code wiki / _hdl_build / nx_gate_roster_run.nx
`nx_gate_roster_run.nx` source

↩ module page · 721 lines · 37407 B
1// nx_gate_roster_run.nx -- THE DATA-DRIVEN GATE ROSTER BEAT: run every gate named in a conf, on the
2// clock, with a deadline, and journal each verdict -- so a promoted gate nobody runs becomes a gate
3// whose verdict is COLLECTED, by adding ONE LINE OF DATA rather than a rebuild.
4//
5// WHY (campaign lane B, 2026-08-18): nx_gateadjudicate measured 3,235 gate sources on the NAS,
6// 919 promoted, and 780 DEPLOYED-DARK -- promoted binaries that no clock row, roster organ, .gates map,
7// gatereg row or MCP call ever runs. The estate's law: "a gate nobody runs does not degrade to
8// neutral -- it degrades to a false sense of coverage, because its existence is counted and its
9// verdict is not." The wiring vehicle that already exists, nx_gfx_gates_beat, is CORRECT in shape
10// (bounded runner, per-gate journal line, ABSENT reported never skipped) but its roster is EIGHT
11// NAMES IN CODE, so admitting a ninth gate is a rebuild. Rule 11/17: rosters are DATA. This organ is
12// that beat with the roster moved to a conf; nx_gfx_gates_beat is the precedent, not a duplicate --
13// its eight rows can migrate here whenever its owner chooses.
14//
15// ROSTER CONF (default knowledge/gateroster.conf), one gate per line:
16//     <gate-name>            runs ./<gate-name>.elf from the estate root
17//     ; comment / blank      ignored (also lines whose first byte is the hash mark)
18// A gate is ADMITTED to the conf only after a TRIAL run has come back GREEN or SKIP -- adoption is not
19// blind wiring, and this organ has a `trial` verb for exactly that:
20//     nx_gate_roster_run                          REFUSED (exit 2): argless mutates NOTHING and prints
21//                                                 usage. The beat must NAME its verb -- every proof tool
22//                                                 in the estate probes an organ argless, so an argless
23//                                                 default that runs the beat makes this organ unprovable
24//                                                 and lets a staged binary write production state.
25//     nx_gate_roster_run beat [conf] [journal] [ms]   the beat. A conf OR journal other than the
26//                                                 production defaults writes its heartbeat BESIDE its own
27//                                                 journal (<journal>.stamp, announced) and never to the
28//                                                 cron-watched production stamp.
29//     nx_gate_roster_run trial <listfile> [journal] [ms]   run every gate in <listfile> ONCE, journal
30//                                                          under tag "trial"; exit 0 always (a trial
31//                                                          reports, it does not judge the fleet)
32//     nx_gate_roster_run admit <journal> <deadline_ms> [conf] [suspectlist=<conf>.suspect]
33//         The journal->conf bridge, so admission is MECHANICAL, never hand-filtered: take the LATEST
34//         row per gate; GREEN/SKIP with ms < deadline_ms -> merge-ADD into the conf (additive, rule 13:
35//         admission never removes -- a beat RED is an alarm to read, not a row to erase); GREEN with
36//         ms >= deadline_ms -> SUSPECT, written to [suspectlist] and NOT admitted. The suspect class
37//         exists because journals written before 2026-08-18 came from a runner that returned exit 0
38//         for a watchdog-KILLED child, so a legacy at-deadline GREEN is a timeout wearing a pass; the
39//         fixed runner reports 137 and those rows say TIMEOUT, making this class empty going forward.
40//         deadline_ms is REQUIRED (it is the value the trial ran with, from its own header line) --
41//         defaulting it here would silently misclassify a journal run at a different deadline.
42// JOURNAL (default knowledge/status/gateroster.jrnl, O_APPEND, one writer):
43//     <epoch> TAB <tag> TAB <gate> TAB <verdict> TAB exit=<rc> TAB ms=<elapsed> TAB <reason>
44// <reason> (2026-08-19) is the LAST non-empty line of the gate's own output, tabs/CRs spaced, capped at
45// GRR_REASON_MAX -- THE REASON TRAVELS WITH THE COUNT: a failing list without reasons costs a re-run of
46// every gate to learn why (measured: 150 DARK-FAILING rows, zero causes). Additive per rule 19 -- every
47// reader indexes fields 0..5 and is untouched.
48// VERDICTS: GREEN(rc 0) . SKIP(rc 3, tolerated: gv_need preconditions) . RED(other rc) .
49//           ABSENT(no ./<gate>.elf) . TIMEOUT(rc 137 = the watchdog killed it at <ms>)
50// Composes gk_run_capture_ms -- the estate's bounded runner; the pipe-deadline and watchdog lessons
51// live THERE. Runs at nice 10 (a roster is background work; it must never become the load it
52// measures). Every gate's output is captured and DISCARDED here except its exit code: the gate's own
53// journal (gv_journal -> knowledge/status/harness.jrnl) is the durable detail; this file is the
54// roster's one-line summary, the same split nx_gfx_gates_beat uses.
55// exit (beat): 0 = no RED/ABSENT/TIMEOUT, 1 otherwise. exit 2 = usage / conf unreadable.
56// license_tier: ORIGINAL   Read-only over the estate except its journal. No hw writes (Rule 26).
