code wiki / _hdl_build / nx_evidence_beat.nx
`nx_evidence_beat.nx` source

↩ module page · 410 lines · 24499 B
1// nx_evidence_beat.nx -- THE CADENCE. Closes the seq1433 half that turns this workstream from a one-shot
2// into an actual loop.
3//
4// ★WHY THIS IS THE KEYSTONE, NOT A CHORE. Everything built this session expires on purpose: evstamps carry
5// an epoch and are refused past the TTL, bite records likewise. That expiry is the whole point -- a verdict
6// that outlives its evidence is the defect this workstream opened by fixing. But expiry without RENEWAL is
7// just a slower way to reach zero: within one TTL every domain silently falls back to UNPROVEN and the
8// board returns to exactly the state it started in. A measurement you never repeat is a measurement you
9// will eventually be lying about.
10//
11// WHAT IT DOES, per invocation:
12//   for each domain declaring executable evidence (knowledge/compare/<d>.gates)
13//     * if its evstamp is missing or older than the REFRESH threshold -> re-run nx_swcompare_evidence <d>
14//     * if any of its declared gates lacks a fresh bite record       -> re-run nx_bite_sweep <d>
15//
16// ★REFRESH AT HALF THE TTL, not at expiry. Renewing only once a record has already died guarantees a window
17// in which the board reads UNPROVEN for domains that are fine -- the instrument would manufacture its own
18// false negatives on a timer. Half-life renewal means a single missed beat is survivable.
19//
20// ★BOUNDED WORK BY CONSTRUCTION. Each refresh forks real gates and, for a sweep, rebuilds source repeatedly;
21// an unbounded beat would run for hours and get killed mid-flight, leaving a mutated tree behind. maxwork
22// caps the number of refreshes per invocation and the beat reports what it DEFERRED rather than silently
23// truncating -- a cadence that hides its own backlog is how "green" drifts away from "current".
24//
25// usage: nx_evidence_beat [maxwork] [--dry]    (CWD = nxc2 root)
26// exit 0 = nothing overdue, or all attempted work succeeded · 1 = a refresh failed · 2 = usage
27// license_tier: ORIGINAL
28import "nx_syscalls.nx"
29import "nx_artifact_root.nx"
30const EB_MAGIC_4096: i64 = 4096
31const EB_MAGIC_4095: i64 = 4095
32const EB_MAGIC_604800: i64 = 604800
33const EB_MAGIC_1024: i64 = 1024
34
35const EB_DEF_MAXWORK: i64 = 3
36
37func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
38func wn(v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 }
39func wf(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
40func wnf(fd: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(fd,b,k); return 0 }
41
42func eb_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var tot: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let n: i64 = sys_read(fd, ((buf as i64)+tot) as *u8, cap - tot)
      if n <= 0 { go = 0 } else { tot = tot + n; if tot >= cap { go = 0 } }
  }
  sys_close(fd)
  return tot
53}
54func eb_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
  var i: i64 = 0
  while i <= n - kl {
      var j: i64 = 0
      var m: i64 = 1
      while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
      if m == 1 {
          var p: i64 = i + kl
          var v: i64 = 0
          var got: i64 = 0
          while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } }
          if got == 1 { return v }
          return 0 - 1
      }
      i = i + 1
  }
  return 0 - 1
71}
72func eb_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
  return o
77}
78func eb_catn(dst: *u8, off: i64, domain: *u8, dl: i64) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while i < dl { dst[o] = domain[i]; o = o + 1; i = i + 1 }
  return o
83}
84
85// A .gates file holds one line per declared gate. The read cap is DERIVED from the buffer size and
86// never authored a second time -- a cap written as its own literal beside the buffer it guards is
87// the same constant spelled twice, and the two drift.
