code wiki / _hdl_build / nx_gate_mutation_sweep.nx
`nx_gate_mutation_sweep.nx` source

↩ module page · 581 lines · 31636 B
1// nx_gate_mutation_sweep.nx -- BATCH mutation-scoring across the gate universe (the liar-killer worklist
2// engine for the sensor-gap program, [[project-nishi-sensor-gap-census-2026-07-14]]).
3//
4//   usage: nx_gate_mutation_sweep <pair-budget> [mutants-per-pair]     0 = DRY RUN (list pairs only)
5//
6// DISCOVERY (mechanical, evidence-based -- the confirmed naming law): for every runtime/_hdl_build/
7// nx_X_gate.nx, the pair (subject=nx_X, gate=nx_X_gate) qualifies iff:
8//   * subject nx_X.nx exists (in _hdl_build or runtime/)
9//   * the gate actually IMPORTS the subject (runtime-built needle `import "nx_X.nx"`, quote bytes composed)
10//   * the gate is not RISKY (listeners/network/bench markers), not build-only, not infra, not known-broken
11//     (gatebase_*.tsv.refused marker)
12// For each qualifying pair (budget-bounded, resumable): fork the installed probe
13// _offc/nx_gate_mutation_probe.elf <subject> <gate> <mutants> -- it runs the identity control + evenly
14// spread ROR/AOR mutants and prints the mutation score. This sweep captures the probe output, parses the
15// LAST THREE ints (killed / total / survived), and BANKS:
16//   knowledge/status/mutscore_<subject>.tsv   subject \t gate \t killed \t total \t survived
17//   knowledge/status/mutscore_<subject>.out   the full probe transcript (survivor op+line = the worklist)
18// Ledger existence = resume-skip. SURVIVORS never fail the sweep -- they ARE the product (ranked
19// liar-killer worklist). Pipeline-RED pairs (identity fail etc.) are tallied as findings.
20// Never-brick: writes only mutscore_* ledgers/transcripts (+the probe's own archived copies).
21// Sovereign nx_cc->nxasm; CWD=nxc2 root. license_tier: ORIGINAL
22import "syscalls.nx"
23import "runtime.nx"
24import "nx_dirent.nx"
25import "nx_fcntl.nx"
26import "nx_handoff_gate.nx"
27import "nx_lease.nx"   // singleton guard: concurrent sweeps corrupt each other via fixed scratch names
28import "nx_sov_ledger.nx"
29
30// The buildroot is the ONE directory that satisfies every dependency of this organ (the _offc build
31// runner, runtime/_hdl_build sources, and knowledge/{status,store,lease}). A NAMED const rather than an
32// inline literal, matching HC_CLOCK in nx_hostctl -- a bootstrap path cannot itself live in a config that
33// the bootstrap has to read in order to find its way.
34const MS_BUILDROOT: *u8 = "/volume1/homes/elderwesto/nishihost/buildroot" as *u8
35const K_MAGIC_3600: i64 = 3600
36const K_MAGIC_16384: i64 = 16384
37const K_MAGIC_1048576: i64 = 1048576
38const K_MAGIC_1024: i64 = 1024
39
40func ms_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
41
42func ms_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
43
44func ms_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 }
  return off + i
48}
49
50func ms_copyn(dst: *u8, src: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { dst[i] = src[i]; i = i + 1 }
  return 0
54}
55
56// render non-negative n into dst at off; returns new offset
57func ms_num(dst: *u8, off: i64, n: i64) -> i64 {
  var m: i64 = n
  if m < 0 { m = 0 }
  let t: *u8 = sys_mmap(28)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { dst[off+i] = t[k-1-i]; i = i + 1 }
  return off + k
67}
68
69// case-insensitive substring (needle lowercase)
70func ms_has_ci(buf: *u8, len: i64, ndl: *u8) -> i64 {
  let nl: i64 = ms_slen(ndl)
  if nl == 0 { return 1 }
  var i: i64 = 0
  while i + nl <= len {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nl {
          if ms_lc(buf[i+j] as i64) != (ndl[j] as i64) { ok = 0; j = nl } else { j = j + 1 }
      }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
84}
85
86// byte-exact find of NUL-terminated needle
87func ms_find(buf: *u8, len: i64, ndl: *u8) -> i64 {
  let nl: i64 = ms_slen(ndl)
  if nl == 0 { return 0 - 1 }
  var i: i64 = 0
  while i + nl <= len {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nl {
