nx_evprofile_lib.nx source
↩ module page · 583 lines · 32736 B
1// nx_evprofile_lib.nx -- THE ONE VOCABULARY AND THE ONE READER for the /compare EVIDENCE PROFILE.
2//
3// WHY THIS EXISTS (measured 2026-08-31). nx_swcompare_evidence ALREADY COMPUTES the whole gap profile of
4// every domain and THROWS MOST OF IT AWAY: ev_scan classifies four row states (GROUNDED / UNGROUNDED /
5// GAP-WATCH / LANDED) and prints the LANDED label WITHOUT COUNTING IT; ev_gates extracts pass=N/M and
6// folds GREEN without ever looking at M. The stamp it materialises carries ten numbers, none of which
7// name a REMEDY, so every consumer of that stamp can say a board is RED and none can say WHY -- and the
8// verdict line itself is a bare disjunction (an ungrounded claim, dead gate, or neg-control leak) that
9// never names its failing conjunct, so the reader always guesses the alarming third.
10// A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, AND A WORKLIST WITHOUT ITS REASON IS STILL ONE STEP SHORT.
11//
12// WHY A LIB AND NOT A PLANE. The obvious shape was producer -> sovereign plane -> PM board, and it was
13// REJECTED on this estate's own law: WHEN TWO ORGANS MUST AGREE, MAKE DISAGREEMENT IMPOSSIBLE BY
14// CONSTRUCTION RATHER THAN BY DISCIPLINE. A plane is a SECOND artifact of the same measurement, i.e. a
15// producer/consumer WIRE, and every wire on this estate has eventually drifted (rm_field line-anchoring,
16// the roi- ordinals, overall_permil= versus permil). There is exactly ONE evidence artifact -- the
17// stamp the referee already writes -- and this lib is the ONLY thing that spells its keys or reads them.
18// The referee IMPORTS these same key literals to WRITE them, so writer and reader cannot disagree about
19// the wire: there is only one of it. It also avoids importing the 194 KB segment store into a referee
20// that runs 96 times a beat, and avoids taking a plane lock on a box already under I/O pressure.
21//
22// ABSTAIN, NEVER ACQUIT. A stamp written before this change carries none of the profile keys. Every
23// accessor returns -1 for an absent key and evp_parse sets EVP_F_V to 1, so a v1 stamp reads as UNKNOWN
24// rather than as a domain with zero gaps. A ZERO-FILLED PROFILE IS A FABRICATED CONSTANT WEARING THE
25// SHAPE OF A MEASUREMENT, and it fails in the flattering direction, which is the direction nobody audits.
26//
27// license_tier: ORIGINAL No hw writes (Rule 26).
28import "nx_syscalls.nx"
29import "nx_estate_path.nx"
30
31const EVP_PATH_CAP: i64 = 512
32// A stamp is ONE line. The longest live stamp measured 2026-08-31 is ~300 B and the profile keys add
33// ~90 B. This reserve is 13x the measured worst case AND IT ANNOUNCES: evp_load sets flags[EVP_FL_BRIM]
34// when the read fills it, because A CAP REACHED IN SILENCE BECOMES A MEASUREMENT NOBODY KNOWS IS PARTIAL.
35const EVP_STAMP_CAP: i64 = 4096
36const EVP_WORD_CAP: i64 = 64
37
38const EVP_STAMP_PRE: *u8 = "knowledge/status/evstamp_"
39const EVP_STAMP_SUF: *u8 = ".verdict"
40
41// ---- THE KEYS, AS DATA. The referee WRITES these literals and this lib READS them; there is one copy. ----
42// EVERY KEY CARRIES ITS LEADING SPACE ON PURPOSE. The scan returns the FIRST hit, and grounded= is a
43// SUFFIX of ungrounded= -- an unanchored probe for the first would be satisfied by the wrong field the
44// day the key order changed. The space is the anchor, and it kills that whole class mechanically rather
45// than by remembering to order the fields correctly.
46const EVP_K_OK: *u8 = "ok="
47const EVP_K_EPOCH: *u8 = " epoch="
48const EVP_K_GROUNDED: *u8 = " grounded="
49const EVP_K_GATES: *u8 = " gates="
50const EVP_K_SKIPPED: *u8 = " skipped="
51const EVP_K_DECLARED: *u8 = " declared="
52const EVP_K_HASHED: *u8 = " hashed="
53const EVP_K_REDSEEN: *u8 = " redseen="
54const EVP_K_UNGROUNDED: *u8 = " ungrounded="
55const EVP_K_ABSENT: *u8 = " absent="
56const EVP_K_ABSNAMED: *u8 = " absent_named="
57const EVP_K_ABSBARE: *u8 = " absent_bare="
58const EVP_K_LANDED: *u8 = " landed="
59const EVP_K_VACUOUS: *u8 = " vacuous="
60const EVP_K_CONJ: *u8 = " conj="
61const EVP_K_MROOT: *u8 = " mroot="
62const EVP_K_MBYTES: *u8 = " mbytes="
63const EVP_K_MCAP: *u8 = " mcapped="
64const EVP_K_GATESROOT: *u8 = " gatesroot="
65// ---- v3, THE WITHHELD-PROOF CLASS (2026-09-01). STRICTLY ADDITIVE, and appended at the TAIL of the
66// profile block so every v1 and v2 key keeps its name, its order and its value. Neither literal is a
67// substring of the other, which matters because evp_find is an UNANCHORED search: " withheld=" cannot
68// match inside " withheld_refused=" because the byte after "withheld" there is an underscore.
