nx_forkcensus.nx source

1// nx_forkcensus.nx -- WHICH FORKED BINARIES DO NOT EXIST? A census of every "<path>.elf" string 2// literal in a source tree, RESOLVED against the filesystem and classified by DURABILITY. 3// 4// THE MEASURED PROBLEM (debt 1786073817). _timer_irq_gate forked "/tmp/nx_timer_irq_emit.sov.elf" -- 5// the VOLATILE build-time twin -- while every other fork in the SAME FILE already used _offc/. /tmp is 6// cleared on idle, so the moment that happened the gate printed reason=emit-failed forever and indicted 7// the KERNEL for a missing temp file. The emitter was never broken: run directly it still wrote its 8// image (84 B, golden=BT). Repointing that ONE literal flipped the gate RED -> GREEN 2/2. 9// 10// A grep then found 490 such literals over 255 files, 151 of them gates -- and nobody knew how many were 11// DEAD, because a grep can find the string but only the filesystem can say whether the target exists. 12// A GREP FINDS THE CLAIM; ONLY A STAT SETTLES IT. 13// 14// Classes, in the order that matters for repair: 15// VOLATILE-MISSING under /tmp/, absent NOW -- dead, silently. THE ACTIONABLE SET. 16// DURABLE-MISSING under _offc/ or the root, absent -- dead, loudly (exit 127 = NOT-FOUND). 17// VOLATILE-PRESENT under /tmp/, present NOW -- ALIVE ONLY UNTIL THE NEXT /tmp SWEEP. 18// DURABLE-PRESENT durable path, present -- correct. 19// VOLATILE-PRESENT is not a pass. It is the same defect between cleanups, and reporting it as healthy 20// is how this class stayed invisible: every one of the 151 looked fine on the day it was written. 21// 22// usage: nx_forkcensus [dir] [mode] 23// dir default buildroot/runtime/_hdl_build 24// mode dead (default, prints the two MISSING classes) | all | summary | repairable | subjects 25// exit 0 ALL-RESOLVABLE · 1 MISSING (a durable subject is absent from the CWD and from every deploy 26// root in knowledge/forkcensus_roots.conf, and not in knowledge/forkcensus_allow.conf) · 27// 3 UNPROVEN (unsound arithmetic / cap hit / nothing scanned) 28// `subjects` prints the deduped remedy worklist: ALLOWED | REPAIR-OFFC-INSTALL | PRESENT-OTHER-ROOT | 29// BUILD | PHANTOM | ALT-SPELLING -- the last line is always the verdict (positional anchor). 30// KNOWN IMPRECISION (stated, not hidden): a caller that probes SEVERAL candidate paths in order 31// registers every non-winning candidate as a dead literal; the subject then prints as 32// ALT-SPELLING (binary present) or PRESENT-OTHER-ROOT, never as clean. Read the caller. 33// SHIP-PROOF 2026-08-07: this line was added solely to prove /api/ship moves the LIVE artefact in one 34// call. staged==live proves nothing when the source is unchanged -- the binary must actually change. 35// license_tier: ORIGINAL expect_exit: 0 36import "nx_syscalls.nx" 37const FC_MAGIC_4096: i64 = 4096 38const FC_MAGIC_1048576: i64 = 1048576 39 40const FC_STDOUT: i64 = 1 41const FC_DIRBUF: i64 = 1048640 42const FC_PATHCAP: i64 = 1024 43const FC_MAXROWS: i64 = 400 44const FC_BACKSCAN: i64 = 512 45 46// counter slots 47const FC_FILES: i64 = 0 48const FC_LITS: i64 = 1 49const FC_VOL: i64 = 2 50const FC_VOLMISS: i64 = 3 51const FC_OFFC: i64 = 4 52const FC_OFFCMISS: i64 = 5 53const FC_OTHER: i64 = 6 54const FC_OTHERMISS: i64 = 7 55const FC_ROWS: i64 = 8 56const FC_SUPPRESSED: i64 = 9 57const FC_COMMENTS: i64 = 10 58const FC_FRAG: i64 = 11 59const FC_BARE: i64 = 12 60const FC_REPAIR: i64 = 13 61const FC_NOREPAIR: i64 = 14 62// VOLATILE repairability (2026-08-14). The _offc class has always been split into "one command away" 63// versus "needs a build", because KNOWING WHICH HALF OF A BACKLOG IS ONE COMMAND AWAY IS THE DIFFERENCE 64// BETWEEN A SWEEP AND A PROJECT -- but the VOLATILE class, which is the LARGEST and the one this organ's 65// header calls THE ACTIONABLE SET, got no such split. 610 of 619 missing was therefore a BOUND, not a 66// worklist: nothing said how many were one repoint away from a binary that already exists. 67const FC_VOLREPOINT: i64 = 15 68const FC_VOLNOREPOINT: i64 = 16 69// DISTINCT-SUBJECT COUNTING (2026-08-14). ★★★★★★A REFERENCE COUNT IS NOT A WORK COUNT: 31 dead _offc 70// references collapsed to FOUR distinct binaries earlier today, so "156 missing" sizes a project while 71// the number of things to actually BUILD may be an order of magnitude smaller. A FAILURE SET THAT 72// PARTITIONS ALONG ONE DEPENDENCY IS ONE ROOT CAUSE WEARING N MASKS, and reporting only the masks makes 73// a tractable job look impossible. Carried in spare ctr slots so fc_scan's signature -- and every 74// caller -- stays untouched. 75const FC_NAMESET: i64 = 17 76const FC_NAMEN: i64 = 18 77const FC_NAMEOVER: i64 = 19 78// Of the DISTINCT missing subjects, how many have NishiLang source? ★★★★★★"71 THINGS TO BUILD" IS STILL 79// NOT A DECISION: a subject WITH source is a build (mechanical, do it); a subject with NO source anywhere 80// is a fork target that CANNOT EVER BE BUILT -- a phantom reference whose remedy is to fix or delete the 81// CALLER, which is the opposite action. Reporting them as one number hides an unbuildable set inside a 82// build queue and guarantees the campaign stalls on rows nobody can finish. 