88const EB_GATES_BYTES: i64 = 65536
89const EB_GATES_CAP: i64 = EB_GATES_BYTES - 1
90const EB_VERDICT_BYTES: i64 = 1024
91const EB_VERDICT_CAP: i64 = EB_VERDICT_BYTES - 1
92
93// ---- EVIDENCE-NEWER-THAN-STAMP: the general repair (2026-08-15) ----
94// A stamp FREEZES redseen at the moment it is written, but its INPUT -- the bite records under
95// knowledge/status/bite_<gate>.verdict -- is written by a DIFFERENT producer at a DIFFERENT time.
96// When a bite lands after the stamp, the stamp reports fewer proven gates than the evidence on disk
97// already supports, and nothing corrects it until the half-life refresh up to ttl/2 later.
98// MEASURED 2026-08-15 over all 42 domains (coverage_complete=1): 26 sat at redseen=0 while the
99// estate held 109 killed=1 records, and finance alone moved 0 -> 16 on a single re-stamp with no
100// gate re-run differently and no source changed.
101// This trigger is deliberately GENERAL: it fires for bite records written by ANY producer, not only
102// by the sweep this beat runs itself, so a hand-run nx_gate_bite is repaired on the next pass too.
103// It is SELF-LIMITING -- re-stamping makes the stamp epoch newer than every bite, so the condition
104// clears until new evidence actually arrives, and a domain with no bites never triggers it at all.
105// A STAMP THAT PREDATES ITS OWN EVIDENCE UNDERSTATES THE SYSTEM AND READS EXACTLY LIKE VACUITY.
106func eb_evidence_newer(dom: *u8, stamp_ep: i64) -> i64 {
  var dl: i64 = 0
  while dom[dl] != (0 as u8) { dl = dl + 1 }
  let gp: *u8 = sys_mmap(512)
  var o: i64 = eb_cat(gp, 0, "knowledge/compare/" as *u8)
  o = eb_catn(gp, o, dom, dl)
  o = eb_cat(gp, o, ".gates" as *u8)
  gp[o] = 0 as u8
  let gb: *u8 = sys_mmap(EB_GATES_BYTES)
  let gn: i64 = eb_read(gp, gb, EB_GATES_CAP)
  if gn <= 0 { return 0 }
  let vp: *u8 = sys_mmap(512)
  let vb: *u8 = sys_mmap(EB_VERDICT_BYTES)
  var found: i64 = 0
  var i: i64 = 0
  while i < gn {
      // The line end is found with a SEPARATE flag, never by writing a sentinel into the cursor --
      // a loop that exits by clobbering its own index cannot then report where it stopped.
      var e: i64 = i
      var eol: i64 = 0
      while eol == 0 {
          if e >= gn { eol = 1 } else {
              if gb[e] == (10 as u8) { eol = 1 } else { e = e + 1 }
          }
      }
      if gb[i] != (35 as u8) {
          var bar: i64 = 0 - 1
          var scan: i64 = i
          while scan < e {
              if bar < 0 { if gb[scan] == (124 as u8) { bar = scan } }
              scan = scan + 1
          }
          if bar > i {
              var s: i64 = i
              var k: i64 = i
              while k < bar { if gb[k] == (47 as u8) { s = k + 1 } k = k + 1 }
              var en: i64 = bar
              if en - s > 4 { if gb[en-4] == (46 as u8) { en = en - 4 } }
              if en > s {
                  var vo: i64 = eb_cat(vp, 0, "knowledge/status/bite_" as *u8)
                  var c: i64 = s
                  while c < en { vp[vo] = gb[c]; vo = vo + 1; c = c + 1 }
                  vo = eb_cat(vp, vo, ".verdict" as *u8)
                  vp[vo] = 0 as u8
                  let vn: i64 = eb_read(vp, vb, EB_VERDICT_CAP)
                  if vn > 0 {
                      let bep: i64 = eb_num_after(vb, vn, "epoch=" as *u8, 6)
                      if bep > stamp_ep { found = 1 }
                  }
              }
          }
      }
      i = e + 1
  }
  return found
161}
162
163// fork <elf> <arg1> [arg2]; return exit code
164func eb_run2(elf: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      // MODE_0644, not 0x1a4. The 39-site consolidation swept the DECIMAL spelling (420) and this
      // hex twin survived it -- the same constant in two bases is two constants to every scanner.
