code wiki / _hdl_build / nx_law_warden.nx
`nx_law_warden.nx` source

↩ module page · 1598 lines · 77354 B
1// ============================================================================================
2// STOP -- DO NOT BUILD OR PROMOTE THIS ORGAN. FREEZE 2026-07-31, debt 1785516173 (sev9).
3// The DEPLOYED binary exposes {scan | file | countfile | selftest} and runs a 20/20 gate including
4// T15 segamp, T16 gatedry, T17 helperdup, T18 scancap, T20 debt-id-parse. THIS SOURCE HAS NONE OF
5// countfile / scancap / gatedry / helperdup / T20 -- countfile appears in ZERO of 20016 .nx files
6// NAS-wide (only nx_magicratchet CALLS it). Meanwhile this source ALONE has valuenamed (seq1348),
7// which the deployed binary lacks. NEITHER SIDE IS A SUPERSET; THERE IS NO SAFE DIRECTION.
8// WHY IT MATTERS: nx_magicratchet is wired into /api/build and gates every build on
9// `nx_law_warden countfile`. Rebuild -> the verb is gone -> mr_parse_magic returns -1 -> the ratchet
10// FAILS OPEN BY DESIGN -> magic-number enforcement is permanently disarmed AND the hourly autofiler
11// stops, silently, WITH EVERY GATE STILL GREEN. One routine rebuild turns off both enforcement and
12// detection at once. Restore the four missing capabilities into this file FIRST, then build.
13// Already restored here: countfile (exact output contract, thr locked to the deployed 1024) and the
14// rewritten string/comment-aware inlinelit scanner plus teeth T21-T27.
15// ============================================================================================
16// nx_law_warden.nx -- MECHANICAL ENFORCEMENT for written laws (ws=cap-autonomy, 2026-07-20).
17// Operator: "make sure autonomously that our nishi ecosystem is getting sota ... what needs to become mcp or
18// api or raci or workflows or agents or other modern capabilities just gets logged and worked without me
19// having to call its need out"; + "our magic number audit and bug stuff dont appear to be autonomous ... lots
20// of workstreams are flagging them as bugs they hit and then just gave a new number to"; + "callouts of using
21// webrtc or webassembly ... not building from the first byte up to a sovereign nishi os and browser".
22//
23// THE GAP THIS EATS: every conformance surface we own is a CURATED manifest -- nx_favela_census states it
24// outright ("unnamed shanty stays invisible until a row names it"). A written law (CLAUDE rule 11, the
25// first-byte-up doctrine, F208 modernization) therefore has NO detector: a human must NOTICE a breach and
26// NAME it before anything tracks it. That is exactly the call-it-out tax the operator is paying. This organ
27// is the DETECTOR tier: laws live as DATA in the sovereign **lawreg- seg-store plane** (nx_store_put, same
28// substrate as raci-/debt-/frontier-), each row carrying its own detector + threshold + severity + RACI
29// owner, and the warden MEASURES live artifacts against them. NO flat TSV, NO truncating .log -- the
30// registry is a plane (provenanced hist- rows) and the evidence is an append-only .jrnl (history is sacred).
31//
32// RULE-11 COMPLIANT BY CONSTRUCTION: every POLICY number (threshold, severity, corpus, owner, token set) is
33// manifest data, never code. Point the warden at its own source and the property holds -- that is a gate tooth,
34// not a promise. The consts below are structural envelopes (buffer sizes, byte codes), all NAMED, never inline.
35//
36// DETECTORS (detector <param> over <corpus>)
37//   valuenamed           CLAUDE-11 breach, the GOODHART half (seq1348): a `const NAME = V` whose NAME
38//                        contains V's own digits (SS_MAGIC_65536 = 65536). Clears `inlinelit` while
39//                        explaining nothing, so part of the inlinelit improvement is a DETECTOR
40//                        ARTIFACT. Reported as its OWN law -- never folded into inlinelit, because a
41//                        number mixing two categories is not a measurement. Takes no param.
42//   inlinelit <thr>      CLAUDE-11 breach: standalone decimal literals >= thr on lines that are neither a
43//                        `const ` declaration nor a `//` comment, across *.nx in <corpus>. A NAMED const is
44//                        lawful; an inline literal buried in code is the magic number. Hex (0x..) and escapes
45//                        (\x..) and identifier-embedded digits (i64, p256) are NOT literals -- excluded.
46//   token <csv>          first-byte-up breach: borrowed-stack tokens present in <corpus> text (proposal
47//                        journals), i.e. the "just use webrtc/wasm" callouts, surfaced the moment they appear.
48//   unregistered <conf>  F208 MCP gap: *.elf organs in <corpus> whose basename is absent from field 0 of
49//                        <conf> -- a shipped capability that never became callable.
50//
51// HONEST BY CONSTRUCTION: findings are DERIVED, never asserted. A detector that cannot read its corpus reports
52// -1 = UNMEASURED (never a silent 0). Missing manifest = RED exit 1 (fail-closed, no verdict over no data).
53// Owner join (F207): owner_role must resolve in the raci- plane or the law is flagged UNOWNED.
54// VERDICT=GREEN means THE WARDEN MEASURED, not that the ecosystem is clean -- breaches are reported as a
55// separate count so a cron watcher can trend them without the gate lying.
56//
57//   nx_law_warden {scan [planeprefix] | selftest}     (plane default knowledge/store/lawreg-)
58// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
59import "nx_store_seed_lib.nx"
60import "nx_syscalls.nx"
61import "nx_estate_path.nx"   // ep_anchor: the CWD must not decide this organ's verdict
62import "nx_tool_run.nx"
63import "nx_gate_verdict.nx"
64
65const LW_OUT: i64 = 262144
66const LW_DIRBUF: i64 = 131072
67const LW_PLANE: i64 = 1048576
68const LW_PATH: i64 = 512
69const LW_NAMEMAX: i64 = 256
70const LW_SCRATCH: i64 = 64
71const LW_FILECAP: i64 = 600
72const LW_COLS: i64 = 8
73const LW_COLS_MAX: i64 = 9
74const LW_FLD_BYTES: i64 = 128
75const LW_OVF: i64 = 100000000000
76const LW_MODE: i64 = 0x1a4
77const LW_NL: i64 = 10
78const LW_TAB: i64 = 9
79const LW_HASH: i64 = 35
80const LW_SP: i64 = 32
81const LW_COMMA: i64 = 44
82const LW_DQ: i64 = 34
83const LW_BSL: i64 = 92
84const LW_SL: i64 = 47
85// countfile's threshold. RULE-11 NOTE, deliberate: this is a NAMED CONST and NOT a lawreg- plane row,
86// because /api/build gates on countfile via nx_magicratchet and must NOT acquire a runtime dependency on
87// plane readability -- a plane hiccup would silently re-denominate every baseline in
88// knowledge/status/magicbase/*.cnt. CONTRACT-LOCKED to the deployed binary's value (rule 19): changing it
89// re-baselines every organ at once. Moving it to the manifest is filed as its own rung, not done inline.
90const LW_MAGIC_THR: i64 = 1024
91const LW_MODE_LIT: i64 = 1
92const LW_MODE_ELF: i64 = 2
93const LW_MODE_TOK: i64 = 3
94const LW_SEGMAX: i64 = 64
95const LW_SEGNAME: i64 = 64
96const LW_SEGTAB: i64 = 4096
97const LW_SEGCNT: i64 = 512
98const LW_DIRMODE: i64 = 0x1ed
99const LW_ST_SLOTS: i64 = 64
100
101// ---------- byte/string primitives ----------
102func lw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
103func lw_cat(o: *u8, at: i64, s: *u8) -> i64 { var a: i64=at; var i: i64=0; while s[i]!=(0 as u8){o[a]=s[i]; a=a+1; i=i+1} return a }
104func lw_catf(o: *u8, at: i64, p: *u8, n: i64) -> i64 { var a: i64=at; var i: i64=0; while i<n { o[a]=p[i]; a=a+1; i=i+1 } return a }
105// JSON-safe copy: quote/backslash/control bytes neutralised so a source sample can never break the envelope
106func lw_catesc(o: *u8, at: i64, p: *u8, n: i64) -> i64 {
  var a: i64=at
  var i: i64=0
  while i<n {
      let c: i64 = p[i] as i64
      if c==34 { o[a]=39 as u8 } else { if c==92 { o[a]=47 as u8 } else { if c<32 { o[a]=32 as u8 } else { o[a]=p[i] } } }
      a=a+1
      i=i+1
  }
  return a
116}
117func lw_catn(o: *u8, at: i64, v: i64) -> i64 {
  var a: i64=at
  var x: i64=v
  if x<0 { o[a]=45 as u8; a=a+1; x=0-x }
  let tm: *u8=sys_mmap(LW_SCRATCH)
  var k: i64=0
  if x==0 { tm[0]=48 as u8; k=1 }
  while x>0 { tm[k]=(48+x%10) as u8; x=x/10; k=k+1 }
  var j: i64=0
  while j<k { o[a]=tm[k-1-j]; a=a+1; j=j+1 }
  return a
128}
129func lw_count(buf: *u8, n: i64, needle: *u8) -> i64 {
  var nl: i64=0
  while needle[nl]!=(0 as u8){nl=nl+1}
  if nl==0 { return 0 }
  var c: i64=0
  var i: i64=0
  while i+nl<=n {
      var j: i64=0
      var ok: i64=1
      while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } }
      if ok==1 { c=c+1; i=i+nl } else { i=i+1 }
  }
  return c
142}
143func lw_span_eq(b: *u8, s: i64, l: i64, lit: *u8) -> i64 {
  let n: i64 = lw_slen(lit)
  if n!=l { return 0 }
  var i: i64=0
  while i<n { if b[s+i]!=lit[i] { return 0 } i=i+1 }
  return 1
149}
150func lw_ends(nm: *u8, suf: *u8) -> i64 {
  let n: i64=lw_slen(nm)
  let s: i64=lw_slen(suf)
  if s>n { return 0 }
  var i: i64=0
  while i<s { if nm[n-s+i]!=suf[i] { return 0 } i=i+1 }
  return 1
157}
158func lw_join(dst: *u8, dir: *u8, nm: *u8) -> i64 {
  var a: i64=0
  a=lw_cat(dst,a,dir)
  dst[a]=47 as u8
  a=a+1
  a=lw_cat(dst,a,nm)
  dst[a]=0 as u8
  return a
166}
167func lw_wfile(path: *u8, content: *u8) -> i64 {
  let fd: i64=sys_openat_wr(path, LW_MODE)
  if fd<0 { return 0-1 }
  sys_write(fd, content, lw_slen(content))
  sys_close(fd)
  return 0
173}
174
175// ---------- detector: inlinelit (CLAUDE rule 11) ----------
176func lw_line_start(b: *u8, ls: i64, le: i64) -> i64 {
  var p: i64=ls
  var go: i64=1
  while go==1 { if p>=le { go=0 } else { if b[p]==(LW_SP as u8) { p=p+1 } else { go=0 } } }
  return p
181}
182// a `const ` declaration is the LAWFUL form of a big number -- exempt
183func lw_is_const(b: *u8, ls: i64, le: i64) -> i64 {
  let p: i64 = lw_line_start(b,ls,le)
  if p+6>le { return 0 }
  if b[p]!=(99 as u8) { return 0 }
  if b[p+1]!=(111 as u8) { return 0 }
  if b[p+2]!=(110 as u8) { return 0 }
  if b[p+3]!=(115 as u8) { return 0 }
  if b[p+4]!=(116 as u8) { return 0 }
  if b[p+5]!=(32 as u8) { return 0 }
  return 1
193}
194func lw_is_comment(b: *u8, ls: i64, le: i64) -> i64 {
  let p: i64 = lw_line_start(b,ls,le)
  if p+2>le { return 0 }
  if b[p]!=(47 as u8) { return 0 }
  if b[p+1]!=(47 as u8) { return 0 }
  return 1
200}
201// standalone decimal literals >= thr in the CODE PART of one line. Digits inside a "string literal" are
202// DATA (a port in a message, a date in a URL), and everything after the first // that is OUTSIDE a string
203// is a comment -- neither is code, so neither can be a rule-11 magic number.
