTED the same day -- search.plan log 1789392700). When
      // EVERY typed term is stopword-class, contentmask is 0. The R1f floor below is written `if contentmask != 0`,
      // so with contentmask==0 NOTHING ever cleared authok: authority was already ON for every candidate, and the
      // first version of this comment (claiming the floor switched authority OFF) was WRONG. What this block does:
      // promote the typed, non-excluded terms to content for the floor ONLY, so a multi-everywhere-term query
      // (q=wikipedia org) requires DSS_AUTH_IDF_MIN coverage of the TYPED terms before a candidate earns the PR
      // boost, the same rule content terms already obey. For a single-term query it is a byte-identical no-op:
      // MEASURED 2026-09-14 before and after deploy, q=wikipedia scope=web read Wikispecies 15144 / Welcome to
      // Wikipedia 14662 / English Wikipedia 14332 both times, and the judged-set A/B was IDENTICAL. The near-tie
      // there is NOT a missing floor: both pages carry a PR prior that saturates at DSS_PR_MAXFAC, so the cap
      // flattens the top authority tier and tf-vs-length decides. A per-page discriminator (anchor text Q1,
      // URL-type prior) is the remedy, on the search board.
      if contentmask == 0 {
          var nv0: i64 = 0
          while nv0 < r1g_onterms { if exclmask[nv0] == 0 { contentmask = contentmask | (1 << nv0); totcidf = totcidf + idf[nv0] } nv0 = nv0 + 1 }
      }
      // R2c trust-prior host list: parse each seed line's host once per query (fork-per-request
      // children; ~2KB file; ss_loadfile absent/empty -> ntshost=0 -> the prior is inert).
      let tsz: *i64 = sys_mmap(16) as *i64
      tsz[0] = 0
      let tsbuf: *u8 = ss_loadfile("knowledge/status/canonical_seeds.txt" as *u8, tsz, 0)
      let tshosts: *u8 = sys_mmap(DSS_TRUST_MAXH * 64)
      var ntshost: i64 = 0
      if (tsbuf as i64) != 0 {
          var tp: i64 = 0
          while tp < tsz[0] {
              var te: i64 = tp
              var tgo: i64 = 1
              while tgo == 1 {
                  if te >= tsz[0] { tgo = 0 } else { if tsbuf[te] == (10 as u8) { tgo = 0 } else { te = te + 1 } }
              }
              if te > tp { if ntshost < DSS_TRUST_MAXH { if tsbuf[tp] != (35 as u8) {
                  let td: *u8 = (tshosts as i64 + ntshost * 64) as *u8
                  let thl: i64 = dss_url_host(((tsbuf as i64) + tp) as *u8, te - tp, td)
                  if thl > 0 { if thl < 60 { ntshost = ntshost + 1 } }
              } } }
              tp = te + 1
          }
      }
      let stscr: *u8 = sys_mmap(256)   // R2d: host-label scratch for the brand exemption
      // PREFETCH PASS (2026-09-14, from the phase timers): with key lookups O(1) the authority phase still read
      // 0.25-0.47 s cold, every byte of it each candidate's url: VALUE faulted one page at a time out of .docs
      // for the slug and search-page checks, then its pr: row the same way. Hand the kernel the whole extent
      // list first -- the PASS 0 idiom -- then read warm. Advisory: computes nothing, ranking byte-identical.
      var pf9: i64 = 0
      while pf9 < ncand {
          dss_mkurlkey(cand_cid[pf9], aukey)
          if ss_hget(h, aukey, aup, aul) == 1 { if aul[0] > 0 {
              let pua: i64 = aup[0]
              let pual: i64 = (pua / DSC_MAGIC_4096) * DSC_MAGIC_4096
              sys_madvise(pual as *u8, (pua - pual) + aul[0], 3)
          } }
          pf9 = pf9 + 1
      }
      pf9 = 0
      while pf9 < ncand {
          dss_mkurlkey(cand_cid[pf9], aukey)
          if ss_hget(h, aukey, aup, aul) == 1 { if aul[0] > 0 {
              dss_prkey(dss_urlcid(aup[0] as *u8, aul[0]), apkey)
              if ss_hget(h, apkey, app, apl) == 1 { if apl[0] > 0 {
                  let ppa: i64 = app[0]
                  let ppal: i64 = (ppa / DSC_MAGIC_4096) * DSC_MAGIC_4096
                  sys_madvise(ppal as *u8, (ppa - ppal) + apl[0], 3)
              } }
          } }
          pf9 = pf9 + 1
      }
      // S9: the composite key's bases are DERIVED from the query -- typed content terms only (never a stem
      // variant, the R1h lesson); radix = typed count + 1 so (coverage, content, ex) order lexicographically.
