nx_law_warden.nx source

1// ============================================================================================ 2// FREEZE LIFTED 2026-08-07 -- debt 1785516173 (sev9) is EATEN and the reconstruction is IN THIS FILE. 3// The banner below used to read "STOP -- DO NOT BUILD OR PROMOTE THIS ORGAN", and it had become 4// FALSE AND INTERNALLY CONTRADICTORY: its first paragraph said this source "HAS NONE OF countfile / 5// scancap / gatedry / helperdup / T20" while its own last paragraph said "Already restored here: 6// countfile ...". All of them are present now -- lw_countfile, lw_file, lw_segamp, lw_file_gatedry, 7// lw_file_helperdup, lw_file_scancap -- and each was compiled, linked and RUN standalone with a 8// POSITIVE and TWO NEGATIVE controls before being wired in (see the L009/L010/L011 note below). 9// ★★★★★★A FREEZE NOTICE OUTLIVES THE CONDITION IT DESCRIBES. A DEBT ROW HAS A LIFECYCLE -- open, 10// eaten -- AND NOTHING EVER CLOSES A COMMENT. The debt was closed; the STOP sign stayed up, and 11// any reader arriving here would have believed a live sev-9 freeze that no longer existed. 12// ⇒ WHEN A COMMENT ASSERTS A STATE, IT MUST NAME THE ARTIFACT THAT CAN BE QUERIED FOR THAT STATE 13// (here: `nx_debt show 1785516173`), so the reader can check it instead of trusting it. 14// 15// THE HAZARD THE FREEZE GUARDED IS REAL AND STILL APPLIES -- read this before rebuilding: 16// nx_magicratchet CONSUMES `nx_law_warden countfile` -- but it is NOT reached from /api/build. 17// CORRECTED 2026-08-15 (open sev-8 debt 1785530277, re-confirmed live today). This line used to assert 18// the wiring as fact. Measured two ways: nx_wiredclaim reports CLAIMED-UNWIRED call_sites=0 19// comment_mentions=17, and behaviourally FOUR /api/build runs of nx_oo_extract_gate left its baseline at 20// -1 while a single direct nx_magicratchet call created one. The chokepoint was exercised; nothing refused. 21// A COMMENT THAT ASSERTS AN ENFORCEMENT IS NOT AN ENFORCEMENT, and this one was load-bearing: it is the 22// stated reason this organ accepts a design constraint in exchange for a guard that is not in the path. 23// If a rebuild ever drops that verb, mr_parse_magic returns -1, the ratchet FAILS OPEN BY DESIGN, 24// and magic-number enforcement plus the hourly autofiler both go silent WITH EVERY GATE STILL GREEN. 25// ⇒ THE MECHANICAL REFEREE, NOT A PROMISE: promote WITHOUT allow_capability_loss. /api/promote 26// compares the new binary's strings against the live one and REFUSES on capability loss, so the 27// guard adjudicates this rebuild rather than anyone's reading of this comment. If it refuses, 28// reconcile -- do not pass the flag to get past it. 29// ★A GATE THAT IS GREEN ON THE BINARY PROVES NOTHING ABOUT THE SOURCE THAT WILL REPLACE IT. 30// ★WHEN SOURCE AND ARTIFACT EACH CONTAIN WORK THE OTHER LACKS, THERE IS NO SAFE DIRECTION. 31// ============================================================================================ 32// nx_law_warden.nx -- MECHANICAL ENFORCEMENT for written laws (ws=cap-autonomy, 2026-07-20). 33// Operator: "make sure autonomously that our nishi ecosystem is getting sota ... what needs to become mcp or 34// api or raci or workflows or agents or other modern capabilities just gets logged and worked without me 35// having to call its need out"; + "our magic number audit and bug stuff dont appear to be autonomous ... lots 36// of workstreams are flagging them as bugs they hit and then just gave a new number to"; + "callouts of using 37// webrtc or webassembly ... not building from the first byte up to a sovereign nishi os and browser". 38// 39// THE GAP THIS EATS: every conformance surface we own is a CURATED manifest -- nx_favela_census states it 40// outright ("unnamed shanty stays invisible until a row names it"). A written law (CLAUDE rule 11, the 41// first-byte-up doctrine, F208 modernization) therefore has NO detector: a human must NOTICE a breach and 42// NAME it before anything tracks it. That is exactly the call-it-out tax the operator is paying. This organ 43// is the DETECTOR tier: laws live as DATA in the sovereign **lawreg- seg-store plane** (nx_store_put, same 44// substrate as raci-/debt-/frontier-), each row carrying its own detector + threshold + severity + RACI 45// owner, and the warden MEASURES live artifacts against them. NO flat TSV, NO truncating .log -- the 46// registry is a plane (provenanced hist- rows) and the evidence is an append-only .jrnl (history is sacred). 47// 48// RULE-11 COMPLIANT BY CONSTRUCTION: every POLICY number (threshold, severity, corpus, owner, token set) is 49// manifest data, never code. Point the warden at its own source and the property holds -- that is a gate tooth, 50// not a promise. The consts below are structural envelopes (buffer sizes, byte codes), all NAMED, never inline. 51// 52// DETECTORS (detector <param> over <corpus>) 53// valuenamed CLAUDE-11 breach, the GOODHART half (seq1348): a `const NAME = V` whose NAME 54// contains V's own digits (SS_MAGIC_65536 = 65536). Clears `inlinelit` while 55// explaining nothing, so part of the inlinelit improvement is a DETECTOR 56// ARTIFACT. Reported as its OWN law -- never folded into inlinelit, because a 57// number mixing two categories is not a measurement. Takes no param. 58// inlinelit <thr> CLAUDE-11 breach: standalone decimal literals >= thr on lines that are neither a 59// `const ` declaration nor a `//` comment, across *.nx in <corpus>. A NAMED const is 60// lawful; an inline literal buried in code is the magic number. Hex (0x..) and escapes 61// (\x..) and identifier-embedded digits (i64, p256) are NOT literals -- excluded. 62// token <csv> first-byte-up breach: borrowed-stack tokens present in <corpus> text (proposal 63// journals), i.e. the "just use webrtc/wasm" callouts, surfaced the moment they appear. 64// unregistered <conf> F208 MCP gap: *.elf organs in <corpus> whose basename is absent from field 0 of 65// <conf> -- a shipped capability that never became callable. 66// 67// HONEST BY CONSTRUCTION: findings are DERIVED, never asserted. A detector that cannot read its corpus reports 68// -1 = UNMEASURED (never a silent 0). Missing manifest = RED exit 1 (fail-closed, no verdict over no data). 69// Owner join (F207): owner_role must resolve in the raci- plane or the law is flagged UNOWNED. 70// VERDICT=GREEN means THE WARDEN MEASURED, not that the ecosystem is clean -- breaches are reported as a 71// separate count so a cron watcher can trend them without the gate lying. 72// 73// nx_law_warden {scan [planeprefix] | selftest} (plane default knowledge/store/lawreg-) 74// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 75import "nx_store_seed_lib.nx" 76import "nx_syscalls.nx" 77import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict 78import "nx_tool_run.nx" 79import "nx_gate_verdict.nx" 80 81const LW_OUT: i64 = 262144 82const LW_DIRBUF: i64 = 131072 83const LW_PLANE: i64 = 1048576 84const LW_PATH: i64 = 512 85const LW_NAMEMAX: i64 = 256 86const LW_SCRATCH: i64 = 64 87// FULL-CORPUS BY DEFAULT (raised 600 -> 50000 on 2026-08-07). WHY THIS NUMBER MATTERED SO MUCH: 88// LW_FILECAP bounds how many files EVERY law's walk will look at, and at 600 it was truncating each 89// one against corpora of 8,077 (_hdl_build) and 22,209 (runtime) files. MEASURED before the change: 90// all 11 laws reported capped=1 scanned=600, i.e. EVERY published law number in this estate was a 91// 2.7%-7.4% sample wearing the authority of a census -- and L011, the SCAN-HONESTY law itself, was 92// the most exquisite case: it declared capped=1 exactly as the law requires and nobody ever acted on 93// the declaration. 