code wiki / _hdl_build / nx_itoaclone.nx
`nx_itoaclone.nx` source

↩ module page · 583 lines · 26644 B
1// nx_itoaclone.nx -- census of HAND-ROLLED integer->decimal emitters that SILENTLY DROP NEGATIVES.
2//
3// WHY THIS EXISTS. nx_matter_lib.mt_catn -- the number formatter for the BILLING/matter lane -- emitted
4// ZERO BYTES for any v < 0: its digit loop is `while m > 0` and the only special case was `m == 0`, so a
5// negative rendered as an EMPTY FIELD. Caught 2026-08-15 by a values-dump in nx_billing_gate printing
6// `overdraw_rc=` with nothing after it. The value was -1, the REFUSAL SENTINEL, and the tooth asserting
7// it was PASSING the whole time.
8// **A NUMBER FORMATTER THAT EMITS NOTHING FOR A NEGATIVE TURNS AN ERROR CODE INTO AN ABSENT FIELD, AND AN
9// ABSENT FIELD READS AS "NOT MEASURED" RATHER THAN "MEASURED, AND NEGATIVE"** -- the worst available
10// direction to fail, because every positive value keeps printing perfectly and nothing looks wrong.
11//
12// THE CLASS IS NOT ONE SITE. A literal grep for the digit-emit idiom returns matches=2545 over 23,169
13// files (corpus_complete=1) -- roughly 29x the "~87 sites" nx_itoa_lib's own header estimates, so that
14// estimate is stale. Reading 2545 sites is not an option and SAMPLING them would answer the wrong
15// question: rare and empty demand different decisions, and only a full pass can tell them apart.
16//
17// WHAT IT MEASURES. Per function (split on a line-initial `func `), a body is an EMITTER if it contains
18// the ASCII-digit idiom (a `48 +` next to a `% 10`). An emitter is NEGATIVE-SAFE if that same body
19// contains a `< 0` test; otherwise it DROPS NEGATIVES.
20//
21// DECLARED IMPRECISION -- read this before trusting a number:
22//   * FLOOR, NOT A TOTAL. Emitters whose digit base is a NAMED CONST (`SG_D0 + (x % 10)`) or that build
23//     digits MSB-first via a power-of-ten walk are NOT matched by the `48 +` anchor. The real emitter
24//     population is >= what this reports.
25//   * The `< 0` test is presence-in-body, not dataflow. A body containing an UNRELATED `< 0` is scored
26//     SAFE, so this UNDER-reports the defect. That direction is deliberate: a detector with false
27//     positives is worse than none, because everyone learns to ignore it. Every offender is NAMED so the
28//     claim is checkable one file at a time rather than taken on faith.
29//   * The verdict binds to this organ's OWN CONTROLS (bite + positive control + coverage), NEVER to the
30//     offender count. An uncalibrated classifier must report numbers, not verdicts.
31// license_tier: ORIGINAL   Read-only: opens sources, writes nothing outside /tmp fixtures.
32import "nx_syscalls.nx"
33import "nx_gate_verdict.nx"
34import "nx_itoa_lib.nx"
35
36const IC_DIRBUF: i64 = 131072
37const IC_PATHBUF: i64 = 4096
38// Offender-identity set. ~900 rows x <256 B; 1 MiB is headroom, allocated ONCE per run.
39const IC_SETBUF: i64 = 1048576
40
41func ic_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
42func ic_p(s: *u8) -> i64 { sys_write(1, s, ic_len(s)); return 0 }
43func ic_n(v: i64) -> i64 { return nxi_out(v) }
44func ic_nl() -> i64 { let b: *u8 = sys_mmap(8); b[0] = 10 as u8; sys_write(1, b, 1); sys_munmap(b, 8); return 0 }
45
46// is buf[a,b) containing pat?  presence only
47func ic_has(buf: *u8, a: i64, b: i64, pat: *u8) -> i64 {
  let pl: i64 = ic_len(pat)
  if pl <= 0 { return 0 }
  var i: i64 = a
  var found: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i + pl > b { go = 0 }
      else {
          var k: i64 = 0
          var ok: i64 = 1
          while k < pl {
              if buf[i + k] != pat[k] { ok = 0; k = pl } else { k = k + 1 }
          }
          if ok == 1 { found = 1; go = 0 } else { i = i + 1 }
      }
  }
  return found
65}
66
67// ★Blank every // comment (OUTSIDE string literals) to spaces, preserving newlines and offsets.
