`nx_ivvcensus.nx` source

↩ module page · 485 lines · 25927 B
1// nx_ivvcensus.nx -- derive the IV+V registry from the WHOLE estate instead of a hand-picked sample.
2//
3// WHY. nx_ivvbeat shipped verifying FOUR gates. buildroot/runtime holds ~1,850 *_gate.nx organs and
4// knowledge/status holds 363 verdict logs, 233 of them carrying a judgeable anchor. Four rows is 0.2%
5// coverage that nobody ever justified -- the registry was a sample masquerading as a roster.
6// (STAR)A HAND-WRITTEN ROSTER IS A SAMPLE WHOSE SIZE NOBODY CHOSE; IT IS NOT SMALL BECAUSE SOMEONE
7// DECIDED IT SHOULD BE, IT IS SMALL BECAUSE SOMEONE STOPPED TYPING.
8//
9// METHOD -- MATCH A KNOWN GOOD, THEN GENERALISE. The marker for each gate is not invented here; it is
10// read out of that gate's OWN log, which is the only place its success string is recorded as fact. Where
11// the log shows a "passed N/M" shape the HIGHEST M ever observed becomes the tooth floor, so a gate is
12// held to the best it has ever demonstrated rather than to a number someone typed once.
13// (STAR)THE STRONGEST FLOOR YOU CAN SET WITHOUT GUESSING IS THE BEST THE THING HAS ALREADY PROVEN.
14//
15// SCOPE DISCIPLINE -- THIS PROPOSES, IT DOES NOT SEED. Every candidate row is written to a proposal file
16// and nothing touches the live ivvreg- plane. A census that silently rewrote the registry would make the
17// beat verify a roster nobody had read.
18//
19// NEVER-BRICK (Rule 26, ABSOLUTE and NOT waivable by any blast-radius instruction): this organ EXECUTES
20// NOTHING. It reads logs and tests for file existence. The firmware-axis gates (uefi/boot/efi/cmos/fw)
21// are additionally flagged so that whoever seeds the registry must decide about them deliberately rather
22// than inherit them in a bulk paste.
23// license_tier: ORIGINAL   No hw writes.   Executes nothing.   Writes ONE proposal file.
24import "nx_syscalls.nx"
25import "nx_store_seed_lib.nx"
26import "nx_guarded_run.nx"
27
28const IC_DIRBUF:  i64 = 262144
29const IC_TAIL:    i64 = 16384
30const IC_OUTCAP:  i64 = 1048576
31const IC_NAMECAP: i64 = 512
32const IC_MODE:    i64 = 0x1a4
33const IC_SEEK_END: i64 = 2
34const IC_SEEK_SET: i64 = 0
35// Per-candidate probe deadline and the whole-pass budget. A per-item bound is not a pass bound.
36const IC_PROBE_MS:        i64 = 20000
37const IC_PROBE_BUDGET_MS: i64 = 900000
38
39func ic_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
40func ic_puts(s: *u8) -> i64 { sys_write(1, s, ic_len(s)); return 0 }
41func ic_putn(v: i64) -> i64 {
  if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
  var mv: i64 = v
  if mv < 0 { sys_write(1, "-" as *u8, 1); mv = 0 - mv }
  let t: *u8 = sys_mmap(32); var k: i64 = 0
  while mv > 0 { t[k] = (0x30 + (mv - (mv/10)*10)) as u8; mv = mv/10; k = k + 1 }
  while k > 0 { k = k - 1; sys_write(1, (((t as i64)+k) as *u8), 1) }
  return 0
49}
50func ic_cat(b: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { b[o+i] = s[i]; i = i + 1 } return o + i }
51func ic_num(b: *u8, o: i64, v: i64) -> i64 {
  if v == 0 { b[o] = 0x30 as u8; return o + 1 }
  var mv: i64 = v; let t: *u8 = sys_mmap(32); var k: i64 = 0
  while mv > 0 { t[k] = (0x30 + (mv - (mv/10)*10)) as u8; mv = mv/10; k = k + 1 }
  var oo: i64 = o
  while k > 0 { k = k - 1; b[oo] = t[k]; oo = oo + 1 }
  return oo
58}
59func ic_isdig(c: u8) -> i64 { if c < (48 as u8) { return 0 } if c > (57 as u8) { return 0 } return 1 }
60