      let s9typed: i64 = (1 << r1g_onterms) - 1
      let s9base: i64 = r1g_onterms + 1
      // S11: a name-shaped query the estate has resolved to a canonical page (entitypin.tsv) takes the band above
      // every S9 tier; the band is derived from the same bases, so no S9 combination can reach it.
      var s11cid: i64 = 0
      if r1g_onterms <= DSS_S9_ENTITY_TERMS { s11cid = dss_ent_lookup(termptrs, r1g_onterms) }
      let s11band: i64 = ((s9base + s9base) * DSS_S9_PAGE_KINDS + 1) * s9base + nterms + 1
      dss_ent_set(0, s11cid)
      var ca: i64 = 0
      while ca < ncand {
          var s9serp: i64 = 0   // S9: 1 once this candidate's url reads as another engine's results page
          // R2d STUFFING PENALTY -- RETIRED UNWIRED after a full two-round ruler campaign
          // (2026-08-04). Round 1 (no exemption): spam halved but MRR@10 368->297, navigational
          // brand pages are dense in their own name. Round 2 (brand-label exemption, T42): nav
          // healed only to 429/532 and the per-query ranks named the terminal class -- kernel.org
          // is legitimately dense in "linux" (rank 20!), londonmet.ac.uk in "london" (compound
          // label), a Lovelace biography in "lovelace". MEASURED CONCLUSION: query-term density
          // CANNOT separate stuffing from topical authority at any reachable threshold; the
          // legitimate hub/brand/biography class occupies the spam's density band. The anti-slop
          // judgment belongs at INGEST (content-quality axes: ad/affiliate density, template
          // mass) or to authority priors -- NOT at serve over query terms. dss_stuff_factor,
          // dss_host_label_match, T41/T42 and nx_doc_lexstat stay as the campaign's evidence.
          var authok: i64 = 1
          // R1f SALIENT-IDF authority floor: earn the PR boost only by matching >= DSS_AUTH_IDF_MIN of the
          // query's CONTENT idf-mass (a peripheral-term-only match on a high-authority domain forfeits it).
          if nph < 2 { if contentmask != 0 {
              if totcidf > 0 {
                  var mcidf: i64 = 0; var mc: i64 = 0
                  while mc < nterms { if (cand_tmask[ca] & contentmask & (1 << mc)) != 0 { mcidf = mcidf + idf[mc] } mc = mc + 1 }
                  if mcidf * DSS_MAGIC_1024 < totcidf * DSS_AUTH_IDF_MIN { authok = 0 }
              } else { if (cand_tmask[ca] & contentmask) == 0 { authok = 0 } }
          } }
          if cand_score[ca] > 0 { if authok == 1 {
              var rank: i64 = 0
              var searchpen: i64 = DSS_MAGIC_1024   // R1e: DSS_MAGIC_1024 = content; DSS_SEARCHPAGE_PEN if a search/query-echo URL
              var slugf: i64 = DSS_MAGIC_1024       // R1g: DSS_SLUG_BOOST if a matched content term is a URL path segment
              dss_mkurlkey(cand_cid[ca], aukey)
              if ss_hget(h, aukey, aup, aul) == 1 { if aul[0] > 0 {
                  if dss_is_search_url(aup[0] as *u8, aul[0]) == 1 { searchpen = DSS_SEARCHPAGE_PEN; s9serp = 1 }
                  // ENTITY-SHAPE GATE (measured 2026-07-24): the prior is for NAME lookups (1-2 terms);
                  // informational 3+-term queries ("malawi household survey") regressed under it -- in this
                  // skewed 150k corpus even "survey"/"university" pass a df-rarity test, so query SHAPE is
                  // the reliable entity signal, rarity the secondary one.
