code wiki / _hdl_build / nx_ecomat_seed.nx
`nx_ecomat_seed.nx` source

↩ module page · 325 lines · 29699 B
1// nx_ecomat_seed.nx -- author the 11 ecosystem-maturity domains into the SOVEREIGN seg_store
2// (knowledge/store/ecomat) as native binary records -- NO TSV. Each record carries its LIVE EVIDENCE
3// POINTER(S) (data-driven). TRIANGULATION: domains with TWO INDEPENDENT sources (ec_seed_two) are trusted
4// only when the sources CONVERGE; one source (ec_seed_one_ev) = SINGLE (flagged); none (ec_seed_one) = STORED.
5// evkind 1=permil-derive 2=gate-liveness(GREEN|PASS|VALID). Every 2nd source verified independent + live first.
6// maturity level: 0 ABSENT 1 TOY 2 FUNCTIONAL 3 PRODUCTION 4 S-CLASS 5 EXCEED ; axis 0 DEPTH 1 BREADTH 2 META.
7// license_tier: ORIGINAL
8import "nx_ecomat_lib.nx"
9
10// exit 4 == REFUSED, the same code nx_store_put's plane-writer guard already uses (NSP_EXIT_REFUSED),
11// so one convention covers every fail-closed plane writer in the estate.
12const ECOMAT_EXIT_REFUSED: i64 = 4
13
14// ---- walk the PENDING write-set -------------------------------------------------------------------
15// The write-set is the store's own wire format, exactly as ss_add2 lays it down:
16//   [kind:1][klen:4][key:klen][vlen:4][val:vlen]
17// Reading it back with the store's own codec means the guard needs NO change to the authoring lines
18// above -- add a domain, the guard sees it. A guard that required its own parallel list would drift
19// from the thing it guards on the very first edit that forgot to update both.
20func es_ws_walk(w: *i64, name: *u8, cntout: *i64) -> i64 {
  let buf: *u8 = w[0] as *u8
  let n: i64 = w[1]
  let base: i64 = buf as i64
  let dom: *u8 = sys_mmap(ECOMAT_DOM_CAP)
  var found: i64 = 0
  var cnt: i64 = 0
  var o: i64 = 0
  while o < n {
      o = o + 1
      let kl: i64 = ss_r32(buf, o)
      o = o + 4 + kl
      let vl: i64 = ss_r32(buf, o)
      o = o + 4
      cnt = cnt + 1
      if ec_str((base + o) as *u8, 0, dom, ECOMAT_DOM_CAP) >= 0 {
          if el_streq(dom, name) == 1 { found = 1 }
      }
      o = o + vl
  }
  cntout[0] = cnt
  return found
42}
43
44func main(argc: i64, argv: *i64) -> i64 {
  // argv[1] = store prefix (defaults to the live plane). Parameterised so the gate can bite-prove
  // this organ on a throwaway fixture instead of on the ecosystem's own scoreboard.
  var store: *u8 = ECOMAT_STORE
  if argc >= 2 { store = argv[1] as *u8 }
  let w: *i64 = ss_begin()
  // STORED (no verified independent source yet -- honest)
  ec_seed_one(w,  6, 1, 16, 3, 5, 7, 1, "cad" as *u8,                  "Fusion360-OpenCASCADE" as *u8, "dcc-gui-editor-parametric-step" as *u8)
  ec_seed_one(w, 10, 2, 13, 2, 4, 8, 1, "maturity-measurement" as *u8, "unified-SSOT" as *u8,          "frontier-board-F202-self-emit-then-feeder-F208" as *u8)
  // SINGLE live source (one witness -- un-triangulated, flagged)
  ec_seed_one_ev(w, 1, 0, 1, 3, 5, 5, 1, 1, "language" as *u8, "Rust-C-safety" as *u8,           "memory-safety-dimension" as *u8,                 "knowledge/status/lang_maturity.log" as *u8,  "maturity_permil=" as *u8)
  ec_seed_one_ev(w, 9, 2,13, 2, 5, 9, 1, 1, "autonomy" as *u8, "Eurisko-self-improving" as *u8,  "close-loop-F204-cron-then-F208-feeder-70pct-to-100pct" as *u8, "knowledge/status/autonomy_meter.log" as *u8, "permil=" as *u8)
  // TRIANGULATED (two INDEPENDENT live witnesses; rollup checks convergence)