69const EVP_K_WITHHELD: *u8 = " withheld="
70const EVP_K_WHREF: *u8 = " withheld_refused="
71// ---- v4, THE THIRD VERDICT STATE (2026-09-01). WRITER-SIDE ONLY FOR NOW, AND THAT IS DELIBERATE.
72// WHY THE STATE EXISTS. The referee's verdict was a BOOLEAN over four liar-kill conjuncts, so a board it
73// could not fully READ still published one of exactly two answers: MEASURED-HONEST or RED. charsim was
74// the measured cost -- 67,965 B of matrix graded through a 65,536 B reserve, with mcapped=1 STAMPED and
75// DISCLOSED on the page, and ok=1 published anyway over a prefix whose dropped tail held that board's own
76// liar-kill row and its operator-acceptance row. THE CEILING WAS MEASURED, PRINTED, AND THEN DROPPED AT
77// THE ONE PLACE IT DECIDED ANYTHING.
78// WHY IT IS A STATED KEY AND NOT A DERIVATION FROM THE TWO THAT EXIST. `ok=0 AND mcapped=1` cannot carry
79// it: graphics is ok=0 mcapped=1 and is a GENUINE red (conj=GPqN -- its quorum failed). A reader deriving
80// UNPROVEN from those two fields would acquit a real failure, so the state must be stated, never inferred.
81// NEITHER LITERAL IS A SUBSTRING OF THE OTHER OR OF ANY KEY ABOVE, which matters because evp_find is an
82// UNANCHORED search: " unproven=" cannot match inside " unproven_reason=" (the byte after "unproven"
83// there is an underscore), and it cannot match " ungrounded=" (they differ at index 3).
84// NO PARSE SLOT AND NO EVP_NF CHANGE HERE, ON PURPOSE. A reader slot moves EVP_NF, and the consumer that
85// most needs this state -- nx_sota_status.ss_stamp_load -- collapses the entire verdict to
86// `if ok != 1 { dissent }`, which ev_verdict returns as EV_RED before any other clause is reached.
87// Shipping the reader half without that one-line fix would turn an honest UNPROVEN into a false RED in
88// the same organ -- the exact conflation ev_verdict's own comment forbids. The literal lives HERE, in the
89// file that owns this wire's vocabulary, so the writer and the eventual reader cannot spell it twice.
90const EVP_K_UNPROVEN: *u8 = " unproven="
91const EVP_K_UNPREASON: *u8 = " unproven_reason="
92// ---- v5, THE RULER'S OWN ABSTENTION (2026-09-01). WRITER-SIDE ONLY, FOR THE REASON v4 STATES ABOVE ----
93// present = grounded + ungrounded was an EXACT IDENTITY in the referee until a claimed axis could be
94// neither. sd_present_or_abstain_buf now returns SD_ABSTAIN for a JS-dialect row whose symbol is not a JS
95// declaration -- measured 9 such rows across comms/video/videoops/surveys, every one a live call site or
96// object property in shipped client code, so convicting them would manufacture 9 FALSE REDs. Those rows
97// are counted HERE and in NEITHER of the other two, which leaves a residual in that identity.
98// AN UNPUBLISHED RESIDUAL IS A LEAK, AND AN ABSTENTION NOBODY READS IS A LIE NOBODY TOLD -- so the key
99// exists so the partition can still be reconciled from the stamp: present = grounded + ungrounded + abstain.
100// It takes NO EVP_F_ slot and does NOT move EVP_NF, exactly as EVP_K_UNPROVEN does not: a reader slot is a
101// separate adjudication with a consumer-side fix attached, and the literal belongs in the file that owns
102// this wire's vocabulary so the writer and the eventual reader cannot spell it twice.
103// NOT A SUBSTRING OF ANY KEY ABOVE (evp_find is UNANCHORED): no other key contained "abstain" until
104// EVP_K_ABSTAIN_WATCH below, and that pair is safe for EXACTLY the reason the withheld pair is: every key
105// literal INCLUDES ITS TRAILING '=', and the byte after "abstain" in " abstain_watch=" is an underscore,
106// so " abstain=" cannot match inside it in either direction. THE COMMENT IS CORRECTED RATHER THAN LEFT
107// STANDING, because A LAW ILLUSTRATED BY A NAMED EXAMPLE ROTS AT THE EXAMPLE, AND THE EXAMPLE IS THE HALF
108// A READER ACTS ON -- the edit that adds the second key is the edit that owes this sentence.
109const EVP_K_ABSTAIN: *u8 = " abstain="
110
111// ---- v6, THE COMPOSITION DENOMINATOR AND THE WATCH-FORM ABSTENTION (2026-09-01). STRICTLY ADDITIVE,
112// appended at the TAIL so every v1..v5 key keeps its name, its order and its value, and dig= stays the
113// newline-terminated tail of the stamp line.