57import "nx_syscalls.nx"
58import "nx_gatekit_lib.nx"
59import "nx_estate_path.nx"
60
61const GRR_MS_DEFAULT: i64 = 60000
62const GRR_CAP: i64 = 65536
63const GRR_MODE: i64 = 420          // 0644
64const GRR_NICE: i64 = 10
65const GRR_SIGKILL_RC: i64 = 137     // 128+SIGKILL: what gk_run_capture_ms returns for a child its watchdog killed
66const GRR_MAXG: i64 = 4096
67const GRR_SLOT: i64 = 128
68const GRR_LINE: i64 = 1400         // one journal line (epoch/tag/gate/verdict/exit/ms/reason)
69const GRR_REASON_MAX: i64 = 240    // reason field cap; a truncated reason still names the cause
70const GRR_MSG:  i64 = 8192         // report buffers (admit summary, beat header/footer)
71const GRR_CONF: *u8 = "knowledge/gateroster.conf"
72const GRR_JRNL: *u8 = "knowledge/status/gateroster.jrnl"
73// LIVENESS HEARTBEAT for nx_cron_watch. Until 2026-08-20 this beat wrote NO stamp, so the surface that
74// runs EVERY NAS-side detector was the one surface no liveness instrument could see: if it stopped,
75// nothing in the estate would report it and 630 gates would keep being counted as covered.
76const GRR_STAMP: *u8 = "knowledge/status/gateroster.stamp"
77// ---- THE PASS FITS ITS SCHEDULER, AND THE STALEST GATE GOES FIRST (2026-09-18) ----
78// MEASURED: the clock dispatcher KILLS any job at CLK_DISPATCH_DEADLINE_MS (900000, nx_clock_sched.nx, logged
79// exit 124), and one serial pass over ~790 gates with a 180000 ms per-gate deadline does not fit: the last
80// COMPLETE pass was stamped ts=1789417451 (778 rows); the passes after it wrote 1,502 and 694 rows and were cut
81// at the kill, so the conf's TAIL (nx_intlog_gate: 2 production rows in the whole journal) never ran again
82// and no heartbeat was written for four days. A BEAT KILLED BEFORE ITS TAIL STARVES THE SAME GATES EVERY DAY,
83// AND BECAUSE IT DIES BEFORE THE STAMP, ITS OWN LIVENESS SIGNAL GOES DARK EXACTLY WHEN IT IS FAILING.
84// Two changes, both on the beat verb only (trial is unchanged):
85//   ORDER  least-recently-run first, read from this beat's OWN journal (a gate with no row runs first; ties
86//          keep conf order), so a beat cut short still advances the stalest gates and no cursor file exists
87//          to corrupt -- the order is re-derived from evidence every beat.
88//   BUDGET the conf may state the scheduler's kill bound as DATA: a line `@dispatch_deadline_ms <ms>`. The
89//          beat then stops STARTING gates once the elapsed time plus the per-gate deadline would pass that
90//          bound, so every gate it starts can finish before the kill; the rest are DEFERRED and named. At
91//          least one gate always runs. No directive = no budget (the old behaviour, byte for byte).
92// The heartbeat is written by every beat that ends by itself and carries ran=, deferred=, never_run= and
93// oldest_age_s= (the roster's TRUE freshness), after the fields its readers already parse.
94const GRR_DIRECTIVE_DISPATCH: *u8 = "@dispatch_deadline_ms"
95const GRR_TAG_BEAT: *u8 = "roster"
96
97func grr_isid(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 48 { if c <= 57 { return 1 } }
  if c == 95 { return 1 }
  if c == 45 { return 1 }
  if c == 46 { return 1 }
  if c == 47 { return 1 }
  return 0
106}
107
108func grr_slot(t: *u8, i: i64) -> *u8 { return ((t as i64) + i * GRR_SLOT) as *u8 }
109
110// read a roster file into the name table; returns names, or -1 unreadable, -2 table full
111func grr_load(path: *u8, tbl: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(path, lenp)
  if lenp[0] <= 0 { return 0 - 1 }
  let n: i64 = lenp[0]
  var cnt: i64 = 0
  var i: i64 = 0
  while i < n {
      let e: i64 = gk_eol(b, i, n)
      var c0: i64 = i
      var fc: i64 = 0
      while fc == 0 {
          if c0 >= e { fc = 1 }
          if fc == 0 { if b[c0] == (32 as u8) { c0 = c0 + 1 } else { fc = 1 } }
      }
      var skip: i64 = 0
      if c0 >= e { skip = 1 }
      if skip == 0 { if b[c0] == (59 as u8) { skip = 1 } }
      if skip == 0 { if b[c0] == (35 as u8) { skip = 1 } }
      if skip == 0 {
          var t: i64 = c0
          var ft: i64 = 0
          while ft == 0 {
              if t >= e { ft = 1 }
              if ft == 0 { if grr_isid(b[t] as i64) == 1 { t = t + 1 } else { ft = 1 } }
          }
          if t > c0 {
              if cnt >= GRR_MAXG { sys_free_file(b, n); return 0 - 2 }
              let dst: *u8 = grr_slot(tbl, cnt)
              var q: i64 = 0
              while q < t - c0 { if q < GRR_SLOT - 1 { dst[q] = b[c0 + q] } q = q + 1 }
              if q > GRR_SLOT - 1 { q = GRR_SLOT - 1 }
              dst[q] = 0 as u8
              cnt = cnt + 1
          }
      }
      i = e + 1
  }
  sys_free_file(b, n)
  return cnt
151}
152
153// the conf's `@dispatch_deadline_ms <ms>` directive: the number, or -1 when the conf states none (or is unreadable)
154func grr_directive_ms(path: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(path, lenp)
  if lenp[0] <= 0 { return 0 - 1 }
  let n: i64 = lenp[0]
  let key: *u8 = GRR_DIRECTIVE_DISPATCH
  let kl: i64 = gk_len(key)
  let endp: *i64 = sys_mmap(16) as *i64
  var found: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      let e: i64 = gk_eol(b, i, n)
      if e - i > kl { if grr_runeq(b, i, i + kl, key) == 1 {
          var p: i64 = i + kl
          while p < e { if b[p] == (32 as u8) { p = p + 1 } else { break } }
          if p < e { let v: i64 = grr_num(b, p, endp); if endp[0] > p { found = v } }
      } }
      i = e + 1
  }
  sys_free_file(b, n)
  return found
175}
176
177// the newest epoch of a `tag` row naming each roster gate, from the beat's own journal: last[i] = -1 when the
178// journal carries none for gate i. Returns the journal rows read, or -1 when it is unreadable (every last[] = -1).