  ec_seed_two(w, 0, 0,  1, 3, 5, 9, 1, 2, 2, "compiler" as *u8, "LLVM-GCC-linear-scan" as *u8, "inliner-miscompile-fix-then-aarch64-backend" as *u8, "knowledge/status/rv64_runproof_gate.log" as *u8, "verdict=" as *u8, "knowledge/status/spirv_khronos_crosscheck.log" as *u8, "verdict=" as *u8)
  ec_seed_two(w, 2, 0,  3, 2, 4, 6, 1, 1, 2, "kernel" as *u8,   "Linux-seL4-boot-metal" as *u8,"native-contract-v1-then-uefi-on-metal-F103" as *u8,            "knowledge/status/kernel_census.log" as *u8,      "our_coverage_permil=" as *u8, "knowledge/status/mmu.log" as *u8,                  "verdict=" as *u8)
  ec_seed_two(w, 3, 0,  4, 2, 4, 7, 1, 2, 2, "silicon" as *u8,  "Yosys-OpenROAD-FPGA" as *u8,  "csr-uart-emit-then-netlist-pnr-ulx3s-boot-F107" as *u8,                "knowledge/status/fw_boot_proof_gate.log" as *u8, "FW-BOOT-PROOF verdict=" as *u8, "knowledge/status/boot_stub.log" as *u8,           "BOOTGATE verdict=" as *u8)   // 2026-08-22: silicon's OWN markers; bare verdict= read whichever of ~27 writers of the SHARED boot_stub.log appended last (tamper neg-controls included) -> cur flapped 2/1/2/1
  ec_seed_two(w, 4, 0,  4, 1, 4, 6, 1, 2, 2, "gpu" as *u8,      "CUDA-Vulkan" as *u8,          "first-sovereign-submit-on-5080-then-C0-gemm-F101" as *u8,          "knowledge/status/gpu_dxg.log" as *u8,            "verdict=" as *u8, "knowledge/status/gpu_bench.log" as *u8,            "verdict=" as *u8)
  // games TOY(1)->FUNCTIONAL(2) 2026-07-20: the declared next rung ("2d-raster-substrate-then-spec-game-gen")
  // is DONE and EXCEEDED -- spec-game-gen ships (game_gen2 FSM, 6 sourced types) and the substrate went past
  // 2d to a 3D FIRST PLAYABLE: nx_gx4_walk_gate GREEN 6/6 + eyeballed = input-driven deterministic walk over
  // a lit, 3-material-band, z-buffered world inside the LIVE browser (byte-identical replay ck=19387962,
  // 20 ms/world-tick), on the first-class <canvas> substrate (nx_gx1c GREEN 7/7). Clears the operator FLOOR
  // LAW (lit 3D, not terminal rects). Evidence colocated: knowledge/status/game_playable.log + the Gx-4 leg
  // folded into game_engine.log (both witnesses stay independent -> triangulation preserved). HONEST: still
  // FUNCTIONAL not PRODUCTION -- no entities, no collision, no win state, scripted (not interactive) input,
  // and near-plane culling pops. bar stays EXCEED(5). Yardsticks Godot/Unreal/NMS.
  ec_seed_two(w, 5, 1, 16, 2, 5, 8, 1, 2, 2, "games" as *u8,    "Godot-Unreal-NMS" as *u8,     "entities-collision-winstate-then-near-plane-clip-then-flagship-game" as *u8,  "knowledge/status/game_engine.log" as *u8,        "verdict=" as *u8, "knowledge/status/game_gen2.log" as *u8,            "verdict=" as *u8)
  ec_seed_two(w, 7, 1, 16, 2, 4, 7, 1, 2, 2, "video" as *u8,    "Zoom-mediasoup-SFU" as *u8,   "codec-efficiency-sovereign-stun-turn" as *u8,    "knowledge/status/room_live_gate.log" as *u8,     "verdict=" as *u8, "knowledge/status/room_sfu.log" as *u8,             "verdict=" as *u8)
  ec_seed_two(w, 8, 1,  7, 3, 5, 9, 1, 2, 2, "sites" as *u8,    "WordPress-Webflow-Vercel" as *u8, "multi-site-cms-template-from-config" as *u8,  "knowledge/status/cms_census.log" as *u8,         "verdict=" as *u8, "knowledge/status/site_liveness.log" as *u8,       "verdict=" as *u8)
  // ★INFRA DOMAINS added 2026-07-04 (operator: measure hosting/routing/network) -- graded vs the SOTA RFCs
  // (HTTP/3 rfc9114 · QUIC rfc9000 · TLS1.3 rfc8446 · BGP rfc4271 · DNS rfc1035). HONEST: hosting has TWO
  // live witnesses (triangulated); network has ONE (flagged); ROUTING has NONE -> STORED = we don't even
  // MEASURE routing yet (a finding in itself).