83const FC_NAMEBUILDABLE: i64 = 20 84const FC_NSLOTS: i64 = 22 85const FC_DISTINCT_MAX: i64 = 1024 86const FC_NAMEW: i64 = 96 87 88func fc_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(FC_STDOUT, s, n); return 0 } 89 90func fc_n(v: i64) -> i64 { 91 let bb: *u8 = sys_mmap(32) 92 var m: i64 = v 93 if m < 0 { m = 0 - m; sys_write(FC_STDOUT, "-" as *u8, 1) } 94 let t: *u8 = sys_mmap(32) 95 var k: i64 = 0 96 if m == 0 { t[0] = 48 as u8; k = 1 } 97 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 98 var i: i64 = 0 99 while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 100 sys_write(FC_STDOUT, bb, k) 101 return 0 102} 103 104func fc_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 105 106func fc_starts(s: *u8, pre: *u8) -> i64 { 107 var i: i64 = 0 108 while pre[i] != (0 as u8) { 109 if s[i] != pre[i] { return 0 } 110 i = i + 1 111 } 112 return 1 113} 114 115// 1 if the path resolves to something we can open, 0 otherwise. THE WHOLE POINT: a literal is a claim, 116// this is the only thing that settles it. 117func fc_exists(p: *u8) -> i64 { 118 let fd: i64 = sys_openat_rd(p) 119 if fd < 0 { return 0 } 120 sys_close(fd) 121 return 1 122} 123 124// THE OTHER DEPLOY ROOTS (2026-08-19). A relative fork path resolves against the CALLER's CWD, and the 125// estate has several: the serving root (this organ's CWD, nishihost/), buildroot/ (nx_sov_build_run and the 126// toolchain lane), and the bundle dirs daemons `cd` into before exec (the galx and torrent families live 127// under /volume1/ai/<family>/ and fork "./nx_x.elf" siblings). A literal MISSING here and PRESENT in one of 128// those is not a phantom and not a build -- it is deployed where its caller looks (nx_cc_sovereign.elf: 129// absent from nishihost/_offc, live in buildroot/_offc; nx_gallery_serve.elf: live in /volume1/ai/galx). 130// The roots are DATA -- FC_ROOTS, one directory per line, '#' comments -- never a list baked in here: 131// the day a new bundle dir appears the conf grows one line and this organ is unchanged. An absent conf 132// means only the CWD is probed, and the summary SAYS so. Returns 1 if `path` (leading "./" stripped; 133// absolute paths are probed as given, once) exists under any listed root. 134const FC_ROOTS: *u8 = "knowledge/forkcensus_roots.conf" 135func fc_other_root(path: *u8, rb: *u8, rn: i64) -> i64 { 136 if (rb as i64) == 0 { return 0 } 137 if path[0] == (47 as u8) { return 0 } // absolute: the CWD probe already settled it 138 let p: *u8 = sys_mmap(FC_PATHCAP) 139 var found: i64 = 0 140 var q: i64 = 0 141 while q < rn { 142 var e: i64 = q 143 while e < rn { if rb[e] == (10 as u8) { break } e = e + 1 } 144 if e > q { if rb[q] != (35 as u8) { if found == 0 { 145 var o: i64 = 0 146 var i: i64 = q 147 while i < e { if o < FC_PATHCAP - 1 { p[o] = rb[i]; o = o + 1 } i = i + 1 } 148 if o > 0 { if p[o-1] != (47 as u8) { p[o] = 47 as u8; o = o + 1 } } 149 i = 0 150 if path[0] == (46 as u8) { if path[1] == (47 as u8) { i = 2 } } 151 while path[i] != (0 as u8) { if o < FC_PATHCAP - 1 { p[o] = path[i]; o = o + 1 } i = i + 1 } 152 p[o] = 0 as u8 153 if fc_exists(p) == 1 { found = 1 } 154 } } } 155 q = e + 1 156 } 157 sys_munmap(p, FC_PATHCAP) 158 return found 159} 160 161// DELIBERATELY-ABSENT SUBJECTS ARE DATA, NOT CODE (2026-08-19). nx_offc_install's own fixtures 162// (_oitest…), the negative controls a gate forks to prove its refusal path (__definitely_not_a_real_organ__, 163// nx_no_such_tool), the "source alpha content" build-cache fixture x -- all are CORRECT to be missing, 164// and a census that counts them is permanently RED, which is the detector everyone learns to ignore. 165// They are listed, one bare subject per line, in FC_ALLOW (# comments allowed); a subject on the list is 166// counted ALLOWED and excluded from the MISSING verdict, and the list is PRINTED so a reader can audit it. 167// An absent list means NOTHING is allowed -- fail toward counting, announced. 168const FC_ALLOW: *u8 = "knowledge/forkcensus_allow.conf" 169func fc_allowed(name: *u8, ab: *u8, an: i64) -> i64 { 170 if (ab as i64) == 0 { return 0 } 171 var p: i64 = 0 172 while p < an { 173 var e: i64 = p 174 while e < an { if ab[e] == (10 as u8) { break } e = e + 1 } 175 if e > p { if ab[p] != (35 as u8) { 176 var k: i64 = 0 177 var same: i64 = 1 178 while same == 1 { 179 if p + k >= e { if name[k] != (0 as u8) { same = 0 } break } 180 if name[k] == (0 as u8) { same = 0; break } 181 if ab[p + k] != name[k] { same = 0; break } 182 k = k + 1 183 } 184 if same == 1 { return 1 } 185 } } 186 p = e + 1 187 } 188 return 0 189} 190 191 192// Is the literal that closes at index `q` sitting on a // comment line? A path named in a comment is 193// documentation, not a fork, and counting it would inflate every number this organ prints. 194func fc_in_comment(buf: *u8, q: i64) -> i64 { 195 var ls: i64 = q 196 var st: i64 = 0 197 while st < FC_MAGIC_4096 { 198 if ls <= 0 { st = FC_MAGIC_4096 } 199 if ls > 0 { 200 if buf[ls - 1] == (10 as u8) { st = FC_MAGIC_4096 } 201 if buf[ls - 1] != (10 as u8) { ls = ls - 1; st = st + 1 } 202 } 203 } 204 var k: i64 = ls 205 var scanning: i64 = 1 206 while scanning == 1 { 207 if k >= q { scanning = 0 } 208 if k < q { 209 var isws: i64 = 0 210 if buf[k] == (32 as u8) { isws = 1 } 211 if buf[k] == (9 as u8) { isws = 1 } 212 if isws == 1 { k = k + 1 } 213 if isws == 0 { scanning = 0 } 214 } 215 } 216 if k + 1 < q { if buf[k] == (47 as u8) { if buf[k + 1] == (47 as u8) { return 1 } } } 217 return 0 218} 219 220// Walk back from the closing quote to the opening one. Bounded: a literal longer than FC_BACKSCAN is 221// not a path, and an unbounded backscan on a 2 MB buffer is how a census turns into a hang. 222func fc_open_quote(buf: *u8, i: i64) -> i64 { 223 var j: i64 = i - 1 224 var open: i64 = 0 - 1 225 var steps: i64 = 0 226 while steps < FC_BACKSCAN { 227 if j < 0 { steps = FC_BACKSCAN } 228 if j >= 0 { 229 if buf[j] == (34 as u8) { open = j; steps = FC_BACKSCAN } 230 if buf[j] != (34 as u8) { j = j - 1; steps = steps + 1 } 231 } 232 } 233 return open 234} 235 236// FIRST MEASUREMENT SAID root-missing=291, AND IT WAS WRONG. The rows showed literals like ".elf" and 237// ".sov.elf" -- SUFFIX FRAGMENTS used to build a filename by concatenation -- being resolved as paths 238// and scored MISSING. A bare "nx_foo.elf" with no slash is likewise a registry VALUE, not a fork target. 