179func grr_lastrun(jrnl: *u8, tag: *u8, tbl: *u8, n: i64, last: *i64) -> i64 {
  var k: i64 = 0
  while k < n { last[k] = 0 - 1; k = k + 1 }
  let lenp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(jrnl, lenp)
  if lenp[0] <= 0 { return 0 - 1 }
  let bn: i64 = lenp[0]
  let endp: *i64 = sys_mmap(16) as *i64
  var rows: i64 = 0
  var i: i64 = 0
  while i < bn {
      let e: i64 = gk_eol(b, i, bn)
      // fields: epoch TAB tag TAB gate TAB ...
      var t1: i64 = i
      while t1 < e { if b[t1] == (9 as u8) { break } t1 = t1 + 1 }
      var t2: i64 = t1 + 1
      while t2 < e { if b[t2] == (9 as u8) { break } t2 = t2 + 1 }
      var t3: i64 = t2 + 1
      while t3 < e { if b[t3] == (9 as u8) { break } t3 = t3 + 1 }
      if t3 < e { if grr_runeq(b, t1 + 1, t2, tag) == 1 {
          let ep: i64 = grr_num(b, i, endp)
          if endp[0] == t1 {
              rows = rows + 1
              var j: i64 = 0
              while j < n {
                  if grr_runeq(b, t2 + 1, t3, grr_slot(tbl, j)) == 1 { if ep > last[j] { last[j] = ep } j = n } else { j = j + 1 }
              }
          }
      } }
      i = e + 1
  }
  sys_free_file(b, bn)
  return rows
212}
213
214// the run order: indices of tbl by last[] ascending (never-run first), ties in conf order -- a stable insertion sort
215func grr_order(last: *i64, n: i64, ord: *i64) -> i64 {
  var i: i64 = 0
  while i < n {
      var j: i64 = i
      while j > 0 { if last[ord[j - 1]] > last[i] { ord[j] = ord[j - 1]; j = j - 1 } else { break } }
      ord[j] = i
      i = i + 1
  }
  return n
224}
225
226// run one gate; append its journal line; returns 0 GREEN/SKIP, 1 RED/ABSENT/TIMEOUT
227func grr_one(name: *u8, tag: *u8, jfd: i64, ms: i64) -> i64 {
  let p: *u8 = sys_mmap(512)
  var o: i64 = gk_cat(p, 0, "./" as *u8)
  o = gk_cat(p, o, name)
  // a roster row may already carry .elf; do not double it
  var has_elf: i64 = 0
  let l: i64 = gk_len(name)
  if l > 4 { if name[l - 4] == (46 as u8) { if name[l - 3] == (101 as u8) { if name[l - 2] == (108 as u8) { if name[l - 1] == (102 as u8) { has_elf = 1 } } } } }
  if has_elf == 0 { o = gk_cat(p, o, ".elf" as *u8) }
  p[o] = 0 as u8
  var absent: i64 = 1
  let fd: i64 = sys_openat_rd(p)
  if fd >= 0 { absent = 0; sys_close(fd) }
  var ec: i64 = 127
  let ob: *u8 = sys_mmap(GRR_CAP)
  let ol: *i64 = sys_mmap(16) as *i64
  ol[0] = 0
  let t0: i64 = sys_now_ms()
  if absent == 0 {
      ec = gk_run_capture_ms(p, 0 as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ms, ob, GRR_CAP, ol)
  }
  let el: i64 = sys_now_ms() - t0
  // the REASON: last non-empty output line, sanitized (tabs/CRs -> space) and capped
  let reason: *u8 = sys_mmap(GRR_REASON_MAX + 8)
  reason[0] = 0 as u8
  if ol[0] > 0 {
      var re: i64 = ol[0]
      var fend: i64 = 0
      while fend == 0 {
          if re <= 0 { fend = 1 }
          if fend == 0 { if ob[re - 1] == (10 as u8) { re = re - 1 } else { if ob[re - 1] == (13 as u8) { re = re - 1 } else { fend = 1 } } }
      }
      var rsb: i64 = re
      var fstart: i64 = 0
      while fstart == 0 {
          if rsb <= 0 { fstart = 1 }
          if fstart == 0 { if ob[rsb - 1] == (10 as u8) { fstart = 1 } else { rsb = rsb - 1 } }
      }
      var rk: i64 = 0
      while rsb < re { if rk < GRR_REASON_MAX {
          var c: u8 = ob[rsb]
          if c == (9 as u8) { c = 32 as u8 }
          if c == (13 as u8) { c = 32 as u8 }
          reason[rk] = c
          rk = rk + 1 } rsb = rsb + 1 }
      reason[rk] = 0 as u8
  }
  var vname: *u8 = "RED" as *u8
  if ec == 0 { vname = "GREEN" as *u8 }
  if ec == 3 { vname = "SKIP" as *u8 }
  if absent == 1 { vname = "ABSENT" as *u8 }
  // TIMEOUT is the WATCHDOG'S verdict, not an elapsed-time guess: since gk_wait_code (2026-08-18) a
  // killed child returns 128+SIGKILL, so key on that. (The old `elapsed >= ms && rc != 0` rule labelled a
  // slow RED that exited 1 at the deadline as TIMEOUT -- measured on nx_planecap_gate.)