  ec_seed_two(w,   11, 1, 7, 3, 5, 7, 1, 2, 2, "hosting" as *u8, "Cloudflare-Vercel-Fastly" as *u8,  "http3-quic-cdn-multiregion-edgecache" as *u8,        "knowledge/status/site_liveness.log" as *u8, "verdict=" as *u8, "knowledge/status/funcheck.log" as *u8, "verdict=" as *u8)
  ec_seed_one_ev(w, 12, 0, 7, 3, 5, 7, 1, 2,    "network" as *u8, "QUIC-HTTP3-BBR" as *u8,            "quic-transport-then-http3-then-bbr-congestion" as *u8, "knowledge/status/funcheck.log" as *u8,      "verdict=" as *u8)
  ec_seed_one(w,    13, 0, 7, 2, 4, 6, 1,       "routing" as *u8, "Cloudflare-anycast-BGP-GSLB" as *u8, "anycast-then-geo-then-health-LB-then-bgp" as *u8)
  // ★SECURITY domain added 2026-07-17 (operator: security audit -> make security a MEASURED domain, not a
  // document). SINGLE live source = the sovereign security census (nx_security_census -> knowledge/status/
  // security_census.log, WEAKEST-LINK coverage_permil). axis DEPTH (substrate defense); bar S-CLASS; high
  // weight (critical work). HONEST baseline cur=TOY(1) until the census log is present -> then the rollup
  // live-derives the level from coverage_permil (so it can never rot into an asserted grade).
  ec_seed_one_ev(w, 14, 0, 7, 1, 4, 9, 1, 1,    "security" as *u8, "seL4-BoringSSL-NIST-PQC" as *u8, "wire-pq-F-sec-04-then-isolate-host-F-sec-02-then-injection-gate-F-sec-06" as *u8, "knowledge/status/security_census.log" as *u8, "coverage_permil=" as *u8)
  // ★COORDINATION domain added 2026-07-18 (operator: benchmark the coordination/standup capability
  // honestly incl maturity -- no self-grade; the rollup derives from the gate log). SINGLE live source
  // (flagged un-triangulated): the nx_ws_cycle_gate verdict published to knowledge/status/. axis META;
  // HONEST cur=FUNCTIONAL(2): live+gated+scale-toothed but gaps named (auto-beat, hub-claims F251,
  // trends/velocity); bar S-CLASS. Yardsticks: Jira-Linear boards, DORA/SPACE, agent-observability.
  // TRIANGULATED 2026-07-18: 2nd INDEPENDENT witness = the F-212 journal-substrate selftest
  // (different organ + author-session; gates the substrate the capability rides; ran ON-HUB 6/6).
  ec_seed_two(w, 15, 2, 7, 2, 4, 8, 1, 2, 2,    "coordination" as *u8, "Jira-Linear-DORA-AgentOps" as *u8, "auto-beat-then-hub-claims-F251-then-trends-velocity" as *u8, "knowledge/status/coordination_gate.log" as *u8, "VERDICT=" as *u8, "knowledge/status/ws_sync_gate.log" as *u8, "VERDICT=" as *u8)
  // ★GRAPHICS domain added 2026-07-18 (operator: benchmark graphics honestly incl maturity). STORED (honest,
  // flagged -- NOT fake-measured): sovereign SW-GPU render foundation gate-proven + live (nx_graphics_census_gate
  // 688/1000, nx_swgpu_sota_census 583, nx_sovgpu_census 343, nx_graphics_sota_rollup 644 -- all verified LIVE
  // 2026-07-18; d3d11 pixel-exact vs WARP) but NOT production-photoreal + no real-silicon GPU. axis DEPTH; bar
  // EXCEED. Yardsticks UE5/Unity/Godot/Bevy/three.js/wgpu. Next rung = colocate evidence on NAS -> triangulate.