239// Counting either as a dead fork inflates the only number anyone would act on. 240// A STRING THAT ENDS IN .elf IS NOT THEREBY A PATH: A FORK TARGET HAS A DIRECTORY. 241// Both are still COUNTED, in their own classes, so the partition keeps summing to the literal total -- 242// dropping them silently would trade a precision bug for an accounting one. 243func fc_classify(path: *u8) -> i64 { 244 // "./<name>.elf" IS A FORK PATH (relative to the caller's CWD), NOT a suffix fragment. The 2026-08-07 245 // fleet sweep found 14 of 77 such targets missing (the whole book/reader pipeline among them) and this 246 // classifier was filing every "./" literal under suffix_fragments -- the exact class the census exists 247 // for was invisible to it. A leading dot with NO slash after it (".elf", ".sov.elf") stays a fragment. 248 if path[0] == (46 as u8) { if path[1] == (47 as u8) { return 3 } return 4 } 249 if fc_starts(path, "/tmp/" as *u8) == 1 { return 1 } 250 // BUILD AND PUBLISH STAGING DIRS ARE VOLATILE BY CONTRACT, exactly like /tmp: `_build/<n>.sov.elf` is 251 // the compiler's drop (consumed by stage/promote; nx_beingctl's bc_pick names it as the FALLBACK 252 // behind ./<n>.elf) and `knowledge/publish/staging/<n>.elf` is the publisher's in-flight copy 253 // (nx_publish_opaque_login / nx_publish_banner name it as the SOURCE of a promote). Both exist only 254 // mid-pipeline. Scoring them DURABLE-MISSING kept nine already-installed subjects on the repair list. 255 if fc_starts(path, "_build/" as *u8) == 1 { return 1 } 256 if fc_starts(path, "knowledge/publish/staging/" as *u8) == 1 { return 1 } 257 if fc_starts(path, "_offc/" as *u8) == 1 { return 2 } 258 var slash: i64 = 0 259 var i: i64 = 0 260 while path[i] != (0 as u8) { 261 if path[i] == (47 as u8) { slash = slash + 1 } 262 i = i + 1 263 } 264 if slash == 0 { return 5 } 265 // "/name.elf" -- ONE slash and it is the first byte -- is a JOIN SUFFIX (`d_path(self_dir, "/nx_x.elf")` 266 // in the torrent daemon, me_join in nx_media_env), never a fork at the filesystem root. Scoring it 267 // MISSING put the whole media bundle (nx_video_get, nx_hls_get, nx_ts2fmp4 ...) on the BUILD worklist 268 // when every one of them is deployed as a SIBLING under its daemon's own dir. 269 if slash == 1 { if path[0] == (47 as u8) { return 4 } } 270 return 3 271} 272 273// A missing _offc/<n>.elf is REPAIRABLE when the promoted <n>.elf is sitting in the serving root: that 274// is precisely the case nx_offc_install now covers, since it learned to source from the promoted 275// artifact. Anything else needs a BUILD first, which is a different and much larger job -- so counting 276// the two together would size the sweep wrong in the expensive direction. 277// KNOWING WHICH HALF OF A BACKLOG IS ONE COMMAND AWAY IS THE DIFFERENCE BETWEEN A SWEEP AND A PROJECT. 278func fc_rootname(path: *u8, out: *u8) -> i64 { 279 var i: i64 = 6 280 var o: i64 = 0 281 while path[i] != (0 as u8) { out[o] = path[i]; o = o + 1; i = i + 1 } 282 out[o] = 0 as u8 283 return o 284} 285 286// The DURABLE TWIN of a VOLATILE literal. TWO transforms, and the second one is what decides whether 287// this census is a worklist or a false-positive generator: 288// 1. strip the "/tmp/" prefix (5 bytes) 289// 2. collapse the BUILD-ARTIFACT suffix ".sov.elf" -> ".elf" 290// A build writes <name>.sov.elf; /api/promote installs <name>.elf. So a naive basename strip (which is 291// all fc_rootname does, and correctly, because _offc/ holds the PROMOTED spelling) would go looking for 292// a file the estate never creates and report EVERY volatile literal as unrepairable -- a confident, 293// uniform, completely wrong answer. ★THE TWO PATHS SPELL THE SAME BINARY DIFFERENTLY, AND A RESOLVER 294// THAT DOES NOT KNOW THAT MEASURES THE SPELLING INSTEAD OF THE FILE. 295func fc_durablename(path: *u8, out: *u8) -> i64 { 296 // strip the volatile DIRECTORY, whatever it is ("/tmp/", "_build/", "knowledge/publish/staging/"): 297 // the twin name is the basename. A fixed 5-byte strip here assumed "/tmp/" and would have produced 298 // "d/x.elf" for a `_build/` literal -- a twin that can never exist, silently inflating no-twin. 299 var i: i64 = 0 300 var last: i64 = 0 301 while path[i] != (0 as u8) { if path[i] == (47 as u8) { last = i + 1 } i = i + 1 } 302 i = last 303 var o: i64 = 0 304 while path[i] != (0 as u8) { out[o] = path[i]; o = o + 1; i = i + 1 } 305 out[o] = 0 as u8 306 if o >= 8 { 307 var sov: i64 = 1 308 if out[o-8] != (46 as u8) { sov = 0 } 309 if out[o-7] != (115 as u8) { sov = 0 } 310 if out[o-6] != (111 as u8) { sov = 0 } 311 if out[o-5] != (118 as u8) { sov = 0 } 312 if out[o-4] != (46 as u8) { sov = 0 } 313 if out[o-3] != (101 as u8) { sov = 0 } 314 if out[o-2] != (108 as u8) { sov = 0 } 315 if out[o-1] != (102 as u8) { sov = 0 } 316 if sov == 1 { 317 out[o-8] = 46 as u8 318 out[o-7] = 101 as u8 319 out[o-6] = 108 as u8 320 out[o-5] = 102 as u8 321 out[o-4] = 0 as u8 322 o = o - 4 323 } 324 } 325 return o 326} 327 328// Prefix a bare durable name with "_offc/" so both homes can be probed: a volatile literal is 329// REPOINTABLE if the binary exists at the serving root OR under _offc/, because either target makes the 330// repoint land. Reporting only the root would understate the worklist. 