94// ★★★★★★AN HONEST DECLARATION OF A BOUND IS NOT A SUBSTITUTE FOR REMOVING THE BOUND -- `capped=1` 95// SATISFIED THE LAW, PASSED EVERY REVIEW, AND LEFT THE MEASUREMENT USELESS. 96// ★★★★★A SAMPLE SIZE NOBODY CHOSE IS A SAMPLE SIZE NOBODY DEFENDS -- 600 is a round decimal with no 97// recorded derivation, i.e. a placeholder that outlived the corpus it was written for. 98// It bounds a COUNTER only (cx[2]>=LW_FILECAP sets the capped flag); no buffer is sized by it, so 99// raising it costs walk time and nothing else. Kept as a named const, and kept FINITE on purpose: 100// an unbounded walk cannot report cap_hit at all, and a scanner that cannot say it stopped early is 101// exactly the L011 defect this organ exists to detect. 102const LW_FILECAP: i64 = 50000 103const LW_COLS: i64 = 8 104const LW_COLS_MAX: i64 = 9 105const LW_FLD_BYTES: i64 = 128 106const LW_OVF: i64 = 100000000000 107const LW_MODE: i64 = 0x1a4 108const LW_NL: i64 = 10 109const LW_TAB: i64 = 9 110const LW_HASH: i64 = 35 111const LW_SP: i64 = 32 112const LW_COMMA: i64 = 44 113const LW_DQ: i64 = 34 114const LW_BSL: i64 = 92 115const LW_SL: i64 = 47 116// L007 worst-plane annotation bytes: "<plane>:<manifest_entries>m/<docs_files>f". Named, not raw, 117// because this organ is the one that enforces rule 11 and must not breach it in its own report path. 118const LW_CH_M: i64 = 109 119const LW_CH_F: i64 = 102 120// countfile's threshold. RULE-11 NOTE, deliberate: this is a NAMED CONST and NOT a lawreg- plane row, 121// because nx_magicratchet consumes countfile and must NOT acquire a runtime dependency on 122// plane readability -- a plane hiccup would silently re-denominate every baseline in 123// knowledge/status/magicbase/*.cnt. CONTRACT-LOCKED to the deployed binary's value (rule 19): changing it 124// re-baselines every organ at once. Moving it to the manifest is filed as its own rung, not done inline. 125const LW_MAGIC_THR: i64 = 1024 126const LW_MODE_LIT: i64 = 1 127const LW_MODE_ELF: i64 = 2 128const LW_MODE_TOK: i64 = 3 129// SEGAMP TRACKING WIDTH, raised 64 -> 512 on 2026-08-07. UNLIKE LW_FILECAP THIS ONE IS REAL: 130// LW_SEGTAB and LW_SEGCNT are the buffers behind it (LW_SEGTAB = LW_SEGMAX * LW_SEGNAME, LW_SEGCNT = 131// LW_SEGMAX * 8), so all three MUST move together -- raising LW_SEGMAX alone overruns both tables. 132// WHY IT MATTERED: the first full-scope run measured L007 at scanned=64 capped=1, i.e. np hit 133// LW_SEGMAX EXACTLY -- knowledge/store holds more distinct planes than the detector could track, so 134// segamp was watching the first 64 and blind to every plane after them. That detector exists for the 135// class that took the whole box down on 2026-07-20 (load 17, OOM, sovereign stack unreachable, found 136// BY HAND after the outage). A blind spot there is not a reporting nicety. 137// ★★★★★★TWO CAPS CAN WEAR THE SAME `capped=1` AND HAVE NOTHING ELSE IN COMMON: one was a free 138// counter, this one owns memory. READ WHAT THE BOUND IS ATTACHED TO BEFORE YOU MOVE IT. 139// 512 WAS TESTED AND FAILED: the next run still reported capped=1, so np had reached 512 too. 140// ⚠AND THE WAY I TRIED TO CHECK IT WAS ITSELF TRUNCATED. I globbed knowledge/store, counted 302 141// distinct plane prefixes, and concluded 512 was ample -- but the job capture had stopped at exactly 142// 1,048,576 bytes and SAID SO in a footer I did not read. The organ was right; my ruler was short. 143// ★★★★★★I MEASURED A TRUNCATION WITH A TRUNCATED INSTRUMENT AND CONCLUDED THERE WAS NONE -- 144// WHILE THE INSTRUMENT WAS PRINTING ITS OWN TRUNCATION MARKER THE WHOLE TIME. 145// ★★★★★THE DECLARATION WAS THERE AND UNREAD, WHICH IS THE SAME DEFECT THIS LAW EXISTS TO CATCH, 146// COMMITTED BY THE PERSON FIXING IT. READ THE ENVELOPE BEFORE BELIEVING THE BODY. 147// ⇒ STOP GUESSING AND LET THE ORGAN MEASURE: at 4096 the walk reports np as `scanned`, so a run 148// that comes back capped=0 has DERIVED the true plane count instead of assuming one. Buffers are 149// 256KB + 32KB -- nothing here justified two rounds of guessing. 150const LW_SEGMAX: i64 = 4096 151const LW_SEGNAME: i64 = 64 152const LW_SEGTAB: i64 = 262144 153const LW_SEGCNT: i64 = 32768 154const LW_DIRMODE: i64 = 0x1ed 155const LW_ST_SLOTS: i64 = 64 156 157// ---------- byte/string primitives ---------- 158func lw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 159func lw_cat(o: *u8, at: i64, s: *u8) -> i64 { var a: i64=at; var i: i64=0; while s[i]!=(0 as u8){o[a]=s[i]; a=a+1; i=i+1} return a } 160func lw_catf(o: *u8, at: i64, p: *u8, n: i64) -> i64 { var a: i64=at; var i: i64=0; while i<n { o[a]=p[i]; a=a+1; i=i+1 } return a } 161// JSON-safe copy: quote/backslash/control bytes neutralised so a source sample can never break the envelope 162func lw_catesc(o: *u8, at: i64, p: *u8, n: i64) -> i64 { 163 var a: i64=at 164 var i: i64=0 165 while i<n { 166 let c: i64 = p[i] as i64 167 if c==34 { o[a]=39 as u8 } else { if c==92 { o[a]=47 as u8 } else { if c<32 { o[a]=32 as u8 } else { o[a]=p[i] } } } 168 a=a+1 169 i=i+1 170 } 171 return a 172} 173func lw_catn(o: *u8, at: i64, v: i64) -> i64 { 174 var a: i64=at 175 var x: i64=v 176 if x<0 { o[a]=45 as u8; a=a+1; x=0-x } 177 let tm: *u8=sys_mmap(LW_SCRATCH) 178 var k: i64=0 179 if x==0 { tm[0]=48 as u8; k=1 } 180 while x>0 { tm[k]=(48+x%10) as u8; x=x/10; k=k+1 } 181 var j: i64=0 182 while j<k { o[a]=tm[k-1-j]; a=a+1; j=j+1 } 183 return a 184} 185func lw_count(buf: *u8, n: i64, needle: *u8) -> i64 { 186 var nl: i64=0 187 while needle[nl]!=(0 as u8){nl=nl+1} 188 if nl==0 { return 0 } 189 var c: i64=0 190 var i: i64=0 191 while i+nl<=n { 192 var j: i64=0 193 var ok: i64=1 194 while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } 195 if ok==1 { c=c+1; i=i+nl } else { i=i+1 } 196 } 197 return c 198} 199func lw_span_eq(b: *u8, s: i64, l: i64, lit: *u8) -> i64 { 200 let n: i64 = lw_slen(lit) 201 if n!=l { return 0 } 202 var i: i64=0 203 while i<n { if b[s+i]!=lit[i] { return 0 } i=i+1 } 204 return 1 205} 206func lw_ends(nm: *u8, suf: *u8) -> i64 { 207 let n: i64=lw_slen(nm) 208 let s: i64=lw_slen(suf) 209 if s>n { return 0 } 210 var i: i64=0 211 while i<s { if nm[n-s+i]!=suf[i] { return 0 } i=i+1 } 212 return 1 213} 214func lw_join(dst: *u8, dir: *u8, nm: *u8) -> i64 { 215 var a: i64=0 216 a=lw_cat(dst,a,dir) 217 dst[a]=47 as u8 218 a=a+1 219 a=lw_cat(dst,a,nm) 220 dst[a]=0 as u8 221 return a 222} 223func lw_wfile(path: *u8, content: *u8) -> i64 { 224 let fd: i64=sys_openat_wr(path, LW_MODE) 225 if fd<0 { return 0-1 } 226 sys_write(fd, content, lw_slen(content)) 227 sys_close(fd) 228 return 0 229} 230 231// ---------- detector: inlinelit (CLAUDE rule 11) ---------- 232func lw_line_start(b: *u8, ls: i64, le: i64) -> i64 { 233 var p: i64=ls 234 var go: i64=1 235 while go==1 { if p>=le { go=0 } else { if b[p]==(LW_SP as u8) { p=p+1 } else { go=0 } } } 236 return p 237} 238// a `const ` declaration is the LAWFUL form of a big number -- exempt 239func lw_is_const(b: *u8, ls: i64, le: i64) -> i64 { 240 let p: i64 = lw_line_start(b,ls,le) 241 if p+6>le { return 0 } 242 if b[p]!=(99 as u8) { return 0 } 243 if b[p+1]!=(111 as u8) { return 0 } 244 if b[p+2]!=(110 as u8) { return 0 } 245 if b[p+3]!=(115 as u8) { return 0 } 246 if b[p+4]!=(116 as u8) { return 0 } 247 if b[p+5]!=(32 as u8) { return 0 } 248 return 1 249} 250func lw_is_comment(b: *u8, ls: i64, le: i64) -> i64 { 251 let p: i64 = lw_line_start(b,ls,le) 252 if p+2>le { return 0 } 253 if b[p]!