61func ic_opendir(p: *u8) -> i64 { return __syscall(257, 0-100, p as i64, 0x10000, 0, 0, 0) }
62func ic_getdents(fd: i64, b: *u8, cap: i64) -> i64 { return __syscall(217, fd, b as i64, cap, 0, 0, 0) }
63func ic_lseek(fd: i64, off: i64, wh: i64) -> i64 { return __syscall(8, fd, off, wh, 0, 0, 0) }
64
65func ic_ends(s: *u8, suf: *u8) -> i64 {
  let sl: i64 = ic_len(s); let pl: i64 = ic_len(suf)
  if sl < pl { return 0 }
  var i: i64 = 0
  while i < pl { if s[sl-pl+i] != suf[i] { return 0 } i = i + 1 }
  return 1
71}
72
73func ic_exists(p: *u8) -> i64 {
  let stb: *u8 = sys_mmap(256)
  if sys_fstatat(p, stb) == 0 { return 1 }
  return 0
77}
78
79func ic_find_n(hay: *u8, n: i64, from: i64, needle: *u8) -> i64 {
  let nl: i64 = ic_len(needle)
  if nl <= 0 { return 0 - 1 }
  var i: i64 = from
  while i + nl <= n {
      var k: i64 = 0; var same: i64 = 1
      while k < nl { if hay[i+k] != needle[k] { same = 0; k = nl } else { k = k + 1 } }
      if same == 1 { return i }
      i = i + 1
  }
  return 0 - 1
90}
91
92// Highest total ever seen in a "passed N/M" token anywhere in the tail. This is the floor: the best the
93// gate has actually demonstrated. Returns 0 when the shape never appears.
94func ic_best_total(buf: *u8, n: i64) -> i64 {
  var best: i64 = 0
  var at: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let p: i64 = ic_find_n(buf, n, at, "passed " as *u8)
      if p < 0 { go = 0 }
      if p >= 0 {
          at = p + 7
          // walk the numerator digits
          var u: i64 = at
          var sawnum: i64 = 0
          var walk: i64 = 1
          while walk == 1 {
              if u >= n { walk = 0 }
              if walk == 1 {
                  if ic_isdig(buf[u]) == 1 { sawnum = 1; u = u + 1 } else { walk = 0 }
              }
          }
          if sawnum == 1 { if u < n { if buf[u] == (47 as u8) {
              var v: i64 = u + 1
              var tot: i64 = 0
              var any: i64 = 0
              var stop: i64 = 0
              while stop == 0 {
                  if v >= n { stop = 1 }
                  if stop == 0 {
                      if ic_isdig(buf[v]) == 1 { tot = tot*10 + ((buf[v] as i64) - 48); any = 1; v = v + 1 } else { stop = 1 }
                  }
              }
              if any == 1 { if tot > best { best = tot } }
          } } }
          if at >= n { go = 0 }
      }
  }
  return best
130}
131
132func main() -> i64 {
  ic_puts("=== nx_ivvcensus: derive the IV+V roster from EVERY status log, not a sample ===\n")
134
  let dfd: i64 = ic_opendir("knowledge/status" as *u8)
  if dfd < 0 { ic_puts("NX-IVVCENSUS cannot open knowledge/status verdict=RED\n"); sys_exit(1); return 1 }
137
  let db: *u8 = sys_mmap(IC_DIRBUF)
  let tail: *u8 = sys_mmap(IC_TAIL + 16)
  let path: *u8 = sys_mmap(IC_NAMECAP)
  let base: *u8 = sys_mmap(IC_NAMECAP)
  let cand: *u8 = sys_mmap(IC_NAMECAP)
  let out:  *u8 = sys_mmap(IC_OUTCAP)
  var oo: i64 = 0
145
  var logs: i64 = 0
  var anchored: i64 = 0
  var mapped: i64 = 0
  var floored: i64 = 0
  var no_anchor: i64 = 0
  var no_organ: i64 = 0
  var fw_flag: i64 = 0
  var probed: i64 = 0
  var rejected: i64 = 0
  var admitted: i64 = 0
  var unprobed: i64 = 0
  let probe_t0: i64 = sys_now_ms()
  let pargv: *i64 = sys_mmap(64) as *i64
  let penv: *i64 = sys_mmap(64) as *i64
  penv[0] = "PATH=/usr/bin:/bin" as *u8 as i64
  penv[1] = 0
  let plen2: *i64 = sys_mmap(16) as *i64
163
  var more: i64 = 1
  while more == 1 {
      let got: i64 = ic_getdents(dfd, db, IC_DIRBUF)