331func fc_offcname(name: *u8, out: *u8) -> i64 { 332 let p: *u8 = "_offc/" as *u8 333 var o: i64 = 0 334 while p[o] != (0 as u8) { out[o] = p[o]; o = o + 1 } 335 var i: i64 = 0 336 while name[i] != (0 as u8) { out[o] = name[i]; o = o + 1; i = i + 1 } 337 out[o] = 0 as u8 338 return o 339} 340 341func fc_row(src: *u8, path: *u8, cls: i64, present: i64) -> i64 { 342 fc_p(" " as *u8) 343 if cls == 1 { fc_p("VOLATILE" as *u8) } 344 if cls == 2 { fc_p("DURABLE-OFFC" as *u8) } 345 if cls == 3 { fc_p("DURABLE-ROOT" as *u8) } 346 if present == 1 { fc_p("-PRESENT " as *u8) } 347 if present == 0 { fc_p("-MISSING " as *u8) } 348 fc_p(path) 349 fc_p(" <- " as *u8) 350 fc_p(src) 351 fc_p("\n" as *u8) 352 return 0 353} 354 355// Scan ONE source file for "<...>.elf" literals; count and (per mode) print them. 356func fc_streq(a: *u8, b: *u8) -> i64 { 357 var i: i64 = 0 358 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 359 if b[i] != (0 as u8) { return 0 } 360 return 1 361} 362 363// The bare organ name behind a fork path: drop the directory, then strip a trailing ".elf" and then a 364// trailing ".sov", so _offc/nx_foo.elf, /tmp/nx_foo.sov.elf and nx_foo.elf all reduce to nx_foo -- which 365// is what makes them COMPARABLE as subjects rather than as spellings. 366func fc_basename(path: *u8, out: *u8, cap: i64) -> i64 { 367 var l: i64 = 0 368 while path[l] != (0 as u8) { l = l + 1 } 369 var s: i64 = 0 370 var i: i64 = 0 371 while i < l { if path[i] == (47 as u8) { s = i + 1 } i = i + 1 } 372 var o: i64 = 0 373 i = s 374 while i < l { if o < cap - 1 { out[o] = path[i]; o = o + 1 } i = i + 1 } 375 out[o] = 0 as u8 376 if o >= 4 { if out[o-4] == (46 as u8) { if out[o-3] == (101 as u8) { if out[o-2] == (108 as u8) { if out[o-1] == (102 as u8) { o = o - 4; out[o] = 0 as u8 } } } } } 377 if o >= 4 { if out[o-4] == (46 as u8) { if out[o-3] == (115 as u8) { if out[o-2] == (111 as u8) { if out[o-1] == (118 as u8) { o = o - 4; out[o] = 0 as u8 } } } } } 378 return o 379} 380 381// Does NishiLang source exist for this subject? Probed in the SAME order the builder resolves 382// (_hdl_build first, then runtime), so this reports on the file that would actually compile. 383func fc_src_exists(name: *u8) -> i64 { 384 let p: *u8 = sys_mmap(FC_PATHCAP) 385 let e: *u8 = ".nx" as *u8 386 var o: i64 = 0 387 var i: i64 = 0 388 let a: *u8 = "buildroot/runtime/_hdl_build/" as *u8 389 while a[i] != (0 as u8) { p[o] = a[i]; o = o + 1; i = i + 1 } 390 i = 0 391 while name[i] != (0 as u8) { p[o] = name[i]; o = o + 1; i = i + 1 } 392 i = 0 393 while e[i] != (0 as u8) { p[o] = e[i]; o = o + 1; i = i + 1 } 394 p[o] = 0 as u8 395 if fc_exists(p) == 1 { sys_munmap(p, FC_PATHCAP); return 1 } 396 o = 0 397 i = 0 398 let b: *u8 = "buildroot/runtime/" as *u8 399 while b[i] != (0 as u8) { p[o] = b[i]; o = o + 1; i = i + 1 } 400 i = 0 401 while name[i] != (0 as u8) { p[o] = name[i]; o = o + 1; i = i + 1 } 402 i = 0 403 while e[i] != (0 as u8) { p[o] = e[i]; o = o + 1; i = i + 1 } 404 p[o] = 0 as u8 405 let r: i64 = fc_exists(p) 406 sys_munmap(p, FC_PATHCAP) 407 return r 408} 409 410// Append nm to the distinct set if absent. 1 = newly added, 0 = already present or refused. 411// ★NO SILENT CAP: exceeding FC_DISTINCT_MAX sets an overflow flag that the summary PRINTS, because a 412// distinct-count that quietly stopped counting is a smaller number that reads like better news. 413func fc_addname(ctr: *i64, nm: *u8) -> i64 { 414 let base: i64 = ctr[FC_NAMESET] 415 if base == 0 { return 0 } 416 let cnt: i64 = ctr[FC_NAMEN] 417 var i: i64 = 0 418 while i < cnt { 419 let e: *u8 = (base + i * FC_NAMEW) as *u8 420 if fc_streq(e, nm) == 1 { return 0 } 421 i = i + 1 422 } 423 if cnt >= FC_DISTINCT_MAX { ctr[FC_NAMEOVER] = 1; return 0 } 424 let d: *u8 = (base + cnt * FC_NAMEW) as *u8 425 var j: i64 = 0 426 while nm[j] != (0 as u8) { d[j] = nm[j]; j = j + 1 } 427 d[j] = 0 as u8 428 ctr[FC_NAMEN] = cnt + 1 429 // Stat ONCE PER SUBJECT, not per reference -- the whole point of deduping first. 430 if fc_src_exists(nm) == 1 { ctr[FC_NAMEBUILDABLE] = ctr[FC_NAMEBUILDABLE] + 1 } 431 return 1 432} 433 434// One subject's REMEDY, decided from the filesystem at print time (a few stats per subject; subjects are 435// deduped, so this is cheap). Order matters: a binary anywhere beats "build", and "build" beats "phantom", 436// because the cheapest TRUE remedy is the one to print. 437// 1 REPAIR-OFFC-INSTALL <n>.elf promoted at the serving root, _offc mirror absent -> nx_offc_install <n> promoted 438// 2 PRESENT-OTHER-ROOT present under a declared deploy root (FC_ROOTS) -- deployed where ITS caller 439// looks; a nishihost-CWD caller of the same literal still needs an install 440// 3 BUILD NishiLang source exists, no binary in any declared root 441// 4 PHANTOM no source anywhere -- fix or delete the CALLER 442// 5 ALT-SPELLING <n>.elf AND _offc/<n>.elf both present here, yet some literal naming this subject 443// is dead: a non-winning candidate of a multi-path resolver ("../<n>.elf", 444// "./_offc/<n>.elf" + "./<n>.elf" probed in order -- nx_closurehash_gate), or a 445// path-policy fixture ("runtime/nx_regdup.elf" in nx_retire_path's refusal test). 446// Nothing to install; read the caller. Printed, not in the verdict. 