          if buf[i+j] != ndl[j] { ok = 0; j = nl } else { j = j + 1 }
      }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
101}
102
103func ms_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      let tail: *u8 = ((buf as i64) + total) as *u8
      let n: i64 = sys_read(fd, tail, cap - total)
      if n > 0 { total = total + n; if total < cap { go = 1 } }
  }
  sys_close(fd)
  return total
116}
117
118func ms_write(path: *u8, buf: *u8, len: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, 0x1a4)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, buf, len)
  sys_close(fd)
  return 0
124}
125
126// gate blind-run risk policy (same law as the baseline sweep)
127func ms_risky(name: *u8, nlen: i64, buf: *u8, len: i64) -> i64 {
  if ms_has_ci(name, nlen, "daemon" as *u8) == 1 { return 1 }
  if ms_has_ci(name, nlen, "serve" as *u8) == 1 { return 1 }
  if ms_has_ci(name, nlen, "bench" as *u8) == 1 { return 1 }
  if ms_has_ci(name, nlen, "monitor" as *u8) == 1 { return 1 }
  if ms_has_ci(name, nlen, "watch" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "sys_listen" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "sys_bind" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "sys_accept" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "sys_connect" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "https" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "sys_sendto" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "nxsecret" as *u8) == 1 { return 1 }
  if ms_has_ci(buf, len, "--build-only" as *u8) == 1 { return 1 }
  return 0
142}
143
144// fork the installed probe on one pair; probe stdout/err -> capture path; signal-aware rc
145func ms_run_probe(subject: *u8, gatename: *u8, mstr: *u8, capfile: *u8, envp: *i64) -> i64 {
  let probe: *u8 = "_offc/nx_gate_mutation_probe.elf" as *u8
  let ofd: i64 = sys_openat_wr(capfile, 0x1a4)
  let av: *i64 = sys_mmap(8 * 6) as *i64
  av[0] = probe as i64
  av[1] = subject as i64
  av[2] = gatename as i64
  av[3] = mstr as i64
  av[4] = 0
  let pid: i64 = sys_fork()
  if pid == 0 {
      if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) }
      sys_execve(probe, av, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  if ofd >= 0 { sys_close(ofd) }
  let sig: i64 = st[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (st[0] >> 8) & 0xff
166}
167
168func main(argc: i64, argv: *i64) -> i64 {
  // ---- SELF-LOCATE BEFORE ANYTHING ELSE (2026-08-01) ----
  // Every path in this organ -- discovery, the forked probe at _offc/, the knowledge/ ledger AND the
  // lease below -- resolves from cwd, and only buildroot/ satisfies all of them. That was fine while a
  // human ran it by hand from the right directory, but it makes the organ UNSCHEDULABLE: the clock
  // dispatches with argv[0]=path and no cwd control, from the nishihost root, where discovery finds
  // zero pairs and this sweep (correctly) refuses. An organ that only works when launched by hand
  // cannot be put on a beat, and a measurement nobody runs is not a measurement.
  // So: locate our own root rather than depend on the caller's. Probe for runtime/_hdl_build and, if
  // it is not here, chdir to the buildroot and re-probe. Fail-closed is preserved -- if neither works
  // the existing [RED] refusal below still fires.
  // ORDER IS LOAD-BEARING: this runs BEFORE ls_acquire, because the lease directory is itself
  // cwd-relative (knowledge/lease/...). Acquiring first and chdir-ing after would take the lock in one
  // directory and release it in another, leaking the lease for its full 3600s TTL.
  // ⚠ THE DISCRIMINATOR MUST BE UNIQUE TO THE TARGET. My first attempt probed for runtime/_hdl_build
  // and never fired, because that directory EXISTS AT BOTH the nishihost root and the buildroot -- my
  // own dependency census had already recorded root: runtime=Y. Testing for something both candidates
  // have answers no question. The runner is the one dependency ONLY buildroot carries (root's _offc/
  // holds 261 files but not this one), which is exactly why buildroot is the correct cwd.