114//
115// WHY EVP_K_AXES AND EVP_K_CLAIMED EXIST, AND WHY NEITHER IS OPTIONAL. The referee ALREADY COMPUTES BOTH
116// on every run and prints them on a COMPOSITION line THAT REACHES NO STAMP -- so the numbers exist and no
117// machine can read them. That is the whole defect. The cheapest published dishonesty available on this
118// estate is an 18-BYTE EDIT that rewrites an ungrounded row's symbol field into the watch form: measured
119// live on team, 6732 -> 6750 B took verdict RED -> MEASURED-HONEST with ungrounded 2 -> 0, for ZERO CODE
120// AND ZERO CAPABILITY. WITHIN ONE CENSUS a retraction and an honest new gap make the IDENTICAL measurable
121// assertion about the world -- this symbol is not declared in this organ -- so no single census can tell
122// them apart. ACROSS TWO THEY HAVE OPPOSITE SIGNATURES, and the signature is pure per-board arithmetic
123// needing no per-row history at all:
124// retraction ......... axes CONSTANT, claimed FALLS, gaps RISES
125// honest new gap ..... axes RISES, claimed HOLDS, gaps RISES
126// ONE NUMBER CANNOT SEPARATE THOSE AND TWO CAN. Until both are on the wire the discriminator is
127// UNBUILDABLE BY CONSTRUCTION, which is why these are KEYS and not a better sentence on a text surface.
128// A DENOMINATOR THAT IS NEVER RECORDED MAKES ITS OWN NUMERATOR UNREADABLE.
129//
130// AND THEY CLOSE A THIRD PARTITION THAT BECOMES CHECKABLE FROM THE STAMP ALONE:
131// axes = claimed + absent + landed
132// so the top-level composition of a board can now FAIL from the artifact instead of being recited in
133// print on a surface no consumer reads.
134// NEITHER LITERAL IS A SUBSTRING OF ANY KEY ABOVE (evp_find is UNANCHORED): no key contains "axes"
135// (" gates=" and " gatesroot=" share no such run) and none contains "claimed" (" declared=" differs at
136// index 1, " landed=" at index 1).
137const EVP_K_AXES: *u8 = " axes="
138const EVP_K_CLAIMED: *u8 = " claimed="
139// THE WATCH-FORM ABSTENTION: A SEPARATE AXIS, DELIBERATELY NOT A PARTITION MEMBER.
140// MEASURED on the LIVE video stamp before this shipped: `grounded=15/19 ... abstain=5`, i.e.
141// 15 + 0 + 5 = 20 against present=19 -- A RESIDUAL OF EXACTLY ONE, ON A BOARD PUBLISHED ok=1
142// MEASURED-HONEST. Mechanism: the referee incremented its abstain counter ABOVE the watch/non-watch
143// branch, while `present` is only incremented on the NON-watch path, so an abstaining WATCH row landed in
144// abstain AND in absent_named and in NEITHER side of the identity it was being summed into.
145// A GAP ROW MUST NEVER ENTER A PARTITION OF THE CLAIMED AXES. It is counted here instead, so nothing is
146// lost and the identity closes exactly. It overlaps absent_named precisely as withheld_refused does, and
147// A NEW BUCKET THAT OVERLAPS AN EXISTING PARTITION MUST BE DECLARED A SEPARATE AXIS.
148const EVP_K_ABSTAIN_WATCH: *u8 = " abstain_watch="
149
150// ---- THE PARSED PROFILE, as ordinal slots. -1 EVERYWHERE MEANS UNKNOWN, NEVER ZERO. ----
151const EVP_F_OK: i64 = 0
152const EVP_F_EPOCH: i64 = 1
153const EVP_F_GROUNDED: i64 = 2
154const EVP_F_PRESENT: i64 = 3
155const EVP_F_GREEN: i64 = 4
156const EVP_F_RAN: i64 = 5
157const EVP_F_SKIPPED: i64 = 6
158const EVP_F_DECLARED: i64 = 7
159const EVP_F_HASHED: i64 = 8
160const EVP_F_REDSEEN: i64 = 9
161const EVP_F_UNGROUND: i64 = 10
162const EVP_F_ABSENT: i64 = 11
163const EVP_F_ABSNAMED: i64 = 12
164const EVP_F_ABSBARE: i64 = 13
165const EVP_F_LANDED: i64 = 14
166const EVP_F_VACUOUS: i64 = 15
167const EVP_F_MBYTES: i64 = 16
168const EVP_F_MCAPPED: i64 = 17
169const EVP_F_MROOT: i64 = 18
170const EVP_F_GATESROOT: i64 = 19
171const EVP_F_CJ_G: i64 = 20
172const EVP_F_CJ_P: i64 = 21
173const EVP_F_CJ_Q: i64 = 22
174const EVP_F_CJ_N: i64 = 23
175const EVP_F_V: i64 = 24
176const EVP_F_WITHHELD: i64 = 25
177const EVP_F_WHREF: i64 = 26
178const EVP_NF: i64 = 27
179
180// tree tokens, matching nx_comparetree_lib's CT_TREE_* BY VALUE so the two cannot drift apart
181const EVP_TREE_NONE: i64 = 0
182const EVP_TREE_PRIMARY: i64 = 1
183const EVP_TREE_BUILD: i64 = 2
184
185const EVP_FL_AMBIG: i64 = 0
186const EVP_FL_BRIM: i64 = 1
187const EVP_NFLAG: i64 = 2
188
189const EVP_RC_UNRESOLVED: i64 = 0 - 1
190const EVP_RC_AMBIGUOUS: i64 = 0 - 2
191
192const EVP_TTL_DEFAULT: i64 = 604800
193const EVP_CONF_CAP: i64 = 4096
194
195func evp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
196
197func evp_cat(dst: *u8, off: i64, s: *u8) -> i64 {
198 var o: i64 = off
199 var i: i64 = 0
200 while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
201 dst[o] = 0 as u8
202 return o
203}
204
205// THE stamp path. The referee builds its WRITE path with this same function, so the artifact the reader
206// looks for and the artifact the writer produces are the same string by construction, not by agreement.