  // graphics STORED -> SINGLE-SOURCE 2026-07-20: the domain's own named next rung ("colocate-evidence-on-NAS")
  // is EATEN -- knowledge/status/graphics_gate.log now carries the Gx suite verdicts (6 legs RE-RUN this
  // session incl the firstbyte trunk 9/9, eye 7/7, canvas 7/7, first-playable 6/6, plus 3 honestly marked
  // rerun=0 prior-banked legs). "nishibrowser-3d-Gx1" in the old next is DONE (Gx-1/1b/1c/4 all HAVE).
  // ★HONESTY: this is ONE witness (mine) -> ec_seed_one_ev = SINGLE-SOURCE, deliberately NOT ec_seed_two.
  // Triangulation waits for the realism-loop/photoreal-critic sibling (an INDEPENDENT, adversarial judge of
  // output reality) to colocate its own log -- claiming triangulated off two logs I wrote would be exactly
  // the fake-triangulation F-006 root-fixed. cur stays FUNCTIONAL(2), bar EXCEED(5).
  ec_seed_one_ev(w, 16, 0, 16, 2, 5, 8, 1, 2, "graphics" as *u8, "UE5-Unity-Godot-Bevy-threejs-wgpu" as *u8, "realism-loop-colocates-2nd-witness-then-triangulate-then-Gx2-mobile-IR-aarch64" as *u8, "knowledge/status/graphics_gate.log" as *u8, "verdict=" as *u8)
  // ★DOCS/LIVING-DOCS domain added 2026-07-18 (operator: wiki/living-docs to SOTA, benchmarked honestly incl
  // maturity). STORED (honest, flagged -- NOT fake-measured): /compare/livingdocs 39-axis matrix + frontier
  // radar + evidence-capped census 383/1000 all LIVE + MCP-served; atlas graph synced 16575 nodes; BUT
  // staleness manual (F224), R6 cards partial, recombination unwired -> cur=FUNCTIONAL(2); bar EXCEED(5)
  // (the card=doc+unit no-drift thesis). Yardsticks Backstage/Confluence/Notion/Obsidian. Next rung =
  // publish the census permil to knowledge/status -> live-derive -> triangulate w/ the maturity board.
  ec_seed_one(w, 17, 2, 13, 2, 5, 7, 1, "docs" as *u8, "Backstage-Confluence-Notion-Obsidian" as *u8, "F224-ingest-cadence-then-R6-cards-then-F225-recombination" as *u8)
  // ★DESIGN-MARKET domain (dmkt lane sibling, 2026-07-18 — RESTORED after a two-edit-surface clobber: the
  // sibling added this via nx_fs_write on the BUILDROOT copy as id17; a laptop-side push overwrote it. Both
  // rows now live in the laptop SSOT: docs=17, design-market=18. LAW: buildroot is a build MIRROR — edit the
  // laptop source or back-sync immediately.) STORED honest (TOY→EXCEED; flips to measured once a dmkt gate
  // log exists). idea→CAD→sourcing→print→finance→propensity on atlas recombination.
  ec_seed_one(w, 18, 1, 16, 1, 5, 8, 1, "design-market" as *u8, "SiemensNX-Teamcenter-Octopart-Xometry-JungleScout" as *u8, "dmkt-gate-log-then-live-derive-then-F310-ideator" as *u8)
  // ★OFFICE-LEGAL domain added 2026-07-18 (operator: the whole lawyer toolbook for Utah at SOTA, benchmarked
  // honestly incl maturity). STORED (honest, flagged -- NOT fake-measured): nx_sign_envelope core SHIPPED
  // MCP-live (tamper=DETECTED edge-proven, cross-machine deterministic head+CID) + F5xx lane/RACI/discovery
  // live; BUT one organ, no ceremony surface, no matter spine, no gate log published -> cur=TOY(1); bar
  // EXCEED(5) (CID-hash-chain tamper-evidence-by-construction + Utah-sandbox authorized delivery thesis).
  // Yardsticks Clio/NetDocuments/DocuSign/iManage/Harvey. Next = publish sign gate receipt to knowledge/
  // status -> live-derive -> ceremony F504 -> spine F502.