204// ROOT FIX 2026-07-31 (ws=law-l006-instrument, debt 1785515802): BOTH exclusions were missing. lw_file_lits
205// guarded with lw_is_comment, which only recognises a WHOLE-LINE comment, so the // TAIL of a code line was
206// scanned as code and a dated trailing comment counted its year as a magic number. Because nx_magicratchet
207// gates /api/build on this count, DATING A TRAILING COMMENT REFUSED REAL BUILDS (debt 1785050172, hit live
208// on nx_mmbench). The absent string state also made this counter disagree with nx_magic map, which already
209// advertised skipped=in-string -- two lexers behind one "ONE canonical counter" claim. Proven by negative
210// control (full-line comment 0, trailing comment 1, genuine literal 1), never by inspection.
211// A digit run preceded by a letter or '_' belongs to an
212// identifier (i64, p256), a hex body (0x1a4) or an escape (\x22) -- never counted.
213func lw_line_lits(b: *u8, ls: i64, le: i64, thr: i64) -> i64 {
  var hits: i64=0
  var p: i64=ls
  var instr: i64=0
  while p<le {
      let c: i64 = b[p] as i64
      if instr==1 {
          if c==LW_BSL { p=p+2 } else {
              if c==LW_DQ { instr=0 }
              p=p+1
          }
      } else {
          var isd: i64=0
          if c>=48 { if c<=57 { isd=1 } }
          if c==LW_DQ { instr=1; p=p+1 } else {
              if isd==0 {
                  var cut: i64=0
                  if c==LW_SL { if p+1<le { if b[p+1]==(LW_SL as u8) { cut=1 } } }
                  if cut==1 { p=le } else { p=p+1 }
              } else {
                  var skip: i64=0
                  if p>ls {
                      let q: i64 = b[p-1] as i64
                      if q==95 { skip=1 }
                      if q>=97 { if q<=122 { skip=1 } }
                      if q>=65 { if q<=90 { skip=1 } }
                  }
                  var v: i64=0
                  var ov: i64=0
                  var run: i64=1
                  while run==1 {
                      if p>=le { run=0 } else {
                          let d: i64 = b[p] as i64
                          var isd2: i64=0
                          if d>=48 { if d<=57 { isd2=1 } }
                          if isd2==1 {
                              if v>LW_OVF { ov=1 } else { v=v*10+(d-48) }
                              p=p+1
                          } else { run=0 }
                      }
                  }
                  if skip==0 { if ov==1 { hits=hits+1 } else { if v>=thr { hits=hits+1 } } }
              }
          }
      }
  }
  return hits
260}
261func lw_file_lits(path: *u8, thr: i64) -> i64 {
  let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64
  let f: *u8 = sys_read_file(path, szp)
  if (f as i64)==0 { return 0-1 }
  let n: i64 = szp[0]
  var hits: i64=0
  var i: i64=0
  while i<n {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=n { go=0 } else { if f[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      if lw_is_comment(f,ls,le)==0 { if lw_is_const(f,ls,le)==0 { hits=hits+lw_line_lits(f,ls,le,thr) } }
  }
  return hits
277}
278
279// ---------- verb: countfile ----------
280// The ONE canonical inline-magic count for a SINGLE file. nx_magicratchet is wired into /api/build and
281// gates every build on this exact contract, so it is load-bearing infrastructure, not a convenience verb.
282// OUTPUT CONTRACT, byte-stable (rule 19): exactly {"magic":N} on stdout, exit 0. N = -1 means UNMEASURED
283// (corpus unreadable) and the ratchet FAILS OPEN on it BY DESIGN -- a false refusal is worse than a miss.
284// RESTORED TO SOURCE 2026-07-31 (ws=law-l006-instrument, debt 1785516173): the deployed binary answered
285// `countfile` while the string appeared in ZERO of 20016 .nx files NAS-wide, so any rebuild would have
286// dropped the verb, made mr_parse_magic return -1 forever, and DISARMED the magic ratchet silently with
287// every gate still GREEN. Source must be a superset of the artifact before either is allowed to move.
288func lw_countfile(path: *u8) -> i64 {
  let n: i64 = lw_file_lits(path, LW_MAGIC_THR)
  let ob: *u8 = sys_mmap(LW_PATH)
  var o: i64 = 0
  o=lw_cat(ob,o,"{\x22magic\x22:" as *u8)
  o=lw_catn(ob,o,n)
  o=lw_cat(ob,o,"}" as *u8)
  sys_write(1,ob,o)
  sys_write(1,"\n" as *u8,1)
  return 0
298}
299
300// ---------- detector: valuenamed (CLAUDE rule 11, the GOODHART half) ----------
301// WHY THIS EXISTS (filed as seq1348, built 2026-07-30). The `inlinelit` detector above counts inline
302// numeric literals and EXEMPTS `const ` lines, because a named constant is the lawful form of a big
303// number. That exemption is being gamed: nx_seg_store.nx alone declares 49 constants of the shape
304//     const SS_MAGIC_65536: i64 = 65536
305// A CONSTANT NAMED AFTER ITS OWN VALUE CARRIES ZERO SEMANTIC CONTENT. It clears inlinelit while leaving
306// the code exactly as unexplainable as before -- nobody can still answer WHY 65536, which is the whole
307// point of rule 11 (you should be able to point at a config key, not a code comment). So part of the
308// measured seq274/seq315 improvement is a DETECTOR ARTIFACT, not a real reduction in unexplained
309// constants. Same class this lane keeps finding: an instrument reporting success for work not done.
310//
311// REPORTED AS ITS OWN LAW, NEVER FOLDED INTO inlinelit -- ★LAW: a number mixing two categories is not
312// a measurement. Zero false positives BY CONSTRUCTION: it fires only when the declared NAME literally
313// contains the decimal digits of its OWN value, which is never meaningful naming.
314// NOT a lint on placement -- the goal is EXPLICABILITY. Remediate by renaming to intent
315// (SS_READ_CHUNK_BYTES, SS_FNV64_PRIME, SS_UNICODE_HANGUL_LO) or moving to a config row. Re-inlining
316// the literal is NOT a fix and would merely move the breach back to inlinelit.
317const LW_MODE_VNAME: i64 = 4
318// L009/L010/L011 detectors, RECONSTRUCTED 2026-07-31 (debt 1785516173): the deployed binary has these
319// three and NO source tree did, so a rebuild would have dropped them. Semantics taken VERBATIM from the
320// lawreg- plane law rows, and each predicate was compiled + linked + RUN standalone with a POSITIVE and
321// TWO NEGATIVE controls before being wired here (_offc/l006_detectors_recon.nx, exit 9).
322// RECONSTRUCTED IS NOT RECOVERED: these are correct-to-spec, not byte-equivalent to the lost originals.
323const LW_MODE_GATEDRY: i64 = 5
324const LW_MODE_HELPERDUP: i64 = 6
325const LW_MODE_SCANCAP: i64 = 7
326
327// digits of `v` into out (no NUL); returns length. v>=0.
328func lw_digits(v: i64, out: *u8) -> i64 {
  if v==0 { out[0]=48 as u8; return 1 }
  let t: *u8 = sys_mmap(32)
  var m: i64=v
  var k: i64=0
  while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 }
  var i: i64=0
  while i<k { out[i]=t[k-1-i]; i=i+1 }
  return k
337}
338// does the byte span [s,e) contain `pat` (len pl)?
339func lw_span_has(b: *u8, s: i64, e: i64, pat: *u8, pl: i64) -> i64 {
  if pl<=0 { return 0 }
  var i: i64=s
  while i+pl<=e {
      var j: i64=0
      var ok: i64=1
      while j<pl { if b[i+j]!=pat[j] { ok=0; j=pl } else { j=j+1 } }
      if ok==1 { return 1 }
      i=i+1
  }
  return 0
350}
351// 1 iff this line is `const NAME...= VALUE` where NAME contains VALUE's decimal digits.
352// Parses the name span (after "const ", up to ':' or '=') and the trailing decimal value.