      let ofd: i64 = sys_openat_wr(outpath, MODE_0644)
      if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) }
      let argv: *i64 = sys_mmap(48) as *i64
      argv[0] = elf as i64
      argv[1] = a1 as i64
      if (a2 as i64) == 0 { argv[2] = 0 } else { argv[2] = a2 as i64; argv[3] = 0 }
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = 0
      sys_execve(elf, argv, envp)
      sys_exit(127)
  }
  let stp: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, stp, 0)
  let sig: i64 = stp[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (stp[0] >> 8) & 0xff
185}
186
187func main(argc: i64, argv: *i64) -> i64 {
  // Resolution order is argv > conf > compiled default (rule 17). 0 means "nobody has said yet", so a
  // conf value can still outrank the compiled floor -- initialising straight to the default would let
  // the code silently beat the config file that exists to hold precisely this number.
  var maxwork: i64 = 0
  var argv_maxwork: i64 = 0
  var dry: i64 = 0
  if argc > 1 {
      let a: *u8 = argv[1] as *u8
      if a[0] == (45 as u8) { dry = 1 } else {
          maxwork = 0
          var i: i64 = 0
          while a[i] != (0 as u8) { maxwork = maxwork*10 + ((a[i] as i64) - 48); i = i + 1 }
          if maxwork <= 0 { maxwork = EB_DEF_MAXWORK }
          argv_maxwork = 1
      }
  }
  if argc > 2 { let b: *u8 = argv[2] as *u8; if b[0] == (45 as u8) { dry = 1 } }
205
  let now: i64 = sys_now_realtime_sec()
  // ONE policy, read from the same file every other consumer reads (rule 17).
  let pb: *u8 = sys_mmap(EB_MAGIC_4096)
  let pn: i64 = eb_read("knowledge/evidence_policy.conf" as *u8, pb, EB_MAGIC_4095)
  var ttl: i64 = EB_MAGIC_604800
  if pn > 0 { let v: i64 = eb_num_after(pb, pn, "ttl_sec=" as *u8, 8); if v > 0 { ttl = v } }
  // THE BUDGET COMES FROM THE SAME POLICY FILE AS THE TTL IT IS DERIVED FROM. It was a compiled
  // constant of 3 while refresh demand was 44 domains / 14 passes per half-life = 3.15 per pass, so
  // the beat could not keep up with its own scan even before sweeps: MEASURED 2026-08-15 as
  // refreshed=3 swept=0 deferred=23, nine domains aged 6.3 days, and smallos/nishios never stamped
  // because they sort last and the budget was always gone before the scan reached them.
  // A BUDGET SET BELOW ITS STEADY-STATE DEMAND DOES NOT SLOW A QUEUE DOWN, IT GUARANTEES IT GROWS --
  // and it reports a tidy GREEN while doing so, because every pass really did complete its budget.