207func evp_path(out: *u8, dom: *u8) -> i64 {
208 var o: i64 = evp_cat(out, 0, EVP_STAMP_PRE)
209 o = evp_cat(out, o, dom)
210 o = evp_cat(out, o, EVP_STAMP_SUF)
211 return o
212}
213
214func evp_read(path: *u8, buf: *u8, cap: i64) -> i64 {
215 let fd: i64 = sys_openat_rd(path)
216 if fd < 0 { return 0 - 1 }
217 var tot: i64 = 0
218 var go: i64 = 1
219 while go == 1 {
220 let n: i64 = sys_read(fd, ((buf as i64) + tot) as *u8, cap - tot)
221 if n <= 0 { go = 0 } else { tot = tot + n; if tot >= cap { go = 0 } }
222 }
223 sys_close(fd)
224 return tot
225}
226
227// byte offset just PAST the first occurrence of key, or -1
228func evp_find(buf: *u8, n: i64, key: *u8) -> i64 {
229 let kl: i64 = evp_slen(key)
230 var i: i64 = 0
231 while i + kl <= n {
232 var j: i64 = 0
233 var hit: i64 = 1
234 while j < kl { if buf[i+j] != key[j] { hit = 0; j = kl } else { j = j + 1 } }
235 if hit == 1 { return i + kl }
236 i = i + 1
237 }
238 return 0 - 1
239}
240
241// the integer at buf[p..]; endp receives the byte after the digits. -1 when no digit is there.
242func evp_digits(buf: *u8, n: i64, p: i64, endp: *i64) -> i64 {
243 var i: i64 = p
244 var v: i64 = 0
245 var any: i64 = 0
246 var go: i64 = 1
247 while go == 1 {
248 if i >= n { go = 0 } else {
249 let c: i64 = buf[i] as i64
250 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; i = i + 1 } else { go = 0 } } else { go = 0 }
251 }
252 }
253 endp[0] = i
254 if any == 1 { return v }
255 return 0 - 1
256}
257
258func evp_num(buf: *u8, n: i64, key: *u8) -> i64 {
259 let p: i64 = evp_find(buf, n, key)
260 if p < 0 { return 0 - 1 }
261 let e: *i64 = sys_mmap(16) as *i64
262 return evp_digits(buf, n, p, e)
263}
264
265// a/b : returns a, writes b to out2 (-1 when the pair is not there)
266func evp_num_pair(buf: *u8, n: i64, key: *u8, out2: *i64) -> i64 {
267 out2[0] = 0 - 1
268 let p: i64 = evp_find(buf, n, key)
269 if p < 0 { return 0 - 1 }
270 let e: *i64 = sys_mmap(16) as *i64
271 let a: i64 = evp_digits(buf, n, p, e)
272 if a < 0 { return 0 - 1 }
273 let q: i64 = e[0]
274 if q < n { if buf[q] == (47 as u8) { out2[0] = evp_digits(buf, n, q + 1, e) } }
275 return a
276}
277
278// the space-delimited word after key, copied NUL-terminated into dst. Returns its length, or -1.
279func evp_word(buf: *u8, n: i64, key: *u8, dst: *u8, cap: i64) -> i64 {
280 let p: i64 = evp_find(buf, n, key)
281 if p < 0 { dst[0] = 0 as u8; return 0 - 1 }
282 var i: i64 = p
283 var t: i64 = 0
284 var go: i64 = 1
285 while go == 1 {
286 if i >= n { go = 0 } else {
287 let c: i64 = buf[i] as i64
288 if c == 32 { go = 0 } else { if c == 10 { go = 0 } else {
289 if t < cap - 1 { dst[t] = buf[i] }
290 if t < cap - 1 { t = t + 1 }
291 i = i + 1
292 } }
293 }
294 }
295 dst[t] = 0 as u8
296 return t
297}
298
299func evp_streq(a: *u8, b: *u8) -> i64 {
300 var i: i64 = 0
301 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
302 if b[i] != (0 as u8) { return 0 }
303 return 1
304}
305
306func evp_upper(c: i64) -> i64 {
307 if c >= 65 { if c <= 90 { return 1 } }
308 return 0
309}
310
311func evp_tree_of(wd: *u8) -> i64 {
312 if evp_streq(wd, "PRIMARY" as *u8) == 1 { return EVP_TREE_PRIMARY }
313 if evp_streq(wd, "BUILDROOT" as *u8) == 1 { return EVP_TREE_BUILD }
314 if evp_streq(wd, "NONE" as *u8) == 1 { return EVP_TREE_NONE }
315 return 0 - 1
316}
317
318func evp_tree_name(t: i64) -> *u8 {
319 if t == EVP_TREE_PRIMARY { return "PRIMARY" as *u8 }
320 if t == EVP_TREE_BUILD { return "BUILDROOT" as *u8 }
321 if t == EVP_TREE_NONE { return "NONE" as *u8 }
322 return "UNKNOWN" as *u8
323}
324
325// THE CONJUNCT VOCABULARY, in ONE place. Order is fixed: grounded / present / quorum / negcontrol.