353func lw_line_valuenamed(b: *u8, ls: i64, le: i64) -> i64 {
  if lw_is_const(b,ls,le)==0 { return 0 }
  let p0: i64 = lw_line_start(b,ls,le)
  let ns: i64 = p0+6                      // past "const "
  if ns>=le { return 0 }
  // name ends at the first ':' or '=' or space
  var ne: i64 = ns
  var go: i64 = 1
  while go==1 {
      if ne>=le { go=0 } else {
          let c: i64 = b[ne] as i64
          if c==58 { go=0 } else { if c==61 { go=0 } else { if c==32 { go=0 } else { ne=ne+1 } } }
      }
  }
  if ne<=ns { return 0 }
  // find '=' then the first decimal run after it (skip 0x.. hex: a '0' followed by 'x' is not decimal)
  var q: i64 = ne
  var eq: i64 = 0-1
  while q<le { if b[q]==(61 as u8) { eq=q; q=le } else { q=q+1 } }
  if eq<0 { return 0 }
  var r: i64 = eq+1
  var v: i64 = 0
  var seen: i64 = 0
  var scan: i64 = 1
  while scan==1 {
      if r>=le { scan=0 } else {
          let d: i64 = b[r] as i64
          var isd: i64=0
          if d>=48 { if d<=57 { isd=1 } }
          if isd==1 {
              // reject hex bodies: '0' immediately followed by 'x'
              if r+1<le { if b[r]==(48 as u8) { if b[r+1]==(120 as u8) { return 0 } } }
              if v>LW_OVF { return 0 }
              v=v*10+(d-48); seen=1; r=r+1
          } else { if seen==1 { scan=0 } else { r=r+1 } }
      }
  }
  if seen==0 { return 0 }
  if v<10 { return 0 }                    // single digits appear in names innocently (V2, P1)
  let db: *u8 = sys_mmap(32)
  let dl: i64 = lw_digits(v,db)
  return lw_span_has(b,ns,ne,db,dl)
395}
396func lw_file_valuenamed(f: *u8, n: i64) -> i64 {
  var hits: i64=0
  var i: i64=0
  while i<n {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=n { go=0 } else { if f[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      if lw_is_comment(f,ls,le)==0 { hits=hits+lw_line_valuenamed(f,ls,le) }
  }
  return hits
408}
409
410// ---------- detector: unregistered (F208 MCP gap) ----------
411// field 0 of a non-comment allowlist line == the tool name (nx_bench_census_lib: field 0 = the DENOMINATOR)
412func lw_field0_has(buf: *u8, n: i64, name: *u8) -> i64 {
  let l: i64=lw_slen(name)
  if l==0 { return 0 }
  if n<=0 { return 0 }
  var i: i64=0
  while i+l<=n {
      var atstart: i64=0
      if i==0 { atstart=1 } else { if buf[i-1]==(LW_NL as u8) { atstart=1 } }
      if atstart==1 {
          var j: i64=0
          var ok: i64=1
          while j<l { if buf[i+j]!=name[j] { ok=0; j=l } else { j=j+1 } }
          if ok==1 {
              var term: i64=0
              if i+l>=n { term=1 } else {
                  let c: i64=buf[i+l] as i64
                  if c==LW_TAB { term=1 }
                  if c==LW_SP { term=1 }
              }
              if term==1 { return 1 }
          }
      }
      i=i+1
  }
  return 0
437}
438
439// ---------- detector: segamp (seg-store SEGMENT AMPLIFICATION) ----------
440// THE CLASS THAT TOOK THE BOX DOWN 2026-07-20: sts_seed commits the WHOLE plane as a NEW segment on every
441// write, so a plane's segment count grows without bound and every read walks all of them (O(rows x segs)).
442// MEASURED that day: debt- at ~464 segments / 42MB for ~200KB of rows; one add >15min then FAILED; a page
443// OOM-killed; the NAS went to load 17 and the whole sovereign stack became unreachable. Nothing detected it
444// -- it was found by hand, after the outage. This detector makes the class mechanically visible BEFORE the
445// next OOM. Counts one segment per <plane>-seg-N.docs and flags any plane over a DATA-DRIVEN threshold.
446// Separate walk (not lw_walk) on purpose: this one ACCUMULATES per-prefix state rather than per-file counts.
447func lw_segamp(dir: *u8, thr: i64, cx: *i64, worst: *u8) -> i64 {
  let fd: i64=sys_openat_rd(dir)
  if fd<0 { return 0-1 }
  let dbuf: *u8=sys_mmap(LW_DIRBUF)
  let names: *u8=sys_mmap(LW_SEGTAB)
  let counts: *i64=sys_mmap(LW_SEGCNT) as *i64
  var np: i64=0
  var go: i64=1
  while go==1 {
      let nr: i64=sys_getdents64(fd,dbuf,LW_DIRBUF)
      if nr<=0 { go=0 } else {
          var off: i64=0
          while off<nr {
              let rec: *u8=(dbuf as i64+off) as *u8
              let nm: *u8=dirent_name(rec)
              if lw_ends(nm,".docs\x00" as *u8)==1 {
                  let ln: i64=lw_slen(nm)
                  var pos: i64=0-1
                  var i2: i64=0
                  while i2+5<=ln {
                      if nm[i2]==(45 as u8) { if nm[i2+1]==(115 as u8) { if nm[i2+2]==(101 as u8) { if nm[i2+3]==(103 as u8) { if nm[i2+4]==(45 as u8) { if pos<0 { pos=i2 } } } } } }
                      i2=i2+1
                  }
                  if pos>0 { if pos<LW_SEGNAME {
                      var found: i64=0-1
                      var k: i64=0
                      while k<np {
                          var same: i64=1
                          var j2: i64=0
                          while j2<pos { if names[k*LW_SEGNAME+j2]!=nm[j2] { same=0; j2=pos } else { j2=j2+1 } }
                          if same==1 { if names[k*LW_SEGNAME+pos]==(0 as u8) { found=k; k=np } }
                          k=k+1
                      }
                      if found<0 {
                          if np<LW_SEGMAX {
                              var j3: i64=0
                              while j3<pos { names[np*LW_SEGNAME+j3]=nm[j3]; j3=j3+1 }
                              names[np*LW_SEGNAME+pos]=0 as u8
                              counts[np]=1
                              np=np+1
                          } else { cx[3]=1 }
                      } else { counts[found]=counts[found]+1 }
                  } }
              }
              off=off+dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
  cx[0]=np
  var over: i64=0
  var mx: i64=0
  var mi: i64=0-1
  var k2: i64=0
  while k2<np {
      if counts[k2]>thr { over=over+1 }
      if counts[k2]>mx { mx=counts[k2]; mi=k2 }
      k2=k2+1
  }
  cx[1]=over
  cx[2]=mx
  if mi>=0 {
      var w: i64=0
      w=lw_cat(worst,w,(names as i64+mi*LW_SEGNAME) as *u8)
      worst[w]=58 as u8
      w=w+1
      w=lw_catn(worst,w,mx)
      worst[w]=0 as u8
  }
  return 0
517}
518
519// ---------- shared corpus walk ----------
520// cx[0]=mode cx[1]=thr cx[2]=files cx[3]=hits cx[4]=worsthits cx[5]=capped cx[6]=allowlist_bytes
521// ---------- T20: parse the debt id out of the nx_debt reply ----------
522// RECONSTRUCTED 2026-07-31 (debt 1785516173). The deployed gate's tooth reads "the debt id is parsed from
523// the nx_debt reply; absent -> -1, NEVER A WRONG ID", and the "never a wrong id" half is the whole point.
524// THE TRAP, hit live today: nx_debt's duplicate reply is
525//     DEBT-DUPLICATE-SKIPPED existing_idx=2003 -- identical desc already filed; ...
526// A naive search for "id=" matches INSIDE "existing_idx=" and returns 2003 -- a real row id belonging to a
527// DIFFERENT debt. That is worse than returning nothing: the warden would stamp law_filed.jrnl with an id
528// that closes someone else's row. So this anchors on the FULL success token and returns -1 for duplicate,
529// empty, truncated and error-page replies. Compiled + linked + RUN standalone (2 POS + 5 NEG) before wiring.
530func lw_debt_id(b: *u8, n: i64) -> i64 {
  let tok: *u8 = "DEBT-ADDED id=" as *u8
  let m: i64 = lw_slen(tok)
  if m>n { return 0-1 }
  var at: i64 = 0-1
  var i: i64 = 0
  while i+m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if b[i+j] != tok[j] { ok=0; j=m } else { j=j+1 } }
      if ok==1 { at=i; i=n } else { i=i+1 }
  }
  if at < 0 { return 0-1 }
  var p: i64 = at + m
  var v: i64 = 0
  var got: i64 = 0
  while p < n {
      let c: i64 = b[p] as i64
      if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p+1 } else { p = n } } else { p = n }
  }
  if got == 0 { return 0-1 }
  return v
552}
553
554// ---------- detectors: gatedry (L009) / helperdup (L010) / scancap (L011) ----------
555// Each returns 1 if THIS FILE breaches, else 0, so the walk's per-file accounting stays uniform with
556// LW_MODE_LIT and LW_MODE_VNAME. Reuses lw_count rather than reimplementing substring search (L010 is
557// literally the law against reimplementing a shared primitive -- these detectors must not breach it).
558
559// L009 gatedry, rule=CLAUDE-6-15-DRY: "gate organs that roll their own verdict instead of inheriting the
560// nx_gate_verdict base class -- the D001 OO-consolidation duplication".
561func lw_file_gatedry(b: *u8, n: i64) -> i64 {
  if lw_count(b,n,"verdict" as *u8)==0 { return 0 }
  if lw_count(b,n,"nx_gate_verdict" as *u8)>0 { return 0 }
  if lw_count(b,n,"gv_verdict" as *u8)>0 { return 0 }
  return 1
566}
567
568// L010 helperdup, rule=CLAUDE-15-DRY: "organs that reimplement the putn/itoa emit primitive instead of
569// importing the nx_estr shared base".
570func lw_file_helperdup(b: *u8, n: i64) -> i64 {
  var defines: i64 = 0
  if lw_count(b,n,"func putn" as *u8)>0 { defines=1 }
  if lw_count(b,n,"_putn(" as *u8)>0 { defines=1 }
  if lw_count(b,n,"itoa" as *u8)>0 { defines=1 }
  if defines==0 { return 0 }
  if lw_count(b,n,"nx_estr" as *u8)>0 { return 0 }
  return 1
578}
579
580// L011 scancap, rule=OPERATOR-HONESTY-selfceiling: "corpus scanners that walk a directory but HIDE their
581// coverage (no scanned/coverage_complete/capped honesty flag) -- presenting partial coverage AS complete".
582// The law names three exemptions -- an honest scanner, a non-scanner, and a PROSE-ONLY mention -- so the
583// walk evidence must be a CALL, not the word appearing in a comment.
584func lw_file_scancap(b: *u8, n: i64) -> i64 {
  var walks: i64 = 0
  if lw_count(b,n,"sys_getdents" as *u8)>0 { walks=1 }
  if lw_count(b,n,"getdents64(" as *u8)>0 { walks=1 }
  if walks==0 { return 0 }
  if lw_count(b,n,"capped" as *u8)>0 { return 0 }
  if lw_count(b,n,"coverage_complete" as *u8)>0 { return 0 }
  if lw_count(b,n,"scanned" as *u8)>0 { return 0 }
  return 1
593}
594
595func lw_walk(dir: *u8, cx: *i64, worst: *u8, abuf: *u8) -> i64 {
  let fd: i64=sys_openat_rd(dir)
  if fd<0 { return 0-1 }
  let dbuf: *u8=sys_mmap(LW_DIRBUF)
  let path: *u8=sys_mmap(LW_PATH)
  let base: *u8=sys_mmap(LW_NAMEMAX)
  var go: i64=1
  while go==1 {
      let nr: i64=sys_getdents64(fd,dbuf,LW_DIRBUF)
      if nr<=0 { go=0 } else {
          var off: i64=0
          while off<nr {
              let rec: *u8=(dbuf as i64+off) as *u8
              let nm: *u8=dirent_name(rec)
              if cx[2]>=LW_FILECAP { cx[5]=1 } else {
                  if cx[0]==LW_MODE_LIT {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let h: i64=lw_file_lits(path,cx[1])
                          if h>=0 {
                              cx[2]=cx[2]+1
                              cx[3]=cx[3]+h
                              if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                          }
                      }
                  }
                  // valuenamed (seq1348): consts named after their own value -- the inlinelit exemption
                  // being gamed. Same walk/accounting shape as LW_MODE_LIT so the roll-up is uniform.