68// WITHOUT THIS THE DETECTOR MEASURES PROSE. A function's range here runs to the NEXT line-initial
69// `func `, so it absorbs the comment block that FOLLOWS it -- and this organ's own real-world positive
70// control caught exactly that: nx_itoa_lib.ccz_cat_num builds digits from NAMED constants
71// (CCZ_ASCII_0 + ((m / pw) % CCZ_DEC)), so it contains no literal `48 +` or `% 10` at all; the match
72// came from a neighbouring COMMENT describing the idiom, and the canon control went FAIL.
73// ★★A SCANNER THAT DOES NOT SKIP COMMENTS MEASURES THE DOCUMENTATION, NOT THE CODE -- and the file it
74// is most likely to misread is the one whose comments EXPLAIN the very pattern it hunts.
75// Strings are tracked so a "http://..." literal cannot blank the rest of a real code line.
76func ic_strip(buf: *u8, n: i64) -> i64 {
  var i: i64 = 0
  var ins: i64 = 0
  while i < n {
      let ch: i64 = buf[i] as i64
      if ins == 1 {
          if ch == 92 { i = i + 1 }
          else {
              if ch == 34 { ins = 0 }
          }
      } else {
          if ch == 34 { ins = 1 }
          else {
              if ch == 47 {
                  if i + 1 < n {
                      if buf[i + 1] == (47 as u8) {
                          var j: i64 = i
                          var go: i64 = 1
                          while go == 1 {
                              if j >= n { go = 0 }
                              else {
                                  if buf[j] == (10 as u8) { go = 0 }
                                  else { buf[j] = 32 as u8; j = j + 1 }
                              }
                          }
                          i = j - 1
                      }
                  }
              }
          }
      }
      i = i + 1
  }
  return 0
110}
111
112func ic_bol(buf: *u8, i: i64) -> i64 {
  if i == 0 { return 1 }
  if buf[i - 1] == (10 as u8) { return 1 }
  return 0
116}
117
118// index >= i of the next line-initial "func ", or n. Separate cursor + flag: never clobber the cursor
119// to exit, or the loop cannot also report where it stopped.
120func ic_next_func(buf: *u8, n: i64, i: i64) -> i64 {
  var j: i64 = i
  var res: i64 = n
  var go: i64 = 1
  while go == 1 {
      if j + 5 > n { go = 0 }
      else {
          var hit: i64 = 0
          if ic_bol(buf, j) == 1 {
              if buf[j] == (102 as u8) {
                  if buf[j + 1] == (117 as u8) {
                      if buf[j + 2] == (110 as u8) {
                          if buf[j + 3] == (99 as u8) {
                              if buf[j + 4] == (32 as u8) { hit = 1 }
                          }
                      }
                  }
              }
          }
          if hit == 1 { res = j; go = 0 } else { j = j + 1 }
      }
  }
  return res
143}
144
145// print buf[a,b) clipped at the first newline -- the function's signature line
146func ic_sig(buf: *u8, a: i64, b: i64) -> i64 {
  var e: i64 = a
  var go: i64 = 1
  while go == 1 {
      if e >= b { go = 0 }
      else {
          if buf[e] == (10 as u8) { go = 0 } else { e = e + 1 }
      }
  }
  sys_write(1, (buf as i64 + a) as *u8, e - a)
  return 0
157}
158
159// ★NAME-SET RATCHET SUPPORT. A COUNT-RATCHET ON A SHARED TREE REPORTS THAT SOMETHING MOVED WITHOUT
160// SAYING WHAT, AND -- proven on this very organ -- IT BLESSES A PRECISION CHANGE AS PROGRESS: widening
161// the safe-check to accept `<= 0` reclassified 49 emitters and the count-ratchet logged
162// "TIGHTENED by 49" although NOTHING IN THE ESTATE HAD CHANGED. A set of NAMES cannot do that: a rise
163// names the arrival, a fall names the departure, and a reclassification is visible as 49 names LEAVING
164// rather than a number shrinking. Same shape as nishi-ops/unwired.baseline.
165// Identity is "<path>|<funcname>" -- path alone collides (several emitters per file) and funcname alone
166// collides estate-wide (g_pn/catn are everywhere).