  if absent == 0 { if ec == GRR_SIGKILL_RC { vname = "TIMEOUT" as *u8 } }
  let ln: *u8 = sys_mmap(GRR_LINE)
  var lo: i64 = gk_catn(ln, 0, sys_now_realtime_sec())
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, tag)
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, name)
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, vname)
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, "exit=" as *u8)
  lo = gk_catn(ln, lo, ec)
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, "ms=" as *u8)
  lo = gk_catn(ln, lo, el)
  ln[lo] = 9 as u8; lo = lo + 1
  lo = gk_cat(ln, lo, reason)
  ln[lo] = 10 as u8; lo = lo + 1
  if jfd >= 0 { gk_write_all(jfd, ln, lo) }
  gk_say(ln, lo)
  if ec == 0 { return 0 }
  if ec == 3 { return 0 }
  return 1
304}
305
306// parse a non-negative decimal out of s starting at off; returns value, writes end to endp
307func grr_num(s: *u8, off: i64, endp: *i64) -> i64 {
  var v: i64 = 0
  var i: i64 = off
  var f: i64 = 0
  while f == 0 {
      if s[i] >= (48 as u8) { if s[i] <= (57 as u8) { v = v * 10 + ((s[i] as i64) - 48); i = i + 1 } else { f = 1 } } else { f = 1 }
  }
  endp[0] = i
  return v
316}
317
318// does the byte run b[s..e) equal the NUL-terminated literal? Length is DERIVED from the literal --
319// a hand-counted length beside a string spelled as character codes is two rule-11 defects at once,
320// and the build ratchet refused exactly that shape here before this helper existed (2026-08-18).
321func grr_runeq(b: *u8, rs: i64, re: i64, lit: *u8) -> i64 {
  let l: i64 = gk_len(lit)
  if re - rs != l { return 0 }
  var k: i64 = 0
  while k < l { if b[rs + k] != lit[k] { return 0 } k = k + 1 }
  return 1
327}
328
329// admit: journal -> conf (additive) + suspect list. See header. exit 0 done, 2 unreadable/usage.
330func grr_admit(jrnl: *u8, dls: *u8, argc: i64, argv: *i64) -> i64 {
  var conf: *u8 = GRR_CONF
  if argc >= 5 { conf = argv[4] as *u8 }
  // the suspect list defaults to a SIBLING of the conf (<conf>.suspect), never a fixed production path:
  // a caller that points admit at a fixture conf must not have its suspects land in production
  // (the fixture-sharing law), and a bounded 4-arg runner cannot always pass the fifth argument.
  let sdef: *u8 = sys_mmap(GRR_SLOT * 4)
  var so: i64 = gk_cat(sdef, 0, conf)
  so = gk_cat(sdef, so, ".suspect" as *u8)
  sdef[so] = 0 as u8
  var susp: *u8 = sdef
  if argc >= 6 { susp = argv[5] as *u8 }
  let endp: *i64 = sys_mmap(16) as *i64
  let deadline: i64 = grr_num(dls, 0, endp)
  let msg: *u8 = sys_mmap(GRR_MSG)
  var o: i64 = 0
  if deadline <= 0 {
      o = gk_cat(msg, 0, "nx_gate_roster_run admit: REFUSED -- deadline_ms must be a positive number (the value the trial ran with)\n" as *u8)
      gk_say(msg, o)
      return 2
  }
  let lenp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(jrnl, lenp)
  if lenp[0] <= 0 {
      o = gk_cat(msg, 0, "nx_gate_roster_run admit: journal unreadable: " as *u8)
      o = gk_cat(msg, o, jrnl)
      o = gk_cat(msg, o, "\n" as *u8)
      gk_say(msg, o)
      return 2
  }
  let n: i64 = lenp[0]
  // latest-row-wins tables (append-only journal: later rows overwrite earlier entries by gate)
  let gname: *u8 = sys_mmap(GRR_MAXG * GRR_SLOT)
  let gverd: *i64 = sys_mmap(GRR_MAXG * 8) as *i64      // 1 GREEN 2 SKIP 3 RED 4 ABSENT 5 TIMEOUT 0 unknown
  let gms:   *i64 = sys_mmap(GRR_MAXG * 8) as *i64
  var ng: i64 = 0
  var rows: i64 = 0
  var overflow: i64 = 0
  var i: i64 = 0
  while i < n {
      let e: i64 = gk_eol(b, i, n)
      // fields: epoch TAB tag TAB gate TAB verdict TAB exit=N TAB ms=N
      var f: i64 = 0
      var fs: i64 = i
      var gs: i64 = 0
      var ge: i64 = 0
      var vs: i64 = 0
      var ve: i64 = 0
      var ms: i64 = 0 - 1
      var t: i64 = i
      while t <= e {
          var atend: i64 = 0
          if t == e { atend = 1 }
          if atend == 0 { if b[t] == (9 as u8) { atend = 1 } }
          if atend == 1 {
              if f == 2 { gs = fs; ge = t }
              if f == 3 { vs = fs; ve = t }
              if f == 5 {
                  let msp: *u8 = "ms=" as *u8
                  let mspl: i64 = gk_len(msp)
                  if t - fs > mspl { ms = grr_num(b, fs + mspl, endp) }
              }
              f = f + 1