      if got <= 0 { more = 0 }
      if got > 0 {
          var p: i64 = 0
          while p < got {
              let rl: i64 = (db[p+16] as i64) + ((db[p+17] as i64) * 256)
              let nm: *u8 = ((db as i64) + p + 19) as *u8
              if ic_ends(nm, ".log" as *u8) == 1 {
                  logs = logs + 1
                  let nl: i64 = ic_len(nm)
                  var i: i64 = 0
                  while i < nl - 4 { base[i] = nm[i]; i = i + 1 }
                  base[nl-4] = 0 as u8
179
                  var po: i64 = 0
                  po = ic_cat(path, 0, "knowledge/status/" as *u8)
                  po = ic_cat(path, po, nm)
                  path[po] = 0 as u8
184
                  // read the TAIL: these logs are append-only, so the current state is at the END.
                  // Reading the head would report a verdict from months ago as if it were now.
                  var tn: i64 = 0
                  let fd: i64 = sys_openat_rd(path)
                  if fd >= 0 {
                      let sz: i64 = ic_lseek(fd, 0, IC_SEEK_END)
                      var st: i64 = sz - IC_TAIL
                      if st < 0 { st = 0 }
                      ic_lseek(fd, st, IC_SEEK_SET)
                      tn = sys_read(fd, tail, IC_TAIL)
                      sys_close(fd)
                  }
                  if tn < 0 { tn = 0 }
198
                  let hasv: i64 = ic_find_n(tail, tn, 0, "verdict=" as *u8)
                  let best: i64 = ic_best_total(tail, tn)
201
                  if hasv < 0 {
                      no_anchor = no_anchor + 1
                      oo = ic_cat(out, oo, "UNJUDGEABLE\t" as *u8); oo = ic_cat(out, oo, base)
                      oo = ic_cat(out, oo, "\tno verdict= anchor anywhere in the last 16KB -- registering it would guarantee permanent false drift\n" as *u8)
                  }
                  if hasv >= 0 {
                      anchored = anchored + 1
                      // organ resolution by convention, VERIFIED by existence -- never guessed.
                      var found: i64 = 0
                      var co: i64 = 0
                      co = ic_cat(cand, 0, "./nx_" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, ".elf" as *u8); cand[co] = 0 as u8
                      if ic_exists(cand) == 1 { found = 1 }
                      if found == 0 {
                          co = ic_cat(cand, 0, "./nx_" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, "_gate.elf" as *u8); cand[co] = 0 as u8
                          if ic_exists(cand) == 1 { found = 1 }
                      }
                      if found == 0 {
                          co = ic_cat(cand, 0, "./" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, ".elf" as *u8); cand[co] = 0 as u8
                          if ic_exists(cand) == 1 { found = 1 }
                      }
                      // THE LEADING-UNDERSCORE FAMILY. v1 of this census tried only nx_* and bare names and
                      // reported 107 anchored logs as having no binary. The registry plainly contains
                      // _mmu_gate, _priv_gate, _syscall_gate, _umode_gate, _timer_irq_gate -- an entire
                      // naming family the convention never asked about, so every one of them was counted as
                      // a missing organ. The measurement was not wrong about what it looked for; it was
                      // wrong about what it looked for.