167func ic_offid(path: *u8, buf: *u8, s: i64, e: i64, out: *u8) -> i64 {
  var o: i64 = 0
  var i: i64 = 0
  while path[i] != (0 as u8) { out[o] = path[i]; o = o + 1; i = i + 1 }
  out[o] = 124 as u8
  o = o + 1
  var p: i64 = s + 5
  var go: i64 = 1
  while go == 1 {
      if p >= e { go = 0 }
      else {
          if buf[p] == (40 as u8) { go = 0 }
          else { out[o] = buf[p]; o = o + 1; p = p + 1 }
      }
  }
  out[o] = 0 as u8
  return o
184}
185
186// exact-LINE membership: the line must start at a line boundary and end at one, so a short id can never
187// match inside a longer one (path|g_pn vs path|g_pnx).
188func ic_line_in(hay: *u8, hn: i64, line: *u8, ll: i64) -> i64 {
  if ll <= 0 { return 0 }
  var i: i64 = 0
  var found: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i + ll > hn { go = 0 }
      else {
          var atbol: i64 = 0
          if i == 0 { atbol = 1 }
          if i > 0 {
              if hay[i - 1] == (10 as u8) { atbol = 1 }
          }
          var ok: i64 = 0
          if atbol == 1 {
              ok = 1
              var k: i64 = 0
              while k < ll {
                  if hay[i + k] != line[k] { ok = 0; k = ll } else { k = k + 1 }
              }
              if ok == 1 {
                  if i + ll < hn {
                      if hay[i + ll] != (10 as u8) { ok = 0 }
                  }
              }
          }
          if ok == 1 { found = 1; go = 0 } else { i = i + 1 }
      }
  }
  return found
218}
219
220// classify one source buffer. ctr[0]=emitters ctr[1]=safe ctr[2]=drops. verbose names each offender.
221// c[4] = BY-DESIGN: emitters in a file that DECLARES the omission is intentional.
222// ★★WHETHER A MISSING SIGN BRANCH IS A DEFECT OR THE DESIGN IS A CONTRACT QUESTION AND NO SCANNER CAN
223// ANSWER IT. nx_g_pn_lite_lib is the proof: it is a DELIBERATE negative-free subset whose superset
224// (nx_g_pn_lib) carries the branch, and a superset self-check already refuses one for the other --
225// "fixing" it would collapse the pair. So intent is DECLARED IN THE SOURCE and read here, exactly as
226// organ_kind.conf declares an organ's kind instead of letting a classifier infer it.
227// ⚠The marker is read from the RAW buffer BEFORE ic_strip runs, because it lives in a comment and the
228// stripper would erase the very declaration it must honour.
229func ic_classify(path: *u8, buf: *u8, n: i64, c: *i64, verbose: i64, setb: *u8) -> i64 {
  var bydesign: i64 = 0
  if ic_has(buf, 0, n, "NX-ITOA-NEGATIVE-FREE-BY-DESIGN" as *u8) == 1 { bydesign = 1 }
  ic_strip(buf, n)
  var s: i64 = ic_next_func(buf, n, 0)
  while s < n {
      let e: i64 = ic_next_func(buf, n, s + 5)
      var em: i64 = 0
      if ic_has(buf, s, e, "% 10" as *u8) == 1 {
          if ic_has(buf, s, e, "48 +" as *u8) == 1 { em = 1 }
      }
      if ic_has(buf, s, e, "%10" as *u8) == 1 {
          if ic_has(buf, s, e, "48+" as *u8) == 1 { em = 1 }
      }
      if em == 1 {
          c[0] = c[0] + 1
          // ★THE SAME PREDICATE IN A SECOND SPELLING IS INVISIBLE TO A SUBSTRING SCANNER. `v <= 0` does
          // NOT contain "< 0" (an '=' sits between the '<' and the space), so nx_manga_shelf_lib.msl_catn
          // -- which CLAMPS negatives to "0" and never emits an empty field -- was reported as a drop.
          // Found by READING a flagged file, the second false positive caught that way. Both spellings
          // are now accepted, and both orderings of the guard.