326// UPPERCASE = the conjunct held, lowercase = it failed. Reading them back is how a bare RED becomes a
327// remedy: GPqN is no gate ran, gPQN is a published claim is unsupported, and they need opposite work.
328func evp_conj_char(pass: i64, up: i64, lo: i64) -> i64 { if pass == 1 { return up } return lo }
329
330func evp_conj_name(idx: i64) -> *u8 {
331 if idx == 0 { return "grounded" as *u8 }
332 if idx == 1 { return "present" as *u8 }
333 if idx == 2 { return "quorum" as *u8 }
334 if idx == 3 { return "negcontrol" as *u8 }
335 return "none" as *u8
336}
337
338// the FIRST failing conjunct, or -1 when all four held / are unknown
339func evp_conj_fail(f: *i64) -> i64 {
340 if f[EVP_F_CJ_G] == 0 { return 0 }
341 if f[EVP_F_CJ_P] == 0 { return 1 }
342 if f[EVP_F_CJ_Q] == 0 { return 2 }
343 if f[EVP_F_CJ_N] == 0 { return 3 }
344 return 0 - 1
345}
346
347// ---- LOAD: resolve the stamp WITHOUT caring which directory the caller was launched from ----
348// nx_compare_regen runs with CWD=buildroot (proven by its own RG_PUBJRNL of ../knowledge/status/...),
349// and buildroot/knowledge/status holds ZERO evstamp files (519 files, matches=0, corpus_complete=1).
350// A BARE RELATIVE READ FROM THE GENERATOR THEREFORE RESOLVES INTO AN EMPTY TREE AND RENDERS
351// no-evidence FOR ALL 96 DOMAINS, CONFIDENTLY. ep_artifact_path is the estate's incumbent for exactly
352// this and is composed rather than re-derived.
353//
354// AND THE AMBIGUITY IS NAMED RATHER THAN SILENTLY DECIDED. ep_open_rd probes the caller's own CWD FIRST
355// on purpose, so a hermetic gate fixture is not shadowed by an estate file of the same name -- which
356// also means a stray copy under the launch directory would WIN. When a bare-CWD copy AND an estate-root
357// copy both exist AND THEIR BYTES DIFFER, two different files answer to one name and no reader may pick
358// one: this refuses with EVP_RC_AMBIGUOUS and names it. Byte-IDENTICAL copies are not a hazard (the
359// numbers are the same) and are deliberately NOT refused -- that is the ordinary case for any caller
360// whose CWD already is the estate root, and refusing it would break every such consumer.
361func evp_load(dom: *u8, buf: *u8, cap: i64, pathout: *u8, flags: *i64) -> i64 {
362 flags[EVP_FL_AMBIG] = 0
363 flags[EVP_FL_BRIM] = 0
364 let rel: *u8 = sys_mmap(EVP_PATH_CAP)
365 evp_path(rel, dom)
366
367 let cfd: i64 = sys_openat_rd(rel)
368 var cwdhit: i64 = 0
369 if cfd >= 0 { sys_close(cfd); cwdhit = 1 }
370 let abs: *u8 = sys_mmap(EVP_PATH_CAP)
371 let ao: i64 = evp_cat(abs, 0, EP_ROOT)
372 evp_cat(abs, ao, rel)
373 let rfd: i64 = sys_openat_rd(abs)
374 var roothit: i64 = 0
375 if rfd >= 0 { sys_close(rfd); roothit = 1 }
376 if cwdhit == 1 { if roothit == 1 {
377 let b2: *u8 = sys_mmap(cap)
378 let n1: i64 = evp_read(rel, buf, cap)
379 let n2: i64 = evp_read(abs, b2, cap)
380 var same: i64 = 0
381 if n1 == n2 { if n1 >= 0 {
382 same = 1
383 var i: i64 = 0
384 while i < n1 { if buf[i] != b2[i] { same = 0; i = n1 } else { i = i + 1 } }
385 } }
386 if same == 0 {
387 flags[EVP_FL_AMBIG] = 1
388 evp_cat(pathout, 0, rel)
389 return EVP_RC_AMBIGUOUS
390 }
391 } }
392
393 if ep_artifact_path(pathout, rel) == 0 { pathout[0] = 0 as u8; return EVP_RC_UNRESOLVED }
394 let n: i64 = evp_read(pathout, buf, cap)
395 if n < 0 { return EVP_RC_UNRESOLVED }
396 if n >= cap { flags[EVP_FL_BRIM] = 1 }
397 return n
398}
399
400// ---- PARSE. Every slot is -1 until a key proves otherwise. ----
401func evp_parse(buf: *u8, n: i64, f: *i64) -> i64 {
402 var i: i64 = 0
403 while i < EVP_NF { f[i] = 0 - 1; i = i + 1 }
404 if n <= 0 { f[EVP_F_V] = 0; return 0 }
405 let pr: *i64 = sys_mmap(16) as *i64
406 f[EVP_F_OK] = evp_num(buf, n, EVP_K_OK)