  // BACK-SYNC 2026-07-18 (anti-clobber lane, seq71): laptop SSOT was 19 while buildroot+store were 20 --
  // this row reconciles the SSOT UP to the authoritative build source (never push the lagging copy down).
  ec_seed_one(w, 19, 1, 16, 1, 5, 7, 1, "office-legal" as *u8, "Clio-NetDocuments-DocuSign-iManage-Harvey" as *u8, "publish-sign-gate-receipt-then-live-derive-then-ceremony-F504-then-spine-F502" as *u8)
  // ★PM-OVERSIGHT domain added 2026-07-18 (operator: the pm exec/mgmt/ops dashboard + ROI benchmarked
  // honestly incl maturity -- no self-grade; the rollup live-derives from the gate log). SINGLE live source
  // (flagged un-triangulated): the nx_pm_dashboard_gate 8/8 GREEN verdict published to knowledge/status/.
  // axis META; HONEST cur=FUNCTIONAL(2): live+gated (count-x-declared-rate ROI + loop-termination-at-scale
  // tooth) but gaps NAMED (embed-grade seq104, converge w/ pm-cockpit seq101, RACI seq105, triangulate);
  // bar EXCEED(5) = the honest-ROI-by-construction + evidence-derived-oversight thesis. Yardsticks
  // Jira/Jellyfish/LinearB/DX/Faros/Swarmia + DORA/SPACE. Next = converge to ONE PM capability then triangulate.
  ec_seed_one_ev(w, 20, 2, 8, 2, 5, 9, 1, 2, "pm-oversight" as *u8, "Jira-Jellyfish-LinearB-DX-Faros-Swarmia-DORA-SPACE" as *u8, "converge-cockpit-seq101-then-embed-grade-then-triangulate" as *u8, "knowledge/status/pm_dashboard_gate.log" as *u8, "VERDICT=" as *u8)
  // ★RELIABILITY domain added 2026-07-19 (operator: "prevent things like this... mature"; the deploy-reliability
  // system built this session, benchmarked honestly). SINGLE live source (flagged un-triangulated): the aggregate
  // pre-deploy gate nx_deploy_ready -> knowledge/status/deploy_ready.log VERDICT=GREEN (published */15). axis META;
  // HONEST cur=FUNCTIONAL(2): 4 gate-proven live guards (fail-loud-build + self-heal-libs + api-contract + cron-death)
  // aggregated + atlas-carded + evidence-native + it caught+resolved a REAL regression (seq153) -- but NEW this
  // session, single-source, gaps NAMED (no triangulation, no SLO burn-rate, no auto-remediate). bar EXCEED(5) =
  // the self-healing + agent-checkable-before-deploy + evidence-layer-native thesis. Yardsticks GitHub-Actions,
  // Healthchecks.io, SLSA, Dependabot/Renovate, Cronitor, Google-SRE. Next = triangulate + freshness SLO burn-rate.
  ec_seed_one_ev(w, 21, 2, 8, 2, 5, 9, 1, 2, "reliability" as *u8, "GitHubActions-Healthchecks-SLSA-Dependabot-Renovate-Cronitor-SRE" as *u8, "triangulate-then-slo-burn-rate-then-auto-remediate" as *u8, "knowledge/status/deploy_ready.log" as *u8, "VERDICT=" as *u8)
  // ★LAB-SCIENCE domain added 2026-07-25. The whole food-chemistry / peptide / supplement lane (22 waves,
  // 33 gates) was ABSENT from this registry -- it had been building capability for days while being invisible
  // to the ecosystem grade, which is its own kind of unmeasured. axis DEPTH; SINGLE live source, deliberately
  // ec_seed_one_ev and NOT ec_seed_two: the only witness is my own lane gate, and pointing a second "independent"
  // pointer at another log I wrote would be exactly the fake-triangulation this file's header warns about.
  // HONEST cur=FUNCTIONAL(2), NOT production: the analytical arc IS anchored against published values
  // (peptide mass, molecular formula, isotope envelope, b/y ladder, de novo round trip) and four service facades
  // are live on the NAS -- but NOTHING here has ever been run against a physical instrument or an accredited
  // lab, and the entire go-to-market half self-reports grounding=ASSERTED with no external oracle. Calling that
  // PRODUCTION would be the author-optimism the lane's own laws forbid. bar EXCEED(5) = the thesis that a
  // formulation/QC stack computing from first principles, refusing rather than approximating, and labelling
  // its own evidence tier per claim, beats the incumbent tools. Yardstick PEAKS is the real de novo competitor.