          // ⚠DECLARED IMPRECISION: a `<= 0` clamp renders a negative as "0", which is NOT this detector's
          // subject (it emits BYTES, not an absent field) but is still a silent value change. It is
          // counted SAFE here because the question asked is "does a negative VANISH?" -- a clamp census
          // is a different instrument, and folding two questions into one counter is how a bucket named
          // for one thing ends up holding another.
          var safe: i64 = 0
          if ic_has(buf, s, e, "< 0" as *u8) == 1 { safe = 1 }
          if ic_has(buf, s, e, "<0" as *u8) == 1 { safe = 1 }
          if ic_has(buf, s, e, "<= 0" as *u8) == 1 { safe = 1 }
          if ic_has(buf, s, e, "<=0" as *u8) == 1 { safe = 1 }
          if safe == 1 { c[1] = c[1] + 1 }
          else {
              if bydesign == 1 {
                  c[4] = c[4] + 1
                  if verbose == 1 {
                      ic_p("  BY-DESIGN " as *u8); ic_p(path); ic_p("  " as *u8)
                      ic_sig(buf, s, e)
                      ic_nl()
                  }
              } else {
                  c[2] = c[2] + 1
                  if (setb as i64) != 0 {
                      let idb: *u8 = sys_mmap(512)
                      let il: i64 = ic_offid(path, buf, s, e, idb)
                      var z: i64 = 0
                      while z < il { setb[c[5] + z] = idb[z]; z = z + 1 }
                      setb[c[5] + il] = 10 as u8
                      c[5] = c[5] + il + 1
                      sys_munmap(idb, 512)
                  }
                  if verbose == 1 {
                      ic_p("  DROPS-NEGATIVE " as *u8); ic_p(path); ic_p("  " as *u8)
                      ic_sig(buf, s, e)
                      ic_nl()
                  }
              }
          }
      }
      s = e
  }
  return 0
291}
292
293func ic_endswith_nx(nm: *u8) -> i64 {
  let l: i64 = ic_len(nm)
  if l < 4 { return 0 }
  if nm[l - 3] != (46 as u8) { return 0 }
  if nm[l - 2] != (110 as u8) { return 0 }
  if nm[l - 1] != (120 as u8) { return 0 }
  return 1
300}
301
302// scan every *.nx directly in dir. c[3] counts files actually read.
303func ic_scan_dir(dir: *u8, c: *i64, verbose: i64, setb: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(dir)
  if fd < 0 { return 0 }
  let dbuf: *u8 = sys_mmap(IC_DIRBUF)
  let path: *u8 = sys_mmap(IC_PATHBUF)
  let szp: *i64 = sys_mmap(16) as *i64
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, IC_DIRBUF)
      if nr <= 0 { go = 0 }
      else {
          var off: i64 = 0
          while off < nr {
              let rec: *u8 = (dbuf as i64 + off) as *u8
              let ty: i64 = dirent_type(rec)
              let nm: *u8 = dirent_name(rec)
              if ty != 4 {
                  if ic_endswith_nx(nm) == 1 {
                      var po: i64 = 0
                      var q: i64 = 0
                      while dir[q] != (0 as u8) { path[po] = dir[q]; po = po + 1; q = q + 1 }
                      path[po] = 47 as u8
                      po = po + 1
                      q = 0
                      while nm[q] != (0 as u8) { path[po] = nm[q]; po = po + 1; q = q + 1 }
                      path[po] = 0 as u8
                      szp[0] = 0
                      let sb: *u8 = sys_read_file(path, szp)
                      if szp[0] > 0 {
                          c[3] = c[3] + 1
                          ic_classify(path, sb, szp[0], c, verbose, setb)
                          sys_munmap(sb, szp[0])
                      }
                  }
              }
              off = off + dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
  sys_munmap(dbuf, IC_DIRBUF)
  sys_munmap(path, IC_PATHBUF)
  return 0
346}
347
348// ★The COUNT-ratchet (ic_read_floor/ic_write_floor over knowledge/status/itoaclone.floor) was REMOVED
349// here, not merely bypassed: it had proven it could bless a PRECISION change as progress, and leaving a
350// dead second ruler in the file is the duplicate-ruler defect with a comment on it. The name-set
351// baseline below is its replacement, and it subsumes every question the count could answer.
352func ic_eol(buf: *u8, n: i64, i: i64) -> i64 {
  var j: i64 = i
  var res: i64 = n
  var go: i64 = 1
  while go == 1 {
      if j >= n { go = 0 }
      else {
          if buf[j] == (10 as u8) { res = j; go = 0 } else { j = j + 1 }
      }
  }
  return res
363}
364
365// count lines of A absent from B, naming each. This is what a count can never do: say WHICH.