  // LAW: A SELF-LOCATE PROBE MUST TEST FOR WHAT DISTINGUISHES THE TARGET, NOT MERELY FOR SOMETHING
  // THE TARGET CONTAINS.
  let sl_probe: i64 = nx_openat(NX_AT_FDCWD, "_offc/nx_sov_build_run.elf" as *u8, NX_O_RDONLY, 0)
  if sl_probe < 0 {
      sys_chdir(MS_BUILDROOT)
  }
  if sl_probe >= 0 { sys_close(sl_probe) }
194
  // ---- SINGLETON LEASE (2026-08-01, debt 1785607895) ----
  // I ran two of these concurrently by accident and they corrupted each other. The probe writes its
  // mutants to FIXED filenames (runtime/_hdl_build/__mutprobe_lib.nx and __mutprobe_gate.nx), so two
  // instances overwrite each other's mutant source in place and each may score a mutant the OTHER
  // wrote. LAW: FIXED SCRATCH FILENAMES ARE A SINGLETON ASSERTION MADE SILENTLY -- writing to a
  // constant path declares that only one instance may run, without saying so and without enforcing it.
  // nx_lease already existed and nothing used it, the same unadopted primitive the clock ignores.
  // ls_acquire returns 0 = ACQUIRED, 1 = held by another, -1 = error -- read from source, NOT assumed
  // (it is the syscall convention, the inverse of the 1-means-success convention hc_promote_to uses).
  // TTL is generous because a single pair can take minutes; a dead holder still frees the lane.
  // OWNER MUST BE UNIQUE PER INSTANCE, NOT THE PROGRAM NAME. First attempt passed the constant
  // "nx_gate_mutation_sweep" as owner; ls_acquire treats a lease held by the SAME owner as re-entrant,
  // so the second concurrent sweep saw its own name on the lock and RE-ACQUIRED. The guard existed,
  // created the lock dir, and let the duel through anyway.
  // A NAME IS NOT AN IDENTITY -- the same law that made kill-by-name a noisy remedy and made the
  // singleness gate miscount a forked keeper. Two processes of one program are two identities.
  let ls_own: *u8 = sys_mmap(128)
  var ls_oo: i64 = ls_cat(ls_own, 0, "mutsweep-" as *u8)
  ls_oo = ls_catn(ls_own, ls_oo, ls_pid())
  ls_own[ls_oo] = 0 as u8
  let ls_hb: *u8 = sys_mmap(K_MAGIC_1024)
  let ls_rc: i64 = ls_acquire("mutsweep" as *u8, ls_own, K_MAGIC_3600, ls_hb)
  if ls_rc != 0 {
      print("=== nx_gate_mutation_sweep: REFUSING -- another sweep holds the lease ===\n" as *u8)
      print("  Two sweeps corrupt each other: the probe's scratch filenames are FIXED, so concurrent\n" as *u8)
      print("  runs overwrite each other's mutant source and score mutants they did not write.\n" as *u8)
      print("  Wait for the holder to finish, or release the lease if it is dead (TTL 3600s).\n" as *u8)
      sys_exit(2)
      return 2
  }
  var budget: i64 = 2
  var mper: i64 = 4
  if argc >= 2 {
      let a: *u8 = argv[1] as *u8
      var v: i64 = 0
      var bi: i64 = 0
      var sawdig: i64 = 0
      while a[bi] != (0 as u8) {
          let d: i64 = a[bi] as i64
          if d >= 48 { if d <= 57 { v = v * 10 + (d - 48); sawdig = 1 } }
          bi = bi + 1
      }
      if sawdig == 1 { budget = v }
  }
  if argc >= 3 {
      let a2: *u8 = argv[2] as *u8
      var v2: i64 = 0
      var b2: i64 = 0
      while a2[b2] != (0 as u8) {
          let d2: i64 = a2[b2] as i64
          if d2 >= 48 { if d2 <= 57 { v2 = v2 * 10 + (d2 - 48) } }
          b2 = b2 + 1
      }
      if v2 > 0 { mper = v2 }
  }
  print("=== nx_gate_mutation_sweep: pair-budget=" as *u8)
  print_i64(budget)
  print(" mutants/pair=" as *u8)
  print_i64(mper)
  if budget == 0 { print(" (DRY RUN)" as *u8) }
  print(" ===\n" as *u8)
  // mutants-per-pair as string for probe argv
  let mstr: *u8 = sys_mmap(16)
  var mo: i64 = 0
  var mm: i64 = mper
  let mt: *u8 = sys_mmap(16)
  var mk: i64 = 0
  if mm == 0 { mt[0] = 48 as u8; mk = 1 }
  while mm > 0 { mt[mk] = (48 + (mm % 10)) as u8; mm = mm / 10; mk = mk + 1 }
  while mo < mk { mstr[mo] = mt[mk-1-mo]; mo = mo + 1 }
  mstr[mo] = 0 as u8
266
  let envp: *i64 = sys_mmap(8 * 4) as *i64
  envp[0] = ("PATH=/usr/bin:/bin" as *u8) as i64
  envp[1] = 0
270
  // 2026-08-01 CWD, INVESTIGATED AND LEFT ALONE. I briefly rewrote these four paths to be
  // ROOT-relative on the assumption that the root was the only cwd carrying knowledge/. THAT WAS
  // WRONG and is reverted. Measured: buildroot/ carries ALL THREE dependencies -- _offc/nx_sov_build_run.elf
  // (the root's _offc does NOT have it, despite holding 261 other files), runtime/_hdl_build, and
  // knowledge/{status,store}. The root satisfies only two of the three. So BUILDROOT IS THE CORRECT
  // CWD and this file was already self-consistent for it.