                  if searchpen == DSS_MAGIC_1024 { if r1g_onterms <= 2 {
                      // R1h-c: THE SLUG PRIOR IS THE LAST LOOP CARRYING THE SAME DEFECT, AND IT IS THE
                      // BIGGEST MULTIPLIER IN THE SYSTEM (DSS_SLUG_BOOST = 6144, i.e. 6x). It walked
                      // `nterms`, so a term the STEMMER INVENTED could earn the entity boost by
                      // appearing in the URL path. Worse, the rarity gate below (dcnt * SLUG_RAREK <
                      // bign) is EASIER for a variant to pass than for the typed word, because a
                      // variant is rarer by construction -- so the loop preferentially rewarded
                      // exactly the terms nobody searched for.
                      // MEASURED: the two queries still failing the probe after R1h both have the
                      // EXPANSION in their slug -- q=ice cream ranks en.wikipedia.org/wiki/
                      // Icing_conditions ("icing" from "ice") and q=star wars ranks /wiki/
                      // Warring_States_period ("warring" from "wars"). A 6x prior on an invented term
                      // is enough to survive the full coordination penalty, which is why fixing idf
                      // and coverage alone did not move them.
                      // THE RULE FOLLOWS THIS PRIOR'S OWN STATED PURPOSE, which the comment above
                      // already gives: it exists for NAME lookups. A NAME THE USER DID NOT TYPE IS NOT
                      // THE NAME THEY ARE LOOKING UP. Bounding the walk by r1g_onterms is the same
                      // one-line shape as the R1f denominator fix and the R1h coverage fix; this is
                      // the third sibling of one loop bound, and the last one.
                      var st: i64 = 0
                      while st < r1g_onterms {
                          if slugf == DSS_MAGIC_1024 { if (cand_tmask[ca] & contentmask & (1 << st)) != 0 {
                              if dcnt[st] * DSS_SLUG_RAREK < bign {
                                  if dss_slug_match_term(aup[0] as *u8, aul[0], termptrs[st] as *u8) == 1 { slugf = DSS_SLUG_BOOST }
                              }
                          } }
                          st = st + 1
                      }
                  } }
                  let cidu: i64 = dss_urlcid(aup[0] as *u8, aul[0])
                  dss_prkey(cidu, apkey)
                  if ss_hget(h, apkey, app, apl) == 1 { if apl[0] == 8 {
                      let vp: *i64 = app[0] as *i64
                      rank = vp[0]
                  } }
              } }
              var authf: i64 = DSS_MAGIC_1024 + (rank * DSS_PR_BOOST) / DSS_PR_SCALE
              if authf > DSS_PR_MAXFAC { authf = DSS_PR_MAXFAC }
              cand_score[ca] = (cand_score[ca] * authf) / DSS_MAGIC_1024
              // R2c TRUST PRIOR: bounded multiply for a curated canonical host (same authok gate
              // as the PR boost; url row already in hand -- zero extra reads; dot-suffix match)
              if ntshost > 0 { if ss_hget(h, aukey, aup, aul) == 1 { if aul[0] > 0 {
                  var th9: i64 = 0
                  while th9 < ntshost {
                      if dss_url_host_match(aup[0] as *u8, aul[0], (tshosts as i64 + th9 * 64) as *u8) == 1 {
                          cand_score[ca] = (cand_score[ca] * DSS_TRUST_BOOST) / DSS_MAGIC_1024
                          th9 = ntshost
                      } else { th9 = th9 + 1 }
                  }
              } } }
              // R1e SEARCH-PAGE DE-RANK: half-weight a query-echo URL so real content outranks it when it exists.
              if searchpen != DSS_MAGIC_1024 { cand_score[ca] = (cand_score[ca] * searchpen) / DSS_MAGIC_1024 }
              // R1g URL-SLUG ENTITY PRIOR: pages ABOUT the entity (term = URL path segment) beat mere mentions.
              if slugf != DSS_MAGIC_1024 { cand_score[ca] = (cand_score[ca] * slugf) / DSS_MAGIC_1024 }
          } }
          // S9 ENTITY DISCRIMINATORS: a page carrying every typed content term outranks any page carrying fewer
          // (measured 2026-09-16: a poem-form article on kyoka held rank 4 on a two-word name), and among equals a
          // content page outranks another engine's results page (three of them held ranks 3-6). DEMOTION, never
          // removal: a results page still serves when nothing better exists. The 0.5x R1e multiplier stays.