407 f[EVP_F_EPOCH] = evp_num(buf, n, EVP_K_EPOCH)
408 f[EVP_F_GROUNDED] = evp_num_pair(buf, n, EVP_K_GROUNDED, pr)
409 f[EVP_F_PRESENT] = pr[0]
410 f[EVP_F_GREEN] = evp_num_pair(buf, n, EVP_K_GATES, pr)
411 f[EVP_F_RAN] = pr[0]
412 f[EVP_F_SKIPPED] = evp_num(buf, n, EVP_K_SKIPPED)
413 f[EVP_F_DECLARED] = evp_num(buf, n, EVP_K_DECLARED)
414 f[EVP_F_HASHED] = evp_num(buf, n, EVP_K_HASHED)
415 f[EVP_F_REDSEEN] = evp_num(buf, n, EVP_K_REDSEEN)
416 f[EVP_F_UNGROUND] = evp_num(buf, n, EVP_K_UNGROUNDED)
417 f[EVP_F_ABSENT] = evp_num(buf, n, EVP_K_ABSENT)
418 f[EVP_F_ABSNAMED] = evp_num(buf, n, EVP_K_ABSNAMED)
419 f[EVP_F_ABSBARE] = evp_num(buf, n, EVP_K_ABSBARE)
420 f[EVP_F_LANDED] = evp_num(buf, n, EVP_K_LANDED)
421 f[EVP_F_VACUOUS] = evp_num(buf, n, EVP_K_VACUOUS)
422 f[EVP_F_MBYTES] = evp_num(buf, n, EVP_K_MBYTES)
423 f[EVP_F_MCAPPED] = evp_num(buf, n, EVP_K_MCAP)
424 f[EVP_F_WITHHELD] = evp_num(buf, n, EVP_K_WITHHELD)
425 f[EVP_F_WHREF] = evp_num(buf, n, EVP_K_WHREF)
426 let wb: *u8 = sys_mmap(EVP_WORD_CAP)
427 if evp_word(buf, n, EVP_K_MROOT, wb, EVP_WORD_CAP) >= 0 { f[EVP_F_MROOT] = evp_tree_of(wb) }
428 if evp_word(buf, n, EVP_K_GATESROOT, wb, EVP_WORD_CAP) >= 0 { f[EVP_F_GATESROOT] = evp_tree_of(wb) }
429 if evp_word(buf, n, EVP_K_CONJ, wb, EVP_WORD_CAP) == 4 {
430 f[EVP_F_CJ_G] = evp_upper(wb[0] as i64)
431 f[EVP_F_CJ_P] = evp_upper(wb[1] as i64)
432 f[EVP_F_CJ_Q] = evp_upper(wb[2] as i64)
433 f[EVP_F_CJ_N] = evp_upper(wb[3] as i64)
434 }
435 // THE VERSION IS DERIVED FROM THE WIRE, NOT DECLARED ON IT. A stamp written before the profile
436 // shipped carries none of these keys, and a reader that filled those slots with 0 would publish a
437 // gapless board for a domain it never measured.
438 f[EVP_F_V] = 1
439 if f[EVP_F_UNGROUND] >= 0 { f[EVP_F_V] = 2 }
440 if f[EVP_F_WITHHELD] >= 0 { f[EVP_F_V] = 3 }
441 // A v2 STAMP'S MISSING WITHHELD COUNT IS A DERIVED ZERO, NOT AN ASSUMED ONE, and that distinction is
442 // the whole of this comment. The withheld form is NEWER than every stamp on the estate, and its
443 // absence from the DATA was measured before this line was written: a literal-substring sweep for it
444 // over the published compare tree returned matches=0 bytes=1475761 files=568 coverage_complete=1
445 // corpus_complete=1. So a v2 board genuinely HAS zero withheld rows, and filling the slot states a
446 // fact instead of manufacturing one. A v1 stamp is deliberately LEFT AT -1 and keeps abstaining,
447 // because there the same zero would be a fabricated constant wearing the shape of a measurement.
448 // RE-RUN THAT CENSUS BEFORE EVER WIDENING THIS: the justification is the count, not the convenience.
449 if f[EVP_F_V] == 2 {
450 if f[EVP_F_WITHHELD] < 0 { f[EVP_F_WITHHELD] = 0 }
451 if f[EVP_F_WHREF] < 0 { f[EVP_F_WHREF] = 0 }
452 }
453 return 0
454}
455
456// ---- THE PARTITION INVARIANTS. Checkable from the row, so a leak cannot hide behind a total. ----
457// Returns 1 reconciles, 0 LEAKS, -1 not measurable (a v1 stamp). Three states, because a partition we
458// could not check and a partition that failed are different facts and only one of them is a defect.
459func evp_reconciles(f: *i64) -> i64 {
460 if f[EVP_F_V] < 2 { return 0 - 1 }
461 if f[EVP_F_PRESENT] < 0 { return 0 - 1 }
462 if f[EVP_F_GROUNDED] + f[EVP_F_UNGROUND] != f[EVP_F_PRESENT] { return 0 }
463 // THREE PARTS NOW, AND EVERY GAP ROW INCREMENTS EXACTLY ONE OF THEM. withheld_refused is deliberately
464 // NOT a fourth part: it OVERLAPS both withheld and absent_named, so folding it into this sum would
465 // silently break a reconciliation whose entire value is that it CAN fail. A NEW BUCKET THAT OVERLAPS
466 // AN EXISTING PARTITION MUST BE DECLARED A SEPARATE AXIS, and it is one.