366func ic_diff(a: *u8, an: i64, b: *u8, bn: i64, label: *u8, verbose: i64) -> i64 {
  var i: i64 = 0
  var cnt: i64 = 0
  while i < an {
      let e: i64 = ic_eol(a, an, i)
      let ll: i64 = e - i
      if ll > 0 {
          if ic_line_in(b, bn, (a as i64 + i) as *u8, ll) == 0 {
              cnt = cnt + 1
              if verbose == 1 {
                  ic_p(label)
                  sys_write(1, (a as i64 + i) as *u8, ll)
                  ic_nl()
              }
          }
      }
      i = e + 1
  }
  return cnt
385}
386
387// ⚠sys_openat_wr has NO O_TRUNC. Writing a SHORTER baseline over a longer one would leave the old tail
388// in place, and those stale ids would still satisfy ic_line_in -- so a genuinely NEW offender could be
389// read back as "already known" and the ratchet would never fire. Padding the remainder with newlines
390// erases it without a second mechanism; blank lines are skipped by the iterator (ll > 0) and can match
391// no id. A shrink that silently leaves a tail is exactly how a ratchet stops ratcheting.
392func ic_write_set(path: *u8, buf: *u8, n: i64, oldn: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, MODE_0644)
  if fd < 0 { return 0 }
  sys_write(fd, buf, n)
  if oldn > n {
      let pad: *u8 = sys_mmap(4096)
      var w: i64 = 0
      while w < 4096 { pad[w] = 10 as u8; w = w + 1 }
      var rem: i64 = oldn - n
      while rem > 0 {
          var chunk: i64 = rem
          if chunk > 4096 { chunk = 4096 }
          sys_write(fd, pad, chunk)
          rem = rem - chunk
      }
      sys_munmap(pad, 4096)
  }
  sys_close(fd)
  return 1
411}
412
413func ic_wfile(path: *u8, s: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, MODE_0644)
  if fd < 0 { return 0 }
  sys_write(fd, s, ic_len(s))
  sys_close(fd)
  return 1
419}
420
421func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("=== nx_itoaclone: hand-rolled digit emitters that SILENTLY DROP NEGATIVES ===" as *u8)
424
  // ---- CONTROLS FIRST, on a planted fixture whose answer is known a priori. A detector that has
  // only ever seen real code has not been shown to FIRE; one that has only ever fired has not been
  // shown to stay SILENT on correct input.
  sys_mkdir("/tmp/nxitoaclone" as *u8, MODE_0755)
  ic_wfile("/tmp/nxitoaclone/bad.nx" as *u8, "func bad_catn(dst: *u8, off: i64, v: i64) -> i64 {\n    var m: i64 = v\n    var k: i64 = 0\n    while m > 0 { dst[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }\n    return k\n}\n" as *u8)
  ic_wfile("/tmp/nxitoaclone/good.nx" as *u8, "func good_catn(dst: *u8, off: i64, v: i64) -> i64 {\n    var m: i64 = v\n    var k: i64 = 0\n    if m < 0 { dst[k] = 45 as u8; k = k + 1; m = 0 - m }\n    while m > 0 { dst[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }\n    return k\n}\n" as *u8)
431
  let fx: *i64 = sys_mmap(64) as *i64
  fx[0] = 0
  fx[1] = 0
  fx[2] = 0
  fx[3] = 0
  fx[4] = 0
  ic_scan_dir("/tmp/nxitoaclone" as *u8, fx, 0, 0 as *u8)
439
  var t_cov: i64 = 0
  if fx[3] == 2 { t_cov = 1 }
  gv_check("fixture-coverage (both planted files were actually READ -- a tooth that passes on the empty set is not a tooth)" as *u8, t_cov, ctr)
443
  var t_em: i64 = 0
  if fx[0] == 2 { t_em = 1 }
  gv_check("fixture-emitters-recognised (both fixtures classify as emitters at all)" as *u8, t_em, ctr)
447
  var t_bite: i64 = 0
  if fx[2] == 1 { t_bite = 1 }
  gv_check("bite: the planted NEGATIVE-DROPPING emitter is flagged exactly once" as *u8, t_bite, ctr)
451
  var t_pos: i64 = 0
  if fx[1] == 1 { t_pos = 1 }
  gv_check("positive-control: the planted NEGATIVE-SAFE emitter is NOT flagged" as *u8, t_pos, ctr)
455
  // ---- REAL-WORLD POSITIVE CONTROL: the canonical shared emitter must classify SAFE. If this ever
  // fails the detector is wrong, not nx_itoa_lib.