              fs = t + 1
          }
          t = t + 1
      }
      if ge > gs {
          if ve > vs {
              rows = rows + 1
              var verd: i64 = 0
              if grr_runeq(b, vs, ve, "GREEN" as *u8) == 1 { verd = 1 }
              if grr_runeq(b, vs, ve, "SKIP" as *u8) == 1 { verd = 2 }
              if grr_runeq(b, vs, ve, "RED" as *u8) == 1 { verd = 3 }
              if grr_runeq(b, vs, ve, "ABSENT" as *u8) == 1 { verd = 4 }
              if grr_runeq(b, vs, ve, "TIMEOUT" as *u8) == 1 { verd = 5 }
              // find or append the gate
              var idx: i64 = 0 - 1
              var j: i64 = 0
              while j < ng {
                  var eq: i64 = 1
                  var k: i64 = 0
                  let sl: *u8 = grr_slot(gname, j)
                  while k < ge - gs { if sl[k] != b[gs + k] { eq = 0; k = ge } else { k = k + 1 } }
                  if k <= ge - gs { if sl[ge - gs] != (0 as u8) { eq = 0 } }
                  if eq == 1 { idx = j; j = ng } else { j = j + 1 }
              }
              if idx < 0 {
                  if ng >= GRR_MAXG { overflow = 1 }
                  if overflow == 0 {
                      let dst: *u8 = grr_slot(gname, ng)
                      var q: i64 = 0
                      while q < ge - gs { if q < GRR_SLOT - 1 { dst[q] = b[gs + q] } q = q + 1 }
                      if q > GRR_SLOT - 1 { q = GRR_SLOT - 1 }
                      dst[q] = 0 as u8
                      idx = ng
                      ng = ng + 1
                  }
              }
              if idx >= 0 { gverd[idx] = verd; gms[idx] = ms }
          }
      }
      i = e + 1
  }
  sys_free_file(b, n)
  if overflow == 1 {
      o = gk_cat(msg, 0, "nx_gate_roster_run admit: REFUSED -- journal names more gates than GRR_MAXG; a truncated admission silently drops gates\n" as *u8)
      gk_say(msg, o)
      return 2
  }
  // load the existing conf so admission is a MERGE (additive), never a clobber
  let have: *u8 = sys_mmap(GRR_MAXG * GRR_SLOT)
  var nh: i64 = grr_load(conf, have)
  if nh < 0 { nh = 0 }
  // classify + build outputs
  let cb: *u8 = sys_mmap(GRR_MAXG * GRR_SLOT)
  var co: i64 = 0
  let sb: *u8 = sys_mmap(GRR_MAXG * GRR_SLOT)
  var so: i64 = gk_cat(sb, 0, "; NX-DERIVED by nx_gate_roster_run admit: legacy at-deadline GREEN rows (runner-kill class) -- re-trial these on the fixed runner\n" as *u8)
  var admitted: i64 = 0
  var already: i64 = 0
  var suspects: i64 = 0
  var rejected: i64 = 0
  var gi: i64 = 0
  while gi < ng {
      let nm: *u8 = grr_slot(gname, gi)
      var cls: i64 = 0                                   // 1 admit, 2 suspect, 3 reject
      if gverd[gi] == 2 { cls = 1 }
      if gverd[gi] == 1 {
          cls = 1
          if gms[gi] >= deadline { cls = 2 }
      }
      if cls == 0 { cls = 3 }
      if cls == 1 {
          var dup: i64 = 0
          var hj: i64 = 0
          while hj < nh { if gk_streq(grr_slot(have, hj), nm) == 1 { dup = 1; hj = nh } else { hj = hj + 1 } }
          if dup == 1 { already = already + 1 }
          if dup == 0 {
              co = gk_cat(cb, co, nm)
              cb[co] = 10 as u8
              co = co + 1
              admitted = admitted + 1
          }
      }
      if cls == 2 {
          so = gk_cat(sb, so, nm)
          sb[so] = 10 as u8
          so = so + 1
          suspects = suspects + 1
      }
      if cls == 3 { rejected = rejected + 1 }
      gi = gi + 1
  }
  // append the new admissions to the conf (create it with a header if absent)
  if admitted > 0 {
      if nh == 0 {
          let hdr: *u8 = "; gateroster.conf -- gates the beat runs; rows are ADMITTED by `nx_gate_roster_run admit` from trial journals (GREEN/SKIP under deadline). Additive: never hand-remove without naming why.\n" as *u8
          let hfd: i64 = sys_openat_append(conf, GRR_MODE)
          if hfd >= 0 { gk_write_all(hfd, hdr, gk_len(hdr)); sys_close(hfd) }
      }
      let afd: i64 = sys_openat_append(conf, GRR_MODE)
      if afd < 0 {
          o = gk_cat(msg, 0, "nx_gate_roster_run admit: cannot open conf for append: " as *u8)
          o = gk_cat(msg, o, conf)
          o = gk_cat(msg, o, "\n" as *u8)
          gk_say(msg, o)
          return 2
      }
      cb[co] = 0 as u8
      gk_write_all(afd, cb, co)