                      // (STAR)A RESOLVER THAT REPORTS "NOT FOUND" IS ONLY EVIDENCE ABOUT THE NAMES IT TRIED
                      // -- ENUMERATE THE NAMING FAMILIES THAT EXIST BEFORE BELIEVING AN ABSENCE COUNT.
                      if found == 0 {
                          co = ic_cat(cand, 0, "./_" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, ".elf" as *u8); cand[co] = 0 as u8
                          if ic_exists(cand) == 1 { found = 1 }
                      }
                      if found == 0 {
                          co = ic_cat(cand, 0, "./_" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, "_gate.elf" as *u8); cand[co] = 0 as u8
                          if ic_exists(cand) == 1 { found = 1 }
                      }
                      if found == 0 {
                          co = ic_cat(cand, 0, "./nx_" as *u8); co = ic_cat(cand, co, base); co = ic_cat(cand, co, "_selftest.elf" as *u8); cand[co] = 0 as u8
                          if ic_exists(cand) == 1 { found = 1 }
                      }
242
                      if found == 0 {
                          no_organ = no_organ + 1
                          oo = ic_cat(out, oo, "NO-ORGAN\t" as *u8); oo = ic_cat(out, oo, base)
                          oo = ic_cat(out, oo, "\tanchored log with no resolvable binary -- the log is the only surviving evidence this gate exists\n" as *u8)
                      }
                      if found == 1 {
                          mapped = mapped + 1
                          var fw: i64 = 0
                          var probe_anchor: i64 = 0
                          if ic_find_n(base, ic_len(base), 0, "uefi" as *u8) >= 0 { fw = 1 }
                          if ic_find_n(base, ic_len(base), 0, "boot" as *u8) >= 0 { fw = 1 }
                          if ic_find_n(base, ic_len(base), 0, "efi" as *u8) >= 0 { fw = 1 }
                          if ic_find_n(base, ic_len(base), 0, "cmos" as *u8) >= 0 { fw = 1 }
                          if ic_find_n(base, ic_len(base), 0, "fw_" as *u8) >= 0 { fw = 1 }
                          if fw == 1 { fw_flag = fw_flag + 1 }
258
                          // ================= PROVE THE CANDIDATE BEFORE PROPOSING IT =================
                          // v2 of this census proposed 121 rows purely from log evidence and the first full
                          // sweep drifted 47. Classifying those by exit code showed EIGHT at rc=2 with a
                          // usage banner and THIRTEEN at rc=0 with no anchor -- roughly half the alarm was
                          // the census registering multi-verb TOOLS as if they were argless gates. Their
                          // logs carry a verdict= line because something ELSE invokes them correctly; the
                          // log records the OUTPUT of a gate and never the COMMAND that produced it.
                          // (STAR)A LOG PROVES THE THING CAN SUCCEED, NOT THAT *YOUR* INVOCATION OF IT WILL
                          // -- EVIDENCE OF AN OUTCOME IS NOT EVIDENCE OF A CALLING CONVENTION.
                          // (STAR)A DETECTOR WITH A 45% FALSE-POSITIVE RATE IS WORSE THAN NO DETECTOR: IT
                          // SPENDS THE READER'S ATTENTION UNTIL THEY STOP READING, AND THEN THE REAL DRIFT
                          // ARRIVES IN A CHANNEL NOBODY WATCHES.
                          // So each candidate is now RUN ONCE, argless, and admitted only if it emits a
                          // recognisable anchor. Admission asks "is this judgeable this way", NOT "is it
                          // passing" -- a gate answering verdict=RED is admitted, because that is exactly
                          // the drift the beat exists to report. Excluding failures would hide the finding.