  // The real defect was elsewhere: nx_offc_install wrote the forked probe into the ROOT's _offc/
  // instead of buildroot/_offc/, so the sweep's fork got rc=127 NOT-FOUND and mislabelled it a
  // PIPELINE-RED gate finding. Fix the INSTALL TARGET, not these paths.
  // LAW: WHEN TWO COMPONENTS DISAGREE ON CWD, FIND WHICH DIRECTORY SATISFIES EVERY DEPENDENCY BEFORE
  // REWRITING EITHER -- I changed the consumer when the producer was misplaced.
  let dirp: *u8 = "runtime/_hdl_build" as *u8
  let dfd: i64 = nx_openat(NX_AT_FDCWD, dirp, NX_O_RDONLY | NX_O_DIRECTORY, 0)
  if dfd < 0 { print("  [RED] cannot open _hdl_build\n" as *u8); sys_exit(1); return 1 }
  let dbuf: *u8 = sys_mmap(K_MAGIC_16384)
  let dr_raw: *u8 = sys_mmap(NX_DIRENT_BYTES)
  let dr: *NxDirent = dr_raw as *NxDirent
288
  let cap: i64 = K_MAGIC_1048576
  let gbuf: *u8 = sys_mmap(cap + 16)
  let subject: *u8 = sys_mmap(256)
  let gatename: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(K_MAGIC_1024)
  let needle: *u8 = sys_mmap(512)
  let ledger: *u8 = sys_mmap(K_MAGIC_1024)
  let mkey: *u8 = sys_mmap(256)
  let capfile: *u8 = "/tmp/mutsweep_probe.out" as *u8
  let pcap: *u8 = sys_mmap(cap + 16)
299
  var n_pairs: i64 = 0
  var n_done: i64 = 0
  var n_scored: i64 = 0
  var n_pipefail: i64 = 0
  var n_knownred: i64 = 0                       // pairs skipped because a prior run banked them RED
  let rkey_buf: *u8 = sys_mmap(256)             // "red:<subject>" key into knowledge/store/mutred
  var n_skip: i64 = 0
  var n_remaining: i64 = 0
  var tot_killed: i64 = 0
  var tot_mut: i64 = 0
  var tot_surv: i64 = 0
  var att: i64 = 0
  var shown_would: i64 = 0
313
  var batch: i64 = nx_dirent_read(dfd, dbuf, K_MAGIC_16384)
  while batch > 0 {
      var off: i64 = 0
      while off < batch {
          let next_off: i64 = nx_dirent_iter(dbuf, off, batch, dr)
          if next_off <= 0 { off = batch + 1 }
          if off <= batch {
              let nmlen: i64 = nx_dirent_name_len(dr)
              // want names ending "_gate.nx" (8 chars)
              var isg: i64 = 0
              if nmlen > 8 {
                  let sfx: *u8 = "_gate.nx" as *u8
                  var si: i64 = 0
                  isg = 1
                  while si < 8 {
                      if dr.name[nmlen-8+si] != sfx[si] { isg = 0; si = 8 } else { si = si + 1 }
                  }
              }
              // ---- EXCLUDE THIS TOOL'S OWN SCRATCH (2026-08-01, debt 1785606069) ----
              // nx_gate_mutation_probe writes its mutants as runtime/_hdl_build/__mutprobe_gate.nx,
              // which ENDS IN _gate.nx and therefore matched the glob above. The probe was handing
              // its own leftovers back to this sweep as a gate to score -- with whatever mutated
              // content the previous run left behind. An instrument that writes into the directory
              // it scans will eventually measure ITSELF.