  if argv_maxwork == 0 { if pn > 0 { let mw: i64 = eb_num_after(pb, pn, "beat_maxwork=" as *u8, 13); if mw > 0 { maxwork = mw } } }
  if maxwork <= 0 { maxwork = EB_DEF_MAXWORK }
  let refresh: i64 = ttl / 2
222
  w("=== nx_evidence_beat -- renew what is about to expire (half-life refresh) ===\n")
  w("  ttl="); wn(ttl); w("s refresh_at="); wn(refresh); w("s maxwork="); wn(maxwork)
  if dry == 1 { w(" MODE=dry-run") }
  w("\n")
227
  let evelf: *u8 = sys_mmap(512)
  let swelf: *u8 = sys_mmap(512)
  let haveev: i64 = ar_resolve("_offc/nx_swcompare_evidence.elf" as *u8, evelf)
  let havesw: i64 = ar_resolve("_offc/nx_bite_sweep.elf" as *u8, swelf)
  if haveev == 0 { w("  CANNOT RESOLVE nx_swcompare_evidence.elf -- promote it first\n"); sys_exit(2); return 2 }
233
  let dbuf: *u8 = sys_mmap(1 << 16)
  let fd: i64 = sys_openat_rd("knowledge/compare\x00" as *u8)
  if fd < 0 { w("  cannot open knowledge/compare\n"); sys_exit(2); return 2 }
  let outp: *u8 = "knowledge/status/evidence_beat_run.out\x00" as *u8
  let dom: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(512)
  var scanned: i64 = 0
  var refreshed: i64 = 0
  var swept: i64 = 0
  var restamped: i64 = 0
  var deferred: i64 = 0
  var failed: i64 = 0
  var work: i64 = 0
247
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, 1 << 16)
      if nr <= 0 { go = 0 } else {
          var pos: i64 = 0
          while pos < nr {
              let rec: *u8 = ((dbuf as i64) + pos) as *u8
              let reclen: i64 = dirent_reclen(rec)
              let name: *u8 = ((rec as i64) + 19) as *u8
              var ln: i64 = 0
              while name[ln] != (0 as u8) { ln = ln + 1 }
              // only domains that DECLARE executable evidence: <d>.gates
              var isg: i64 = 0
              if ln > 6 {
                  let g: *u8 = ".gates\x00" as *u8
                  var m: i64 = 1
                  var q: i64 = 0
                  while q < 6 { if name[ln-6+q] != g[q] { m = 0; q = 6 } else { q = q + 1 } }
                  isg = m
              }
              if isg == 1 {
                  let dl: i64 = ln - 6
                  var c: i64 = 0
                  while c < dl { dom[c] = name[c]; c = c + 1 }
                  dom[dl] = 0 as u8
                  scanned = scanned + 1
                  // age of this domain's evstamp
                  var o: i64 = eb_cat(path, 0, "knowledge/status/evstamp_" as *u8)
                  o = eb_catn(path, o, dom, dl)
                  o = eb_cat(path, o, ".verdict" as *u8)
                  path[o] = 0 as u8
                  let sb: *u8 = sys_mmap(EB_MAGIC_1024)
                  let sn: i64 = eb_read(path, sb, 1023)
                  var age: i64 = ttl + 1
                  var stamp_ep: i64 = 0
                  if sn > 0 { let ep: i64 = eb_num_after(sb, sn, "epoch=" as *u8, 6); if ep > 0 { stamp_ep = ep; if now >= ep { age = now - ep } } }
                  // TWO INDEPENDENT REASONS TO RENEW, AND THEY MUST NOT SHARE A MESSAGE: the stamp is
                  // near expiry (TIME), or the evidence underneath it has moved since it was written
                  // (CONTENT). Only the first existed before 2026-08-15, which is why 26 of 42 domains
                  // published a redseen lower than their own bite records already supported. The content
                  // test is asked ONLY when the time test did not fire, so an overdue domain costs no
                  // extra reads and a fresh one costs a handful of small reads and no gate runs.
                  var evnew: i64 = 0
                  if age <= refresh { if stamp_ep > 0 { evnew = eb_evidence_newer(dom, stamp_ep) } }
                  var due: i64 = 0
                  if age > refresh { due = 1 } else { if evnew == 1 { due = 1 } }
                  if due == 1 {
                      // ★THE DRY RUN MUST SPEND THE SAME BUDGET. The first cut incremented the work
                      // counter only on the real path, so --dry listed EVERY overdue domain as if it
                      // would all be done in one pass -- a preview that disagrees with the run it is
                      // previewing is worse than no preview, because it is trusted.