                  if cx[0]==LW_MODE_VNAME {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let vszp: *i64 = sys_mmap(LW_SCRATCH) as *i64
                          let vb: *u8 = sys_read_file(path,vszp)
                          if (vb as i64)!=0 {
                              let h: i64=lw_file_valuenamed(vb,vszp[0])
                              cx[2]=cx[2]+1
                              cx[3]=cx[3]+h
                              if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                          }
                      }
                  }
                  // L009/L010/L011 (reconstructed 2026-07-31): identical walk/accounting shape to
                  // LW_MODE_VNAME so the roll-up stays uniform. Each per-file predicate returns 1 for a
                  // breaching file, so cx[3] counts BREACHING FILES and cx[2] counts files SCANNED --
                  // which is what the law rows' measured/scanned pair means.
                  if cx[0]==LW_MODE_GATEDRY {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let gszp: *i64 = sys_mmap(LW_SCRATCH) as *i64
                          let gb: *u8 = sys_read_file(path,gszp)
                          if (gb as i64)!=0 {
                              let h: i64=lw_file_gatedry(gb,gszp[0])
                              cx[2]=cx[2]+1
                              cx[3]=cx[3]+h
                              if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                          }
                      }
                  }
                  if cx[0]==LW_MODE_HELPERDUP {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let dszp: *i64 = sys_mmap(LW_SCRATCH) as *i64
                          let db2: *u8 = sys_read_file(path,dszp)
                          if (db2 as i64)!=0 {
                              let h: i64=lw_file_helperdup(db2,dszp[0])
                              cx[2]=cx[2]+1
                              cx[3]=cx[3]+h
                              if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                          }
                      }
                  }
                  if cx[0]==LW_MODE_SCANCAP {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let sszp: *i64 = sys_mmap(LW_SCRATCH) as *i64
                          let sb2: *u8 = sys_read_file(path,sszp)
                          if (sb2 as i64)!=0 {
                              let h: i64=lw_file_scancap(sb2,sszp[0])
                              cx[2]=cx[2]+1
                              cx[3]=cx[3]+h
                              if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                          }
                      }
                  }
                  // borrowed-stack tokens ACROSS A SOURCE TREE (not just a journal): the callouts the
                  // operator keeps seeing live in code and plans, so the corpus must be the tree itself.
                  // abuf carries the csv token list for this mode (documented, mode-specific contract).
                  if cx[0]==LW_MODE_TOK {
                      if lw_ends(nm,".nx\x00" as *u8)==1 {
                          lw_join(path,dir,nm)
                          let tsz: *i64 = sys_mmap(LW_SCRATCH) as *i64
                          let tbuf: *u8 = sys_read_file(path,tsz)
                          if (tbuf as i64)!=0 {
                              cx[2]=cx[2]+1
                              let tk: *u8 = sys_mmap(LW_NAMEMAX)
                              var ti: i64=0
                              var tl2: i64=0
                              var tdone: i64=0
                              var fhits: i64=0
                              while tdone==0 {
                                  let cc: i64=abuf[ti] as i64
                                  var flu: i64=0
                                  if cc==0 { flu=1; tdone=1 }
                                  if cc==LW_COMMA { flu=1 }
                                  if flu==1 {
                                      if tl2>0 { tk[tl2]=0 as u8; fhits=fhits+lw_count(tbuf,tsz[0],tk) }
                                      tl2=0
                                  } else { tk[tl2]=abuf[ti]; tl2=tl2+1 }
                                  ti=ti+1
                              }
                              if fhits>0 {
                                  cx[3]=cx[3]+fhits
                                  if fhits>cx[4] { cx[4]=fhits; let lnt: i64=lw_slen(nm); lw_catf(worst,0,nm,lnt); worst[lnt]=0 as u8 }
                              }
                          }
                      }
                  }
                  if cx[0]==LW_MODE_ELF {
                      if lw_ends(nm,".elf\x00" as *u8)==1 {
                          let ln: i64=lw_slen(nm)
                          let bl: i64=ln-4
                          if bl>0 {
                              cx[2]=cx[2]+1
                              var k: i64=0
                              while k<bl { base[k]=nm[k]; k=k+1 }
                              base[bl]=0 as u8
                              // fail-CLOSED: a zero-length basename would make the lookup vacuously "absent"
                              // and brand every organ unregistered -- only count when we truly resolved a name
                              let blen: i64=lw_slen(base)
                              if blen==bl {
                                  let reg: i64=lw_field0_has(abuf,cx[6],base)
                                  if reg==0 {
                                      cx[3]=cx[3]+1
                                      if cx[4]==0 { cx[4]=1; lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 }
                                  }
                              }
                          }
                      }
                  }
              }
              off=off+dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
  return 0
741}
742
743// ---------- detector: token (first-byte-up doctrine) ----------
744// cx[0]=total occurrences cx[1]=distinct tokens present ; -1 if corpus unreadable (UNMEASURED)
745// count needle across lines, SKIPPING any line that contains excl. Why: the warden's own reports land in
746// the same journals it scans ("top hit: wasm"), so a naive buffer-wide count measures itself and inflates
747// the finding every beat. Exclusion is DATA (optional 9th law column), never a hardcoded self-reference.
748func lw_count_lines(b: *u8, n: i64, needle: *u8, excl: *u8) -> i64 {
  let el: i64 = lw_slen(excl)
  var total: i64 = 0
  var i: i64 = 0
  while i<n {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=n { go=0 } else { if b[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      var skip: i64=0
      if el>0 { if lw_count((b as i64+ls) as *u8, le-ls, excl)>0 { skip=1 } }
      if skip==0 { total=total+lw_count((b as i64+ls) as *u8, le-ls, needle) }
  }
  return total
763}
764func lw_token_scan(corpus: *u8, csv: *u8, cx: *i64, worst: *u8, excl: *u8) -> i64 {
  let szp: *i64=sys_mmap(LW_SCRATCH) as *i64
  let b: *u8=sys_read_file(corpus,szp)
  if (b as i64)==0 { return 0-1 }
  let n: i64=szp[0]
  let tok: *u8=sys_mmap(LW_NAMEMAX)
  worst[0]=0 as u8
  var i: i64=0
  var tl: i64=0
  var done: i64=0
  while done==0 {
      let c: i64=csv[i] as i64
      var flush: i64=0
      if c==0 { flush=1; done=1 }
      if c==LW_COMMA { flush=1 }
      if flush==1 {
          if tl>0 {
              tok[tl]=0 as u8
              let h: i64=lw_count_lines(b,n,tok,excl)
              if h>0 {
                  cx[0]=cx[0]+h
                  cx[1]=cx[1]+1
                  if lw_slen(worst)==0 { lw_catf(worst,0,tok,tl); worst[tl]=0 as u8 }
              }
          }
          tl=0
      } else { tok[tl]=csv[i]; tl=tl+1 }
      i=i+1
  }
  return 0
794}
795
796// ---------- file: the autonomy half -- breaches become OWNED work with no human in the loop ----------
797// EVIDENCE-DERIVED, never re-asserted: reads the append-only law_warden.jrnl the scan already wrote and
798// acts on the LATEST scan block only. IDEMPOTENT (rule 10): a law already present in law_filed.jrnl is
799// never re-filed, so an hourly beat does not spam the debt plane. DRY (rule 15): the debt row is written
800// by FORKING nx_debt -- the sibling organ stays the single writer of its own plane.
801
802// ts of the final frame = the most recent scan block
803func lw_last_ts(buf: *u8, n: i64) -> i64 {
  var ts: i64 = 0
  var i: i64 = 0
  var ls: i64 = 0
  while i<n {
      if buf[i]==(LW_NL as u8) {
          if i>ls {
              var v: i64=0
              var k: i64=ls
              var go: i64=1
              while go==1 {
                  if k>=i { go=0 } else {
                      let d: i64=buf[k] as i64
                      if d>=48 { if d<=57 { v=v*10+(d-48); k=k+1 } else { go=0 } } else { go=0 }
                  }
              }
              if v>0 { ts=v }
          }
          ls=i+1
      }
      i=i+1
  }
  return ts
826}
827// has <lawid> already been filed? matches the exact framed token \tFILED\t<lawid>\t
828func lw_filed_has(buf: *u8, n: i64, lawid: *u8) -> i64 {
  if n<=0 { return 0 }
  let pat: *u8 = sys_mmap(LW_NAMEMAX)
  var p: i64 = 0
  pat[p]=LW_TAB as u8
  p=p+1
  p=lw_cat(pat,p,"FILED" as *u8)
  pat[p]=LW_TAB as u8
  p=p+1
  p=lw_cat(pat,p,lawid)
  pat[p]=LW_TAB as u8
  p=p+1
  pat[p]=0 as u8
  if lw_count(buf,n,pat)>0 { return 1 }
  return 0
843}
844
845// resolve a tool NAME to its absolute ELF via tool_allowlist.conf (field0 -> field1). NEVER hardcode a
846// path: a guessed path execve-fails as 127 and the caller silently files nothing. Ask the registry.
847func lw_allow_path(abuf: *u8, an: i64, name: *u8, out: *u8) -> i64 {
  if an<=0 { return 0 }
  var i: i64=0
  while i<an {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=an { go=0 } else { if abuf[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      if le>ls { if abuf[ls]!=(LW_HASH as u8) {
          var p: i64=ls
          var g1: i64=1
          while g1==1 { if p>=le { g1=0 } else { if abuf[p]==(LW_TAB as u8) { g1=0 } else { p=p+1 } } }
          if lw_span_eq(abuf,ls,p-ls,name)==1 {
              let s1: i64=p+1
              var q: i64=s1
              var g2: i64=1
              while g2==1 { if q>=le { g2=0 } else { if abuf[q]==(LW_TAB as u8) { g2=0 } else { q=q+1 } } }
              let f1l: i64=q-s1
              if f1l>0 { lw_catf(out,0,(abuf as i64+s1) as *u8,f1l); out[f1l]=0 as u8; return 1 }
          }
      } }
  }
  return 0
871}
872
873// ---------- selftest ----------
874func lw_selftest() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_law_warden gate -- laws become mechanically checkable, and the warden obeys rule 11 itself" as *u8)
  let thr: i64 = 1024
878
  lw_wfile("/tmp/lw_a.nx\x00" as *u8, "var x: i64 = 65536\n\x00" as *u8)
  let a: i64 = lw_file_lits("/tmp/lw_a.nx\x00" as *u8, thr)
  var t1: i64=0
  if a==1 { t1=1 }
  gv_check("T1 inline literal above threshold is a BREACH" as *u8, t1, ctr)
884
  lw_wfile("/tmp/lw_b.nx\x00" as *u8, "const LW_X: i64 = 65536\n\x00" as *u8)
  let b: i64 = lw_file_lits("/tmp/lw_b.nx\x00" as *u8, thr)
  var t2: i64=0
  if b==0 { t2=1 }
  gv_check("T2 the same number as a NAMED const is lawful (the rule-11 fix, not a breach)" as *u8, t2, ctr)
890
  // ---- valuenamed teeth (seq1348). Each reads a REAL file through the same reader the walk uses. ----
  // ⚠T2 above proves a NAMED const is lawful under inlinelit, and that stays true. valuenamed does not
  // contradict it: it asks the SECOND question -- does the name actually EXPLAIN the number, or merely
  // repeat it? LW_X = 65536 is lawful under BOTH; SS_MAGIC_65536 = 65536 is lawful only under the first.