  // Next rung is validation against a real instrument -- geography of the gap is named, not rounded away.
  // 07-25 next-rung REFRESHED: the previous text named unify-nx_arrhenius and
  // the RH-humidity-term, both of which landed this session (the Arrhenius debt
  // was paid by PROVING CONVERGENCE rather than merging, which kept the only
  // witness that could catch the dead-primitive bug; the moisture axis now
  // separates the lumped Ea from three conditions). A next-rung that still
  // names finished work is the same staleness this registry exists to kill.
  // ⚠RECONCILED UP TO THE LIVE PLANE 2026-08-07, NOT AUTHORED FROM THIS FILE'S OWN HISTORY.
  // This row had drifted: the source said axis=DEPTH and carried an older next-rung, while the live
  // store said axis=BREADTH with "sovereign-lane-runner-...". A restore run authored the SOURCE's
  // version over the STORE's and silently reverted a sibling's update -- the same two-writer drift
  // this file's design invites, caught only by diffing the rollup before and after.
  // The store is the more recent decision, so the source reconciles UP to it. Never push the
  // lagging copy down.
  // ⚠PATTERN CASE IS LOAD-BEARING: em_derive_level matches these bytes EXACTLY. This row declared
  // "verdict=" while the NAS labsci_gate.log emits "VERDICT=GREEN checks=13 passed=13 permil=1000",
  // so the scan found nothing and the derive returned TOY(1) -- a domain passing 13/13 at permil
  // 1000 was published as TOY, and that number reached the ecosystem headline. Found by
  // nx_ecomat_evprobe over all 26 domains / 29 slots; it was the ONLY case-mismatch in the estate,
  // which is also why the other TOY grades must be left alone -- they are honest.
  // ⚠The laptop copy of labsci_gate.log uses lowercase; the NAS copy uses uppercase. The rollup runs
  // on the NAS, so the NAS spelling is the one that governs.
  ec_seed_one_ev(w, 22, 1, 22, 2, 5, 7, 1, 2, "lab-science" as *u8, "PEAKS-Skyline-ProteomeDiscoverer-Mascot-ChemDraw" as *u8, "sovereign-lane-runner-replaces-scratch-shell-then-supplement-claims-then-market-surface" as *u8, "knowledge/status/labsci_gate.log" as *u8, "VERDICT=" as *u8)
  // ---- ANTI-CLOBBER GUARD: refuse by IDENTITY, never by row count -------------------------------
  // ss_commit REPLACES the plane with this write-set (nx_ecomat_put.nx:66, gate-proven), so any LIVE
  // domain this source no longer authors is DELETED -- silently, and the old hardcoded `ver == N`
  // success check PASSED on the smaller store because N was edited down to match.  MEASURED 2026-08-07:
  // the live plane held 26 domains while this source authored 23 and the NAS copy authored 22, so
  // running either deleted 3-4 domains and printed GREEN.
  //
  // WHY BY NAME AND NOT BY COUNT.  A count-based shrink refusal was built in the shared primitive on
  // 2026-08-02 and REVERTED before promote (nx_store_seed_lib.nx:207) because it broke legitimate
  // whole-plane rewriters -- plane_append's rollback, plane_repair, and a negative control that must
  // be allowed to shrink.  Debt 1785710884 concluded the guard belongs at the PLANE-WRITER layer.
  // This is that guard, for this writer, keyed on the one thing that is never legitimately lost: a
  // domain's NAME.  A rewriter that renumbers, re-grades or reorders every row still passes; only
  // one that makes a named domain VANISH is refused.  So the 2026-08-02 failure cannot recur here.
  let hl: *i64 = ss_open(store)
  let pq: *i64 = sys_mmap(16) as *i64
  let lq: *i64 = sys_mmap(16) as *i64
  let ldom: *u8 = sys_mmap(ECOMAT_DOM_CAP)
  let wc: *i64 = sys_mmap(16) as *i64
  // authored count must be taken BEFORE carry-forward, or it counts the rows it is measuring.