          let s9cov: i64 = dss_popcount(cand_tmask[ca] & contentmask & s9typed)
          // S9b PHRASE TIER (2026-09-17, measured after S9 shipped): on a NAME lookup (one or two typed words, the
          // slug prior's shape gate) a page carrying the words ADJACENT outranks a page carrying them scattered -- the
          // live probe put a poem-form article and an open-access page above three results pages carrying the exact
          // name, because co-occurrence is not a name. Longer queries keep coverage first (users do not type phrases).
          var s9phr: i64 = 0
          if r1g_onterms <= DSS_S9_ENTITY_TERMS { if cand_phrase[ca] == 1 { s9phr = 1 } }
          cand_tier[ca] = (((s9phr * s9base) + s9cov) * DSS_S9_PAGE_KINDS + (1 - s9serp)) * s9base + cand_ex[ca]
          if s11cid != 0 { if cand_cid[ca] == s11cid { cand_tier[ca] = cand_tier[ca] + s11band; dss_ent_set(1, s11cid) } }   // S11 pin
          ca = ca + 1
      }
  }
  let ph_n8: i64 = sys_now_us()
  dss_ph_box[8] = ph_n8 - ph_t
  ph_t = ph_n8
  // DROP candidates with NO POSITIVE relevance (score <= 0). A score of 0 means the term(s) the postings
  // said this doc matched were either past the tf-scan cap (a deep, weak match in a huge doc -- which BM25
  // length-norm penalizes anyway) OR only zero-idf terms (in every doc, no discriminative value). Either
  // way it is NOISE, not a result -- this was the "julia kyoka returns Dance/YouTube/Quaternion at score 0"
  // bug (2026-07-03, operator-reported). Required/excluded failures (sc=-1) drop here too. totalout[0] is
  // recomputed to the surviving POSITIVE count so "N matched" is honest (no phantom score-0 results).
  var wk2: i64 = 0
  var rc3: i64 = 0
  while rc3 < ncand {
      if cand_score[rc3] > 0 {
          cand_cid[wk2] = cand_cid[rc3]
          cand_score[wk2] = cand_score[rc3]
          cand_ex[wk2] = cand_ex[rc3]   // Q8: the tier key moves with its row (a parallel array left behind re-keys every later row)
          cand_tier[wk2] = cand_tier[rc3]   // S9: the composite key moves with its row for the same reason
          wk2 = wk2 + 1
      }
      rc3 = rc3 + 1
  }
  // honest-total: subtract the dropped phantoms from the running matched estimate (never reset to the
  // shortlist remnant); floor at the surviving count so the page is never larger than its own total
  matched_total = matched_total - (ncand - wk2)
  ncand = wk2
  if ncand == 0 { return 0 }
  if matched_total < ncand { matched_total = ncand }
  totalout[0] = matched_total
  // HOST-DIVERSITY CAP (web scope only): precompute each surviving candidate's host fingerprint so one
  // crawl-heavy host cannot dominate a page (the "trust law -> 9 plato.stanford.edu" skew of a small,
  // seed-biased web index). 0 = onsite/trusted shard OR a doc with no url host -> never capped. Serve-time
  // rerank only: totals + scores are unchanged, and over-cap hits still appear (phase B) = down-rank not
  // delete (the neutrality charter). At real web scale (P1) authority + anti-slop-at-ingest supersede this.