  let lc: *i64 = sys_mmap(64) as *i64
  lc[0] = 0
  lc[1] = 0
  lc[2] = 0
  lc[3] = 0
  lc[4] = 0
  let lszp: *i64 = sys_mmap(16) as *i64
  lszp[0] = 0
  let lbuf: *u8 = sys_read_file("buildroot/runtime/nx_itoa_lib.nx" as *u8, lszp)
  if lszp[0] > 0 { ic_classify("buildroot/runtime/nx_itoa_lib.nx" as *u8, lbuf, lszp[0], lc, 0, 0 as *u8) }
  // ★THIS TOOTH WAS WRONG ON ITS FIRST TWO RUNS AND THE CONTROL IS WHAT SAID SO. It originally also
  // required lc[0] > 0 as an anti-vacuity guard -- but nx_itoa_lib builds digits from NAMED CONSTANTS
  // (CCZ_ASCII_0 + ((m / pw) % CCZ_DEC)), so it contains NO literal `48 +` or `% 10` and this anchor
  // sees ZERO emitters in it. The guard could therefore never pass, and I twice mis-diagnosed the FAIL
  // (first as a comment-contamination bug, which the stripper below fixes but was NOT this).
  // ★★THE INCUMBENT BEING INVISIBLE TO THE ANCHOR *IS* THE DECLARED FLOOR, DEMONSTRATED: the cleanest
  // emitter in the estate is the one this detector cannot see. So the assertion is now the honest one
  // -- the incumbent contributes NO drops -- and the non-vacuity burden moves to a real-world file the
  // anchor CAN see.
  var t_canon: i64 = 0
  if lszp[0] > 0 {
      if lc[2] == 0 { t_canon = 1 }
  }
  gv_check("canon-no-drops: nx_itoa_lib (the incumbent) contributes ZERO negative-dropping emitters" as *u8, t_canon, ctr)
482
  // REAL-WORLD POSITIVE CONTROL the anchor CAN see: a literal-48 emitter that DOES handle negatives
  // (nx_media_inventory_lib.iv_ntoa opens `if m < 0 { dst[o] = 45 ... m = 0 - m }`). If this is ever
  // flagged, the detector has a false positive on correct code and must be fixed before its numbers
  // are believed -- a detector with false positives is worse than none.
  let rc2: *i64 = sys_mmap(64) as *i64
  rc2[0] = 0
  rc2[1] = 0
  rc2[2] = 0
  rc2[3] = 0
  rc2[4] = 0
  let rszp: *i64 = sys_mmap(16) as *i64
  rszp[0] = 0
  let rbuf: *u8 = sys_read_file("buildroot/runtime/_hdl_build/nx_media_inventory_lib.nx" as *u8, rszp)
  if rszp[0] > 0 { ic_classify("buildroot/runtime/_hdl_build/nx_media_inventory_lib.nx" as *u8, rbuf, rszp[0], rc2, 0, 0 as *u8) }
  var t_real_pos: i64 = 0
  if rszp[0] > 0 {
      if rc2[0] > 0 {
          if rc2[2] == 0 { t_real_pos = 1 }
      }
  }
  gv_check("real-positive-control: a REAL literal-48 emitter that handles negatives is NOT flagged" as *u8, t_real_pos, ctr)
504
  // ---- THE CENSUS. Numbers are REPORTED, never judged: see the declared imprecision in the header.
  let c: *i64 = sys_mmap(64) as *i64
  c[0] = 0
  c[1] = 0
  c[2] = 0
  c[3] = 0
  c[4] = 0
  c[5] = 0
  let setb: *u8 = sys_mmap(IC_SETBUF)
  ic_scan_dir("buildroot/runtime" as *u8, c, 1, setb)
  ic_scan_dir("buildroot/runtime/_hdl_build" as *u8, c, 1, setb)
516
  ic_p("  files_read=" as *u8); ic_n(c[3])
  ic_p("  emitters=" as *u8); ic_n(c[0])
  ic_p("  negative_safe=" as *u8); ic_n(c[1])
  ic_p("  DROPS_NEGATIVE=" as *u8); ic_n(c[2])
  ic_p("  by_design=" as *u8); ic_n(c[4])
  ic_nl()
  // A partition is a claim: check the parts SUM, and print the sum so the reader can too.