                          if fw == 0 {
                              if sys_now_ms() - probe_t0 < IC_PROBE_BUDGET_MS {
                                  let pfd: i64 = sys_openat_wr("/tmp/ivvcensus_probe.out" as *u8, IC_MODE)
                                  pargv[0] = cand as i64
                                  pargv[1] = 0
                                  let prc: i64 = nx_guarded_run(cand, pargv, penv, IC_PROBE_MS, pfd, pfd)
                                  sys_close(pfd)
                                  plen2[0] = 0
                                  let pbuf: *u8 = sys_read_file("/tmp/ivvcensus_probe.out" as *u8, plen2)
                                  let pn2: i64 = plen2[0]
                                  probed = probed + 1
                                  if pn2 > 0 { if ic_find_n(pbuf, pn2, 0, "verdict=" as *u8) >= 0 { probe_anchor = 1 } }
                                  if probe_anchor == 0 {
                                      rejected = rejected + 1
                                      oo = ic_cat(out, oo, "REJECT\t" as *u8); oo = ic_cat(out, oo, base)
                                      oo = ic_cat(out, oo, "\t" as *u8); oo = ic_cat(out, oo, cand)
                                      oo = ic_cat(out, oo, "\trc=" as *u8); oo = ic_num(out, oo, prc)
                                      oo = ic_cat(out, oo, " out=" as *u8); oo = ic_num(out, oo, pn2)
                                      oo = ic_cat(out, oo, " -- argless run emits NO verdict anchor, so this beat cannot judge it; its log was produced by a caller that knows the right argv\n" as *u8)
                                  }
                              }
                              if sys_now_ms() - probe_t0 >= IC_PROBE_BUDGET_MS {
                                  unprobed = unprobed + 1
                              }
                          }
                          if fw == 1 { probe_anchor = 1 }
301
                          if probe_anchor == 1 {
                          oo = ic_cat(out, oo, "ROW\tivv-" as *u8); oo = ic_cat(out, oo, base)
                          oo = ic_cat(out, oo, "\t" as *u8); oo = ic_cat(out, oo, cand)
                          oo = ic_cat(out, oo, "\t-\t" as *u8)
                          if best > 0 {
                              floored = floored + 1
                              oo = ic_cat(out, oo, "passed " as *u8); oo = ic_num(out, oo, best)
                              oo = ic_cat(out, oo, "/" as *u8); oo = ic_num(out, oo, best)
                              oo = ic_cat(out, oo, " verdict=GREEN" as *u8)
                          }
                          if best <= 0 { oo = ic_cat(out, oo, "verdict=GREEN" as *u8) }
                          if fw == 1 { oo = ic_cat(out, oo, "\tFIRMWARE-AXIS-DECIDE-DELIBERATELY" as *u8) }
                          out[oo] = 10 as u8; oo = oo + 1
                          admitted = admitted + 1
                          }
                      }
                  }
              }
              if rl <= 0 { p = got } else { p = p + rl }
          }
      }
  }
  sys_close(dfd)
325
  let wfd: i64 = sys_openat_wr("knowledge/status/ivvcensus_proposed.tsv" as *u8, IC_MODE)
  if wfd >= 0 { sys_write(wfd, out, oo); sys_close(wfd) }
328
  // ================= STAGING: THE EXISTING ROSTER IS PART OF THE ANSWER =================
  // nx_store_seed REPLACES a plane, so a staging file built only from the census would DELETE every row
  // that no status log can produce -- above all ivv-negcontrol, the planted lie. Losing it would not
  // break the sweep loudly; it would make every future sweep UNFALSIFIABLE while still printing rows.
  // (STAR)A REBUILD THAT DERIVES ITS CONTENT FROM ONE SOURCE SILENTLY DELETES EVERYTHING THE OTHER
  // SOURCES CONTRIBUTED -- AND THE MOST DANGEROUS THING TO LOSE IS THE CONTROL, BECAUSE ITS ABSENCE
  // LOOKS LIKE SUCCESS.
  // So the live plane is read FIRST and copied verbatim, the census only ADDS ids it does not already
  // carry, and the whole staging file is REFUSED unless the negative control survived it.
  let stg: *u8 = sys_mmap(IC_OUTCAP)
  var so: i64 = 0
  let cur: *u8 = sys_mmap(IC_OUTCAP)
  let cfl: *i64 = sys_mmap(64) as *i64
  let cn: i64 = sts_load_honest("knowledge/store/ivvreg-" as *u8, cur, IC_OUTCAP, cfl)
  // MERGE-PRESERVING IS NOT ENOUGH: IT MUST ALSO BE ABLE TO RETRACT. The first version copied the live
  // plane verbatim, which protects hand-written rows -- but it also made a bad row IMMORTAL. 26 rows
  // seeded from log evidence were later PROVEN unjudgeable by the probe, and a verbatim copy carried
  // every one of them forward, so the census could diagnose its own mistake and not undo it.