=(47 as u8) { return 0 } 254 if b[p+1]!=(47 as u8) { return 0 } 255 return 1 256} 257// standalone decimal literals >= thr in the CODE PART of one line. Digits inside a "string literal" are 258// DATA (a port in a message, a date in a URL), and everything after the first // that is OUTSIDE a string 259// is a comment -- neither is code, so neither can be a rule-11 magic number. 260// ROOT FIX 2026-07-31 (ws=law-l006-instrument, debt 1785515802): BOTH exclusions were missing. lw_file_lits 261// guarded with lw_is_comment, which only recognises a WHOLE-LINE comment, so the // TAIL of a code line was 262// scanned as code and a dated trailing comment counted its year as a magic number. Because nx_magicratchet 263// gates /api/build on this count, DATING A TRAILING COMMENT REFUSED REAL BUILDS (debt 1785050172, hit live 264// on nx_mmbench). The absent string state also made this counter disagree with nx_magic map, which already 265// advertised skipped=in-string -- two lexers behind one "ONE canonical counter" claim. Proven by negative 266// control (full-line comment 0, trailing comment 1, genuine literal 1), never by inspection. 267// A digit run preceded by a letter or '_' belongs to an 268// identifier (i64, p256), a hex body (0x1a4) or an escape (\x22) -- never counted. 269func lw_line_lits(b: *u8, ls: i64, le: i64, thr: i64) -> i64 { 270 var hits: i64=0 271 var p: i64=ls 272 var instr: i64=0 273 while p<le { 274 let c: i64 = b[p] as i64 275 if instr==1 { 276 if c==LW_BSL { p=p+2 } else { 277 if c==LW_DQ { instr=0 } 278 p=p+1 279 } 280 } else { 281 var isd: i64=0 282 if c>=48 { if c<=57 { isd=1 } } 283 if c==LW_DQ { instr=1; p=p+1 } else { 284 if isd==0 { 285 var cut: i64=0 286 if c==LW_SL { if p+1<le { if b[p+1]==(LW_SL as u8) { cut=1 } } } 287 if cut==1 { p=le } else { p=p+1 } 288 } else { 289 var skip: i64=0 290 if p>ls { 291 let q: i64 = b[p-1] as i64 292 if q==95 { skip=1 } 293 if q>=97 { if q<=122 { skip=1 } } 294 if q>=65 { if q<=90 { skip=1 } } 295 } 296 var v: i64=0 297 var ov: i64=0 298 var run: i64=1 299 while run==1 { 300 if p>=le { run=0 } else { 301 let d: i64 = b[p] as i64 302 var isd2: i64=0 303 if d>=48 { if d<=57 { isd2=1 } } 304 if isd2==1 { 305 if v>LW_OVF { ov=1 } else { v=v*10+(d-48) } 306 p=p+1 307 } else { run=0 } 308 } 309 } 310 if skip==0 { if ov==1 { hits=hits+1 } else { if v>=thr { hits=hits+1 } } } 311 } 312 } 313 } 314 } 315 return hits 316} 317func lw_file_lits(path: *u8, thr: i64) -> i64 { 318 let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64 319 let f: *u8 = sys_read_file(path, szp) 320 if (f as i64)==0 { return 0-1 } 321 let n: i64 = szp[0] 322 var hits: i64=0 323 var i: i64=0 324 while i<n { 325 let ls: i64=i 326 var le: i64=ls 327 var go: i64=1 328 while go==1 { if le>=n { go=0 } else { if f[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 329 i=le+1 330 if lw_is_comment(f,ls,le)==0 { if lw_is_const(f,ls,le)==0 { hits=hits+lw_line_lits(f,ls,le,thr) } } 331 } 332 return hits 333} 334 335// ---------- verb: countfile ---------- 336// The ONE canonical inline-magic count for a SINGLE file. nx_magicratchet consumes this exact contract, 337// so it is load-bearing infrastructure, not a convenience verb -- but note the ratchet is NOT reached from 338// /api/build today (open sev-8 1785530277). The contract still binds: the moment the wiring lands, every 339// build depends on this output shape, and it is byte-stable for that reason and not merely for tidiness. 340// OUTPUT CONTRACT, byte-stable (rule 19): exactly {"magic":N} on stdout, exit 0. N = -1 means UNMEASURED 341// (corpus unreadable) and the ratchet FAILS OPEN on it BY DESIGN -- a false refusal is worse than a miss. 342// RESTORED TO SOURCE 2026-07-31 (ws=law-l006-instrument, debt 1785516173): the deployed binary answered 343// `countfile` while the string appeared in ZERO of 20016 .nx files NAS-wide, so any rebuild would have 344// dropped the verb, made mr_parse_magic return -1 forever, and DISARMED the magic ratchet silently with 345// every gate still GREEN. Source must be a superset of the artifact before either is allowed to move. 346func lw_countfile(path: *u8) -> i64 { 347 let n: i64 = lw_file_lits(path, LW_MAGIC_THR) 348 let ob: *u8 = sys_mmap(LW_PATH) 349 var o: i64 = 0 350 o=lw_cat(ob,o,"{\x22magic\x22:" as *u8) 351 o=lw_catn(ob,o,n) 352 // EVERY COUNT CARRIES ITS COVERAGE (2026-08-14). `{"magic":0}` alone READS AS "rule-11 clean" 353 // when it only means "clean at or above LW_MAGIC_THR". Measured cost: a seat published ELEVEN 354 // organs as clean on this output the same day; re-measured at threshold 2, one of them 355 // (nx_skullgen) was 426 sites / 93 distinct. The number was never wrong -- the sentence it 356 // invited was. Emitting the bar beside the count makes that misreading impossible. 357 // APPEND-ONLY, AND AFTER `magic` ON PURPOSE: nx_magicratchet's mr_parse_magic anchors on the 358 // FIRST occurrence of the bytes `magic` and then takes the first integer following it, so a 359 // field appended here is never reached by the /api/build gate's parser. Rule 19 -- adding a 360 // field is safe, reordering or renaming is not. Do not move this above `magic`. 361 o=lw_cat(ob,o,",\x22threshold\x22:" as *u8) 362 o=lw_catn(ob,o,LW_MAGIC_THR) 363 o=lw_cat(ob,o,"}" as *u8) 364 sys_write(1,ob,o) 365 sys_write(1,"\n" as *u8,1) 366 return 0 367} 368 369// ---------- detector: valuenamed (CLAUDE rule 11, the GOODHART half) ---------- 370// WHY THIS EXISTS (filed as seq1348, built 2026-07-30). The `inlinelit` detector above counts inline 371// numeric literals and EXEMPTS `const ` lines, because a named constant is the lawful form of a big 372// number. That exemption is being gamed: nx_seg_store.nx alone declares 49 constants of the shape 373// const SS_MAGIC_65536: i64 = 65536 374// A CONSTANT NAMED AFTER ITS OWN VALUE CARRIES ZERO SEMANTIC CONTENT. It clears inlinelit while leaving 375// the code exactly as unexplainable as before -- nobody can still answer WHY 65536, which is the whole 376// point of rule 11 (you should be able to point at a config key, not a code comment). So part of the 377// measured seq274/seq315 improvement is a DETECTOR ARTIFACT, not a real reduction in unexplained 378// constants. Same class this lane keeps finding: an instrument reporting success for work not done. 379// 380// REPORTED AS ITS OWN LAW, NEVER FOLDED INTO inlinelit -- ★LAW: a number mixing two categories is not 381// a measurement. Zero false positives BY CONSTRUCTION: it fires only when the declared NAME literally 382// contains the decimal digits of its OWN value, which is never meaningful naming. 383// NOT a lint on placement -- the goal is EXPLICABILITY. Remediate by renaming to intent 384// (SS_READ_CHUNK_BYTES, SS_FNV64_PRIME, SS_UNICODE_HANGUL_LO) or moving to a config row. Re-inlining 385// the literal is NOT a fix and would merely move the breach back to inlinelit. 386const LW_MODE_VNAME: i64 = 4 387// L009/L010/L011 detectors, RECONSTRUCTED 2026-07-31 (debt 1785516173): the deployed binary has these 388// three and NO source tree did, so a rebuild would have dropped them. Semantics taken VERBATIM from the 389// lawreg- plane law rows, and each predicate was compiled + linked + RUN standalone with a POSITIVE and 390// TWO NEGATIVE controls before being wired here (_offc/l006_detectors_recon.nx, exit 9). 391// RECONSTRUCTED IS NOT RECOVERED: these are correct-to-spec, not byte-equivalent to the lost originals. 392const LW_MODE_GATEDRY: i64 = 5 393const LW_MODE_HELPERDUP: i64 = 6 394const LW_MODE_SCANCAP: i64 = 7 395 396// digits of `v` into out (no NUL); returns length. v>=0. 