447func fc_remedy(name: *u8, rb: *u8, rn: i64) -> i64 { 448 let p: *u8 = sys_mmap(FC_PATHCAP) 449 var o: i64 = 0 450 var i: i64 = 0 451 while name[i] != (0 as u8) { p[o] = name[i]; o = o + 1; i = i + 1 } 452 let e: *u8 = ".elf" as *u8 453 i = 0 454 while e[i] != (0 as u8) { p[o] = e[i]; o = o + 1; i = i + 1 } 455 p[o] = 0 as u8 456 var r: i64 = 4 457 if fc_exists(p) == 1 { 458 r = 1 459 let q1: *u8 = sys_mmap(FC_PATHCAP) 460 fc_offcname(p, q1) 461 if fc_exists(q1) == 1 { r = 5 } 462 sys_munmap(q1, FC_PATHCAP) 463 } else { 464 if fc_other_root(p, rb, rn) == 1 { r = 2 } else { 465 let q: *u8 = sys_mmap(FC_PATHCAP) 466 fc_offcname(p, q) 467 if fc_other_root(q, rb, rn) == 1 { r = 2 } else { 468 if fc_src_exists(name) == 1 { r = 3 } 469 } 470 sys_munmap(q, FC_PATHCAP) 471 } 472 } 473 sys_munmap(p, FC_PATHCAP) 474 return r 475} 476 477// Append ONE trend row: epoch TAB dir TAB distinct TAB allowed TAB install TAB other TAB build TAB 478// phantom TAB alt TAB dead TAB files. Returns 0 appended / -1 budget refused / -2 unwritable. 479const FC_LOG: *u8 = "knowledge/status/forkcensus.log" 480const FC_LOG_CAP: i64 = 1048576 // the procchurn.jrnl status-journal budget, reused not invented 481func fc_num_at(b: *u8, off: i64, v: i64) -> i64 { 482 var o: i64 = off 483 var x: i64 = v 484 if x < 0 { b[o] = 45 as u8; o = o + 1; x = 0 - x } 485 let t: *u8 = sys_mmap(24) 486 var k: i64 = 0 487 if x == 0 { t[0] = 48 as u8; k = 1 } 488 while x > 0 { t[k] = (48 + (x % 10)) as u8; x = x / 10; k = k + 1 } 489 var i: i64 = 0 490 while i < k { b[o] = t[k-1-i]; o = o + 1; i = i + 1 } 491 sys_munmap(t, 24) 492 return o 493} 494func fc_receipt(dir: *u8, ctr: *i64, allowed: i64, inst: i64, other: i64, build: i64, phantom: i64, alt: i64) -> i64 { 495 let ll: *i64 = sys_mmap(16) as *i64 496 let lb: *u8 = sys_read_file(FC_LOG, ll) 497 var cur: i64 = 0 498 if (lb as i64) != 0 { cur = ll[0]; sys_free_file(lb, ll[0]) } 499 if cur > FC_LOG_CAP { 500 fc_p(" RECEIPT-REFUSED: " as *u8); fc_p(FC_LOG); fc_p(" exceeds its budget -- archive it deliberately; the verdict below is unaffected\n" as *u8) 501 return 0 - 1 502 } 503 let fd: i64 = sys_openat_append(FC_LOG, 420) 504 if fd < 0 { fc_p(" RECEIPT-UNWRITABLE: " as *u8); fc_p(FC_LOG); fc_p("\n" as *u8); return 0 - 2 } 505 let m: *u8 = sys_mmap(FC_PATHCAP) 506 var o: i64 = 0 507 o = fc_num_at(m, o, sys_now_realtime_sec()) 508 m[o] = 9 as u8; o = o + 1 509 var i: i64 = 0 510 while dir[i] != (0 as u8) { if o < FC_PATHCAP - 160 { m[o] = dir[i]; o = o + 1 } i = i + 1 } 511 m[o] = 9 as u8; o = o + 1 512 o = fc_num_at(m, o, ctr[FC_NAMEN]); m[o] = 9 as u8; o = o + 1 513 o = fc_num_at(m, o, allowed); m[o] = 9 as u8; o = o + 1 514 o = fc_num_at(m, o, inst); m[o] = 9 as u8; o = o + 1 515 o = fc_num_at(m, o, other); m[o] = 9 as u8; o = o + 1 516 o = fc_num_at(m, o, build); m[o] = 9 as u8; o = o + 1 517 o = fc_num_at(m, o, phantom); m[o] = 9 as u8; o = o + 1 518 o = fc_num_at(m, o, alt); m[o] = 9 as u8; o = o + 1 519 o = fc_num_at(m, o, ctr[FC_VOLMISS] + ctr[FC_OFFCMISS] + ctr[FC_OTHERMISS]); m[o] = 9 as u8; o = o + 1 520 o = fc_num_at(m, o, ctr[FC_FILES]) 521 m[o] = 10 as u8; o = o + 1 522 sys_write(fd, m, o) 523 sys_close(fd) 524 sys_munmap(m, FC_PATHCAP) 525 fc_p(" receipt appended: " as *u8); fc_p(FC_LOG); fc_p("\n" as *u8) 526 return 0 527} 528 529func fc_scan(src: *u8, buf: *u8, n: i64, ctr: *i64, mode: i64) -> i64 { 530 let path: *u8 = sys_mmap(FC_PATHCAP) 531 var i: i64 = 0 532 while i + 4 < n { 533 var hit: i64 = 0 534 if buf[i] == (46 as u8) { 535 if buf[i + 1] == (101 as u8) { 536 if buf[i + 2] == (108 as u8) { 537 if buf[i + 3] == (102 as u8) { 538 if buf[i + 4] == (34 as u8) { hit = 1 } 539 } 540 } 541 } 542 } 543 if hit == 1 { 544 let open: i64 = fc_open_quote(buf, i) 545 if open >= 0 { 546 let plen: i64 = i + 3 - open 547 if plen > 0 { 548 if plen < 500 { 549 if fc_in_comment(buf, open) == 1 { ctr[FC_COMMENTS] = ctr[FC_COMMENTS] + 1 } 550 if fc_in_comment(buf, open) == 0 { 551 var c: i64 = 0 552 while c < plen { path[c] = buf[open + 1 + c]; c = c + 1 } 553 path[plen] = 0 as u8 554 let cls: i64 = fc_classify(path) 555 let present: i64 = fc_exists(path) 556 ctr[FC_LITS] = ctr[FC_LITS] + 1 557 if cls == 1 { ctr[FC_VOL] = ctr[FC_VOL] + 1; if present == 0 { ctr[FC_VOLMISS] = ctr[FC_VOLMISS] + 1 } } 558 if cls == 2 { ctr[FC_OFFC] = ctr[FC_OFFC] + 1; if present == 0 { ctr[FC_OFFCMISS] = ctr[FC_OFFCMISS] + 1 } } 559 if cls == 3 { ctr[FC_OTHER] = ctr[FC_OTHER] + 1; if present == 0 { ctr[FC_OTHERMISS] = ctr[FC_OTHERMISS] + 1 } } 560 if cls == 4 { ctr[FC_FRAG] = ctr[FC_FRAG] + 1 } 561 if cls == 5 { ctr[FC_BARE] = ctr[FC_BARE] + 1 } 562 var forky: i64 = 0 563 if cls < 4 { forky = 1 } 564 var repairable: i64 = 0 565 // VOLATILE: is a durable twin already on disk? If so this is a REPOINT (edit 566 // one literal), not a build -- the exact repair this organ's own header 567 // describes as flipping _timer_irq_gate RED -> GREEN 2/2. 