  let vszp: *i64 = sys_mmap(LW_SCRATCH) as *i64
  lw_wfile("/tmp/lw_v1.nx\x00" as *u8, "const SS_MAGIC_65536: i64 = 65536\n\x00" as *u8)
  let v1b: *u8 = sys_read_file("/tmp/lw_v1.nx\x00" as *u8, vszp)
  var tv1: i64=0
  if (v1b as i64)!=0 { if lw_file_valuenamed(v1b,vszp[0])==1 { tv1=1 } }
  gv_check("TV1 a const NAMED AFTER ITS OWN VALUE is a breach (SS_MAGIC_65536 = 65536)" as *u8, tv1, ctr)
901
  // NEGATIVE CONTROL -- the whole point is that INTENT-named consts must pass, or the detector would
  // simply re-flag every constant and be useless. Same value, explanatory name.
  lw_wfile("/tmp/lw_v2.nx\x00" as *u8, "const SS_READ_CHUNK_BYTES: i64 = 65536\n\x00" as *u8)
  let v2b: *u8 = sys_read_file("/tmp/lw_v2.nx\x00" as *u8, vszp)
  var tv2: i64=0
  if (v2b as i64)!=0 { if lw_file_valuenamed(v2b,vszp[0])==0 { tv2=1 } }
  gv_check("TV2 NEG-CONTROL: an INTENT-named const of the same value is NOT flagged" as *u8, tv2, ctr)
909
  // a comment mentioning the shape is not a declaration
  lw_wfile("/tmp/lw_v3.nx\x00" as *u8, "// const SS_MAGIC_65536: i64 = 65536\n\x00" as *u8)
  let v3b: *u8 = sys_read_file("/tmp/lw_v3.nx\x00" as *u8, vszp)
  var tv3: i64=0
  if (v3b as i64)!=0 { if lw_file_valuenamed(v3b,vszp[0])==0 { tv3=1 } }
  gv_check("TV3 NEG-CONTROL: a COMMENTED-OUT value-named const is not code" as *u8, tv3, ctr)
916
  // hex must not be read as decimal (0x1ed's digits would otherwise chase the wrong number)
  lw_wfile("/tmp/lw_v4.nx\x00" as *u8, "const LW_MODE_0x1ed: i64 = 0x1ed\n\x00" as *u8)
  let v4b: *u8 = sys_read_file("/tmp/lw_v4.nx\x00" as *u8, vszp)
  var tv4: i64=0
  if (v4b as i64)!=0 { if lw_file_valuenamed(v4b,vszp[0])==0 { tv4=1 } }
  gv_check("TV4 NEG-CONTROL: a HEX value is not decimal-matched (no false positive)" as *u8, tv4, ctr)
923
  lw_wfile("/tmp/lw_c.nx\x00" as *u8, "// note 65536 here\n\x00" as *u8)
  let c: i64 = lw_file_lits("/tmp/lw_c.nx\x00" as *u8, thr)
  var t3: i64=0
  if c==0 { t3=1 }
  gv_check("T3 a number inside a comment is not code" as *u8, t3, ctr)
929
  // T21-T24 exist because T3 above passed while the detector was BROKEN: T3 only ever writes a WHOLE-LINE
  // comment, and lw_is_comment only recognises that shape. The live defect was the // TAIL of a CODE line --
  // a dated trailing comment counted its year as a magic number and, through nx_magicratchet on /api/build,
  // REFUSED REAL BUILDS (debt 1785050172). ★A TOOTH THAT CANNOT FAIL ON THE DEFECT IT NAMES IS NOT EVIDENCE.
  // T21/T22 are the negative controls that would have caught it; T23/T24 are POSITIVE controls so the fix
  // cannot pass by making the detector blind instead of accurate.
  lw_wfile("/tmp/lw_tc.nx\x00" as *u8, "let w: i64 = q + 1   // dated 2026-07-31 is not code\n\x00" as *u8)
  let tc: i64 = lw_file_lits("/tmp/lw_tc.nx\x00" as *u8, thr)
  var t21: i64=0
  if tc==0 { t21=1 }
  gv_check("T21 NEG-CONTROL: a TRAILING // comment on a code line is not code (the whole-line case is not the defect)" as *u8, t21, ctr)
941
  lw_wfile("/tmp/lw_ts.nx\x00" as *u8, "let s: *u8 = \x22listening on port 8080 since 2026\x22\n\x00" as *u8)
  let tsq: i64 = lw_file_lits("/tmp/lw_ts.nx\x00" as *u8, thr)
  var t22: i64=0
  if tsq==0 { t22=1 }
  gv_check("T22 NEG-CONTROL: digits inside a string literal are DATA, not rule-11 magic (agrees with nx_magic skipped=in-string)" as *u8, t22, ctr)
947
  lw_wfile("/tmp/lw_tp.nx\x00" as *u8, "let z: i64 = q + 4096   // 2026 in the tail must not add to this\n\x00" as *u8)
  let tp: i64 = lw_file_lits("/tmp/lw_tp.nx\x00" as *u8, thr)
  var t23: i64=0
  if tp==1 { t23=1 }
  gv_check("T23 POS-CONTROL: a genuine inline literal is still counted EXACTLY ONCE beside a trailing comment" as *u8, t23, ctr)
953
  lw_wfile("/tmp/lw_tx.nx\x00" as *u8, "let s: *u8 = \x22a 9999 b\x22 + 4096\n\x00" as *u8)
  let tx: i64 = lw_file_lits("/tmp/lw_tx.nx\x00" as *u8, thr)
  var t24: i64=0
  if tx==1 { t24=1 }
  gv_check("T24 POS-CONTROL: string state EXITS at the closing quote -- a literal after it is still counted" as *u8, t24, ctr)
959
  // T25-T27 harden the string state against the idioms this corpus actually uses. Verified first as a
  // standalone executable (scratchpad/l006_hard.nx, exit 63 = 6/6) before being seeded here.
  lw_wfile("/tmp/lw_tu.nx\x00" as *u8, "let u: *u8 = \x22http://x\x22   let n: i64 = 8192\n\x00" as *u8)
  let tu: i64 = lw_file_lits("/tmp/lw_tu.nx\x00" as *u8, thr)
  var t25: i64=0
  if tu==1 { t25=1 }
  gv_check("T25 a // INSIDE a string is not a comment cut -- the literal after the string still counts" as *u8, t25, ctr)
967
  lw_wfile("/tmp/lw_tm.nx\x00" as *u8, "f(\x22a\x22, 4096, \x22b9999\x22)\n\x00" as *u8)
  let tm: i64 = lw_file_lits("/tmp/lw_tm.nx\x00" as *u8, thr)
  var t26: i64=0
  if tm==1 { t26=1 }
  gv_check("T26 two adjacent strings do not merge: the literal BETWEEN them counts, the one inside does not" as *u8, t26, ctr)
973
  lw_wfile("/tmp/lw_th.nx\x00" as *u8, "let m: i64 = 0x1a4 + p256 + 65536\n\x00" as *u8)
  let th: i64 = lw_file_lits("/tmp/lw_th.nx\x00" as *u8, thr)
  var t27: i64=0
  if th==1 { t27=1 }
  gv_check("T27 hex bodies and identifier digits stay excluded while a real literal on the same line counts" as *u8, t27, ctr)
979
  lw_wfile("/tmp/lw_d.nx\x00" as *u8, "let m: i64 = 0x1a4\n\x00" as *u8)
  let d: i64 = lw_file_lits("/tmp/lw_d.nx\x00" as *u8, thr)
  var t4: i64=0
  if d==0 { t4=1 }
  gv_check("T4 hex bodies and escapes are not decimal literals (no false positives)" as *u8, t4, ctr)
985
  lw_wfile("/tmp/lw_e.nx\x00" as *u8, "var y: i64 = 42\n\x00" as *u8)
  let e: i64 = lw_file_lits("/tmp/lw_e.nx\x00" as *u8, thr)
  var t5: i64=0
  if e==0 { t5=1 }
  gv_check("T5 threshold comes from manifest DATA -- below it is not flagged" as *u8, t5, ctr)
991
  let miss: i64 = lw_file_lits("/tmp/lw_does_not_exist_zz.nx\x00" as *u8, thr)
  var t6: i64=0
  if miss==(0-1) { t6=1 }
  gv_check("T6 unreadable corpus reports -1 UNMEASURED, never a silent 0" as *u8, t6, ctr)
996
  lw_wfile("/tmp/lw_t.txt\x00" as *u8, "plan: we should just use webassembly for this\n\x00" as *u8)
  let tcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  tcx[0]=0
  tcx[1]=0
  let tw: *u8 = sys_mmap(LW_NAMEMAX)
  lw_token_scan("/tmp/lw_t.txt\x00" as *u8, "webassembly,cuda\x00" as *u8, tcx, tw, "\x00" as *u8)
  var t7: i64=0
  if tcx[1]==1 { if tcx[0]>=1 { t7=1 } }
  gv_check("T7 borrowed-stack token found, absent token NOT counted (neg-control)" as *u8, t7, ctr)
1006
  let ab: *u8 = sys_mmap(LW_NAMEMAX)
  let abn: i64 = lw_cat(ab,0,"nx_seat\tp\tGREEN\nnx_claims\tp\tGREEN\n" as *u8)
  let present: i64 = lw_field0_has(ab,abn,"nx_seat\x00" as *u8)
  let absent: i64 = lw_field0_has(ab,abn,"nx_ghost\x00" as *u8)
  var t8: i64=0
  if present==1 { if absent==0 { t8=1 } }
  gv_check("T8 MCP-exposure join reads field 0 exactly (shipped-but-unregistered is detectable)" as *u8, t8, ctr)
1014
  lw_wfile("/tmp/lw_zz_unreg.elf\x00" as *u8, "x\n\x00" as *u8)
  let wcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  wcx[0]=LW_MODE_ELF
  wcx[1]=0
  wcx[2]=0
  wcx[3]=0
  wcx[4]=0
  wcx[5]=0
  wcx[6]=abn
  let ww: *u8 = sys_mmap(LW_NAMEMAX)