      sys_close(afd)
  }
  sb[so] = 0 as u8
  let sw: i64 = gk_write(susp, sb)
  o = gk_cat(msg, 0, "nx_gate_roster_run admit: journal_rows=" as *u8); o = gk_catn(msg, o, rows)
  o = gk_cat(msg, o, " gates=" as *u8); o = gk_catn(msg, o, ng)
  o = gk_cat(msg, o, " admitted_new=" as *u8); o = gk_catn(msg, o, admitted)
  o = gk_cat(msg, o, " already_in_conf=" as *u8); o = gk_catn(msg, o, already)
  o = gk_cat(msg, o, " suspects=" as *u8); o = gk_catn(msg, o, suspects)
  o = gk_cat(msg, o, " rejected=" as *u8); o = gk_catn(msg, o, rejected)
  o = gk_cat(msg, o, " (admitted+already+suspects+rejected=" as *u8)
  o = gk_catn(msg, o, admitted + already + suspects + rejected)
  o = gk_cat(msg, o, " == gates: " as *u8)
  if admitted + already + suspects + rejected == ng { o = gk_cat(msg, o, "partition RECONCILES)" as *u8) }
  if admitted + already + suspects + rejected != ng { o = gk_cat(msg, o, "PARTITION LEAK)" as *u8) }
  o = gk_cat(msg, o, "\n  conf=" as *u8); o = gk_cat(msg, o, conf)
  o = gk_cat(msg, o, " suspects_wrote=" as *u8); o = gk_catn(msg, o, sw)
  o = gk_cat(msg, o, " of=" as *u8); o = gk_cat(msg, o, susp)
  o = gk_cat(msg, o, "\n" as *u8)
  gk_say(msg, o)
  return 0
522}
523
524func main(argc: i64, argv: *i64) -> i64 {
  // the pass budget is measured from the moment the process starts: the scheduler's kill counts from there too
  let t_start: i64 = sys_now_ms()
  // ARGLESS IS NOT THE BEAT (2026-08-20). This organ's argless default USED to be the FULL PRODUCTION
  // BEAT: every row of knowledge/gateroster.conf, appending knowledge/status/gateroster.jrnl and
  // writing the cron-watched heartbeat. Every proof tool in the estate probes an organ ARGLESS --
  // nx_behaveprobe runs LIVE and STAGED that way, nx_adoptgate drives nx_behaveprobe, nx_organ_ship
  // composes nx_adoptgate -- so the default meant proving this organ ran the daily beat TWICE and let
  // a STAGED, unpromoted binary write production state.
  // AN ORGAN WHOSE ARGLESS DEFAULT IS A PRODUCTION MUTATION CANNOT BE SAFELY PROBED, AND EVERY PROOF
  // TOOL IN THE ESTATE PROBES ARGLESS.
  // Fixed at the SHAPE rather than by asking callers to remember: argless prints usage and mutates
  // NOTHING. CHECKED BEFORE CHANGING, NOT ASSUMED: all four live clock rows already name their verb
  // explicitly in the clocksched- plane (`beat <conf> <journal> <ms>`, two `trial ...` rows and one
  // `admit ...`), so the beat and its retrial/admit siblings are untouched by this.
  if argc < 2 {
      let u0: *u8 = "nx_gate_roster_run: REFUSED -- argless does NOTHING, deliberately. The production beat mutates the roster journal AND the cron-watched heartbeat, and every proof tool in the estate probes an organ with no arguments; an argless default that runs the beat makes this organ unprovable and lets a staged binary write production state. Name the verb.\nusage: nx_gate_roster_run beat [conf] [journal] [ms] | trial <listfile> [journal] [ms] | admit <journal> <deadline_ms> [conf] [suspectlist]\n" as *u8
      gk_say(u0, gk_len(u0))
      return 2
  }
  var verb: *u8 = argv[1] as *u8
  var conf: *u8 = GRR_CONF
  var jrnl: *u8 = GRR_JRNL
  var ms: i64 = GRR_MS_DEFAULT
  var tag: *u8 = "roster" as *u8
  var trial: i64 = 0
  if gk_streq(verb, "admit" as *u8) == 1 {
      if argc < 4 {
          let ua: *u8 = "usage: nx_gate_roster_run admit <journal> <deadline_ms> [conf] [suspectlist]\n" as *u8
          gk_say(ua, gk_len(ua))
          return 2
      }
      return grr_admit(argv[2] as *u8, argv[3] as *u8, argc, argv)
  }
  if gk_streq(verb, "trial" as *u8) == 1 { trial = 1; tag = "trial" as *u8 }
  if trial == 0 { if gk_streq(verb, "beat" as *u8) == 0 {
      let u0: *u8 = "usage: nx_gate_roster_run [beat [conf] [journal] [ms]] | trial <listfile> [journal] [ms]\n" as *u8
      gk_say(u0, gk_len(u0)); return 2 } }
  if trial == 1 { if argc < 3 { let u: *u8 = "usage: nx_gate_roster_run trial <listfile> [journal] [ms]\n" as *u8; gk_say(u, gk_len(u)); return 2 } conf = argv[2] as *u8 }
  if trial == 0 { if argc >= 3 { conf = argv[2] as *u8 } }
  if argc >= 4 { jrnl = argv[3] as *u8 }
  if argc >= 5 {
      let a4: *u8 = argv[4] as *u8
      var v: i64 = 0
      var i: i64 = 0