568 if cls == 1 { 569 if present == 0 { 570 let dn: *u8 = sys_mmap(FC_PATHCAP) 571 let on: *u8 = sys_mmap(FC_PATHCAP) 572 fc_durablename(path, dn) 573 fc_offcname(dn, on) 574 var have: i64 = 0 575 if fc_exists(dn) == 1 { have = 1 } 576 if fc_exists(on) == 1 { have = 1 } 577 if have == 1 { repairable = 1; ctr[FC_VOLREPOINT] = ctr[FC_VOLREPOINT] + 1 } 578 if have == 0 { ctr[FC_VOLNOREPOINT] = ctr[FC_VOLNOREPOINT] + 1 } 579 sys_munmap(on, FC_PATHCAP) 580 sys_munmap(dn, FC_PATHCAP) 581 } 582 } 583 if cls == 2 { 584 if present == 0 { 585 // COUNT THE SUBJECT, NOT THE MENTION: N references to one missing 586 // binary is ONE thing to build, and only the distinct count sizes it. 587 let bn: *u8 = sys_mmap(FC_NAMEW) 588 fc_basename(path, bn, FC_NAMEW) 589 fc_addname(ctr, bn) 590 sys_munmap(bn, FC_NAMEW) 591 let rn: *u8 = sys_mmap(FC_PATHCAP) 592 fc_rootname(path, rn) 593 if fc_exists(rn) == 1 { repairable = 1; ctr[FC_REPAIR] = ctr[FC_REPAIR] + 1 } 594 if fc_exists(rn) == 0 { ctr[FC_NOREPAIR] = ctr[FC_NOREPAIR] + 1 } 595 sys_munmap(rn, FC_PATHCAP) 596 } 597 } 598 // ROOT-CLASS MISSING SUBJECTS JOIN THE SAME TABLE (2026-08-19): "./nx_kf8_book.elf" 599 // dead at the serving root is the same kind of work item as a dead _offc 600 // mirror -- one subject, one remedy -- and a worklist that only saw _offc could 601 // not name the book/reader pipeline the lane was opened for. 602 if cls == 3 { 603 if present == 0 { 604 let bn3: *u8 = sys_mmap(FC_NAMEW) 605 fc_basename(path, bn3, FC_NAMEW) 606 fc_addname(ctr, bn3) 607 sys_munmap(bn3, FC_NAMEW) 608 } 609 } 610 var show: i64 = 0 611 if mode == 1 { if present == 0 { if forky == 1 { show = 1 } } } 612 if mode == 2 { if forky == 1 { show = 1 } } 613 if mode == 3 { if repairable == 1 { show = 1 } } 614 if show == 1 { 615 if ctr[FC_ROWS] < FC_MAXROWS { fc_row(src, path, cls, present); ctr[FC_ROWS] = ctr[FC_ROWS] + 1 } 616 if ctr[FC_ROWS] >= FC_MAXROWS { ctr[FC_SUPPRESSED] = ctr[FC_SUPPRESSED] + 1 } 617 } 618 } 619 } 620 } 621 } 622 } 623 i = i + 1 624 } 625 return 0 626} 627 628func fc_is_nx(name: *u8, nl: i64) -> i64 { 629 if nl <= 3 { return 0 } 630 if name[nl - 3] != (46 as u8) { return 0 } 631 if name[nl - 2] != (110 as u8) { return 0 } 632 if name[nl - 1] != (120 as u8) { return 0 } 633 return 1 634} 635 636func main(argc: i64, argv: *i64) -> i64 { 637 // av[0] is RESERVED for the ELF path; real args start at av[1]. 638 let av: *i64 = argv 639 var dir: *u8 = "buildroot/runtime/_hdl_build" as *u8 640 var mode: i64 = 1 641 if argc > 1 { dir = av[1] as *u8 } 642 if argc > 2 { 643 let m: *u8 = av[2] as *u8 644 if fc_starts(m, "all" as *u8) == 1 { mode = 2 } 645 if fc_starts(m, "summary" as *u8) == 1 { mode = 0 } 646 if fc_starts(m, "repairable" as *u8) == 1 { mode = 3 } 647 // ★★★★★★A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE. The summary says 71 subjects / 59 648 // buildable, and nobody can DO anything with a number -- they need the NAMES, each already 649 // sorted into the remedy that applies to it. This mode prints exactly that, deduped, so the 650 // campaign is a list to work down rather than 156 references to re-derive by hand. 651 if fc_starts(m, "subjects" as *u8) == 1 { mode = 4 } 652 } 653 654 fc_p("=== nx_forkcensus -- forked .elf literals resolved against the filesystem ===\n" as *u8) 655 fc_p("dir=" as *u8); fc_p(dir); fc_p("\n" as *u8) 656 657 let ctr: *i64 = sys_mmap(FC_NSLOTS * 8) as *i64 658 var z: i64 = 0 659 while z < FC_NSLOTS { ctr[z] = 0; z = z + 1 } 660 // Distinct-subject table, allocated ONCE and carried in a ctr slot so fc_scan keeps its signature. 661 ctr[FC_NAMESET] = sys_mmap(FC_DISTINCT_MAX * FC_NAMEW) as i64 662 663 let dfd: i64 = sys_openat_rd(dir) 664 if dfd < 0 { 665 fc_p("NX-FORKCENSUS verdict=UNPROVEN reason=dir-unreadable dir=" as *u8); fc_p(dir); fc_p(" exit=3\n" as *u8) 666 sys_exit(3); return 3 667 } 668 let dirbuf: *u8 = sys_mmap(FC_DIRBUF) 669 let pathbuf: *u8 = sys_mmap(FC_PATHCAP) 670 let fll: *i64 = sys_mmap(16) as *i64 // hoisted: one length cell for every file read, not one per file 671 let dl: i64 = fc_slen(dir) 672 673 var done: i64 = 0 674 while done == 0 { 675 let nb: i64 = sys_getdents64(dfd, dirbuf, FC_MAGIC_1048576) 676 if nb <= 0 { done = 1 } 677 if nb > 0 { 678 var off: i64 = 0 679 while off < nb { 680 let base: i64 = dirbuf as i64 681 let rec: *u8 = (base + off) as *u8 682 let rl: i64 = dirent_reclen(rec) 683 if rl <= 0 { off = nb } 684 if rl > 0 { 685 let name: *u8 = dirent_name(rec) 686 let nl: i64 = fc_slen(name) 687 if fc_is_nx(name, nl) == 1 { 688 var p: i64 = 0 689 while p < dl { pathbuf[p] = dir[p]; p = p + 1 } 690 pathbuf[p] = 47 as u8; p = p + 1 691 var q: i64 = 0 692 while q < nl { pathbuf[p] = name[q]; p = p + 1; q = q + 1 } 693 pathbuf[p] = 0 as u8 694 // WHOLE FILE OR NOT AT ALL. The old fc_read returned a 2 MiB PREFIX and reported it as 695 // the length, so any literal past the cap was silently unscanned -- the banked 696 // capped-reader defect, inside the organ that hunts dead references. sys_read_file 697 // sizes its buffer from the file and cannot short-read. 698 let fbuf: *u8 = sys_read_file(pathbuf, fll) 699 if (fbuf as i64) != 0 { 700 if fll[0] > 0 { 701 ctr[FC_FILES] = ctr[FC_FILES] + 1 702 fc_scan(pathbuf, fbuf, fll[0], ctr, mode) 703 } 704 sys_free_file(fbuf, fll[0]) 705 } 706 } 707 off = off + rl 708 } 709 } 710 } 711 } 712 sys_close(dfd) 713 714 // NON-VACUITY FLOOR. A census that scanned nothing prints all-zero counts that read exactly like a 715 // clean bill of health. Refuse instead. (Same defect I found in nx_staghyg stagedref, where a 716 // partition check reported OK over an empty set.) 717 if ctr[FC_FILES] <= 0 { 718 fc_p("NX-FORKCENSUS verdict=UNPROVEN reason=no-sources-scanned -- a zero census is not a clean census exit=3\n" as *u8) 719 sys_exit(3); return 3 720 } 721 722 let dead: i64 = ctr[FC_VOLMISS] + ctr[FC_OFFCMISS] + ctr[FC_OTHERMISS] 723 let forks: i64 = ctr[FC_VOL] + ctr[FC_OFFC] + ctr[FC_OTHER] 724 let alive: i64 = forks - dead 725 726 // THE ALLOWLIST: deliberately-absent subjects, read ONCE (absent list = nothing allowed, announced). 727 let aln: *i64 = sys_mmap(16) as *i64 728 let alb: *u8 = sys_read_file(FC_ALLOW, aln) 729 var allowed_n: i64 = 0 730 // THE DEPLOY ROOTS, read ONCE (absent = only the CWD is probed, announced in the summary). 