  // webdiv is a CALLER-KNOWN flag (the serve layer knows the scope); dss_search_off auto-detects "web".
  let cand_hh: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  var hz: i64 = 0
  while hz < ncand { cand_hh[hz] = 0; hz = hz + 1 }
  let cand_uc: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  // Entity key, filled and zeroed on exactly the same terms as cand_hh: 0 = never capped, and it is
  // only ever populated under webdiv==1, so site and trusted shards are bit-for-bit unaffected.
  let cand_eh: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  var ez: i64 = 0
  while ez < ncand { cand_eh[ez] = 0; ez = ez + 1 }
  if webdiv == 1 {
      let hukey: *u8 = sys_mmap(64)
      let hup: *i64 = sys_mmap(16) as *i64
      let hul: *i64 = sys_mmap(16) as *i64
      let hscr: *u8 = sys_mmap(256)
      var hc0: i64 = 0
      while hc0 < ncand {
          cand_uc[hc0] = 0
          dss_mkurlkey(cand_cid[hc0], hukey)
          if ss_hget(h, hukey, hup, hul) == 1 { if hul[0] > 0 {
              cand_hh[hc0] = dss_hosthash(hup[0] as *u8, hul[0], hscr)
              cand_eh[hc0] = dss_entityhash(hup[0] as *u8, hul[0], hscr)
              cand_uc[hc0] = dss_urlcid(hup[0] as *u8, hul[0])
          } }
          hc0 = hc0 + 1
      }
      // URL DEDUP (web scope only): a re-crawled page leaves MULTIPLE content snapshots (distinct content
      // cids, SAME url row value). One page = one result: keep only the best-scored snapshot per full-url
      // cid (score tie -> first candidate), and recount totals to DISTINCT pages (the operator-visible
      // "Trust_law at #2 AND #3" dup, 2026-07-14). Flags are decided over the PRISTINE arrays first, THEN
      // one compaction pass -- deciding while compacting would compare against already-moved slots.
      let keepf: *u8 = sys_mmap(DSS_MAXCAND)
      var d0: i64 = 0
      while d0 < ncand {
          var keep: i64 = 1
          if cand_uc[d0] != 0 {
              var d1: i64 = 0
              while d1 < ncand {
                  if d1 != d0 { if cand_uc[d1] == cand_uc[d0] {
                      if cand_score[d1] > cand_score[d0] { keep = 0 }
                      if cand_score[d1] == cand_score[d0] { if d1 < d0 { keep = 0 } }
                  } }
                  d1 = d1 + 1
              }
          }
          if keep == 1 { keepf[d0] = 1 as u8 } else { keepf[d0] = 0 as u8 }
          d0 = d0 + 1
      }
      var wk4: i64 = 0
      var d2: i64 = 0
      while d2 < ncand {
          if keepf[d2] == (1 as u8) {
              cand_cid[wk4] = cand_cid[d2]
              cand_score[wk4] = cand_score[d2]
              cand_hh[wk4] = cand_hh[d2]
              // The entity key MUST move with its row. A parallel array that is not compacted beside
              // the others silently re-associates every key with the wrong candidate from the first
              // dropped row onward -- the compaction is where a second array goes wrong, so it is
              // carried here rather than rebuilt afterwards.
              cand_eh[wk4] = cand_eh[d2]
              cand_ex[wk4] = cand_ex[d2]   // Q8: tier key carried through the dedup compaction for the same reason
              cand_tier[wk4] = cand_tier[d2]   // S9: composite key carried too
              wk4 = wk4 + 1
          }
          d2 = d2 + 1
      }
      // honest-total: dedup drops subtract from the running matched estimate (see the candidacy note)
      matched_total = matched_total - (ncand - wk4)
      ncand = wk4
      if matched_total < ncand { matched_total = ncand }
      totalout[0] = matched_total
  }
  let ph_n9: i64 = sys_now_us()
  dss_ph_box[9] = ph_n9 - ph_t
  ph_t = ph_n9
  // select ranks [offset, offset+max) by score desc, honoring the per-host cap (selection; sets are small)
  let selhh:  *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let selcnt: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  var nsel: i64 = 0
  let seleh: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  let selecnt: *i64 = sys_mmap(DSS_MAXCAND * 8) as *i64
  var nesel: i64 = 0
  let used: *u8 = sys_mmap(DSS_MAXCAND)
  var u: i64 = 0
  while u < ncand { used[u] = 0 as u8; u = u + 1 }
  var rank: i64 = 0
  var out_n: i64 = 0
  while rank < offset + max {
      // PHASE A: highest-scored unused candidate whose host is still under DSS_HOSTCAP on this page.