  es_ws_walk(w, "" as *u8, wc)
  let authored: i64 = wc[0]
  var live: i64 = 0
  var carried: i64 = 0
  var lost: i64 = 0
  var nextid: i64 = authored
  if (hl as i64) != 0 {
      var k1: i64 = 0
      var go1: i64 = 1
      while go1 == 1 {
          let key1: *u8 = sys_mmap(64); ec_key(k1, key1)
          if ss_hget(hl, key1, pq, lq) == 1 {
              live = live + 1
              ec_str(pq[0] as *u8, 0, ldom, ECOMAT_DOM_CAP)
              if es_ws_walk(w, ldom, wc) == 0 {
                  // CARRY FORWARD, byte-for-byte. Re-authoring this row from guessed parameters
                  // would silently downgrade it -- a domain wired to a live evidence log would come
                  // back as a STORED assertion and read as a healthy row. Copying the stored record
                  // verbatim preserves its evidence pointers, weight and bench exactly.
                  // Matching by NAME (not id) is what makes this safe: a domain the source DOES
                  // author is never duplicated, so a plane that already holds a stray copy collapses
                  // back to one row rather than accumulating.
                  let key2: *u8 = sys_mmap(64); ec_key(nextid, key2)
                  if ss_add(w, 1, key2, pq[0] as *u8, lq[0]) != 0 {
                      _p("  CARRY-FAILED (write-set full): " as *u8); _p(ldom); _p("\n" as *u8)
                      lost = lost + 1
                  } else {
                      _p("  carried forward (unauthored by this source): " as *u8); _p(ldom); _p("\n" as *u8)
                      carried = carried + 1
                      nextid = nextid + 1
                  }
              }
              k1 = k1 + 1
          } else { go1 = 0 }
      }
  }
  // The guard is now a BACKSTOP, not the primary mechanism. Carry-forward means the normal case
  // preserves everything, so this fires only when a row could NOT be carried (write-set full) --
  // i.e. exactly when proceeding would drop a domain. Fail closed and write nothing.
  if lost > 0 {
      _p("ECOMAT-SEED REFUSED: " as *u8); _fn(1, lost)
      _p(" of " as *u8); _fn(1, live)
      _p(" live domains could not be carried forward (authored=" as *u8); _fn(1, authored)
      _p("). NOTHING WRITTEN -- the store is untouched.\n" as *u8)
      // PRECISION ABOUT THE HARM, measured 2026-08-07 rather than assumed. ss_commit layers a new
      // segment and readers take newest-wins PER KEY, so a key absent from the write-set is NOT
      // deleted -- it retains its old value. The harm is therefore KEY REUSE: an unauthored domain
      // whose id this source assigns to a DIFFERENT domain is destroyed, and the displaced domain
      // then exists twice. This guard is deliberately CONSERVATIVE -- it refuses on any unauthored
      // live NAME without computing which ids collide -- because a source that does not author a
      // domain has no business rewriting the plane that domain lives on, and a guard that has to
      // model the collision is a guard that can get the model wrong.
      _p("(ss_commit is newest-wins PER KEY, so unauthored rows are not erased wholesale -- the harm\n" as *u8)
      _p("is ID REUSE: a colliding id destroys one domain and duplicates another. Refusing on the\n" as *u8)
      _p("NAME is the conservative check and does not try to predict which ids collide.)\n" as *u8)
      _p("Either reconcile this seeder up to the live plane (never push the lagging copy down), or\n" as *u8)
      _p("add domains with `nx_ecomat_put addauto`, which reloads every row before committing.  verdict=RED\n" as *u8)
      sys_exit(ECOMAT_EXIT_REFUSED); return ECOMAT_EXIT_REFUSED
  }
  // CHECKED RETURN. The return used to be DISCARDED. ss_commit FAILS CLOSED and writes NOTHING on
  // several codes, so a dropped return made "my write never happened" indistinguishable from "the
  // store shrank" -- the count check below then fired and blamed the PLANE for the WRITER's
  // failure. nx_ecomat_put already checks this return; the seeder was the outlier.
  //
  // ⚠SEGID: EPOCH, NOT ss_next_segid -- AND THAT IS DELIBERATE, MEASURED 2026-08-07.