397func lw_digits(v: i64, out: *u8) -> i64 { 398 if v==0 { out[0]=48 as u8; return 1 } 399 let t: *u8 = sys_mmap(32) 400 var m: i64=v 401 var k: i64=0 402 while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } 403 var i: i64=0 404 while i<k { out[i]=t[k-1-i]; i=i+1 } 405 return k 406} 407// does the byte span [s,e) contain `pat` (len pl)? 408func lw_span_has(b: *u8, s: i64, e: i64, pat: *u8, pl: i64) -> i64 { 409 if pl<=0 { return 0 } 410 var i: i64=s 411 while i+pl<=e { 412 var j: i64=0 413 var ok: i64=1 414 while j<pl { if b[i+j]!=pat[j] { ok=0; j=pl } else { j=j+1 } } 415 if ok==1 { return 1 } 416 i=i+1 417 } 418 return 0 419} 420// 1 iff this line is `const NAME...= VALUE` where NAME contains VALUE's decimal digits. 421// Parses the name span (after "const ", up to ':' or '=') and the trailing decimal value. 422func lw_line_valuenamed(b: *u8, ls: i64, le: i64) -> i64 { 423 if lw_is_const(b,ls,le)==0 { return 0 } 424 let p0: i64 = lw_line_start(b,ls,le) 425 let ns: i64 = p0+6 // past "const " 426 if ns>=le { return 0 } 427 // name ends at the first ':' or '=' or space 428 var ne: i64 = ns 429 var go: i64 = 1 430 while go==1 { 431 if ne>=le { go=0 } else { 432 let c: i64 = b[ne] as i64 433 if c==58 { go=0 } else { if c==61 { go=0 } else { if c==32 { go=0 } else { ne=ne+1 } } } 434 } 435 } 436 if ne<=ns { return 0 } 437 // find '=' then the first decimal run after it (skip 0x.. hex: a '0' followed by 'x' is not decimal) 438 var q: i64 = ne 439 var eq: i64 = 0-1 440 while q<le { if b[q]==(61 as u8) { eq=q; q=le } else { q=q+1 } } 441 if eq<0 { return 0 } 442 var r: i64 = eq+1 443 var v: i64 = 0 444 var seen: i64 = 0 445 var scan: i64 = 1 446 while scan==1 { 447 if r>=le { scan=0 } else { 448 let d: i64 = b[r] as i64 449 var isd: i64=0 450 if d>=48 { if d<=57 { isd=1 } } 451 if isd==1 { 452 // reject hex bodies: '0' immediately followed by 'x' 453 if r+1<le { if b[r]==(48 as u8) { if b[r+1]==(120 as u8) { return 0 } } } 454 if v>LW_OVF { return 0 } 455 v=v*10+(d-48); seen=1; r=r+1 456 } else { if seen==1 { scan=0 } else { r=r+1 } } 457 } 458 } 459 if seen==0 { return 0 } 460 if v<10 { return 0 } // single digits appear in names innocently (V2, P1) 461 let db: *u8 = sys_mmap(32) 462 let dl: i64 = lw_digits(v,db) 463 return lw_span_has(b,ns,ne,db,dl) 464} 465func lw_file_valuenamed(f: *u8, n: i64) -> i64 { 466 var hits: i64=0 467 var i: i64=0 468 while i<n { 469 let ls: i64=i 470 var le: i64=ls 471 var go: i64=1 472 while go==1 { if le>=n { go=0 } else { if f[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 473 i=le+1 474 if lw_is_comment(f,ls,le)==0 { hits=hits+lw_line_valuenamed(f,ls,le) } 475 } 476 return hits 477} 478 479// ---------- detector: unregistered (F208 MCP gap) ---------- 480// field 0 of a non-comment allowlist line == the tool name (nx_bench_census_lib: field 0 = the DENOMINATOR) 481func lw_field0_has(buf: *u8, n: i64, name: *u8) -> i64 { 482 let l: i64=lw_slen(name) 483 if l==0 { return 0 } 484 if n<=0 { return 0 } 485 var i: i64=0 486 while i+l<=n { 487 var atstart: i64=0 488 if i==0 { atstart=1 } else { if buf[i-1]==(LW_NL as u8) { atstart=1 } } 489 if atstart==1 { 490 var j: i64=0 491 var ok: i64=1 492 while j<l { if buf[i+j]!=name[j] { ok=0; j=l } else { j=j+1 } } 493 if ok==1 { 494 var term: i64=0 495 if i+l>=n { term=1 } else { 496 let c: i64=buf[i+l] as i64 497 if c==LW_TAB { term=1 } 498 if c==LW_SP { term=1 } 499 } 500 if term==1 { return 1 } 501 } 502 } 503 i=i+1 504 } 505 return 0 506} 507 508// ---------- detector: segamp (seg-store SEGMENT AMPLIFICATION) ---------- 509// THE CLASS THAT TOOK THE BOX DOWN 2026-07-20: sts_seed commits the WHOLE plane as a NEW segment on every 510// write, so a plane's segment count grows without bound and every read walks all of them (O(rows x segs)). 511// MEASURED that day: debt- at ~464 segments / 42MB for ~200KB of rows; one add >15min then FAILED; a page 512// OOM-killed; the NAS went to load 17 and the whole sovereign stack became unreachable. Nothing detected it 513// -- it was found by hand, after the outage. This detector makes the class mechanically visible BEFORE the 514// next OOM. Counts one segment per <plane>-seg-N.docs and flags any plane over a DATA-DRIVEN threshold. 515// Separate walk (not lw_walk) on purpose: this one ACCUMULATES per-prefix state rather than per-file counts. 516// ---------- L007 SUBJECT: the quantity that actually drives the hazard ---------- 517// Returns how many segments a LOAD of <dir>/<plane>- would walk -- the line count of that plane's 518// manifest.txt -- or -1 when no manifest is readable. 519// WHY THE MANIFEST AND NOT THE FILES ON DISK: ss_manifest_file (nx_seg_store.nx) reads 520// "<prefix>manifest.txt", one seg-<id> per line, and THAT list is what every ss_open3 load opens and 521// mmaps. A .docs file that no manifest references is never opened by a load: it costs disk, not 522// memory, so it cannot OOM the host. Declared above lw_segamp because this compiler REFUSES 523// use-before-declaration (a module const read early used to silently evaluate to 0). 524func lw_manifest_count(dir: *u8, plane: *u8) -> i64 { 525 let p: *u8 = sys_mmap(LW_PATH) 526 var o: i64 = 0 527 o = lw_cat(p,o,dir) 528 o = lw_cat(p,o,"/" as *u8) 529 o = lw_cat(p,o,plane) 530 o = lw_cat(p,o,"-manifest.txt" as *u8) 531 p[o] = 0 as u8 532 let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64 533 szp[0] = 0 534 let b: *u8 = sys_read_file(p, szp) 535 if (b as i64)==0 { return 0-1 } 536 let n: i64 = szp[0] 537 if n<=0 { return 0-1 } 538 var c: i64 = 0 539 var i: i64 = 0 540 while i<n { if (b[i] as i64)==LW_NL { c=c+1 } i=i+1 } 541 return c 542} 543 544func lw_segamp(dir: *u8, thr: i64, cx: *i64, worst: *u8) -> i64 { 545 let fd: i64=sys_openat_rd(dir) 546 if fd<0 { return 0-1 } 547 let dbuf: *u8=sys_mmap(LW_DIRBUF) 548 let names: *u8=sys_mmap(LW_SEGTAB) 549 let counts: *i64=sys_mmap(LW_SEGCNT) as *i64 550 var np: i64=0 551 var go: i64=1 552 while go==1 { 553 let nr: i64=sys_getdents64(fd,dbuf,LW_DIRBUF) 554 if nr<=0 { go=0 } else { 555 var off: i64=0 556 while off<nr { 557 let rec: *u8=(dbuf as i64+off) as *u8 558 let nm: *u8=dirent_name(rec) 559 if lw_ends(nm,".docs\x00" as *u8)==1 { 560 let ln: i64=lw_slen(nm) 561 var pos: i64=0-1 562 var i2: i64=0 563 while i2+5<=ln { 564 if nm[i2]==(45 as u8) { if nm[i2+1]==(115 as u8) { if nm[i2+2]==(101 as u8) { if nm[i2+3]==(103 as u8) { if nm[i2+4]==(45 as u8) { if pos<0 { pos=i2 } } } } } } 565 i2=i2+1 566 } 567 if pos>0 { if pos<LW_SEGNAME { 568 var found: i64=0-1 569 var k: i64=0 570 while k<np { 571 var same: i64=1 572 var j2: i64=0 573 while j2<pos { if names[k*LW_SEGNAME+j2]!=nm[j2] { same=0; j2=pos } else { j2=j2+1 } } 574 if same==1 { if names[k*LW_SEGNAME+pos]==(0 as u8) { found=k; k=np } } 575 k=k+1 576 } 577 if found<0 { 578 if np<LW_SEGMAX { 579 var j3: i64=0 580 while j3<pos { names[np*LW_SEGNAME+j3]=nm[j3]; j3=j3+1 } 581 names[np*LW_SEGNAME+pos]=0 as u8 582 counts[np]=1 583 np=np+1 584 } else { cx[3]=1 } 585 } else { counts[found]=counts[found]+1 } 586 } } 587 } 588 off=off+dirent_reclen(rec) 589 } 590 } 591 } 592 sys_close(fd) 593 cx[0]=np 594 // SUBJECT CORRECTED 2026-09-03. This law exists for the read-amplification OOM (INCIDENT-0720), 595 // and a load walks the MANIFEST, not the directory -- so manifest entries are the driver. 596 // Counting .docs files on disk was wrong in a way that HID THE REMEDY: nx_store_compact "apply" 597 // collapses a plane BY MANIFEST REWRITE and leaves the superseded segment files in place, so a 598 // file count reports a correctly-compacted plane as breached forever and can never go clean. 