      while a4[i] != (0 as u8) { if a4[i] >= (48 as u8) { if a4[i] <= (57 as u8) { v = v * 10 + ((a4[i] as i64) - 48) } } i = i + 1 }
      if v > 0 { ms = v }
  }
  if ep_anchor() < 0 {
      let u2: *u8 = "nx_gate_roster_run: UNOBSERVABLE -- no estate root on this host\n" as *u8
      gk_say(u2, gk_len(u2))
      return 2
  }
  sys_setpriority(GRR_NICE)
  let tbl: *u8 = sys_mmap(GRR_MAXG * GRR_SLOT)
  let n: i64 = grr_load(conf, tbl)
  let msg: *u8 = sys_mmap(GRR_MSG)
  var o: i64 = 0
  if n == (0 - 1) { o = gk_cat(msg, 0, "nx_gate_roster_run: roster unreadable: " as *u8); o = gk_cat(msg, o, conf); o = gk_cat(msg, o, "\n" as *u8); gk_say(msg, o); return 2 }
  if n == (0 - 2) { o = gk_cat(msg, 0, "nx_gate_roster_run: REFUSED -- roster exceeds GRR_MAXG rows; a truncated roster silently drops gates\n" as *u8); gk_say(msg, o); return 2 }
  let jfd: i64 = sys_openat_append(jrnl, GRR_MODE)
  o = gk_cat(msg, 0, "nx_gate_roster_run: " as *u8); o = gk_cat(msg, o, tag)
  o = gk_cat(msg, o, " rows=" as *u8); o = gk_catn(msg, o, n)
  o = gk_cat(msg, o, " conf=" as *u8); o = gk_cat(msg, o, conf)
  o = gk_cat(msg, o, " journal=" as *u8); o = gk_cat(msg, o, jrnl)
  o = gk_cat(msg, o, " deadline_ms=" as *u8); o = gk_catn(msg, o, ms)
  o = gk_cat(msg, o, " nice=" as *u8); o = gk_catn(msg, o, GRR_NICE)
  o = gk_cat(msg, o, "\n" as *u8)
  gk_say(msg, o)
  // ORDER and BUDGET, the beat only: least-recently-run first, and no gate started that could outlive the
  // scheduler's kill. A trial runs its list once, in list order, exactly as before.
  let last: *i64 = sys_mmap((n + 1) * 8) as *i64
  let ord: *i64 = sys_mmap((n + 1) * 8) as *i64
  var k0: i64 = 0
  while k0 < n { ord[k0] = k0; last[k0] = 0 - 1; k0 = k0 + 1 }
  var jrows: i64 = 0 - 1
  var dispatch: i64 = 0 - 1
  if trial == 0 {
      jrows = grr_lastrun(jrnl, GRR_TAG_BEAT, tbl, n, last)
      grr_order(last, n, ord)
      dispatch = grr_directive_ms(conf)
      o = gk_cat(msg, 0, "nx_gate_roster_run: order=least-recently-run-first journal_rows_read=" as *u8)
      o = gk_catn(msg, o, jrows)
      if dispatch > 0 {
          o = gk_cat(msg, o, " dispatch_deadline_ms=" as *u8); o = gk_catn(msg, o, dispatch)
          o = gk_cat(msg, o, " pass_budget_ms=" as *u8); o = gk_catn(msg, o, dispatch - ms)
          o = gk_cat(msg, o, " (the conf's scheduler kill bound minus the per-gate deadline: a gate is started only if it can finish before the kill)" as *u8)
      } else { o = gk_cat(msg, o, " pass_budget=none (the conf states no @dispatch_deadline_ms)" as *u8) }
      o = gk_cat(msg, o, "\n" as *u8)
      gk_say(msg, o)
  }
  var bad: i64 = 0
  var green: i64 = 0
  var ran: i64 = 0
  var deferred: i64 = 0
  var i: i64 = 0
  while i < n {
      let gi: i64 = ord[i]
      var go: i64 = 1
      // >= and never >: a gate whose deadline lands ON the kill bound is still killed there, so it must not start
      if dispatch > 0 { if ran > 0 { if sys_now_ms() - t_start + ms >= dispatch { go = 0 } } }
      if go == 1 {
          let r: i64 = grr_one(grr_slot(tbl, gi), tag, jfd, ms)
          if r == 0 { green = green + 1 }
          bad = bad + r
          ran = ran + 1
          last[gi] = sys_now_realtime_sec()
      } else { deferred = deferred + 1 }
      i = i + 1
  }
  if jfd >= 0 { sys_close(jfd) }
  // the roster's TRUE freshness after this beat: how many gates have never run, and the oldest last run
  let nowe: i64 = sys_now_realtime_sec()
  var never: i64 = 0
  var oldest: i64 = 0 - 1
  var q0: i64 = 0
  while q0 < n {
      if last[q0] < 0 { never = never + 1 } else { if nowe - last[q0] > oldest { oldest = nowe - last[q0] } }
      q0 = q0 + 1
  }
  if deferred > 0 {
      o = gk_cat(msg, 0, "nx_gate_roster_run: DEFERRED " as *u8); o = gk_catn(msg, o, deferred)
      o = gk_cat(msg, o, " gate(s) to the next beat: the pass budget was spent, and the stalest ran first\n" as *u8)
      gk_say(msg, o)
  }
  // ---- HEARTBEAT: written because the PASS COMPLETED, and deliberately NOT gated on the verdict.
  // nx_cron_watch is a dead-man's switch for the BEAT, not a health check for the gates -- their
  // verdicts are already collected per row in the journal above.
  //   A LIVENESS SIGNAL MADE CONDITIONAL ON HEALTH GOES SILENT EXACTLY WHEN THINGS ARE FAILING,
  //   WHICH IS THE ONE MOMENT IT HAS TO SPEAK.