      var best: i64 = 0 - 1
      var bestsc: i64 = 0 - 1
      var bestex: i64 = 0 - 1   // Q8: tier key of the current best; -1 = none chosen yet, so the first candidate always wins
      var c3: i64 = 0
      while c3 < ncand {
          if used[c3] == (0 as u8) { if dss_exact_precedence(cand_tier[c3], cand_score[c3], bestex, bestsc) == 1 {
              var okcap: i64 = 1
              if cand_hh[c3] != 0 {
                  var sk: i64 = 0
                  while sk < nsel { if selhh[sk] == cand_hh[c3] { if selcnt[sk] >= DSS_HOSTCAP { okcap = 0 } } sk = sk + 1 }
              }
              // ENTITY cap, deliberately a SECOND and INDEPENDENT test rather than a replacement:
              // the host cap answers "is one SITE crowding the page", this answers "is one DOCUMENT
              // appearing twice". Collapsing them into one key would lose whichever question it was
              // not keyed on -- which is exactly how twenty language editions got through a working
              // host cap. Phase B below is untouched, so an over-cap hit is still reachable.
              if cand_eh[c3] != 0 {
                  var ek: i64 = 0
                  while ek < nesel { if seleh[ek] == cand_eh[c3] { if selecnt[ek] >= DSS_ENTITYCAP { okcap = 0 } } ek = ek + 1 }
              }
              if okcap == 1 { bestsc = cand_score[c3]; bestex = cand_tier[c3]; best = c3 }
          } }
          c3 = c3 + 1
      }
      // PHASE B (overflow fallback): the cap left nothing selectable -> take the best unused of ANY host,
      // so a dominant host still fills the page once diversity is exhausted (never returns fewer results).
      if best < 0 {
          var bs2: i64 = 0 - 1
          var be2: i64 = 0 - 1   // Q8: the overflow pick honours the same tier as phase A
          var c4: i64 = 0
          while c4 < ncand {
              if used[c4] == (0 as u8) { if dss_exact_precedence(cand_tier[c4], cand_score[c4], be2, bs2) == 1 { bs2 = cand_score[c4]; be2 = cand_tier[c4]; best = c4 } }
              c4 = c4 + 1
          }
      }
      if best < 0 { dss_ph_fin(ph_t, ph_t0); return out_n }
      used[best] = 1 as u8
      if cand_hh[best] != 0 {
          var fk: i64 = 0 - 1
          var sk2: i64 = 0
          while sk2 < nsel { if selhh[sk2] == cand_hh[best] { fk = sk2 } sk2 = sk2 + 1 }
          if fk < 0 { selhh[nsel] = cand_hh[best]; selcnt[nsel] = 1; nsel = nsel + 1 }
          else { selcnt[fk] = selcnt[fk] + 1 }
      }
      // Record the entity too. This runs for the PHASE B pick as well, exactly like the host tally
      // above: a candidate taken through the overflow path still occupies its entity's slot, or the
      // fallback would quietly re-admit the duplicates the cap just excluded.
      if cand_eh[best] != 0 {
          var efk: i64 = 0 - 1
          var ek2: i64 = 0
          while ek2 < nesel { if seleh[ek2] == cand_eh[best] { efk = ek2 } ek2 = ek2 + 1 }
          if efk < 0 { seleh[nesel] = cand_eh[best]; selecnt[nesel] = 1; nesel = nesel + 1 }
          else { selecnt[efk] = selecnt[efk] + 1 }
      }
      if rank >= offset {
          cids_out[out_n] = cand_cid[best]
          scores_out[out_n] = cand_score[best]
          out_n = out_n + 1
      }
      rank = rank + 1
  }
  dss_ph_fin(ph_t, ph_t0)
  return out_n
3721}
3722// contract-stable 8-arg entry (rule 19): auto-detects web scope from the shard name so EVERY caller (serve,
3723// api, census) gets host-crowding diversity on the "web" shard with ZERO call-site changes; site/trusted
3724// pass webdiv=0 and stay byte-identical. A caller that already knows its scope can call ..._div directly.