  // (STAR)A MERGE THAT ONLY EVER ADDS CANNOT CORRECT ITSELF -- PRESERVATION AND RETRACTION ARE TWO
  // DIFFERENT GUARANTEES AND A ROSTER NEEDS BOTH.
  // The retraction is deliberately NARROW: a live row is dropped ONLY if this run's probe positively
  // proved that exact id emits no anchor. Everything else -- hand-tuned commands, the negative control,
  // rows this census knows nothing about -- is preserved untouched. Absence of evidence retracts nothing.
  var kept: i64 = 0
  var retracted: i64 = 0
  var ci: i64 = 0
  while ci < cn {
      var ce: i64 = ci
      var cnl: i64 = 0 - 1
      while ce < cn { if cur[ce] == (10 as u8) { cnl = ce; ce = cn } else { ce = ce + 1 } }
      var cend: i64 = cn
      if cnl >= 0 { cend = cnl }
      if cend > ci {
          // id is field 0; the census REJECT lines carry the bare base, so compare on id minus "ivv-"
          var cide: i64 = ci
          var ctab: i64 = 0 - 1
          while cide < cend { if cur[cide] == (9 as u8) { ctab = cide; cide = cend } else { cide = cide + 1 } }
          var drop: i64 = 0
          if ctab > ci + 4 {
              let blen: i64 = ctab - ci - 4
              let key: *u8 = sys_mmap(IC_NAMECAP)
              var ko: i64 = 0
              ko = ic_cat(key, 0, "REJECT\t" as *u8)
              var kk: i64 = 0
              while kk < blen { key[ko+kk] = cur[ci+4+kk]; kk = kk + 1 }
              key[ko+blen] = 9 as u8
              key[ko+blen+1] = 0 as u8
              if ic_find_n(out, oo, 0, key) >= 0 { drop = 1 }
          }
          if drop == 1 { retracted = retracted + 1 }
          if drop == 0 {
              var cc2: i64 = ci
              while cc2 < cend { stg[so] = cur[cc2]; so = so + 1; cc2 = cc2 + 1 }
              stg[so] = 10 as u8; so = so + 1
              kept = kept + 1
          }
      }
      ci = cend + 1
  }
388
  // append census rows whose id is not already in the staging buffer, skipping the firmware axis
  var added: i64 = 0
  var skipped_fw: i64 = 0
  var dup: i64 = 0
  // (STAR)A LOOP THAT BREAKS BY OVERSHOOTING ITS INDEX DESTROYS THE POSITION IT WAS SEARCHING FOR.
  // v1 of this scan ended its line-walk with le = oo + 1, which terminates the loop and simultaneously
  // throws away WHERE the newline was -- so every line looked like the whole buffer and added=0 while
  // reporting success. The position is now captured in its own variable before the walk ends.