599 // MEASURED on the live deployqhist plane the day this changed: 630 .docs files vs 80 manifest 600 // entries -- 550 files no load will ever open. 601 // The file count is NOT discarded: it rides in `worst` after the manifest count, because disk 602 // sprawl is a real hazard and folding it into this one would silently redefine both. 603 let mcounts: *i64=sys_mmap(LW_SEGCNT) as *i64 604 var nomf: i64=0 605 var kf: i64=0 606 while kf<np { 607 var mc: i64=lw_manifest_count(dir,(names as i64+kf*LW_SEGNAME) as *u8) 608 if mc<0 { nomf=nomf+1; mc=0 } 609 mcounts[kf]=mc 610 kf=kf+1 611 } 612 var over: i64=0 613 var mx: i64=0 614 var mi: i64=0-1 615 var k2: i64=0 616 while k2<np { 617 if mcounts[k2]>thr { over=over+1 } 618 if mcounts[k2]>mx { mx=mcounts[k2]; mi=k2 } 619 k2=k2+1 620 } 621 cx[1]=over 622 cx[2]=mx 623 // Planes whose manifest could not be read: a load walks 0 segments there, so they are not a 624 // breach -- but the number is PUBLISHED rather than swallowed, so a reader can see the horizon. 625 cx[4]=nomf 626 if mi>=0 { 627 var w: i64=0 628 w=lw_cat(worst,w,(names as i64+mi*LW_SEGNAME) as *u8) 629 worst[w]=58 as u8 630 w=w+1 631 w=lw_catn(worst,w,mx) 632 worst[w]=LW_CH_M as u8 633 w=w+1 634 worst[w]=LW_SL as u8 635 w=w+1 636 w=lw_catn(worst,w,counts[mi]) 637 worst[w]=LW_CH_F as u8 638 w=w+1 639 worst[w]=0 as u8 640 } 641 return 0 642} 643 644// ---------- shared corpus walk ---------- 645// cx[0]=mode cx[1]=thr cx[2]=files cx[3]=hits cx[4]=worsthits cx[5]=capped cx[6]=allowlist_bytes 646// ---------- T20: parse the debt id out of the nx_debt reply ---------- 647// RECONSTRUCTED 2026-07-31 (debt 1785516173). The deployed gate's tooth reads "the debt id is parsed from 648// the nx_debt reply; absent -> -1, NEVER A WRONG ID", and the "never a wrong id" half is the whole point. 649// THE TRAP, hit live today: nx_debt's duplicate reply is 650// DEBT-DUPLICATE-SKIPPED existing_idx=2003 -- identical desc already filed; ... 651// A naive search for "id=" matches INSIDE "existing_idx=" and returns 2003 -- a real row id belonging to a 652// DIFFERENT debt. That is worse than returning nothing: the warden would stamp law_filed.jrnl with an id 653// that closes someone else's row. So this anchors on the FULL success token and returns -1 for duplicate, 654// empty, truncated and error-page replies. Compiled + linked + RUN standalone (2 POS + 5 NEG) before wiring. 655func lw_debt_id(b: *u8, n: i64) -> i64 { 656 let tok: *u8 = "DEBT-ADDED id=" as *u8 657 let m: i64 = lw_slen(tok) 658 if m>n { return 0-1 } 659 var at: i64 = 0-1 660 var i: i64 = 0 661 while i+m <= n { 662 var j: i64 = 0 663 var ok: i64 = 1 664 while j < m { if b[i+j] != tok[j] { ok=0; j=m } else { j=j+1 } } 665 if ok==1 { at=i; i=n } else { i=i+1 } 666 } 667 if at < 0 { return 0-1 } 668 var p: i64 = at + m 669 var v: i64 = 0 670 var got: i64 = 0 671 while p < n { 672 let c: i64 = b[p] as i64 673 if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p+1 } else { p = n } } else { p = n } 674 } 675 if got == 0 { return 0-1 } 676 return v 677} 678 679// ---------- detectors: gatedry (L009) / helperdup (L010) / scancap (L011) ---------- 680// Each returns 1 if THIS FILE breaches, else 0, so the walk's per-file accounting stays uniform with 681// LW_MODE_LIT and LW_MODE_VNAME. Reuses lw_count rather than reimplementing substring search (L010 is 682// literally the law against reimplementing a shared primitive -- these detectors must not breach it). 683 684// L009 gatedry, rule=CLAUDE-6-15-DRY: "gate organs that roll their own verdict instead of inheriting the 685// nx_gate_verdict base class -- the D001 OO-consolidation duplication". 686func lw_file_gatedry(b: *u8, n: i64) -> i64 { 687 if lw_count(b,n,"verdict" as *u8)==0 { return 0 } 688 if lw_count(b,n,"nx_gate_verdict" as *u8)>0 { return 0 } 689 if lw_count(b,n,"gv_verdict" as *u8)>0 { return 0 } 690 return 1 691} 692 693// L010 helperdup, rule=CLAUDE-15-DRY: "organs that reimplement the putn/itoa emit primitive instead of 694// importing the nx_estr shared base". 695func lw_file_helperdup(b: *u8, n: i64) -> i64 { 696 var defines: i64 = 0 697 if lw_count(b,n,"func putn" as *u8)>0 { defines=1 } 698 if lw_count(b,n,"_putn(" as *u8)>0 { defines=1 } 699 if lw_count(b,n,"itoa" as *u8)>0 { defines=1 } 700 if defines==0 { return 0 } 701 if lw_count(b,n,"nx_estr" as *u8)>0 { return 0 } 702 return 1 703} 704 705// L011 scancap, rule=OPERATOR-HONESTY-selfceiling: "corpus scanners that walk a directory but HIDE their 706// coverage (no scanned/coverage_complete/capped honesty flag) -- presenting partial coverage AS complete". 707// The law names three exemptions -- an honest scanner, a non-scanner, and a PROSE-ONLY mention -- so the 708// walk evidence must be a CALL, not the word appearing in a comment. 709func lw_file_scancap(b: *u8, n: i64) -> i64 { 710 var walks: i64 = 0 711 if lw_count(b,n,"sys_getdents" as *u8)>0 { walks=1 } 712 if lw_count(b,n,"getdents64(" as *u8)>0 { walks=1 } 713 if walks==0 { return 0 } 714 if lw_count(b,n,"capped" as *u8)>0 { return 0 } 715 if lw_count(b,n,"coverage_complete" as *u8)>0 { return 0 } 716 if lw_count(b,n,"scanned" as *u8)>0 { return 0 } 717 return 1 718} 719 720func lw_walk(dir: *u8, cx: *i64, worst: *u8, abuf: *u8) -> i64 { 721 let fd: i64=sys_openat_rd(dir) 722 if fd<0 { return 0-1 } 723 let dbuf: *u8=sys_mmap(LW_DIRBUF) 724 let path: *u8=sys_mmap(LW_PATH) 725 let base: *u8=sys_mmap(LW_NAMEMAX) 726 var go: i64=1 727 while go==1 { 728 let nr: i64=sys_getdents64(fd,dbuf,LW_DIRBUF) 729 if nr<=0 { go=0 } else { 730 var off: i64=0 731 while off<nr { 732 let rec: *u8=(dbuf as i64+off) as *u8 733 let nm: *u8=dirent_name(rec) 734 if cx[2]>=LW_FILECAP { cx[5]=1 } else { 735 if cx[0]==LW_MODE_LIT { 736 if lw_ends(nm,".nx\x00" as *u8)==1 { 737 lw_join(path,dir,nm) 738 let h: i64=lw_file_lits(path,cx[1]) 739 if h>=0 { 740 cx[2]=cx[2]+1 741 cx[3]=cx[3]+h 742 if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 743 } 744 } 745 } 746 // valuenamed (seq1348): consts named after their own value -- the inlinelit exemption 747 // being gamed. Same walk/accounting shape as LW_MODE_LIT so the roll-up is uniform. 748 if cx[0]==LW_MODE_VNAME { 749 if lw_ends(nm,".nx\x00" as *u8)==1 { 750 lw_join(path,dir,nm) 751 let vszp: *i64 = sys_mmap(LW_SCRATCH) as *i64 752 let vb: *u8 = sys_read_file(path,vszp) 753 if (vb as i64)!=0 { 754 let h: i64=lw_file_valuenamed(vb,vszp[0]) 755 cx[2]=cx[2]+1 756 cx[3]=cx[3]+h 757 if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 758 } 759 } 760 } 761 // L009/L010/L011 (reconstructed 2026-07-31): identical walk/accounting shape to 762 // LW_MODE_VNAME so the roll-up stays uniform. Each per-file predicate returns 1 for a 763 // breaching file, so cx[3] counts BREACHING FILES and cx[2] counts files SCANNED -- 764 // which is what the law rows' measured/scanned pair means. 765 if cx[0]==LW_MODE_GATEDRY { 766 if lw_ends(nm,".nx\x00" as *u8)==1 { 767 lw_join(path,dir,nm) 768 let gszp: *i64 = sys_mmap(LW_SCRATCH) as *i64 769 let gb: *u8 = sys_read_file(path,gszp) 770 if (gb as i64)!=0 { 771 let h: i64=lw_file_gatedry(gb,gszp[0]) 772 cx[2]=cx[2]+1 773 cx[3]=cx[3]+h 774 if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 775 } 776 } 777 } 778 if cx[0]==LW_MODE_HELPERDUP { 779 if lw_ends(nm,".nx\x00" as *u8)==1 { 780 lw_join(path,dir,nm) 781 let dszp: *i64 = sys_mmap(LW_SCRATCH) as *i64 782 let db2: *u8 = sys_read_file(path,dszp) 783 if (db2 as i64)!