                      if work >= maxwork {
                          deferred = deferred + 1
                          w("  DEFER  "); w(dom); w("  age="); wn(age); w("s (budget spent)\n")
                      } else {
                          work = work + 1
                          if evnew == 1 { w("  REFRESH "); w(dom); w("  EVIDENCE-NEWER-THAN-STAMP -> ") } else { w("  REFRESH "); w(dom); w("  age="); wn(age); w("s -> ") }
                          if dry == 1 { w("(dry)\n") } else {
                              let rc: i64 = eb_run2(evelf, dom, 0 as *u8, outp)
                              if rc == 0 { w("MEASURED-HONEST\n") } else { w("RED (exit "); wn(rc); w(")\n"); failed = failed + 1 }
                              refreshed = refreshed + 1
                              // NON-VACUITY RENEWAL: re-read the stamp we just wrote. If fewer gates have
                              // a live bite record than the domain declares, its non-vacuity has aged out
                              // and the sweep must run -- otherwise the beat renews the cheap half of the
                              // evidence and quietly lets the expensive half expire.
                              if havesw == 1 {
                                  let s2: *u8 = sys_mmap(EB_MAGIC_1024)
                                  let n2: i64 = eb_read(path, s2, 1023)
                                  if n2 > 0 {
                                      let rs: i64 = eb_num_after(s2, n2, "redseen=" as *u8, 8)
                                      let dc: i64 = eb_num_after(s2, n2, "declared=" as *u8, 9)
                                      if dc > 0 { if rs < dc {
                                          // A SWEEP WHOSE RESULT IS NEVER STAMPED IS WORK PAID FOR AND
                                          // THROWN AWAY. The re-stamp is not a separate task -- it is the
                                          // second half of this one, so the budget reserves BOTH or the
                                          // pass declines to start. Budget-checking the cheap half only
                                          // AFTER spending the expensive half discards the sweep's result
                                          // at exactly the moment the budget is tightest, which is the
                                          // worst possible time to lose it.
                                          if work + 2 <= maxwork {
                                              work = work + 2
                                              w("  SWEEP   "); w(dom); w("  redseen="); wn(rs); w("/"); wn(dc); w(" -> ")
                                              // 6 -> 16, MEASURED 2026-08-01, not guessed. nx_x25519_kat_gate
                                              // returned INCONCLUSIVE at 4 sites and again at 6-equivalent
                                              // depth; the KILL landed at site 4 of the NUMERIC-CONSTANT
                                              // operator only once the cap allowed 14. Constant-time crypto
                                              // exposes few mutable comparisons and its early numeric literals
                                              // are structural (array sizes -> uncompilable), so the first
                                              // handful of sites are systematically barren for exactly the
                                              // KAT/ORACLE class this beat most needs to score.
                                              // ★A SITE CAP IS A SAMPLING DECISION: TOO SMALL AND THE SWEEP
                                              // MANUFACTURES "INCONCLUSIVE" AND CALLS IT A MEASUREMENT.
                                              // Cost is bounded -- the sweep stops at the FIRST kill, so a
                                              // gate that bites early still costs the same 1-2 rebuilds.
                                              let rc2: i64 = eb_run2(swelf, dom, "16\x00" as *u8, outp)
                                              if rc2 == 0 { w("all gates BITE\n") } else { w("not all proven (exit "); wn(rc2); w(")\n") }
                                              swept = swept + 1
                                              // THE STAMP IS WRITTEN BEFORE THE SWEEP THAT PRODUCES ITS OWN
                                              // NON-VACUITY EVIDENCE. Without this re-stamp the sweep's
                                              // result is invisible until the next half-life refresh 3.5
                                              // days later, so the beat renews the CHEAP half of the
                                              // evidence, generates the EXPENSIVE half, and then throws the
                                              // expensive half away.
                                              // MEASURED 2026-08-15 over all 42 domains: finance held 18
                                              // killed=1 records and published redseen=0 because its stamp
                                              // epoch was 100 SECONDS OLDER than the bites it should have
                                              // counted; librarian (2s) and surveys (3s) show the identical
                                              // ordering. A single re-stamp moved finance 0 -> 16 with no
                                              // gate re-run differently and no source changed -- the proof
                                              // was on disk the whole time and the stamp could not see it.