  var li: i64 = 0
  while li < oo {
      var le: i64 = li
      var nlpos: i64 = 0 - 1
      while le < oo {
          if out[le] == (10 as u8) { nlpos = le; le = oo } else { le = le + 1 }
      }
      var lend: i64 = oo
      if nlpos >= 0 { lend = nlpos }
      if lend > li {
          if ic_find_n(out, lend, li, "ROW\t" as *u8) == li {
              let fwm: i64 = ic_find_n(out, lend, li, "FIRMWARE-AXIS" as *u8)
              // the row body starts after "ROW\t"
              let bstart: i64 = li + 4
              var bend: i64 = lend
              if fwm >= 0 { bend = fwm - 1 }
              // id is the first field of the body
              var ide: i64 = bstart
              var idtab: i64 = 0 - 1
              while ide < bend {
                  if out[ide] == (9 as u8) { idtab = ide; ide = bend } else { ide = ide + 1 }
              }
              var idlen: i64 = 0
              if idtab >= 0 { idlen = idtab - bstart }
              var isdup: i64 = 0
              if idlen > 0 {
                  let idb2: *u8 = sys_mmap(IC_NAMECAP)
                  var k2: i64 = 0
                  while k2 < idlen { idb2[k2] = out[bstart+k2]; k2 = k2 + 1 }
                  idb2[idlen] = 9 as u8
                  idb2[idlen+1] = 0 as u8
                  if ic_find_n(stg, so, 0, idb2) >= 0 { isdup = 1 }
              }
              if fwm >= 0 { skipped_fw = skipped_fw + 1 }
              if fwm < 0 {
                  if isdup == 1 { dup = dup + 1 }
                  if isdup == 0 {
                      var b2: i64 = bstart
                      while b2 < bend { stg[so] = out[b2]; so = so + 1; b2 = b2 + 1 }
                      stg[so] = 10 as u8; so = so + 1
                      added = added + 1
                  }
              }
          }
      }
      li = lend + 1
  }
444
  // THE CONTROL MUST SURVIVE. This is a refusal, not a warning.
  var ctl_ok: i64 = 0
  if ic_find_n(stg, so, 0, "ivv-negcontrol" as *u8) >= 0 { ctl_ok = 1 }
448
  ic_puts("staging: kept_existing="); ic_putn(kept)
  ic_puts(" retracted_proven_unjudgeable="); ic_putn(retracted)
  ic_puts(" added="); ic_putn(added)
  ic_puts(" already_present="); ic_putn(dup)
  ic_puts(" skipped_firmware_axis="); ic_putn(skipped_fw)
  ic_puts(" negcontrol_survives="); ic_putn(ctl_ok)
  ic_puts("\n")
456
  if ctl_ok == 1 {
      let sfd: i64 = sys_openat_wr("knowledge/status/ivvreg_staging.tsv" as *u8, IC_MODE)
      if sfd >= 0 { sys_write(sfd, stg, so); sys_close(sfd) }
      ic_puts("staging -> knowledge/status/ivvreg_staging.tsv  (seed deliberately: nx_store_seed knowledge/store/ivvreg- knowledge/status/ivvreg_staging.tsv)\n")
  }
  if ctl_ok == 0 {
      ic_puts("[REFUSED] the staging roster does NOT contain the negative control -- writing it would make every future sweep unfalsifiable. Nothing staged.\n")
  }
465
  ic_puts("logs=");            ic_putn(logs)
  ic_puts(" anchored=");       ic_putn(anchored)
  ic_puts(" mapped_to_organ="); ic_putn(mapped)
  ic_puts(" with_tooth_floor="); ic_putn(floored)
  ic_puts(" no_anchor=");      ic_putn(no_anchor)
  ic_puts(" anchored_no_organ="); ic_putn(no_organ)
  ic_puts(" firmware_axis=");  ic_putn(fw_flag)
  ic_puts("\nprobe: ran="); ic_putn(probed)
  ic_puts(" admitted="); ic_putn(admitted)
  ic_puts(" rejected_no_anchor="); ic_putn(rejected)
  ic_puts(" unprobed_budget="); ic_putn(unprobed)
  ic_puts("\nproposal -> knowledge/status/ivvcensus_proposed.tsv (NOTHING was seeded; the plane is untouched)\n")
478
  // An empty census is a configuration error, never a clean estate.
  if logs == 0 { ic_puts("NX-IVVCENSUS read ZERO logs verdict=RED (an empty world is a bug, not a pass)\n"); sys_exit(1); return 1 }
  if mapped == 0 { ic_puts("NX-IVVCENSUS mapped ZERO organs verdict=RED (the naming convention did not resolve once)\n"); sys_exit(1); return 1 }
  ic_puts("NX-IVVCENSUS passed "); ic_putn(mapped); ic_puts("/"); ic_putn(mapped)
  ic_puts(" verdict=GREEN (roster derived from evidence; seeding remains a separate deliberate act)\n")
  sys_exit(0)
  return 0
486}
nx_ivvcensus.nx source

`nx_ivvcensus.nx` source