=0 { 784 let h: i64=lw_file_helperdup(db2,dszp[0]) 785 cx[2]=cx[2]+1 786 cx[3]=cx[3]+h 787 if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 788 } 789 } 790 } 791 if cx[0]==LW_MODE_SCANCAP { 792 if lw_ends(nm,".nx\x00" as *u8)==1 { 793 lw_join(path,dir,nm) 794 let sszp: *i64 = sys_mmap(LW_SCRATCH) as *i64 795 let sb2: *u8 = sys_read_file(path,sszp) 796 if (sb2 as i64)!=0 { 797 let h: i64=lw_file_scancap(sb2,sszp[0]) 798 cx[2]=cx[2]+1 799 cx[3]=cx[3]+h 800 if h>cx[4] { cx[4]=h; let ln: i64=lw_slen(nm); lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 801 } 802 } 803 } 804 // borrowed-stack tokens ACROSS A SOURCE TREE (not just a journal): the callouts the 805 // operator keeps seeing live in code and plans, so the corpus must be the tree itself. 806 // abuf carries the csv token list for this mode (documented, mode-specific contract). 807 if cx[0]==LW_MODE_TOK { 808 if lw_ends(nm,".nx\x00" as *u8)==1 { 809 lw_join(path,dir,nm) 810 let tsz: *i64 = sys_mmap(LW_SCRATCH) as *i64 811 let tbuf: *u8 = sys_read_file(path,tsz) 812 if (tbuf as i64)!=0 { 813 cx[2]=cx[2]+1 814 let tk: *u8 = sys_mmap(LW_NAMEMAX) 815 var ti: i64=0 816 var tl2: i64=0 817 var tdone: i64=0 818 var fhits: i64=0 819 while tdone==0 { 820 let cc: i64=abuf[ti] as i64 821 var flu: i64=0 822 if cc==0 { flu=1; tdone=1 } 823 if cc==LW_COMMA { flu=1 } 824 if flu==1 { 825 if tl2>0 { tk[tl2]=0 as u8; fhits=fhits+lw_count(tbuf,tsz[0],tk) } 826 tl2=0 827 } else { tk[tl2]=abuf[ti]; tl2=tl2+1 } 828 ti=ti+1 829 } 830 if fhits>0 { 831 cx[3]=cx[3]+fhits 832 if fhits>cx[4] { cx[4]=fhits; let lnt: i64=lw_slen(nm); lw_catf(worst,0,nm,lnt); worst[lnt]=0 as u8 } 833 } 834 } 835 } 836 } 837 if cx[0]==LW_MODE_ELF { 838 if lw_ends(nm,".elf\x00" as *u8)==1 { 839 let ln: i64=lw_slen(nm) 840 let bl: i64=ln-4 841 if bl>0 { 842 cx[2]=cx[2]+1 843 var k: i64=0 844 while k<bl { base[k]=nm[k]; k=k+1 } 845 base[bl]=0 as u8 846 // fail-CLOSED: a zero-length basename would make the lookup vacuously "absent" 847 // and brand every organ unregistered -- only count when we truly resolved a name 848 let blen: i64=lw_slen(base) 849 if blen==bl { 850 let reg: i64=lw_field0_has(abuf,cx[6],base) 851 if reg==0 { 852 cx[3]=cx[3]+1 853 if cx[4]==0 { cx[4]=1; lw_catf(worst,0,nm,ln); worst[ln]=0 as u8 } 854 } 855 } 856 } 857 } 858 } 859 } 860 off=off+dirent_reclen(rec) 861 } 862 } 863 } 864 sys_close(fd) 865 return 0 866} 867 868// ---------- detector: token (first-byte-up doctrine) ---------- 869// cx[0]=total occurrences cx[1]=distinct tokens present ; -1 if corpus unreadable (UNMEASURED) 870// count needle across lines, SKIPPING any line that contains excl. Why: the warden's own reports land in 871// the same journals it scans ("top hit: wasm"), so a naive buffer-wide count measures itself and inflates 872// the finding every beat. Exclusion is DATA (optional 9th law column), never a hardcoded self-reference. 873func lw_count_lines(b: *u8, n: i64, needle: *u8, excl: *u8) -> i64 { 874 let el: i64 = lw_slen(excl) 875 var total: i64 = 0 876 var i: i64 = 0 877 while i<n { 878 let ls: i64=i 879 var le: i64=ls 880 var go: i64=1 881 while go==1 { if le>=n { go=0 } else { if b[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 882 i=le+1 883 var skip: i64=0 884 if el>0 { if lw_count((b as i64+ls) as *u8, le-ls, excl)>0 { skip=1 } } 885 if skip==0 { total=total+lw_count((b as i64+ls) as *u8, le-ls, needle) } 886 } 887 return total 888} 889func lw_token_scan(corpus: *u8, csv: *u8, cx: *i64, worst: *u8, excl: *u8) -> i64 { 890 let szp: *i64=sys_mmap(LW_SCRATCH) as *i64 891 let b: *u8=sys_read_file(corpus,szp) 892 if (b as i64)==0 { return 0-1 } 893 let n: i64=szp[0] 894 let tok: *u8=sys_mmap(LW_NAMEMAX) 895 worst[0]=0 as u8 896 var i: i64=0 897 var tl: i64=0 898 var done: i64=0 899 while done==0 { 900 let c: i64=csv[i] as i64 901 var flush: i64=0 902 if c==0 { flush=1; done=1 } 903 if c==LW_COMMA { flush=1 } 904 if flush==1 { 905 if tl>0 { 906 tok[tl]=0 as u8 907 let h: i64=lw_count_lines(b,n,tok,excl) 908 if h>0 { 909 cx[0]=cx[0]+h 910 cx[1]=cx[1]+1 911 if lw_slen(worst)==0 { lw_catf(worst,0,tok,tl); worst[tl]=0 as u8 } 912 } 913 } 914 tl=0 915 } else { tok[tl]=csv[i]; tl=tl+1 } 916 i=i+1 917 } 918 return 0 919} 920 921// ---------- file: the autonomy half -- breaches become OWNED work with no human in the loop ---------- 922// EVIDENCE-DERIVED, never re-asserted: reads the append-only law_warden.jrnl the scan already wrote and 923// acts on the LATEST scan block only. IDEMPOTENT (rule 10): a law already present in law_filed.jrnl is 924// never re-filed, so an hourly beat does not spam the debt plane. DRY (rule 15): the debt row is written 925// by FORKING nx_debt -- the sibling organ stays the single writer of its own plane. 926 927// ts of the final frame = the most recent scan block 928func lw_last_ts(buf: *u8, n: i64) -> i64 { 929 var ts: i64 = 0 930 var i: i64 = 0 931 var ls: i64 = 0 932 while i<n { 933 if buf[i]==(LW_NL as u8) { 934 if i>ls { 935 var v: i64=0 936 var k: i64=ls 937 var go: i64=1 938 while go==1 { 939 if k>=i { go=0 } else { 940 let d: i64=buf[k] as i64 941 if d>=48 { if d<=57 { v=v*10+(d-48); k=k+1 } else { go=0 } } else { go=0 } 942 } 943 } 944 if v>0 { ts=v } 945 } 946 ls=i+1 947 } 948 i=i+1 949 } 950 return ts 951} 952// has <lawid> already been filed? matches the exact framed token \tFILED\t<lawid>\t 953func lw_filed_has(buf: *u8, n: i64, lawid: *u8) -> i64 { 954 if n<=0 { return 0 } 955 let pat: *u8 = sys_mmap(LW_NAMEMAX) 956 var p: i64 = 0 957 pat[p]=LW_TAB as u8 958 p=p+1 959 p=lw_cat(pat,p,"FILED" as *u8) 960 pat[p]=LW_TAB as u8 961 p=p+1 962 p=lw_cat(pat,p,lawid) 963 pat[p]=LW_TAB as u8 964 p=p+1 965 pat[p]=0 as u8 966 if lw_count(buf,n,pat)>0 { return 1 } 967 return 0 968} 969 970// resolve a tool NAME to its absolute ELF via tool_allowlist.conf (field0 -> field1). NEVER hardcode a 971// path: a guessed path execve-fails as 127 and the caller silently files nothing. Ask the registry. 972func lw_allow_path(abuf: *u8, an: i64, name: *u8, out: *u8) -> i64 { 973 if an<=0 { return 0 } 974 var i: i64=0 975 while i<an { 976 let ls: i64=i 977 var le: i64=ls 978 var go: i64=1 979 while go==1 { if le>=an { go=0 } else { if abuf[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 980 i=le+1 981 if le>ls { if abuf[ls]!=(LW_HASH as u8) { 982 var p: i64=ls 983 var g1: i64=1 984 while g1==1 { if p>=le { g1=0 } else { if abuf[p]==(LW_TAB as u8) { g1=0 } else { p=p+1 } } } 985 if lw_span_eq(abuf,ls,p-ls,name)==1 { 986 let s1: i64=p+1 987 var q: i64=s1 988 var g2: i64=1 989 while g2==1 { if q>=le { g2=0 } else { if abuf[q]==(LW_TAB as u8) { g2=0 } else { q=q+1 } } } 990 let f1l: i64=q-s1 991 if f1l>0 { lw_catf(out,0,(abuf as i64+s1) as *u8,f1l); out[f1l]=0 as u8; return 1 } 992 } 993 } } 994 } 995 return 0 996} 997 998// ---------- selftest ---------- 999// The threshold the selftest drives its fixtures with. It MIRRORS the param on the L001/L006 rows in the 1000// lawreg- plane rather than reading them: a test that draws its threshold from the same data production 1001// reads cannot detect that data changing, and would go on passing while the shipped laws moved. 1002// NAMED FOR ITS PURPOSE, NOT FOR ITS VALUE. `nx_magic apply` offered LW_MAGIC_1024, which restates the 1003// number and is LESS greppable than the bare literal -- the estate has measured that remedy manufacturing 1004// the disease (Bhaskara's sine approximation, Teschner's hash primes: the value was right and the NAME 1005// was the defect). A reader who wants "where is the selftest's cutoff" can now find it by intent. 