  ic_p("  partition: safe+drops+by_design=" as *u8); ic_n(c[1] + c[2] + c[4])
  ic_p(" emitters=" as *u8); ic_n(c[0])
  if c[1] + c[2] + c[4] == c[0] { ic_p("  RECONCILES" as *u8) } else { ic_p("  LEAK -- the buckets do not sum" as *u8) }
  ic_nl()
  ic_p("  NOTE: DROPS_NEGATIVE is a FLOOR. Emitters using a NAMED digit-base const or an MSB-first\n" as *u8)
  ic_p("  power-of-ten walk are not matched by the 48+ anchor, and a body carrying an UNRELATED '< 0'\n" as *u8)
  ic_p("  scores SAFE -- both directions UNDER-report, deliberately, because a detector with false\n" as *u8)
  ic_p("  positives is worse than none. Every offender above is NAMED so each is checkable.\n" as *u8)
532
  var t_sum: i64 = 0
  if c[1] + c[2] + c[4] == c[0] { t_sum = 1 }
  gv_check("partition-reconciles (safe + drops + by_design == emitters)" as *u8, t_sum, ctr)
536
  var t_real: i64 = 0
  if c[3] > 0 {
      if c[0] > 0 { t_real = 1 }
  }
  gv_check("census-non-vacuous (real files read AND real emitters found)" as *u8, t_real, ctr)
542
  // ---- RATCHET. A one-off census decays into a number nobody re-runs; a ratchet makes the class
  // SHRINK-ONLY and catches the 940th the moment someone writes it. It also TIGHTENS on its own, so
  // fixing sites is rewarded rather than merely acknowledged -- a ratchet that does not tighten when
  // you improve is just a threshold. Seeded on first run (no floor file = SEED, not a failure: an
  // absent baseline is a cannot-observe, never a pass).
  // ★NAME-SET RATCHET, replacing the count. The count version blessed a PRECISION change as progress:
  // widening the safe-check to accept `<= 0` reclassified 49 emitters and it logged "TIGHTENED by 49"
  // while NOTHING IN THE ESTATE HAD CHANGED. A set of names cannot lie that way -- a reclassification
  // shows up as 49 names LEAVING, an actual regression shows up as a name ARRIVING, and the arrival is
  // PRINTED. ★★A COUNT-RATCHET ON A SHARED TREE REPORTS THAT SOMETHING MOVED WITHOUT SAYING WHOSE.
  let blp: *u8 = "knowledge/status/itoaclone.baseline" as *u8
  let bszp: *i64 = sys_mmap(16) as *i64
  bszp[0] = 0
  let bb: *u8 = sys_read_file(blp, bszp)
  var t_ratchet: i64 = 0
  if bszp[0] <= 0 {
      ic_write_set(blp, setb, c[5], 0)
      ic_p("  RATCHET SEEDED with " as *u8); ic_n(c[2])
      ic_p(" NAMED offenders (no prior baseline -- an absent baseline is a cannot-observe, never a pass)" as *u8); ic_nl()
      t_ratchet = 1
  } else {
      let nnew: i64 = ic_diff(setb, c[5], bb, bszp[0], "  RATCHET-NEW " as *u8, 1)
      let ngone: i64 = ic_diff(bb, bszp[0], setb, c[5], "" as *u8, 0)
      ic_p("  RATCHET baseline=" as *u8); ic_n(bszp[0])
      ic_p("B new=" as *u8); ic_n(nnew)
      ic_p(" gone=" as *u8); ic_n(ngone)
      if nnew == 0 { t_ratchet = 1 }
      if nnew == 0 {
          if ngone > 0 {
              ic_write_set(blp, setb, c[5], bszp[0])
              ic_p("  TIGHTENED -- " as *u8); ic_n(ngone)
              ic_p(" names left the set (a FIX and a RECLASSIFICATION both look like this; say which)" as *u8)
          }
      }
      if nnew > 0 { ic_p("  REGRESSED -- each new offender is NAMED above" as *u8) }
      ic_nl()
  }
  gv_check("ratchet: no NEW negative-dropping emitter appeared (set is shrink-only)" as *u8, t_ratchet, ctr)
581
  return gv_verdict("ITOACLONE" as *u8, ctr, "detector self-proof: bite + positive control + canon control + partition. The offender COUNT is reported, never judged -- an uncalibrated classifier must report numbers, not verdicts" as *u8)
583}
nx_itoaclone.nx source

`nx_itoaclone.nx` source