467 if f[EVP_F_ABSNAMED] + f[EVP_F_ABSBARE] + f[EVP_F_WITHHELD] != f[EVP_F_ABSENT] { return 0 }
468 return 1
469}
470
471// ---- THE GAP BUCKETS. SEPARATE PREDICATES, NEVER ONE MERGED SCORE. ----
472// claim_only and gate_failing MUST NOT BE MERGED: one needs a gate WRITTEN, the other needs a gate
473// FIXED, and a single not-honest number sends a seat at the wrong work. A bucket named for how the
474// reader failed rather than for what the subject is merges a real failure with a healthy pass.
475func evp_claim_only(f: *i64) -> i64 { if f[EVP_F_RAN] == 0 { return 1 } return 0 }
476// A SKIP IS AN ABSTENTION AND MUST NEVER BE CONVICTED AS A FAILURE. The PRODUCER says so in its own
477// words: nx_swcompare_evidence's ev_gates initialises `ran[1] = 0 // gates that ABSTAINED (exit
478// EV_RC_SKIP): counted, never convicted`, and it then counts every skip INSIDE ran[0] while counting
479// none of them in green. So `green < ran` is ALSO true of a board whose every non-green gate merely
480// abstained, and this predicate convicted it.
481// MEASURED 2026-08-31 on the live smallos stamp: `gates=1/3 skipped=2 declared=3 ... conj=GPQN`
482// -- 1 green + 2 skipped + ZERO failing, and the referee's OWN conjunct string in that same stamp says
483// quorum HELD. The old arithmetic listed the board as failing anyway.
484// THE PRODUCER AND THE CONSUMER OF ONE ARTIFACT DISAGREED, AND THE CONSUMER WAS THE LOUD ONE.
485// The three states stay apart because they need three different actions: FIX the gate, READ why it
486// abstained, or GO LOOK because the stamp cannot say which.
487func evp_gate_failing_n(f: *i64) -> i64 {
488 if f[EVP_F_RAN] <= 0 { return 0 - 1 }
489 if f[EVP_F_GREEN] < 0 { return 0 - 1 }
490 if f[EVP_F_SKIPPED] < 0 { return 0 - 1 }
491 return f[EVP_F_RAN] - f[EVP_F_GREEN] - f[EVP_F_SKIPPED]
492}
493func evp_gate_failing(f: *i64) -> i64 { if evp_gate_failing_n(f) > 0 { return 1 } return 0 }
494func evp_gate_skipped(f: *i64) -> i64 { if f[EVP_F_SKIPPED] > 0 { return 1 } return 0 }
495// THE THIRD STATE, AND IT IS NOT DECORATION. ` skipped=` is written UNCONDITIONALLY by the current
496// referee (outside its ev_p_v2 guard), so this fires only for a stamp written before that field
497// existed. Reading such a stamp as not-failing would ACQUIT on a measurement that never happened;
498// reading it as failing is the defect above. A gate outcome the stamp cannot resolve is its OWN
499// bucket. I COULD NOT LOOK IS NOT IT IS FINE.
500func evp_gate_unknown(f: *i64) -> i64 {
501 if f[EVP_F_RAN] <= 0 { return 0 }
502 if f[EVP_F_SKIPPED] >= 0 { return 0 }
503 if f[EVP_F_GREEN] < f[EVP_F_RAN] { return 1 }
504 return 0
505}
506// THE GATE PARTITION: green + skipped + failing == ran. It is closed BY CONSTRUCTION because failing
507// is derived as the remainder, so the only falsifiable content here is that the remainder is NOT
508// NEGATIVE -- that green and skipped do not together exceed ran.
509// THAT IMPRECISION IS STATED RATHER THAN LEFT FOR THE NEXT READER TO DISCOVER, because a guard whose
510// limits are undocumented gets trusted as exact. It still catches a hand-written or corrupted stamp,
511// which is exactly the class the evpleak fixture already exists for.
512// Returns 1 reconciles, 0 LEAKS, -1 not measurable.
513// DELIBERATELY NOT ROUTED THROUGH evp_gate_failing_n. That helper returns -1 as its NOT-MEASURABLE
514// sentinel, and -1 is ALSO a legitimate remainder (green+skipped exactly one MORE than ran), so a
515// reconcile built on it would report a real LEAK as "I could not measure" -- a negative answer that
516// cannot say which negative it is, which is the very defect this whole change exists to remove.
517// Reading the three fields directly keeps the two negatives distinguishable.