3725func dss_search_off(domain: *u8, q: *u8, qn: i64, cids_out: *i64, scores_out: *i64, max: i64, offset: i64, totalout: *i64) -> i64 {
  let div: i64 = dss_is_web(domain)
  // FAIL-SAFE TOWARD THE INCUMBENT: every bypass below runs the ORIGINAL call unchanged, so an
  // unarmed table, an oversized page or an empty query can only ever behave exactly as before.
  if (dsq_buf as i64) == 0 { return dss_search_off_div(domain, q, qn, cids_out, scores_out, max, offset, totalout, div) }
  if qn <= 0            { return dss_search_off_div(domain, q, qn, cids_out, scores_out, max, offset, totalout, div) }
  if max > DSQ_MAXR     { return dss_search_off_div(domain, q, qn, cids_out, scores_out, max, offset, totalout, div) }
  let key: i64 = dsq_key(domain, q, qn, max, offset, div)
  dss_ph_init()   // a memo hit runs no phase: the API must read zeros plus memo=1, never the parent's last query
  dss_bq_set(0, 0)   // S7: bm25q.repeats / bm25q.moved read 0 until this query fuses (and stay 0 on a memo hit)
  dss_ent_set(0, 0)  // S11: entity.pinned / entity.cid read 0 until a name-shaped query looks the table up
  var slot: i64 = key % DSQ_SLOTS
  if slot < 0 { slot = 0 - slot }
  let base: i64 = DSQ_HDRW + slot * DSQ_SLOTW
  let tailw: i64 = base + DSQ_SLOTW - 1
  let gen: i64 = dsq_buf[0]
  // TORN-WRITE GUARD (no atomics in the substrate): the key is written at BOTH ends of the slot,
  // head LAST. A reader accepts only when head, tail and generation all agree, so a slot caught
  // mid-write by a sibling child fails to a MISS and recomputes. There is no lock: the failure
  // direction is "do the work again", never "serve another query's results".
  if dsq_buf[base] == key { if dsq_buf[tailw] == key { if dsq_buf[base + 1] == gen {
      let n: i64 = dsq_buf[base + 2]
      if n >= 0 { if n <= max {
          totalout[0] = dsq_buf[base + 3]
          totalout[1] = dsq_buf[base + 4]
          var i: i64 = 0
          while i < n { cids_out[i] = dsq_buf[base + 5 + i]; scores_out[i] = dsq_buf[base + 5 + DSQ_MAXR + i]; i = i + 1 }
          dss_ph_box[13] = 1
          dss_ent_memo_load(((dsq_buf as i64) + (base + 5 + 2 * DSQ_MAXR) * DSS_I64_BYTES) as *i64)   // S11-c: the memo carries the pin
          return n
      } }
  } } }
  let n2: i64 = dss_search_off_div(domain, q, qn, cids_out, scores_out, max, offset, totalout, div)
  if n2 >= 0 { if n2 <= DSQ_MAXR {
      dsq_buf[base] = 0                      // claim: invalidate before mutating the payload
      dsq_buf[base + 2] = n2
      dsq_buf[base + 3] = totalout[0]
      dsq_buf[base + 4] = totalout[1]
      var j: i64 = 0
      while j < n2 { dsq_buf[base + 5 + j] = cids_out[j]; dsq_buf[base + 5 + DSQ_MAXR + j] = scores_out[j]; j = j + 1 }
      dss_ent_memo_save(((dsq_buf as i64) + (base + 5 + 2 * DSQ_MAXR) * DSS_I64_BYTES) as *i64)   // S11-c
      dsq_buf[base + 1] = gen
      dsq_buf[tailw] = key
      dsq_buf[base] = key                    // publish LAST
  } }
  return n2
3771}
3772// contract-stable wrapper: the original signature, rank 0, total discarded (rule 19: additive evolution)
3773func dss_search(domain: *u8, q: *u8, qn: i64, cids_out: *i64, scores_out: *i64, max: i64) -> i64 {
  // tb0 is a scratch OUT-param for the total; the callee writes it and this wrapper discards it, so
  // it is dead the moment dss_search_off returns. Free after the call, never before.
  let tb0: *i64 = sys_mmap(DSC_POSBUF) as *i64
  let r: i64 = dss_search_off(domain, q, qn, cids_out, scores_out, max, 0, tb0)
  sys_munmap(tb0 as *u8, DSC_POSBUF)
  return r
3780}
nx_docportal_search_seg.nx source

`nx_docportal_search_seg.nx` source