              // The probe's cleanup rename is the other defence, but it FAILED SILENTLY for months
              // (its destination dir did not exist), so the two must be INDEPENDENT: prefix-skip here
              // does not rely on cleanup working, and cleanup does not rely on this filter existing.
              // Keying on the `__` PREFIX because the SUFFIX is what the glob matches -- naming the
              // scratch with a leading __ was never enough on its own.
              if nmlen > 2 {
                  if dr.name[0] == (95 as u8) {
                      if dr.name[1] == (95 as u8) { isg = 0 }
                  }
              }
              if isg == 1 {
                  // subject = name minus "_gate.nx"; gatename = name minus ".nx"
                  ms_copyn(subject, dr.name, nmlen - 8)
                  subject[nmlen-8] = 0 as u8
                  ms_copyn(gatename, dr.name, nmlen - 3)
                  gatename[nmlen-3] = 0 as u8
354
                  // subject source must exist (_hdl_build or runtime/)
                  var o: i64 = 0
                  o = ms_cat(path, o, "runtime/_hdl_build/" as *u8)
                  o = ms_cat(path, o, subject)
                  o = ms_cat(path, o, ".nx" as *u8)
                  path[o] = 0 as u8
                  var subj_ok: i64 = hg_evidence_file(path)
                  if subj_ok == 0 {
                      o = 0
                      o = ms_cat(path, o, "runtime/" as *u8)
                      o = ms_cat(path, o, subject)
                      o = ms_cat(path, o, ".nx" as *u8)
                      path[o] = 0 as u8
                      subj_ok = hg_evidence_file(path)
                  }
                  if subj_ok == 1 {
                      // read the GATE source for risk + import checks
                      o = 0
                      o = ms_cat(path, o, "runtime/_hdl_build/" as *u8)
                      o = ms_cat(path, o, gatename)
                      o = ms_cat(path, o, ".nx" as *u8)
                      path[o] = 0 as u8
                      let glen: i64 = ms_read(path, gbuf, cap)
                      if glen > 0 {
                          var skip: i64 = 0
                          if ms_risky(dr.name, nmlen, gbuf, glen) == 1 { skip = 1 }
                          // known-broken gate marker
                          if skip == 0 {
                              o = 0
                              o = ms_cat(ledger, o, "knowledge/status/gatebase_" as *u8)
                              o = ms_cat(ledger, o, gatename)
                              o = ms_cat(ledger, o, ".tsv.refused" as *u8)
                              ledger[o] = 0 as u8
                              if hg_evidence_file(ledger) == 1 { skip = 1 }
                          }
                          // gate must IMPORT the subject: needle import "<subject>.nx" (quote composed)
                          if skip == 0 {
                              o = 0
                              o = ms_cat(needle, o, "import " as *u8)
                              needle[o] = 34 as u8
                              o = o + 1
                              o = ms_cat(needle, o, subject)
                              o = ms_cat(needle, o, ".nx" as *u8)
                              needle[o] = 34 as u8
                              o = o + 1
                              needle[o] = 0 as u8
                              if ms_find(gbuf, glen, needle) < 0 { skip = 1 }
                          }
                          if skip == 1 { n_skip = n_skip + 1 }
                          if skip == 0 {
                              n_pairs = n_pairs + 1
                              // resume: SOVEREIGN mutscore record exists? (seg_store key mut:<subject>, NO tsv)
                              o = 0
                              o = ms_cat(mkey, o, "mut:" as *u8)
                              o = ms_cat(mkey, o, subject)
                              mkey[o] = 0 as u8
                              // ---- SKIP PAIRS ALREADY KNOWN UNSCOREABLE (2026-08-01) ----
                              // MEASURED DEFECT: scores were banked but PIPELINE-REDs were not, so every
                              // run re-attempted the same ~145 unscoreable pairs from the top of the
                              // alphabet and never reached new territory. A 30-round x 20-pair batch
                              // scored ZERO in 7 minutes -- it spent the whole time re-proving that
                              // nx_a11y_breadth through nx_aec still fail on correct code, which was
                              // already known and recorded.