731 let rln: *i64 = sys_mmap(16) as *i64 732 let rlb: *u8 = sys_read_file(FC_ROOTS, rln) 733 // REMEDY PARTITION over the distinct subjects, computed for EVERY mode because the exit code is 734 // derived from it (a verdict must not depend on which listing the caller asked for). 735 var rem_install: i64 = 0 736 var rem_other: i64 = 0 737 var rem_build: i64 = 0 738 var rem_phantom: i64 = 0 739 var rem_alt: i64 = 0 740 let nbase: i64 = ctr[FC_NAMESET] 741 // THE WORKLIST ITSELF, deduped and pre-sorted into remedies. Printed BEFORE the summary so the 742 // reader sees the actionable rows first and the totals as context, not the other way round. 743 if mode == 4 { 744 fc_p("\n -- DISTINCT MISSING DURABLE SUBJECTS (root + _offc, both artifact roots probed) --\n" as *u8) 745 // ⚠READ THIS LIST, DO NOT SWEEP IT. Some rows are DELIBERATELY-ABSENT TEST LITERALS -- negative 746 // controls a gate forks to prove its refusal path -- and those are CORRECT to be missing. 747 // MEASURED 2026-08-14 in this very output: _oitest/_oitest3/_oifreshtest are nx_offc_install's 748 // OWN fixtures, a/b/__definitely_not_a_real_organ__ are obvious negative controls, and 749 // BUILDABLE x resolves to buildroot/runtime/x.nx whose entire content is "source alpha content". 750 // ★★★★★★A DETECTOR THAT SCANS SOURCE WILL FIND ITS OWN TEST FIXTURES, AND BOTH BUCKETS ARE 751 // CONTAMINATED BY THEM. Since 2026-08-19 the adjudicated fixtures live in FC_ALLOW (data) and print 752 // as ALLOWED; anything else is a CANDIDATE whose row needs the CALLER's context before a sweep. 753 fc_p(" (ALLOWED rows are adjudicated fixtures from " as *u8); fc_p(FC_ALLOW); fc_p("; every other row is a candidate -- read the caller)\n" as *u8) 754 } 755 var q: i64 = 0 756 while q < ctr[FC_NAMEN] { 757 let e: *u8 = (nbase + q * FC_NAMEW) as *u8 758 var rem: i64 = 0 759 if fc_allowed(e, alb, aln[0]) == 1 { rem = 0; allowed_n = allowed_n + 1 } else { rem = fc_remedy(e, rlb, rln[0]) } 760 if rem == 1 { rem_install = rem_install + 1 } 761 if rem == 2 { rem_other = rem_other + 1 } 762 if rem == 3 { rem_build = rem_build + 1 } 763 if rem == 4 { rem_phantom = rem_phantom + 1 } 764 if rem == 5 { rem_alt = rem_alt + 1 } 765 if mode == 4 { 766 // Opposite remedies must never share a line prefix. 767 if rem == 0 { fc_p(" ALLOWED " as *u8) } 768 if rem == 1 { fc_p(" REPAIR-OFFC-INSTALL " as *u8) } 769 if rem == 2 { fc_p(" PRESENT-OTHER-ROOT " as *u8) } 770 if rem == 3 { fc_p(" BUILD " as *u8) } 771 if rem == 4 { fc_p(" PHANTOM " as *u8) } 772 if rem == 5 { fc_p(" ALT-SPELLING " as *u8) } 773 fc_p(e) 774 fc_p("\n" as *u8) 775 } 776 q = q + 1 777 } 778 779 fc_p("\n files_scanned=" as *u8); fc_n(ctr[FC_FILES]) 780 fc_p(" elf_literals=" as *u8); fc_n(ctr[FC_LITS]) 781 fc_p(" fork_paths=" as *u8); fc_n(forks) 782 fc_p(" suffix_fragments=" as *u8); fc_n(ctr[FC_FRAG]) 783 fc_p(" bare_names=" as *u8); fc_n(ctr[FC_BARE]) 784 fc_p(" comment_only_skipped=" as *u8); fc_n(ctr[FC_COMMENTS]) 785 fc_p("\n VOLATILE(/tmp, _build/, publish-staging) total=" as *u8); fc_n(ctr[FC_VOL]); fc_p(" missing=" as *u8); fc_n(ctr[FC_VOLMISS]) 786 // ⚠LABEL CORRECTED 2026-08-14: this counter was called REPOINTABLE, which IMPLIED AN ACTION IT HAS 787 // NOT EARNED. It measures ONE fact -- a durable twin exists on disk -- and that does NOT mean the 788 // literal should be changed. MEASURED COUNTER-EXAMPLE: nx_analyst_register forks 789 // /tmp/nx_analyst_gate.sov.elf and its own header states the contract -- "the three elfs built THIS 790 // INVOCATION". Its /tmp-ness is LOAD-BEARING: repointing it to _offc would silently convert 791 // "verify what I just built" into "verify whatever happens to be installed", which is the exact 792 // stale-artifact defect this estate keeps rediscovering, introduced deliberately. 793 // ★★★★★★VOLATILE-VS-DURABLE IS A CONTRACT QUESTION, NOT A FILESYSTEM QUESTION, AND NO STAT CAN 794 // ANSWER IT. The census can find the literals; only reading each organ's contract decides whether 795 // /tmp is a bug or the point. So this prints a CANDIDATE SET, never a worklist -- naming it for the 796 // action would send the next reader on a harmful sweep with the numbers apparently backing them. 797 fc_p(" of which HAS-DURABLE-TWIN (a twin exists at root or _offc/ -- CANDIDATES for adjudication, NOT a repoint worklist: /tmp may be load-bearing)=" as *u8); fc_n(ctr[FC_VOLREPOINT]) 798 fc_p(" no-twin-anywhere=" as *u8); fc_n(ctr[FC_VOLNOREPOINT]) 799 fc_p("\n DURABLE(_offc/) total=" as *u8); fc_n(ctr[FC_OFFC]); fc_p(" missing=" as *u8); fc_n(ctr[FC_OFFCMISS]) 800 fc_p(" of which ONE-COMMAND-REPAIRABLE (promoted root binary exists)=" as *u8); fc_n(ctr[FC_REPAIR]) 801 fc_p(" needs-a-build=" as *u8); fc_n(ctr[FC_NOREPAIR]) 802 // THE NUMBER THAT SIZES THE JOB. Everything above counts REFERENCES; this counts SUBJECTS, and the 803 // remedy partition below is what a seat works down. Its parts MUST sum to the distinct count. 