  ww[0]=0 as u8
  lw_walk("/tmp\x00" as *u8, wcx, ww, ab)
  var t9: i64=0
  if wcx[3]>=1 { if lw_slen(ww)>0 { t9=1 } }
  gv_check("T9 unregistered walk NAMES the organ (an empty sample means the basename never resolved, which would brand every organ unregistered)" as *u8, t9, ctr)
1030
  lw_wfile("/tmp/lw_tok.nx\x00" as *u8, "// plan: just bridge it with webrtc for now\n\x00" as *u8)
  let kcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  kcx[0]=LW_MODE_TOK
  kcx[1]=0
  kcx[2]=0
  kcx[3]=0
  kcx[4]=0
  kcx[5]=0
  kcx[6]=0
  let kw: *u8 = sys_mmap(LW_NAMEMAX)
  kw[0]=0 as u8
  lw_walk("/tmp\x00" as *u8, kcx, kw, "webrtc,zzznotpresentzz\x00" as *u8)
  var t10: i64=0
  if kcx[3]>=1 { if lw_slen(kw)>0 { t10=1 } }
  gv_check("T10 tokendir finds borrowed-stack callouts ACROSS a source tree and names the file" as *u8, t10, ctr)
1046
  let lb: *u8 = sys_mmap(LW_NAMEMAX)
  var lp: i64=0
  lp=lw_cat(lb,lp,"100" as *u8)
  lb[lp]=LW_TAB as u8
  lp=lp+1
  lp=lw_cat(lb,lp,"LAW" as *u8)
  lb[lp]=LW_NL as u8
  lp=lp+1
  lp=lw_cat(lb,lp,"200" as *u8)
  lb[lp]=LW_TAB as u8
  lp=lp+1
  lp=lw_cat(lb,lp,"LAW" as *u8)
  lb[lp]=LW_NL as u8
  lp=lp+1
  var t11: i64=0
  if lw_last_ts(lb,lp)==200 { t11=1 }
  gv_check("T11 file acts on the LATEST scan block only (last ts wins, not the first)" as *u8, t11, ctr)
1064
  let pb: *u8 = sys_mmap(LW_NAMEMAX)
  var pp: i64=0
  pp=lw_catn(pb,pp,100)
  pb[pp]=LW_TAB as u8
  pp=pp+1
  pp=lw_cat(pb,pp,"FILED" as *u8)
  pb[pp]=LW_TAB as u8
  pp=pp+1
  pp=lw_cat(pb,pp,"L001" as *u8)
  pb[pp]=LW_TAB as u8
  pp=pp+1
  pp=lw_cat(pb,pp,"5" as *u8)
  pb[pp]=LW_NL as u8
  pp=pp+1
  var t12: i64=0
  if lw_filed_has(pb,pp,"L001\x00" as *u8)==1 { if lw_filed_has(pb,pp,"L002\x00" as *u8)==0 { t12=1 } }
  gv_check("T12 IDEMPOTENT: an already-filed law is skipped, a new one is not (hourly beat cannot spam)" as *u8, t12, ctr)
1082
  let rp: *u8 = sys_mmap(LW_PATH)
  let r1: i64 = lw_allow_path(ab,abn,"nx_seat\x00" as *u8,rp)
  let r2: i64 = lw_allow_path(ab,abn,"nx_ghost\x00" as *u8,rp)
  var t13: i64=0
  if r1==1 { if r2==0 { t13=1 } }
  gv_check("T13 filing organ resolved from the REGISTRY, unknown name refused (no guessed path -> no silent execve 127)" as *u8, t13, ctr)
1089
  lw_wfile("/tmp/lw_x.txt\x00" as *u8, "plan: just bridge it with webrtc\nwarden report: webrtc was the top hit\n\x00" as *u8)
  let xcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  xcx[0]=0
  xcx[1]=0
  let xw: *u8 = sys_mmap(LW_NAMEMAX)
  lw_token_scan("/tmp/lw_x.txt\x00" as *u8, "webrtc\x00" as *u8, xcx, xw, "warden report\x00" as *u8)
  var t14: i64=0
  if xcx[0]==1 { t14=1 }
  gv_check("T14 exclusion: the warden's OWN report line is not counted as a callout (2 lines -> 1 real hit)" as *u8, t14, ctr)
1099
  // OWN scratch dir: /tmp is shared and already held another organ's seg-store fixtures, so asserting
  // on a global max was never deterministic. A test that reads a mutable shared directory is not a test.
  sys_mkdir("/tmp/lwseg\x00" as *u8, LW_DIRMODE)
  lw_wfile("/tmp/lwseg/zzlw-seg-0.docs\x00" as *u8, "x\n\x00" as *u8)
  lw_wfile("/tmp/lwseg/zzlw-seg-1.docs\x00" as *u8, "x\n\x00" as *u8)
  lw_wfile("/tmp/lwseg/yylw-seg-0.docs\x00" as *u8, "x\n\x00" as *u8)
  let scx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  scx[0]=0
  scx[1]=0
  scx[2]=0
  scx[3]=0
  let sw: *u8 = sys_mmap(LW_NAMEMAX)
  sw[0]=0 as u8
  lw_segamp("/tmp/lwseg\x00" as *u8, 1, scx, sw)
  var t15: i64=0
  if scx[0]==2 { if scx[1]==1 { if scx[2]==2 { t15=1 } } }
  gv_check("T15 segamp counts segments PER PLANE and flags the amplified one (the class that OOM-killed the box)" as *u8, t15, ctr)
1117
  let rc: i64 = gv_verdict("LAW-WARDEN-GATE" as *u8, ctr, "written laws now have detectors; warden is rule-11 clean by construction" as *u8)
  return rc
1120}
1121
1122// ---------- scan ----------
1123func lw_scan(prefix: *u8) -> i64 {
  let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64
  // THE LAW REGISTRY IS A SOVEREIGN PLANE (seg-store behind nx_store_put), NOT a flat TSV -- the same
  // substrate as raci-/debt-/frontier-/featreg-, so every mutation is provenanced into its hist- rows
  // and parallel seats cannot clobber each other. A flat file had neither property.
  let mb: *u8 = sys_mmap(LW_PLANE)
  let mn: i64 = sts_load(prefix, mb, LW_PLANE)
  if mn<=0 {
      gv_puts("LAW-WARDEN RED -- law plane unseeded (fail-closed: no verdict over no data): " as *u8)
      gv_puts(prefix)
      gv_puts("\n" as *u8)
      sys_exit(1)
      return 1
  }
1137
  // RACI owner join (F207): the whole raci- plane as text; -1 bytes = plane unreadable = UNMEASURED
  let rb: *u8 = sys_mmap(LW_PLANE)
  let rn: i64 = sts_load("knowledge/store/raci-\x00" as *u8, rb, LW_PLANE)
1141
  // NOTE: the unregistered detector reads its allowlist from the law row's own param -- the conf path is
  // DATA like every other policy input, so the registry can never describe a file the code does not read.
1144
  let jb: *u8 = sys_mmap(LW_OUT)
  var j: i64=0
  let fb: *u8 = sys_mmap(LW_OUT)
  var fp: i64=0
  let now: i64 = sys_now_realtime_sec()
  j=lw_cat(jb,j,"{\x22v\x22:1,\x22domain\x22:\x22law-warden\x22,\x22title\x22:\x22Written laws, mechanically detected -- no human needs to name the breach\x22,\x22laws\x22:[" as *u8)
1151
  let fs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let fl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let cx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  let worst: *u8 = sys_mmap(LW_NAMEMAX)
  let corpus: *u8 = sys_mmap(LW_PATH)
  let param: *u8 = sys_mmap(LW_PATH)
  let role: *u8 = sys_mmap(LW_NAMEMAX)
  let excl: *u8 = sys_mmap(LW_PATH)
1160
  var nlaw: i64=0
  var nmeas: i64=0
  var nbreach: i64=0
  var nunowned: i64=0
  var sevall: i64=0
  var sevbr: i64=0
  var first: i64=1
  var i: i64=0
  while i<mn {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=mn { go=0 } else { if mb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      let lend: i64=le
      i=le+1
      let llen: i64=lend-ls
      if llen>3 { if mb[ls]!=(LW_HASH as u8) {
          var nf: i64=0
          var p: i64=ls
          var fstart: i64=ls
          while p<lend {
              if mb[p]==(LW_TAB as u8) {
                  if nf<LW_COLS_MAX { fs[nf]=fstart; fl[nf]=p-fstart; nf=nf+1 }
                  fstart=p+1
              }
              p=p+1
          }
          if nf<LW_COLS_MAX { fs[nf]=fstart; fl[nf]=lend-fstart; nf=nf+1 }
          if nf>=LW_COLS {
              let sev: i64 = (mb[fs[5]] as i64)-48
              // zero-terminate the fields the detectors need as C strings
              lw_catf(param,0,(mb as i64+fs[4]) as *u8,fl[4])
              param[fl[4]]=0 as u8
              lw_catf(corpus,0,(mb as i64+fs[7]) as *u8,fl[7])
              corpus[fl[7]]=0 as u8
              lw_catf(role,0,(mb as i64+fs[6]) as *u8,fl[6])
              role[fl[6]]=0 as u8
              // optional 9th column = a substring that marks a line as NOT-A-PROPOSAL (e.g. the warden's
              // own report frames). Absent -> no exclusion, identical to the 8-column contract (rule 19).