                              // LAW: A RESUMABLE SWEEP MUST BANK ITS NEGATIVE RESULTS TOO. Remembering
                              // only successes means the unfinishable work is retried forever and the
                              // finishable work is never reached -- the sweep converges to a treadmill.
                              // Kept as a SEPARATE store from mutscore, deliberately: a pipeline-RED is
                              // NOT a score and must never be read as one. It also stays retryable --
                              // when the underlying gate is fixed and goes GREEN, delete its mutred row
                              // (or the store) and the pair re-enters the queue.
                              var rkey: i64 = 0
                              rkey = ms_cat(rkey_buf, 0, "red:" as *u8)
                              rkey = ms_cat(rkey_buf, rkey, subject)
                              rkey_buf[rkey] = 0 as u8
                              let have_red: i64 = sov_has("knowledge/store/mutred" as *u8, rkey_buf)
                              if have_red == 1 { n_knownred = n_knownred + 1 }
431
                              let have_mut: i64 = sov_has("knowledge/store/mutscore" as *u8, mkey)
                              if have_mut == 1 { n_done = n_done + 1 }
                              // Combined into ONE flag rather than nesting a second `if`, so the brace
                              // count of this block is UNCHANGED. Editing nested braces by hand in a
                              // 500-line function is how the D001 applier deleted a RED branch earlier
                              // today; the same caution applies to me.
                              var do_pair: i64 = 0
                              if have_mut == 0 { if have_red == 0 { do_pair = 1 } }
                              if do_pair == 1 {
                                  if att < budget {
                                      att = att + 1
                                      print("  [pair " as *u8)
                                      print_i64(att)
                                      print("/" as *u8)
                                      print_i64(budget)
                                      print("] " as *u8)
                                      print(subject)
                                      print(" x " as *u8)
                                      print(gatename)
                                      print(" -> " as *u8)
                                      let prc: i64 = ms_run_probe(subject, gatename, mstr, capfile, envp)
                                      print("probe rc=" as *u8)
                                      print_i64(prc)
                                      let clen: i64 = ms_read(capfile, pcap, cap)
                                      if prc != 0 {
                                          n_pipefail = n_pipefail + 1
                                          // BANK the negative result so the next run skips this pair
                                          // instead of re-proving it. Value is the probe rc, which
                                          // distinguishes a gate that FAILS on correct code (rc=1) from
                                          // one that could not be built or run at all (rc=127).
                                          let rv: *i64 = sys_mmap(16) as *i64
                                          rv[0] = prc
                                          sov_put_ints("knowledge/store/mutred" as *u8, rkey_buf, rv, 1)
                                          print("  PIPELINE-RED (identity/needle) -> finding BANKED, no score\n" as *u8)
                                      }
                                      if prc == 0 {
                                          // parse ALL ints; last three = killed / total / survived
                                          let iv: *i64 = sys_mmap(8 * 256) as *i64
                                          var nints: i64 = 0
                                          if clen > 0 { nints = hg_parse_ints(pcap, clen, iv, 256) }
                                          if nints >= 3 {
                                              var st3: i64 = nints - 3
                                              if nints > 256 { st3 = 256 - 3 }
                                              let k: i64 = iv[st3]
                                              let t: i64 = iv[st3+1]
                                              let s: i64 = iv[st3+2]
                                              tot_killed = tot_killed + k
                                              tot_mut = tot_mut + t
                                              tot_surv = tot_surv + s
                                              n_scored = n_scored + 1
                                              print("score " as *u8)
                                              print_i64(k)
                                              print("/" as *u8)
                                              print_i64(t)
                                              print(" survivors=" as *u8)
                                              print_i64(s)