                                              // A STAMP THAT PREDATES ITS OWN EVIDENCE UNDERSTATES THE
                                              // SYSTEM'S HONESTY AND READS EXACTLY LIKE VACUOUS GATES.
                                              let rc3: i64 = eb_run2(evelf, dom, 0 as *u8, outp)
                                              if rc3 == 0 { w("  RESTAMP "); w(dom); w("  post-sweep -> MEASURED-HONEST\n") } else { w("  RESTAMP "); w(dom); w("  post-sweep RED (exit "); wn(rc3); w(")\n"); failed = failed + 1 }
                                              restamped = restamped + 1
                                          } else { deferred = deferred + 1; w("  DEFER  "); w(dom); w(" sweep (budget spent)\n") }
                                      } }
                                  }
                              }
                          }
                      }
                  }
              }
              if reclen <= 0 { pos = nr } else { pos = pos + reclen }
          }
      }
  }
  sys_close(fd)
376
  // swept WAS COUNTED AND NEVER PRINTED, so a pass that swept nothing and a pass that swept every
  // overdue domain produced IDENTICAL summaries. The non-vacuity half of this beat's work was
  // invisible in the beat's own log, which is why "scanned=43 refreshed=3 failed=0" read as the
  // whole story when it was reporting only the cheap half. A COUNTER THAT IS TALLIED BUT NEVER
  // EMITTED IS A MEASUREMENT THE ORGANISATION IS PAYING FOR AND NOT COLLECTING.
  w("  scanned="); wn(scanned); w(" refreshed="); wn(refreshed); w(" swept="); wn(swept); w(" restamped="); wn(restamped); w(" deferred="); wn(deferred); w(" failed="); wn(failed); w("\n")
  if havesw == 0 { w("  NOTE nx_bite_sweep.elf unresolved -- non-vacuity records will not be renewed by this beat\n") }
384
  let lfd: i64 = sys_openat_wr("knowledge/status/evidence_beat.log\x00" as *u8, 0x1a4)
  if lfd >= 0 {
      wf(lfd, "NX-EVIDENCE-BEAT scanned=" as *u8); wnf(lfd, scanned)
      wf(lfd, " refreshed=" as *u8); wnf(lfd, refreshed)
      wf(lfd, " deferred=" as *u8); wnf(lfd, deferred)
      wf(lfd, " failed=" as *u8); wnf(lfd, failed)
      wf(lfd, " ttl=" as *u8); wnf(lfd, ttl)
      // ts= is the DEAD-MAN'S-SWITCH marker knowledge/registry/cron_heartbeats.tsv looks for. Emitting
      // only `epoch=` would leave the watch permanently stale even while the beat ran perfectly -- the
      // heartbeat would report a dead cadence that is actually alive, which is the same false-negative
      // class as every other reader/writer dialect mismatch this session. Both are written: ts= for the
      // watch, epoch= for anything reading this log the way the stamps are read.
      wf(lfd, " ts=" as *u8); wnf(lfd, now)
      wf(lfd, " epoch=" as *u8); wnf(lfd, now)
      wf(lfd, "\n" as *u8)
      // DEFERRED WORK IS NOT A FAILURE, but it must be VISIBLE: a beat that silently drops its backlog
      // lets the board age out one domain at a time while every log line still reads GREEN.
      if failed == 0 { wf(lfd, "VERDICT=GREEN evidence renewed within its half-life\n" as *u8) } else { wf(lfd, "VERDICT=RED a refresh failed -- a domain's evidence could not be re-measured\n" as *u8) }
      sys_close(lfd)
  }
405
  if failed == 0 { w("VERDICT: verdict=GREEN (nothing overdue, or all attempted refreshes succeeded)\n"); sys_exit(0); return 0 }
  w("VERDICT: verdict=RED (a refresh failed)\n")
  sys_exit(1)
  return 1
410}
nx_evidence_beat.nx source

`nx_evidence_beat.nx` source