              excl[0]=0 as u8
              if nf>=LW_COLS_MAX { lw_catf(excl,0,(mb as i64+fs[8]) as *u8,fl[8]); excl[fl[8]]=0 as u8 }
1202
              // owner join: role must resolve in the raci- plane, else UNOWNED
              var owner_ok: i64 = 0-1
              if rn>0 { owner_ok=0; if lw_count(rb,rn,role)>0 { owner_ok=1 } }
              if owner_ok==0 { nunowned=nunowned+1 }
1207
              cx[0]=0
              cx[1]=0
              cx[2]=0
              cx[3]=0
              cx[4]=0
              cx[5]=0
              cx[6]=0
              worst[0]=0 as u8
              var measured: i64 = 0-1
              var files: i64 = 0
1218
              if lw_span_eq(mb,fs[3],fl[3],"inlinelit" as *u8)==1 {
                  var thr: i64=0
                  var q: i64=0
                  while q<fl[4] { let dch: i64=param[q] as i64; if dch>=48 { if dch<=57 { thr=thr*10+(dch-48) } } q=q+1 }
                  cx[0]=LW_MODE_LIT
                  cx[1]=thr
                  if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"valuenamed" as *u8)==1 {
                  cx[0]=LW_MODE_VNAME
                  if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"gatedry" as *u8)==1 {
                  cx[0]=LW_MODE_GATEDRY
                  if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"helperdup" as *u8)==1 {
                  cx[0]=LW_MODE_HELPERDUP
                  if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"scancap" as *u8)==1 {
                  cx[0]=LW_MODE_SCANCAP
                  if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"unregistered" as *u8)==1 {
                  let csz: *i64 = sys_mmap(LW_SCRATCH) as *i64
                  let cb: *u8 = sys_read_file(param, csz)
                  if (cb as i64)!=0 {
                      cx[0]=LW_MODE_ELF
                      cx[6]=csz[0]
                      if lw_walk(corpus,cx,worst,cb)==0 { measured=cx[3]; files=cx[2] }
                  }
              }
              if lw_span_eq(mb,fs[3],fl[3],"token" as *u8)==1 {
                  cx[0]=0
                  cx[1]=0
                  if lw_token_scan(corpus,param,cx,worst,excl)==0 { measured=cx[0]; files=cx[1] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"tokendir" as *u8)==1 {
                  cx[0]=LW_MODE_TOK
                  if lw_walk(corpus,cx,worst,param)==0 { measured=cx[3]; files=cx[2] }
              }
              if lw_span_eq(mb,fs[3],fl[3],"segamp" as *u8)==1 {
                  var thr2: i64=0
                  var q2: i64=0
                  while q2<fl[4] { let dc: i64=param[q2] as i64; if dc>=48 { if dc<=57 { thr2=thr2*10+(dc-48) } } q2=q2+1 }
                  cx[0]=0
                  cx[1]=0
                  cx[2]=0
                  cx[3]=0
                  if lw_segamp(corpus,thr2,cx,worst)==0 { measured=cx[1]; files=cx[0]; if cx[3]==1 { cx[5]=1 } }
              }
1271
              nlaw=nlaw+1
              sevall=sevall+sev
              if measured>=0 { nmeas=nmeas+1 }
              if measured>0 { nbreach=nbreach+1; sevbr=sevbr+sev }
1276
              // one APPEND-ONLY frame per law per scan -- this is what makes a TREND derivable
              fp=lw_catn(fb,fp,now)
              fp=lw_cat(fb,fp,"\tLAW\t" as *u8)
              fp=lw_catf(fb,fp,(mb as i64+fs[0]) as *u8,fl[0])
              fp=lw_cat(fb,fp,"\t" as *u8)
              fp=lw_catf(fb,fp,(mb as i64+fs[3]) as *u8,fl[3])
              fp=lw_cat(fb,fp,"\t" as *u8)
              fp=lw_catn(fb,fp,measured)
              fp=lw_cat(fb,fp,"\t" as *u8)
              if measured<0 { fp=lw_cat(fb,fp,"UNMEASURED" as *u8) } else { if measured>0 { fp=lw_cat(fb,fp,"BREACH" as *u8) } else { fp=lw_cat(fb,fp,"CLEAN" as *u8) } }
              fp=lw_cat(fb,fp,"\t" as *u8)
              fp=lw_catesc(fb,fp,worst,lw_slen(worst))
              fp=lw_cat(fb,fp,"\n" as *u8)
1290
              if first==0 { j=lw_cat(jb,j,"," as *u8) }
              first=0
              j=lw_cat(jb,j,"{\x22law\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[0]) as *u8,fl[0])
              j=lw_cat(jb,j,"\x22,\x22title\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[1]) as *u8,fl[1])
              j=lw_cat(jb,j,"\x22,\x22rule\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[2]) as *u8,fl[2])
              j=lw_cat(jb,j,"\x22,\x22detector\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[3]) as *u8,fl[3])
              j=lw_cat(jb,j,"\x22,\x22param\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[4]) as *u8,fl[4])
              j=lw_cat(jb,j,"\x22,\x22sev\x22:" as *u8); j=lw_catn(jb,j,sev)
              j=lw_cat(jb,j,",\x22owner_role\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[6]) as *u8,fl[6])
              j=lw_cat(jb,j,"\x22,\x22owner_resolved\x22:" as *u8); j=lw_catn(jb,j,owner_ok)
              j=lw_cat(jb,j,",\x22corpus\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[7]) as *u8,fl[7])
              j=lw_cat(jb,j,"\x22,\x22measured\x22:" as *u8); j=lw_catn(jb,j,measured)
              j=lw_cat(jb,j,",\x22scanned\x22:" as *u8); j=lw_catn(jb,j,files)
              j=lw_cat(jb,j,",\x22capped\x22:" as *u8); j=lw_catn(jb,j,cx[5])
              j=lw_cat(jb,j,",\x22worst\x22:\x22" as *u8); j=lw_catesc(jb,j,worst,lw_slen(worst))
              j=lw_cat(jb,j,"\x22,\x22status\x22:\x22" as *u8)
              if measured<0 { j=lw_cat(jb,j,"UNMEASURED" as *u8) } else { if measured>0 { j=lw_cat(jb,j,"BREACH" as *u8) } else { j=lw_cat(jb,j,"CLEAN" as *u8) } }
              j=lw_cat(jb,j,"\x22}" as *u8)
          }
      } }
  }
1312
  var enforced: i64=0
  var breachw: i64=0
  if nlaw>0 { enforced=(nmeas*1000)/nlaw }
  if sevall>0 { breachw=(sevbr*1000)/sevall }
1317
  j=lw_cat(jb,j,"],\x22laws_total\x22:" as *u8); j=lw_catn(jb,j,nlaw)
  j=lw_cat(jb,j,",\x22laws_measured\x22:" as *u8); j=lw_catn(jb,j,nmeas)
  j=lw_cat(jb,j,",\x22laws_breached\x22:" as *u8); j=lw_catn(jb,j,nbreach)
  j=lw_cat(jb,j,",\x22laws_unowned\x22:" as *u8); j=lw_catn(jb,j,nunowned)
  j=lw_cat(jb,j,",\x22enforced_permil\x22:" as *u8); j=lw_catn(jb,j,enforced)
  j=lw_cat(jb,j,",\x22breach_weight_permil\x22:" as *u8); j=lw_catn(jb,j,breachw)
  j=lw_cat(jb,j,",\x22raci_plane_bytes\x22:" as *u8); j=lw_catn(jb,j,rn)
  j=lw_cat(jb,j,",\x22formula\x22:\x22enforced_permil = laws with a detector that actually RAN over laws in the registry; breach_weight_permil = severity share of breached laws. UNMEASURED is counted as un-enforced, never as clean.\x22" as *u8)
  j=lw_cat(jb,j,",\x22envelope\x22:\x22law roster = the lawreg- plane (grows by appended rows, NOT exhaustive); dir walks are one level, non-recursive, capped at LW_FILECAP files with capped=1 declared; owner join is substring presence in the raci- plane; -1 = UNMEASURED. tokendir counts MENTIONS not endorsements -- an anti-mention (no python) counts too, so token findings are review candidates for the router, never auto-verdicts.\x22" as *u8)
  j=lw_cat(jb,j,",\x22honest\x22:\x22VERDICT=GREEN means THE WARDEN MEASURED -- not that the ecosystem is clean; read laws_breached for that. A law with no row here is UNENFORCED and therefore invisible: adding a row is how a written rule becomes mechanically checkable, and doing so RAISES the breach count (that is the system working).\x22}" as *u8)
1328
  sys_write(1,jb,j)
  sys_write(1,"\n" as *u8,1)
1331
  // APPEND-ONLY evidence journal (rule 13: history is sacred; ws_sync/claims/actlog lineage). The old
  // truncating .log ERASED every prior scan, so the hourly beat could never yield a trend -- each run
  // overwrote the last. O_APPEND frames are conflict-free under parallel seats too.
  let lf: i64 = sys_openat_append("knowledge/status/law_warden.jrnl\x00" as *u8, LW_MODE)
  if lf>=0 {
      fp=lw_catn(fb,fp,now)
      fp=lw_cat(fb,fp,"\tVERDICT=GREEN\tlaws=" as *u8)
      fp=lw_catn(fb,fp,nlaw)
      fp=lw_cat(fb,fp,"\tmeasured=" as *u8)
      fp=lw_catn(fb,fp,nmeas)
      fp=lw_cat(fb,fp,"\tbreached=" as *u8)
      fp=lw_catn(fb,fp,nbreach)
      fp=lw_cat(fb,fp,"\tunowned=" as *u8)
      fp=lw_catn(fb,fp,nunowned)
      fp=lw_cat(fb,fp,"\tenforced_permil=" as *u8)
      fp=lw_catn(fb,fp,enforced)
      fp=lw_cat(fb,fp,"\n" as *u8)
      sys_write(lf,fb,fp)
      sys_close(lf)
  }
  return 0
1353}
1354
1355// find the lawreg- row whose col0 == lawid; fills gs/gl with its 8 column spans
1356func lw_plane_find(rb: *u8, rn: i64, lawid: *u8, gs: *i64, gl: *i64) -> i64 {
  var i: i64=0
  while i<rn {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=rn { go=0 } else { if rb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      if le>ls { if rb[ls]!=(LW_HASH as u8) {
          var nf: i64=0
          var p: i64=ls
          var st: i64=ls
          while p<le {
              if rb[p]==(LW_TAB as u8) { if nf<LW_COLS_MAX { gs[nf]=st; gl[nf]=p-st; nf=nf+1 } st=p+1 }
              p=p+1
          }
          if nf<LW_COLS_MAX { gs[nf]=st; gl[nf]=le-st; nf=nf+1 }
          if nf>=LW_COLS { if lw_span_eq(rb,gs[0],gl[0],lawid)==1 { return 1 } }
      } }
  }
  return 0
1377}
1378
1379func lw_file(prefix: *u8, toolname: *u8) -> i64 {
  let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64
  // the filing organ is resolved from the REGISTRY, never from a hardcoded path
  let az: *i64 = sys_mmap(LW_SCRATCH) as *i64
  let ab: *u8 = sys_read_file("tool_allowlist.conf\x00" as *u8, az)
  let elfpath: *u8 = sys_mmap(LW_PATH)
  var okp: i64 = 0
  if (ab as i64)!=0 { okp=lw_allow_path(ab,az[0],toolname,elfpath) }
  if okp==0 {
      gv_puts("LAW-FILE RED -- filing organ has no tool_allowlist.conf row; refusing to fork a guessed path: " as *u8)
      gv_puts(toolname)
      gv_puts("\n" as *u8)
      sys_exit(1)
      return 1
  }
  let rb: *u8 = sys_mmap(LW_PLANE)
  let rn: i64 = sts_load(prefix, rb, LW_PLANE)
  if rn<=0 {
      gv_puts("LAW-FILE RED -- law plane unseeded (fail-closed): " as *u8)
      gv_puts(prefix)
      gv_puts("\n" as *u8)
      sys_exit(1)
      return 1
  }
  let jb: *u8 = sys_read_file("knowledge/status/law_warden.jrnl\x00" as *u8, szp)
  if (jb as i64)==0 {