  // A 630-row roster is essentially never all-green, so a GREEN-only stamp would never be written at
  // all and the watch would read STALE forever -- a stuck alarm, which is worse than no watch.
  // TRIAL DOES NOT STAMP: a hand-run must never forge the beat's heartbeat, or the dead-man's switch
  // reports fresh because some seat happened to run a trial.
  if trial == 0 {
      var so: i64 = gk_cat(msg, 0, "ts=" as *u8)
      so = gk_catn(msg, so, sys_now_realtime_sec())
      so = gk_cat(msg, so, " rows=" as *u8); so = gk_catn(msg, so, n)
      so = gk_cat(msg, so, " green_or_skip=" as *u8); so = gk_catn(msg, so, green)
      so = gk_cat(msg, so, " red_absent_timeout=" as *u8); so = gk_catn(msg, so, bad)
      so = gk_cat(msg, so, " ran=" as *u8); so = gk_catn(msg, so, ran)
      so = gk_cat(msg, so, " deferred=" as *u8); so = gk_catn(msg, so, deferred)
      so = gk_cat(msg, so, " never_run=" as *u8); so = gk_catn(msg, so, never)
      so = gk_cat(msg, so, " oldest_age_s=" as *u8); so = gk_catn(msg, so, oldest)
      so = gk_cat(msg, so, "\n" as *u8)
      // gk_cat/gk_catn return an OFFSET and do NOT terminate, and `msg` still holds the header built
      // above -- so without this byte gk_write's gk_len() would run past the stamp and append the
      // previous message's tail. A BUFFER REUSED WITHOUT TERMINATION CARRIES THE LAST MESSAGE'S TAIL.
      msg[so] = 0 as u8
      // ---- ONLY THE PRODUCTION BEAT MAY WRITE THE PRODUCTION HEARTBEAT (2026-08-20) ----
      // GRR_STAMP is a CONSTANT path, so before this ANY caller that passed a fixture conf or a
      // scratch journal still stamped production: `beat /tmp/x.conf /tmp/x.jrnl` forged the
      // cron-watched liveness signal for a run that touched no production row.
      // A LIVENESS SIGNAL ANY CALLER CAN WRITE IS A DEAD-MAN'S SWITCH ANY CALLER CAN HOLD DOWN.
      // THIS ORGAN ALREADY KNEW THE LAW AND HAD WIRED IT INTO ONE VERB ONLY: `admit` defaults its
      // suspect list to a SIBLING of the conf so a fixture run cannot write a production artifact,
      // and the comment above says a hand-run must never forge the beat's heartbeat -- while the
      // beat verb wrote a fixed production path regardless of what it had just measured.
      // MEASURED BEFORE THE FIX: the live stamp read rows=1 while knowledge/gateroster.conf held
      // hundreds of rows, i.e. the last writer of the production heartbeat was NOT the production
      // beat -- and nx_cron_watch was reading that as FRESH.
      // A non-default run still stamps, BESIDE ITS OWN JOURNAL and announced, because writing
      // nothing at all would trade a forged heartbeat for an invisible one.
      var stamp: *u8 = GRR_STAMP
      var offbeat: i64 = 0
      if gk_streq(conf, GRR_CONF) == 0 { offbeat = 1 }
      if gk_streq(jrnl, GRR_JRNL) == 0 { offbeat = 1 }
      if offbeat == 1 {
          let sp: *u8 = sys_mmap(GRR_SLOT * 8)
          var spo: i64 = gk_cat(sp, 0, jrnl)
          spo = gk_cat(sp, spo, ".stamp" as *u8)
          sp[spo] = 0 as u8
          stamp = sp
          let m2: *u8 = sys_mmap(GRR_MSG)
          var wo: i64 = gk_cat(m2, 0, "nx_gate_roster_run: NOT the production beat (conf or journal is not the default) -- heartbeat written beside its own journal at " as *u8)
          wo = gk_cat(m2, wo, stamp)
          wo = gk_cat(m2, wo, " and deliberately NOT to " as *u8)
          wo = gk_cat(m2, wo, GRR_STAMP)
          wo = gk_cat(m2, wo, "\n" as *u8)
          gk_say(m2, wo)
      }
      if gk_write(stamp, msg) < 0 {
          let hw: *u8 = "nx_gate_roster_run: WARN heartbeat NOT written -- the liveness watch will read STALE\n" as *u8
          gk_say(hw, gk_len(hw))
      }
  }
  o = gk_cat(msg, 0, "nx_gate_roster_run: " as *u8); o = gk_cat(msg, o, tag)
  o = gk_cat(msg, o, " done rows=" as *u8); o = gk_catn(msg, o, n)
  o = gk_cat(msg, o, " ran=" as *u8); o = gk_catn(msg, o, ran)
  o = gk_cat(msg, o, " deferred=" as *u8); o = gk_catn(msg, o, deferred)
  o = gk_cat(msg, o, " green_or_skip=" as *u8); o = gk_catn(msg, o, green)
  o = gk_cat(msg, o, " red_absent_timeout=" as *u8); o = gk_catn(msg, o, bad)
  if trial == 1 { o = gk_cat(msg, o, " (trial: reported, not judged)\nverdict=TRIAL\n" as *u8); gk_say(msg, o); return 0 }
  if bad > 0 { o = gk_cat(msg, o, "\nverdict=RED\n" as *u8); gk_say(msg, o); return 1 }
  o = gk_cat(msg, o, "\nverdict=GREEN\n" as *u8)
  gk_say(msg, o)
  return 0
721}
nx_gate_roster_run.nx source

`nx_gate_roster_run.nx` source