  // ss_commit's contract advertises ss_commit(p, w, ss_next_segid(p)) and a first cut "corrected"
  // this line to match. It compiled, it passed every fixture, and it FAILED ON THE LIVE PLANE with
  // rc=-17 -- nothing written, restore blocked. Cause: ss_max_segid deliberately SKIPS
  // pointer-shaped ids when scanning the manifest (nx_seg_store.nx:1730, the seq1730 self-heal), so
  // on a plane whose segments already carry epoch-scale ids the scan can return a low max and
  // mx+1 lands on a segment file that already exists.
  // nx_ecomat_put has always passed the epoch here and has always worked on THIS plane -- it is the
  // known good for this store, and it is collision-resistant by construction because every commit
  // draws a fresh timestamp. The textbook idiom is not the right idiom for a plane already written
  // this way. Matching the working incumbent beats matching the documentation.
  let crc: i64 = ss_commit(store, w, sys_now_realtime_sec())
  if crc != 0 {
      _p("ECOMAT-SEED COMMIT FAILED rc=" as *u8); _fn(1, crc)
      _p(" (-7 poisoned segid / -8 plane lock unavailable) -- NOTHING WRITTEN.\n" as *u8)
      _p("The plane is INTACT. This is a WRITER failure, not a store shrink -- do not go looking\n" as *u8)
      _p("for lost domains.  verdict=RED\n" as *u8)
      sys_exit(1); return 1
  }
  let h: *i64 = ss_open(store)
  var ver: i64 = 0
  var k: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let key: *u8 = sys_mmap(64); ec_key(k, key)
      if ss_hget(h, key, pq, lq) == 1 { ver = ver + 1; k = k + 1 } else { go = 0 }
  }
  _p("ECOMAT-SEED committed + verified domains=" as *u8); _fn(1, ver)
  _p(" (authored=" as *u8); _fn(1, authored); _p(" carried=" as *u8); _fn(1, carried)
  _p(" live_before=" as *u8); _fn(1, live)
  _p(") -> validation live-derived per pointer at rollup, NOT asserted here.  verdict=" as *u8)
  // MONOTONIC FLOOR, not an equality. The old check was `ver == 23`: a literal that had to be
  // hand-edited every time a domain was added, so it went RED on any plane richer than the source
  // -- reporting the SOURCE's staleness as a STORE failure, after the write had already landed.
  // A marker that encodes a count breaks every time the thing it watches grows.
  //
  // ⚠BOTH BOUNDS ARE >=, AND THE SECOND ONE COST A GATE FAILURE TO LEARN. `ver == authored` looks
  // right and is wrong: ss_commit is newest-wins PER KEY, so seeding 23 rows onto a 26-row plane
  // leaves 26 -- the 3 higher keys were never addressed and correctly survive. Measured by
  // nx_ecomat_seed_clobber_gate T5 (26 -> 26), which is precisely the legitimate name-preserving
  // rewrite the 2026-08-02 count-guard revert was about. The invariant is: the plane did not
  // shrink, and it holds at least everything we authored.
  // ⚠A FLOOR, NOT AN EQUALITY -- and the equality is what a first cut got wrong, twice.
  // `ver == authored + carried` looks exact and fails on a plane that holds MORE keys than this
  // source addresses: ss_commit is newest-wins PER KEY and the store has NO DELETE, so writing 23
  // keys over a 26-key plane leaves keys 23..25 exactly where they were. That is not a failure and
  // must not be reported as one.
  //
  // ⚠DOCUMENTED IMPRECISION, stated rather than hidden: because there is no delete, a plane that
  // already carries DUPLICATE rows (the wreckage a stale seeder's id collision leaves) keeps those
  // stale trailing rows. This organ can guarantee NOTHING IS LOST; it cannot guarantee nothing is
  // redundant. Draining duplicates needs a store-level truncate that does not exist yet.
  //
  // What IS guaranteed, structurally rather than by counting: every authored row is written, and
  // every live name this source does not author was copied forward byte-for-byte before the commit.
  if ver >= authored + carried { _p("GREEN\n" as *u8); sys_exit(0); return 0 }
  _p("RED (expected at least " as *u8); _fn(1, authored + carried); _p(" = authored + carried)\n" as *u8)
  sys_exit(1); return 1
325}
nx_ecomat_seed.nx source

`nx_ecomat_seed.nx` source