      gv_puts("LAW-FILE RED -- no evidence journal yet; run scan first (never files on no data)\n" as *u8)
      sys_exit(1)
      return 1
  }
  let jl: i64 = szp[0]
  let last: i64 = lw_last_ts(jb,jl)
  let fz: *i64 = sys_mmap(LW_SCRATCH) as *i64
  let fb: *u8 = sys_read_file("knowledge/status/law_filed.jrnl\x00" as *u8, fz)
  var fn2: i64 = 0
  if (fb as i64)!=0 { fn2=fz[0] }
1415
  let ob: *u8 = sys_mmap(LW_OUT)
  var o: i64=0
  o=lw_cat(ob,o,"{\x22v\x22:1,\x22domain\x22:\x22law-file\x22,\x22scan_ts\x22:" as *u8)
  o=lw_catn(ob,o,last)
  o=lw_cat(ob,o,",\x22actions\x22:[" as *u8)
1421
  let fs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let fl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let gs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let gl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64
  let lawid: *u8 = sys_mmap(LW_NAMEMAX)
  let sevb: *u8 = sys_mmap(LW_NAMEMAX)
  let scope: *u8 = sys_mmap(LW_NAMEMAX)
  let desc: *u8 = sys_mmap(LW_OUT)
  let capb: *u8 = sys_mmap(LW_OUT)
  let ol: *i64 = sys_mmap(LW_SCRATCH) as *i64
  let av: *i64 = sys_mmap(LW_ST_SLOTS) as *i64
  let fr: *u8 = sys_mmap(LW_OUT)
  var fp: i64=0
  var nfiled: i64=0
  var nskip: i64=0
  var nerr: i64=0
  var first: i64=1
1439
  var i: i64=0
  while i<jl {
      let ls: i64=i
      var le: i64=ls
      var go: i64=1
      while go==1 { if le>=jl { go=0 } else { if jb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } }
      i=le+1
      if le>ls {
          var nf: i64=0
          var p: i64=ls
          var st: i64=ls
          while p<le {
              if jb[p]==(LW_TAB as u8) { if nf<LW_COLS { fs[nf]=st; fl[nf]=p-st; nf=nf+1 } st=p+1 }
              p=p+1
          }
          if nf<LW_COLS { fs[nf]=st; fl[nf]=le-st; nf=nf+1 }
          if nf>=6 {
              var ts: i64=0
              var k: i64=fs[0]
              var g2: i64=1
              while g2==1 {
                  if k>=fs[0]+fl[0] { g2=0 } else {
                      let d: i64=jb[k] as i64
                      if d>=48 { if d<=57 { ts=ts*10+(d-48); k=k+1 } else { g2=0 } } else { g2=0 }
                  }
              }
              if ts==last { if lw_span_eq(jb,fs[1],fl[1],"LAW" as *u8)==1 { if lw_span_eq(jb,fs[5],fl[5],"BREACH" as *u8)==1 {
                  lw_catf(lawid,0,(jb as i64+fs[2]) as *u8,fl[2])
                  lawid[fl[2]]=0 as u8
                  if first==0 { o=lw_cat(ob,o,"," as *u8) }
                  first=0
                  o=lw_cat(ob,o,"{\x22law\x22:\x22" as *u8)
                  o=lw_catesc(ob,o,lawid,lw_slen(lawid))
                  o=lw_cat(ob,o,"\x22,\x22action\x22:\x22" as *u8)
                  if lw_filed_has(fb,fn2,lawid)==1 {
                      nskip=nskip+1
                      o=lw_cat(ob,o,"SKIP-ALREADY-FILED" as *u8)
                  } else {
                      if lw_plane_find(rb,rn,lawid,gs,gl)==0 {
                          nerr=nerr+1
                          o=lw_cat(ob,o,"ERR-LAW-NOT-IN-PLANE" as *u8)
                      } else {
                          sevb[0]=rb[gs[5]]
                          sevb[1]=0 as u8
                          var sp: i64=0
                          sp=lw_cat(scope,sp,"law-" as *u8)
                          sp=lw_catf(scope,sp,lawid,lw_slen(lawid))
                          scope[sp]=0 as u8
                          var dp: i64=0
                          dp=lw_cat(desc,dp,"LAW " as *u8)
                          dp=lw_catf(desc,dp,lawid,lw_slen(lawid))
                          dp=lw_cat(desc,dp," BREACH (nx_law_warden AUTOFILED by the hourly beat, zero-Claude): " as *u8)
                          dp=lw_catf(desc,dp,(rb as i64+gs[1]) as *u8,gl[1])
                          dp=lw_cat(desc,dp," | rule=" as *u8)
                          dp=lw_catf(desc,dp,(rb as i64+gs[2]) as *u8,gl[2])
                          dp=lw_cat(desc,dp," detector=" as *u8)
                          dp=lw_catf(desc,dp,(jb as i64+fs[3]) as *u8,fl[3])
                          dp=lw_cat(desc,dp," measured=" as *u8)
                          dp=lw_catf(desc,dp,(jb as i64+fs[4]) as *u8,fl[4])
                          dp=lw_cat(desc,dp," worst=" as *u8)
                          if nf>=7 { dp=lw_catf(desc,dp,(jb as i64+fs[6]) as *u8,fl[6]) }
                          dp=lw_cat(desc,dp," owner_role=" as *u8)
                          dp=lw_catf(desc,dp,(rb as i64+gs[6]) as *u8,gl[6])
                          dp=lw_cat(desc,dp,". Corpus " as *u8)
                          dp=lw_catf(desc,dp,(rb as i64+gs[7]) as *u8,gl[7])
                          dp=lw_cat(desc,dp,". COVERAGE (added 2026-07-31, debts 1785519276 + 1785519488): this measurement is a ONE-LEVEL, NON-RECURSIVE directory walk CAPPED at LW_FILECAP files. It is a FLOOR, NOT A CORPUS TOTAL -- the named corpus is typically an order of magnitude larger (buildroot/runtime/_hdl_build alone holds 6555 one-level .nx, so the cap is about 9pct coverage). Do NOT size effort or trend from this number without reading files_seen/capped in the scan envelope. The warden's OWN L011 scancap law calls presenting partial coverage as complete a BUG, not a declared floor, so this sentence exists to stop the naked number travelling without its denominator." as *u8)
                          dp=lw_cat(desc,dp,". Evidence knowledge/status/law_warden.jrnl (append-only, one frame per law per beat = the trend). Filed ONCE and never re-filed; the journal carries movement." as *u8)
                          desc[dp]=0 as u8
                          av[0]=elfpath as i64
                          av[1]=("add\x00" as *u8) as i64
                          av[2]=sevb as i64
                          av[3]=scope as i64
                          av[4]=desc as i64
                          av[5]=0
                          let rc: i64 = tr_run_capture(elfpath, av, capb, LW_OUT, ol)
                          if rc==0 {
                              nfiled=nfiled+1
                              o=lw_cat(ob,o,"FILED" as *u8)
                              fp=lw_catn(fr,fp,last)
                              fr[fp]=LW_TAB as u8
                              fp=fp+1
                              fp=lw_cat(fr,fp,"FILED" as *u8)
                              fr[fp]=LW_TAB as u8
                              fp=fp+1
                              fp=lw_catf(fr,fp,lawid,lw_slen(lawid))
                              fr[fp]=LW_TAB as u8
                              fp=fp+1
                              fp=lw_catf(fr,fp,(jb as i64+fs[4]) as *u8,fl[4])
                              // col 5 = the debt id parsed from the reply, or -1 if the reply was not an
                              // unambiguous DEBT-ADDED. ADDITIVE (rule 19): lw_filed_has keys on the
                              // "\tFILED\t<lawid>\t" substring, which is unchanged, so every existing
                              // reader of cols 0-3 is unaffected. -1 is recorded rather than omitted, so
                              // an unparseable reply is VISIBLE instead of looking like it never happened.
                              fr[fp]=LW_TAB as u8
                              fp=fp+1
                              fp=lw_catn(fr,fp,lw_debt_id(capb,ol[0]))
                              fr[fp]=LW_NL as u8
                              fp=fp+1
                          } else {
                              nerr=nerr+1
                              o=lw_cat(ob,o,"ERR-DEBT-FORK-RC" as *u8)
                              o=lw_catn(ob,o,rc)
                          }
                      }
                  }
                  o=lw_cat(ob,o,"\x22}" as *u8)
              } } }
          }
      }
  }
1550
  if fp>0 {
      let ff: i64 = sys_openat_append("knowledge/status/law_filed.jrnl\x00" as *u8, LW_MODE)
      if ff>=0 { sys_write(ff,fr,fp); sys_close(ff) }
  }
  o=lw_cat(ob,o,"],\x22filed\x22:" as *u8)
  o=lw_catn(ob,o,nfiled)
  o=lw_cat(ob,o,",\x22skipped\x22:" as *u8)
  o=lw_catn(ob,o,nskip)
  o=lw_cat(ob,o,",\x22errors\x22:" as *u8)
  o=lw_catn(ob,o,nerr)
  o=lw_cat(ob,o,",\x22honest\x22:\x22files ONCE per law (idempotent, rule 10) so an hourly beat never spams the plane; movement lives in law_warden.jrnl, not in duplicate rows. A law filed here is OWNED work in the debt plane -- written by forking nx_debt, which stays the single writer of its own plane.\x22}" as *u8)
  sys_write(1,ob,o)
  sys_write(1,"\n" as *u8,1)
  return 0
1565}
1566
1567func main(argc: i64, argv: *i64) -> i64 {
  // ★ANCHOR FIRST (2026-08-04). MEASURED: run from buildroot this warden printed
  // "LAW-WARDEN RED -- law plane unseeded (fail-closed: no verdict over no data)" while the SAME
  // binary run from nishihost returned all 11 laws with real breach counts. Every corpus path
  // here ("knowledge/store/lawreg-", "buildroot/runtime/_hdl_build") is estate-root relative, so
  // the CWD silently decided whether the estate had ANY laws. The cron row already spells
  // `cd .../nishihost &&`; this makes the warden independent of whether its caller remembered.
  ep_anchor()
  var verb: *u8 = "scan" as *u8
  if argc>1 { verb=argv[1] as *u8 }
  let vl: i64 = lw_slen(verb)
  if lw_span_eq(verb,0,vl,"selftest" as *u8)==1 { let rc: i64=lw_selftest(); sys_exit(rc); return rc }
  if lw_span_eq(verb,0,vl,"countfile" as *u8)==1 {
      if argc<3 { gv_puts("usage: nx_law_warden countfile <path>\n" as *u8); sys_exit(2); return 2 }
      let rc: i64=lw_countfile(argv[2] as *u8)
      sys_exit(rc)
      return rc
  }
  var prefix: *u8 = "knowledge/store/lawreg-" as *u8
  if argc>2 { prefix=argv[2] as *u8 }
  if lw_span_eq(verb,0,vl,"scan" as *u8)==1 { let rc: i64=lw_scan(prefix); sys_exit(rc); return rc }
  if lw_span_eq(verb,0,vl,"file" as *u8)==1 {
      var toolnm: *u8 = "nx_debt" as *u8
      if argc>3 { toolnm=argv[3] as *u8 }
      let rc: i64=lw_file(prefix,toolnm)
      sys_exit(rc)
      return rc
  }
  gv_puts("usage: nx_law_warden {scan [planeprefix] | file [planeprefix] [debtelf] | countfile <path> | selftest}\n" as *u8)
  sys_exit(2)
  return 2
1598}
nx_law_warden.nx source

`nx_law_warden.nx` source