804 fc_p("\n DISTINCT MISSING DURABLE SUBJECTS=" as *u8); fc_n(ctr[FC_NAMEN]) 805 fc_p(" (root + _offc references above collapse to this many SUBJECTS)" as *u8) 806 fc_p(" of which source-exists=" as *u8); fc_n(ctr[FC_NAMEBUILDABLE]) 807 fc_p("\n REMEDY PARTITION: ALLOWED(fixture)=" as *u8); fc_n(allowed_n) 808 fc_p(" REPAIR-OFFC-INSTALL=" as *u8); fc_n(rem_install) 809 fc_p(" PRESENT-OTHER-ROOT=" as *u8); fc_n(rem_other) 810 fc_p(" BUILD=" as *u8); fc_n(rem_build) 811 fc_p(" PHANTOM=" as *u8); fc_n(rem_phantom) 812 fc_p(" ALT-SPELLING=" as *u8); fc_n(rem_alt) 813 let remsum: i64 = allowed_n + rem_install + rem_other + rem_build + rem_phantom + rem_alt 814 fc_p(" sum=" as *u8); fc_n(remsum) 815 if remsum == ctr[FC_NAMEN] { fc_p(" == distinct OK" as *u8) } else { fc_p(" != distinct UNSOUND" as *u8) } 816 if (alb as i64) == 0 { fc_p("\n allowlist ABSENT (" as *u8); fc_p(FC_ALLOW); fc_p(") -- every missing subject counts" as *u8) } 817 if (rlb as i64) == 0 { fc_p("\n deploy-roots conf ABSENT (" as *u8); fc_p(FC_ROOTS); fc_p(") -- only the CWD was probed; PRESENT-OTHER-ROOT cannot fire" as *u8) } 818 if ctr[FC_NAMEOVER] > 0 { fc_p(" ⚠DISTINCT-SET CAP HIT at " as *u8); fc_n(FC_DISTINCT_MAX); fc_p(" -- this count is a FLOOR, not a total" as *u8) } 819 fc_p("\n DURABLE(root) total=" as *u8); fc_n(ctr[FC_OTHER]); fc_p(" missing=" as *u8); fc_n(ctr[FC_OTHERMISS]) 820 fc_p("\n dead=" as *u8); fc_n(dead); fc_p(" alive=" as *u8); fc_n(alive) 821 822 // A PARTITION IS A CLAIM: CHECK THE PARTS SUM. If the classes do not add back to the literal count 823 // the census is arithmetically unsound and every number above it is untrustworthy. 824 // SECOND FREE AUDIT (2026-08-14): the volatile split is itself a partition of VOLMISS, so it must 825 // reconcile independently. TWO COUNTERS OF THE SAME POPULATION ARE A FREE AUDIT -- if repointable + 826 // needs-a-build does not equal missing, the new classifier dropped or double-counted a literal and 827 // the worklist it produces cannot be trusted to be the whole set. 828 let volsplit: i64 = ctr[FC_VOLREPOINT] + ctr[FC_VOLNOREPOINT] 829 fc_p("\n volatile_split=" as *u8); fc_n(volsplit) 830 if volsplit == ctr[FC_VOLMISS] { fc_p(" == VOLATILE missing OK" as *u8) } 831 if volsplit != ctr[FC_VOLMISS] { fc_p(" != VOLATILE missing UNSOUND" as *u8) } 832 833 let partsum: i64 = forks + ctr[FC_FRAG] + ctr[FC_BARE] 834 var sumok: i64 = 0 835 if partsum == ctr[FC_LITS] { sumok = 1 } 836 fc_p("\n partition_sum=" as *u8); fc_n(partsum) 837 if sumok == 1 { fc_p(" == elf_literals OK" as *u8) } 838 if sumok == 0 { fc_p(" != elf_literals UNSOUND" as *u8) } 839 840 // NO SILENT CAPS: if rows were dropped, say so, or the printed list reads as the whole story. 841 if ctr[FC_SUPPRESSED] > 0 { 842 fc_p("\n ROWS TRUNCATED: " as *u8); fc_n(ctr[FC_SUPPRESSED]); fc_p(" further rows not printed (cap=" as *u8); fc_n(FC_MAXROWS); fc_p("). Re-run with mode=summary for counts only." as *u8) 843 } 844 fc_p("\n" as *u8) 845 846 // TREND RECEIPT (2026-08-19): one line per run appended to FC_LOG, so the daily beat is a trajectory 847 // and not a level -- two censuses say "and it is growing", one cannot. Budget REUSED from the 848 // established status-journal envelope (procchurn.jrnl 1 MiB); past it the append is REFUSED loudly 849 // (rotation would be a duplicate ruler and trips nx_jrnlguard's shrinking-journal tooth). A failed 850 // receipt never changes the verdict. 851 fc_receipt(dir, ctr, allowed_n, rem_install, rem_other, rem_build, rem_phantom, rem_alt) 852 // EXIT CONTRACT (2026-08-19): the code CARRIES the verdict, so a roster or gate can branch on it. 853 // 0 ALL-RESOLVABLE no durable subject is missing outside the adjudicated allowlist 854 // 1 MISSING at least one durable subject (root or _offc, both roots probed) is dead 855 // 3 UNPROVEN the census could not be trusted: arithmetic unsound, distinct-set cap hit, 856 // directory unreadable or zero files scanned (the two early exits above) 857 // Before this the organ exited 0 with dead=718 -- a census whose exit code said "fine" about every 858 // dead reference it had just printed, i.e. a verdict nobody could wire into anything. 859 // VOLATILE (/tmp) misses are DELIBERATELY NOT in the verdict: whether /tmp is a bug or the contract 860 // is a per-organ question this organ cannot answer (see HAS-DURABLE-TWIN above). PRESENT-OTHER-ROOT is 861 // likewise outside the verdict: the binary exists in a declared deploy root, and whether THIS literal's 862 // caller runs from that root is a per-caller question -- it is printed as its own class so a reader can 863 // adjudicate it, never folded into MISSING (permanently-red) or into clean (hidden hazard). ALT-SPELLING 864 // (root and _offc both present) is outside it for the same reason. 865 var unresolved: i64 = rem_install + rem_build + rem_phantom 866 if sumok == 0 { 867 fc_p("NX-FORKCENSUS verdict=UNPROVEN reason=partition-unsound exit=3\n" as *u8) 868 sys_exit(3); return 3 869 } 870 if remsum != ctr[FC_NAMEN] { 871 fc_p("NX-FORKCENSUS verdict=UNPROVEN reason=remedy-partition-unsound exit=3\n" as *u8) 872 sys_exit(3); return 3 873 } 874 if ctr[FC_NAMEOVER] > 0 { 875 fc_p("NX-FORKCENSUS verdict=UNPROVEN reason=distinct-set-cap-hit exit=3\n" as *u8) 876 sys_exit(3); return 3 877 } 878 if unresolved > 0 { 879 fc_p("NX-FORKCENSUS verdict=MISSING files=" as *u8); fc_n(ctr[FC_FILES]) 880 fc_p(" fork_paths=" as *u8); fc_n(forks) 881 fc_p(" dead=" as *u8); fc_n(dead) 882 fc_p(" unresolved_subjects=" as *u8); fc_n(unresolved) 883 fc_p(" allowed=" as *u8); fc_n(allowed_n) 884 fc_p(" volatile_present_at_risk=" as *u8); fc_n(ctr[FC_VOL] - ctr[FC_VOLMISS]) 885 fc_p(" exit=1\n" as *u8) 886 sys_exit(1); return 1 887 } 888 fc_p("NX-FORKCENSUS verdict=ALL-RESOLVABLE files=" as *u8); fc_n(ctr[FC_FILES]) 889 fc_p(" fork_paths=" as *u8); fc_n(forks) 890 fc_p(" dead=" as *u8); fc_n(dead) 891 fc_p(" allowed=" as *u8); fc_n(allowed_n) 892 fc_p(" volatile_present_at_risk=" as *u8); fc_n(ctr[FC_VOL] - ctr[FC_VOLMISS]) 893 fc_p(" exit=0\n" as *u8) 894 sys_exit(0) 895 return 0 896}