518func evp_gates_reconcile(f: *i64) -> i64 {
519 if f[EVP_F_RAN] < 0 { return 0 - 1 }
520 if f[EVP_F_RAN] == 0 { return 1 }
521 if f[EVP_F_GREEN] < 0 { return 0 - 1 }
522 if f[EVP_F_SKIPPED] < 0 { return 0 - 1 }
523 if f[EVP_F_GREEN] + f[EVP_F_SKIPPED] > f[EVP_F_RAN] { return 0 }
524 return 1
525}
526
527// UNGROUNDED, NOT "FABRICATED". This measures exactly ONE thing: the stamp says a published axis
528// claims a symbol the referee could not find in the organ that the row ITSELF NAMES. Every instance
529// adjudicated on 2026-08-31 was a STALE POINTER -- a symbol that had moved into a shared lib, or a row
530// naming the CALLER instead of the DEFINER -- and not one was invented evidence.
531// NAME A BUCKET FOR WHAT WAS MEASURED, NEVER FOR THE STORY YOU IMAGINE BEHIND IT. "fabricated"
532// accuses a seat of fraud for a broken pointer, and it sends the next reader to audit a PERSON when
533// the work is to repoint a ROW.
534// The estate had ALREADY converged on the honest name and only this predicate dissented: both other
535// consumers -- nx_swcompare_matrix and nx_swcompare_lib -- render it as "UNSUPPORTED-CLAIM", and
536// nx_pm_board's own totals object already emits the identical quantity as "ungrounded_claims".
537func evp_ungrounded_claim(f: *i64) -> i64 { if f[EVP_F_UNGROUND] > 0 { return 1 } return 0 }
538// DEPRECATED ALIAS, KEPT SO THE RENAME IS ADDITIVE (rule 19): nx_swcompare_matrix and nx_swcompare_lib
539// call this name and are owned by another lane. It DELEGATES rather than repeating the comparison, so
540// there is exactly ONE copy of the arithmetic and the two can never drift apart. Retire it only when a
541// census proves no caller remains.
542func evp_fabricated(f: *i64) -> i64 { return evp_ungrounded_claim(f) }
543func evp_flip_ready(f: *i64) -> i64 { if f[EVP_F_LANDED] > 0 { return 1 } return 0 }
544func evp_unnamed_gap(f: *i64) -> i64 { if f[EVP_F_ABSBARE] > 0 { return 1 } return 0 }
545// ---- THE WITHHELD-PROOF CLASS: A THIRD ANSWER THE BOARD COULD NOT PREVIOUSLY GIVE (2026-09-01) ----
546// Before this, a row had exactly two ways to speak: claim the capability, or declare it absent. A row
547// whose MECHANISM shipped and is gate-proven, but whose CLAIM rests on a precondition nobody has met,
548// could only lie in one direction or the other -- so an honest retraction had to be written as a FALSE
549// ABSENCE, which the referee then resolved, FOUND, and filed as LANDED. THE RETRACTION UNDID ITSELF,
550// and the board went on telling the next seat that those very rows were the cheapest flips available.
551// A withheld row is an OPEN GAP: counted in absent, NOT present, NOT grounded, NOT landed, so it can
552// never fire FLIP-READY. And it is deliberately COSTLY -- adopting the form LOWERS a board's present
553// count and RAISES its open gaps -- which is the real reason it cannot hide anything: THERE IS NO
554// DIRECTION IN WHICH RELABELLING A ROW WITHHELD MAKES A BOARD LOOK BETTER.
555func evp_withheld(f: *i64) -> i64 { if f[EVP_F_WITHHELD] > 0 { return 1 } return 0 }
556// THE ANTI-GAMING AXIS, AND THE REASON THE FORM IS NOT A SILENCE BUTTON. A row may claim withheld proof
557// only while a reader can SEE that its precondition is unmet: the referee opens the named path itself,
558// and if that path holds data the excuse has expired and the row is REFUSED here instead of quietly
559// honoured. A SEPARATE AXIS, not a partition member -- it overlaps both withheld and absent_named.
560func evp_withheld_refused(f: *i64) -> i64 { if f[EVP_F_WHREF] > 0 { return 1 } return 0 }
561func evp_vacuous_gate(f: *i64) -> i64 { if f[EVP_F_VACUOUS] > 0 { return 1 } return 0 }
562
563// STALE is a THIRD STATE, not a failure: a stamp older than the policy TTL is evidence about a build
564// nobody can vouch for now. A NEGATIVE age (a future stamp, i.e. clock skew) is equally unusable and is
565// reported as stale rather than as fresh -- being wrong in the direction of refusing is the safe way.
566func evp_stale(f: *i64, now: i64, ttl: i64) -> i64 {
567 if f[EVP_F_EPOCH] <= 0 { return 1 }
568 if now < f[EVP_F_EPOCH] { return 1 }
569 if now - f[EVP_F_EPOCH] > ttl { return 1 }
570 return 0
571}
572
573// ONE POLICY, EVERY CONSUMER (rule 17) -- the same conf nx_swcompare_evidence's own TTL reads.
574func evp_ttl_sec() -> i64 {
575 let b: *u8 = sys_mmap(EVP_CONF_CAP)
576 let p: *u8 = sys_mmap(EVP_PATH_CAP)
577 if ep_artifact_path(p, "knowledge/evidence_policy.conf" as *u8) == 0 { return EVP_TTL_DEFAULT }
578 let n: i64 = evp_read(p, b, EVP_CONF_CAP - 1)
579 if n <= 0 { return EVP_TTL_DEFAULT }
580 let v: i64 = evp_num(b, n, "ttl_sec=" as *u8)
581 if v <= 0 { return EVP_TTL_DEFAULT }
582 return v
583}