                                              print("\n" as *u8)
                                              // bank SOVEREIGN typed record [k,t,s] + transcript into seg_store (NO .tsv/.out side-car)
                                              let kts: *i64 = sys_mmap(8 * 4) as *i64
                                              kts[0] = k
                                              kts[1] = t
                                              kts[2] = s
                                              sov_put_ints("knowledge/store/mutscore" as *u8, mkey, kts, 3)
                                              if clen > 0 { sov_put("knowledge/store/mutscore_txt" as *u8, mkey, pcap, clen) }
                                              if s > 0 { print("    *** SURVIVORS -> see transcript (liar-killer worklist)\n" as *u8) }
                                          } else {
                                              n_pipefail = n_pipefail + 1
                                              print("  [unparseable probe output -> finding]\n" as *u8)
                                          }
                                      }
                                  } else {
                                      n_remaining = n_remaining + 1
                                      if budget == 0 {
                                          if shown_would < 20 {
                                              print("  [pair] " as *u8)
                                              print(subject)
                                              print(" x " as *u8)
                                              print(gatename)
                                              print("\n" as *u8)
                                              shown_would = shown_would + 1
                                          }
                                      }
                                  }
                              }
                          }
                      }
                  }
              }
              off = next_off
          }
      }
      batch = nx_dirent_read(dfd, dbuf, K_MAGIC_16384)
  }
  sys_close(dfd)
526
  print("---- mutation-sweep tally ----\n" as *u8)
  print("  qualifying pairs     = " as *u8)
  print_i64(n_pairs)
  print("  (skipped risky/broken/no-import = " as *u8)
  print_i64(n_skip)
  print(")\n  already scored       = " as *u8)
  print_i64(n_done)
  print("\n  known-RED (skipped)  = " as *u8)
  print_i64(n_knownred)
  print("   (banked unscoreable; delete its knowledge/store/mutred row to retry after a fix)" as *u8)
  print("\n  scored this run      = " as *u8)
  print_i64(n_scored)
  print("  (mutants " as *u8)
  print_i64(tot_mut)
  print(", killed " as *u8)
  print_i64(tot_killed)
  print(", SURVIVORS " as *u8)
  print_i64(tot_surv)
  print(")\n  pipeline-RED pairs   = " as *u8)
  print_i64(n_pipefail)
  print("\n  remaining unscored   = " as *u8)
  print_i64(n_remaining)
  // ---- NON-VACUITY TOOTH (2026-08-01): A SWEEP THAT SCANNED NOTHING IS NOT GREEN ----
  // MEASURED DEFECT, not a hypothetical. Discovery walks runtime/_hdl_build/ CWD-RELATIVE. Run from
  // the nishihost root -- where every other organ is launched -- it finds ZERO pairs and printed
  // `verdict: GREEN` with sys_exit(0). Run from buildroot/ it finds hundreds. The fleet has 2192
  // *_gate.nx under _hdl_build and 841 that import their subject by this tool's OWN documented rule,
  // so "0 qualifying pairs" is never a true statement about the fleet -- it is the instrument
  // reporting on its own cwd and calling it the world.
  //
  // This is the build-cwd-vs-run-cwd class that already cost a full redseen=0 investigation, and it
  // FAILED OPEN: the one outcome that must never be silent is the one it chose.
  // A sweep is only entitled to a verdict about the fleet if it SAW the fleet.
  if n_pairs == 0 {
      if n_done == 0 {
          print("\n  DISCOVERY FOUND ZERO PAIRS. This is almost certainly the CWD: discovery walks\n" as *u8)
          print("  runtime/_hdl_build/ relative to the current directory, so it must be run from\n" as *u8)
          print("  buildroot/ -- from the nishihost root it sees nothing.\n" as *u8)
          print("  Reporting GREEN here would say 'no gate has a surviving mutant' when the truth is\n" as *u8)
          print("  'no gate was examined'. Those render identically to every rollup and mean opposite\n" as *u8)
          print("  things, so this REFUSES instead.\n" as *u8)
          print("=== verdict: RED (sweep measured NOTHING -- not a statement about the fleet) ===\n" as *u8)
          ls_release("mutsweep" as *u8, ls_own)
          sys_exit(3)
          return 3
      }
  }
  print("\n=== verdict: GREEN (sweep mechanics; survivors + pipeline-REDs above are FINDINGS) ===\n" as *u8)
  // RELEASE ON EVERY EXIT. Acquire without release is HALF A FIX: the lease would survive its full
  // 3600s TTL and refuse the next LEGITIMATE run for an hour. A guard that blocks correct work is a
  // worse defect than the duel it prevents, and it would look exactly like the tool being broken.
  ls_release("mutsweep" as *u8, ls_own)
  sys_exit(0)
  return 0
581}
nx_gate_mutation_sweep.nx source

`nx_gate_mutation_sweep.nx` source