1006// Caught by nx_magicratchet REFUSING this organ's own rebuild -- the rule-11 detector was breaching 1007// rule 11 one line below the banner claiming it does not, and only the estate's own ratchet could see it. 1008const LW_SELFTEST_THRESHOLD: i64 = 1024 1009 1010func lw_selftest() -> i64 { 1011 let ctr: *i64 = gv_ctr() 1012 gv_head("nx_law_warden gate -- laws become mechanically checkable, and the warden obeys rule 11 itself" as *u8) 1013 let thr: i64 = LW_SELFTEST_THRESHOLD 1014 1015 lw_wfile("/tmp/lw_a.nx\x00" as *u8, "var x: i64 = 65536\n\x00" as *u8) 1016 let a: i64 = lw_file_lits("/tmp/lw_a.nx\x00" as *u8, thr) 1017 var t1: i64=0 1018 if a==1 { t1=1 } 1019 gv_check("T1 inline literal above threshold is a BREACH" as *u8, t1, ctr) 1020 1021 lw_wfile("/tmp/lw_b.nx\x00" as *u8, "const LW_X: i64 = 65536\n\x00" as *u8) 1022 let b: i64 = lw_file_lits("/tmp/lw_b.nx\x00" as *u8, thr) 1023 var t2: i64=0 1024 if b==0 { t2=1 } 1025 gv_check("T2 the same number as a NAMED const is lawful (the rule-11 fix, not a breach)" as *u8, t2, ctr) 1026 1027 // ---- valuenamed teeth (seq1348). Each reads a REAL file through the same reader the walk uses. ---- 1028 // ⚠T2 above proves a NAMED const is lawful under inlinelit, and that stays true. valuenamed does not 1029 // contradict it: it asks the SECOND question -- does the name actually EXPLAIN the number, or merely 1030 // repeat it? LW_X = 65536 is lawful under BOTH; SS_MAGIC_65536 = 65536 is lawful only under the first. 1031 let vszp: *i64 = sys_mmap(LW_SCRATCH) as *i64 1032 lw_wfile("/tmp/lw_v1.nx\x00" as *u8, "const SS_MAGIC_65536: i64 = 65536\n\x00" as *u8) 1033 let v1b: *u8 = sys_read_file("/tmp/lw_v1.nx\x00" as *u8, vszp) 1034 var tv1: i64=0 1035 if (v1b as i64)!=0 { if lw_file_valuenamed(v1b,vszp[0])==1 { tv1=1 } } 1036 gv_check("TV1 a const NAMED AFTER ITS OWN VALUE is a breach (SS_MAGIC_65536 = 65536)" as *u8, tv1, ctr) 1037 1038 // NEGATIVE CONTROL -- the whole point is that INTENT-named consts must pass, or the detector would 1039 // simply re-flag every constant and be useless. Same value, explanatory name. 1040 lw_wfile("/tmp/lw_v2.nx\x00" as *u8, "const SS_READ_CHUNK_BYTES: i64 = 65536\n\x00" as *u8) 1041 let v2b: *u8 = sys_read_file("/tmp/lw_v2.nx\x00" as *u8, vszp) 1042 var tv2: i64=0 1043 if (v2b as i64)!=0 { if lw_file_valuenamed(v2b,vszp[0])==0 { tv2=1 } } 1044 gv_check("TV2 NEG-CONTROL: an INTENT-named const of the same value is NOT flagged" as *u8, tv2, ctr) 1045 1046 // a comment mentioning the shape is not a declaration 1047 lw_wfile("/tmp/lw_v3.nx\x00" as *u8, "// const SS_MAGIC_65536: i64 = 65536\n\x00" as *u8) 1048 let v3b: *u8 = sys_read_file("/tmp/lw_v3.nx\x00" as *u8, vszp) 1049 var tv3: i64=0 1050 if (v3b as i64)!=0 { if lw_file_valuenamed(v3b,vszp[0])==0 { tv3=1 } } 1051 gv_check("TV3 NEG-CONTROL: a COMMENTED-OUT value-named const is not code" as *u8, tv3, ctr) 1052 1053 // hex must not be read as decimal (0x1ed's digits would otherwise chase the wrong number) 1054 lw_wfile("/tmp/lw_v4.nx\x00" as *u8, "const LW_MODE_0x1ed: i64 = 0x1ed\n\x00" as *u8) 1055 let v4b: *u8 = sys_read_file("/tmp/lw_v4.nx\x00" as *u8, vszp) 1056 var tv4: i64=0 1057 if (v4b as i64)!=0 { if lw_file_valuenamed(v4b,vszp[0])==0 { tv4=1 } } 1058 gv_check("TV4 NEG-CONTROL: a HEX value is not decimal-matched (no false positive)" as *u8, tv4, ctr) 1059 1060 lw_wfile("/tmp/lw_c.nx\x00" as *u8, "// note 65536 here\n\x00" as *u8) 1061 let c: i64 = lw_file_lits("/tmp/lw_c.nx\x00" as *u8, thr) 1062 var t3: i64=0 1063 if c==0 { t3=1 } 1064 gv_check("T3 a number inside a comment is not code" as *u8, t3, ctr) 1065 1066 // T21-T24 exist because T3 above passed while the detector was BROKEN: T3 only ever writes a WHOLE-LINE 1067 // comment, and lw_is_comment only recognises that shape. The live defect was the // TAIL of a CODE line -- 1068 // a dated trailing comment counted its year as a magic number and, through nx_magicratchet on /api/build, 1069 // REFUSED REAL BUILDS (debt 1785050172). ★A TOOTH THAT CANNOT FAIL ON THE DEFECT IT NAMES IS NOT EVIDENCE. 1070 // T21/T22 are the negative controls that would have caught it; T23/T24 are POSITIVE controls so the fix 1071 // cannot pass by making the detector blind instead of accurate. 1072 lw_wfile("/tmp/lw_tc.nx\x00" as *u8, "let w: i64 = q + 1 // dated 2026-07-31 is not code\n\x00" as *u8) 1073 let tc: i64 = lw_file_lits("/tmp/lw_tc.nx\x00" as *u8, thr) 1074 var t21: i64=0 1075 if tc==0 { t21=1 } 1076 gv_check("T21 NEG-CONTROL: a TRAILING // comment on a code line is not code (the whole-line case is not the defect)" as *u8, t21, ctr) 1077 1078 lw_wfile("/tmp/lw_ts.nx\x00" as *u8, "let s: *u8 = \x22listening on port 8080 since 2026\x22\n\x00" as *u8) 1079 let tsq: i64 = lw_file_lits("/tmp/lw_ts.nx\x00" as *u8, thr) 1080 var t22: i64=0 1081 if tsq==0 { t22=1 } 1082 gv_check("T22 NEG-CONTROL: digits inside a string literal are DATA, not rule-11 magic (agrees with nx_magic skipped=in-string)" as *u8, t22, ctr) 1083 1084 lw_wfile("/tmp/lw_tp.nx\x00" as *u8, "let z: i64 = q + 4096 // 2026 in the tail must not add to this\n\x00" as *u8) 1085 let tp: i64 = lw_file_lits("/tmp/lw_tp.nx\x00" as *u8, thr) 1086 var t23: i64=0 1087 if tp==1 { t23=1 } 1088 gv_check("T23 POS-CONTROL: a genuine inline literal is still counted EXACTLY ONCE beside a trailing comment" as *u8, t23, ctr) 1089 1090 lw_wfile("/tmp/lw_tx.nx\x00" as *u8, "let s: *u8 = \x22a 9999 b\x22 + 4096\n\x00" as *u8) 1091 let tx: i64 = lw_file_lits("/tmp/lw_tx.nx\x00" as *u8, thr) 1092 var t24: i64=0 1093 if tx==1 { t24=1 } 1094 gv_check("T24 POS-CONTROL: string state EXITS at the closing quote -- a literal after it is still counted" as *u8, t24, ctr) 1095 1096 // T25-T27 harden the string state against the idioms this corpus actually uses. Verified first as a 1097 // standalone executable (scratchpad/l006_hard.nx, exit 63 = 6/6) before being seeded here. 1098 lw_wfile("/tmp/lw_tu.nx\x00" as *u8, "let u: *u8 = \x22http://x\x22 let n: i64 = 8192\n\x00" as *u8) 1099 let tu: i64 = lw_file_lits("/tmp/lw_tu.nx\x00" as *u8, thr) 1100 var t25: i64=0 1101 if tu==1 { t25=1 } 1102 gv_check("T25 a // INSIDE a string is not a comment cut -- the literal after the string still counts" as *u8, t25, ctr) 1103 1104 lw_wfile("/tmp/lw_tm.nx\x00" as *u8, "f(\x22a\x22, 4096, \x22b9999\x22)\n\x00" as *u8) 1105 let tm: i64 = lw_file_lits("/tmp/lw_tm.nx\x00" as *u8, thr) 1106 var t26: i64=0 1107 if tm==1 { t26=1 } 1108 gv_check("T26 two adjacent strings do not merge: the literal BETWEEN them counts, the one inside does not" as *u8, t26, ctr) 1109 1110 lw_wfile("/tmp/lw_th.nx\x00" as *u8, "let m: i64 = 0x1a4 + p256 + 65536\n\x00" as *u8) 1111 let th: i64 = lw_file_lits("/tmp/lw_th.nx\x00" as *u8, thr) 1112 var t27: i64=0 1113 if th==1 { t27=1 } 1114 gv_check("T27 hex bodies and identifier digits stay excluded while a real literal on the same line counts" as *u8, t27, ctr) 1115 1116 lw_wfile("/tmp/lw_d.nx\x00" as *u8, "let m: i64 = 0x1a4\n\x00" as *u8) 1117 let d: i64 = lw_file_lits("/tmp/lw_d.nx\x00" as *u8, thr) 1118 var t4: i64=0 1119 if d==0 { t4=1 } 1120 gv_check("T4 hex bodies and escapes are not decimal literals (no false positives)" as *u8, t4, ctr) 1121 1122 lw_wfile("/tmp/lw_e.nx\x00" as *u8, "var y: i64 = 42\n\x00" as *u8) 1123 let e: i64 = lw_file_lits("/tmp/lw_e.nx\x00" as *u8, thr) 1124 var t5: i64=0 1125 if e==0 { t5=1 } 1126 gv_check("T5 threshold comes from manifest DATA -- below it is not flagged" as *u8, t5, ctr) 1127 1128 let miss: i64 = lw_file_lits("/tmp/lw_does_not_exist_zz.nx\x00" as *u8, thr) 1129 var t6: i64=0 1130 if miss==(0-1) { t6=1 } 1131 gv_check("T6 unreadable corpus reports -1 UNMEASURED, never a silent 0" as *u8, t6, ctr) 1132 1133 lw_wfile("/tmp/lw_t.txt\x00" as *u8, "plan: we should just use webassembly for this\n\x00" as *u8) 1134 let tcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1135 tcx[0]=0 1136 tcx[1]=0 1137 let tw: *u8 = sys_mmap(LW_NAMEMAX) 1138 lw_token_scan("/tmp/lw_t.txt\x00" as *u8, "webassembly,cuda\x00" as *u8, tcx, tw, "\x00" as *u8) 1139 var t7: i64=0 1140 if tcx[1]==1 { if tcx[0]>=1 { t7=1 } } 1141 gv_check("T7 borrowed-stack token found, absent token NOT counted (neg-control)" as *u8, t7, ctr) 1142 1143 let ab: *u8 = sys_mmap(LW_NAMEMAX) 1144 let abn: i64 = lw_cat(ab,0,"nx_seat\tp\tGREEN\nnx_claims\tp\tGREEN\n" as *u8) 1145 let present: i64 = lw_field0_has(ab,abn,"nx_seat\x00" as *u8) 1146 let absent: i64 = lw_field0_has(ab,abn,"nx_ghost\x00" as *u8) 1147 var t8: i64=0 1148 if present==1 { if absent==0 { t8=1 } } 1149 gv_check("T8 MCP-exposure join reads field 0 exactly (shipped-but-unregistered is detectable)" as *u8, t8, ctr) 1150 1151 lw_wfile("/tmp/lw_zz_unreg.elf\x00" as *u8, "x\n\x00" as *u8) 1152 let wcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1153 wcx[0]=LW_MODE_ELF 1154 wcx[1]=0 1155 wcx[2]=0 1156 wcx[3]=0 1157 wcx[4]=0 1158 wcx[5]=0 1159 wcx[6]=abn 1160 let ww: *u8 = sys_mmap(LW_NAMEMAX) 1161 ww[0]=0 as u8 1162 lw_walk("/tmp\x00" as *u8, wcx, ww, ab) 1163 var t9: i64=0 1164 if wcx[3]>=1 { if lw_slen(ww)>0 { t9=1 } } 1165 gv_check("T9 unregistered walk NAMES the organ (an empty sample means the basename never resolved, which would brand every organ unregistered)" as *u8, t9, ctr) 1166 1167 lw_wfile("/tmp/lw_tok.nx\x00" as *u8, "// plan: just bridge it with webrtc for now\n\x00" as *u8) 1168 let kcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1169 kcx[0]=LW_MODE_TOK 1170 kcx[1]=0 1171 kcx[2]=0 1172 kcx[3]=0 1173 kcx[4]=0 1174 kcx[5]=0 1175 kcx[6]=0 1176 let kw: *u8 = sys_mmap(LW_NAMEMAX) 1177 kw[0]=0 as u8 1178 lw_walk("/tmp\x00" as *u8, kcx, kw, "webrtc,zzznotpresentzz\x00" as *u8) 1179 var t10: i64=0 1180 if kcx[3]>=1 { if lw_slen(kw)>0 { t10=1 } } 1181 gv_check("T10 tokendir finds borrowed-stack callouts ACROSS a source tree and names the file" as *u8, t10, ctr) 1182 1183 let lb: *u8 = sys_mmap(LW_NAMEMAX) 1184 var lp: i64=0 1185 lp=lw_cat(lb,lp,"100" as *u8) 1186 lb[lp]=LW_TAB as u8 1187 lp=lp+1 1188 lp=lw_cat(lb,lp,"LAW" as *u8) 1189 lb[lp]=LW_NL as u8 1190 lp=lp+1 1191 lp=lw_cat(lb,lp,"200" as *u8) 1192 lb[lp]=LW_TAB as u8 1193 lp=lp+1 1194 lp=lw_cat(lb,lp,"LAW" as *u8) 1195 lb[lp]=LW_NL as u8 1196 lp=lp+1 1197 var t11: i64=0 1198 if lw_last_ts(lb,lp)==200 { t11=1 } 1199 gv_check("T11 file acts on the LATEST scan block only (last ts wins, not the first)" as *u8, t11, ctr) 1200 1201 let pb: *u8 = sys_mmap(LW_NAMEMAX) 1202 var pp: i64=0 1203 pp=lw_catn(pb,pp,100) 1204 pb[pp]=LW_TAB as u8 1205 pp=pp+1 1206 pp=lw_cat(pb,pp,"FILED" as *u8) 1207 pb[pp]=LW_TAB as u8 1208 pp=pp+1 1209 pp=lw_cat(pb,pp,"L001" as *u8) 1210 pb[pp]=LW_TAB as u8 1211 pp=pp+1 1212 pp=lw_cat(pb,pp,"5" as *u8) 1213 pb[pp]=LW_NL as u8 1214 pp=pp+1 1215 var t12: i64=0 1216 if lw_filed_has(pb,pp,"L001\x00" as *u8)==1 { if lw_filed_has(pb,pp,"L002\x00" as *u8)==0 { t12=1 } } 1217 gv_check("T12 IDEMPOTENT: an already-filed law is skipped, a new one is not (hourly beat cannot spam)" as *u8, t12, ctr) 1218 1219 let rp: *u8 = sys_mmap(LW_PATH) 1220 let r1: i64 = lw_allow_path(ab,abn,"nx_seat\x00" as *u8,rp) 1221 let r2: i64 = lw_allow_path(ab,abn,"nx_ghost\x00" as *u8,rp) 1222 var t13: i64=0 1223 if r1==1 { if r2==0 { t13=1 } } 1224 gv_check("T13 filing organ resolved from the REGISTRY, unknown name refused (no guessed path -> no silent execve 127)" as *u8, t13, ctr) 1225 1226 lw_wfile("/tmp/lw_x.txt\x00" as *u8, "plan: just bridge it with webrtc\nwarden report: webrtc was the top hit\n\x00" as *u8) 1227 let xcx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1228 xcx[0]=0 1229 xcx[1]=0 1230 let xw: *u8 = sys_mmap(LW_NAMEMAX) 1231 lw_token_scan("/tmp/lw_x.txt\x00" as *u8, "webrtc\x00" as *u8, xcx, xw, "warden report\x00" as *u8) 1232 var t14: i64=0 1233 if xcx[0]==1 { t14=1 } 1234 gv_check("T14 exclusion: the warden's OWN report line is not counted as a callout (2 lines -> 1 real hit)" as *u8, t14, ctr) 1235 1236 // OWN scratch dir: /tmp is shared and already held another organ's seg-store fixtures, so asserting 1237 // on a global max was never deterministic. A test that reads a mutable shared directory is not a test. 1238 // 1239 // ---- 2026-08-07: AND ITS OWN DIR WENT STALE, WHICH IS THE SAME BUG ONE LEVEL IN. ---- 1240 // T15 was RED (25/26, debt 1786122057, filed as "fix the per-plane counting"). THE COUNTING WAS 1241 // NEVER WRONG. /tmp/lwseg had accumulated zzlw-seg-2 and zzlw-seg-3 from an older revision of this 1242 // fixture, so lw_segamp CORRECTLY reported max=4 and the assertion demanded 2. A capability that 1243 // guards an OOM class sat indicted for hours by its own leftovers. 1244 // ★★★★★★A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER. 1245 // ★★★★★★A RED TOOTH IS NOT EVIDENCE THE CAPABILITY IS BROKEN -- IT IS EVIDENCE THE ASSERTION 1246 // FAILED, AND THE FIXTURE IS PART OF THE ASSERTION. Diagnose the fixture before the code. 1247 // ⇒ BUILD THE FIXTURE, NEVER INHERIT IT: every name this test could ever have written is removed 1248 // first, so the directory's contents are a function of THIS run alone. Unlinking a name that is 1249 // not there is a harmless no-op, which is exactly why the list can be generous. 1250 sys_mkdir("/tmp/lwseg\x00" as *u8, LW_DIRMODE) 1251 sys_unlinkat("/tmp/lwseg/zzlw-seg-0.docs\x00" as *u8) 1252 sys_unlinkat("/tmp/lwseg/zzlw-seg-1.docs\x00" as *u8) 1253 sys_unlinkat("/tmp/lwseg/zzlw-seg-2.docs\x00" as *u8) 1254 sys_unlinkat("/tmp/lwseg/zzlw-seg-3.docs\x00" as *u8) 1255 sys_unlinkat("/tmp/lwseg/zzlw-seg-4.docs\x00" as *u8) 1256 sys_unlinkat("/tmp/lwseg/yylw-seg-0.docs\x00" as *u8) 1257 sys_unlinkat("/tmp/lwseg/yylw-seg-1.docs\x00" as *u8) 1258 sys_unlinkat("/tmp/lwseg/zzlw-manifest.txt\x00" as *u8) 1259 sys_unlinkat("/tmp/lwseg/yylw-manifest.txt\x00" as *u8) 1260 lw_wfile("/tmp/lwseg/zzlw-seg-0.docs\x00" as *u8, "x\n\x00" as *u8) 1261 lw_wfile("/tmp/lwseg/zzlw-seg-1.docs\x00" as *u8, "x\n\x00" as *u8) 1262 lw_wfile("/tmp/lwseg/yylw-seg-0.docs\x00" as *u8, "x\n\x00" as *u8) 1263 let scx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1264 scx[0]=0 1265 scx[1]=0 1266 scx[2]=0 1267 scx[3]=0 1268 let sw: *u8 = sys_mmap(LW_NAMEMAX) 1269 sw[0]=0 as u8 1270 lw_segamp("/tmp/lwseg\x00" as *u8, 1, scx, sw) 1271 var t15: i64=0 1272 if scx[0]==2 { if scx[1]==1 { if scx[2]==2 { t15=1 } } } 1273 gv_check("T15 segamp counts segments PER PLANE and flags the amplified one (the class that OOM-killed the box)" as *u8, t15, ctr) 1274 1275 let rc: i64 = gv_verdict("LAW-WARDEN-GATE" as *u8, ctr, "written laws now have detectors; warden is rule-11 clean by construction" as *u8) 1276 return rc 1277} 1278 1279// ---------- scan ---------- 1280func lw_scan(prefix: *u8) -> i64 { 1281 let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64 1282 // THE LAW REGISTRY IS A SOVEREIGN PLANE (seg-store behind nx_store_put), NOT a flat TSV -- the same 1283 // substrate as raci-/debt-/frontier-/featreg-, so every mutation is provenanced into its hist- rows 1284 // and parallel seats cannot clobber each other. A flat file had neither property. 1285 let mb: *u8 = sys_mmap(LW_PLANE) 1286 let mn: i64 = sts_load(prefix, mb, LW_PLANE) 1287 if mn<=0 { 1288 gv_puts("LAW-WARDEN RED -- law plane unseeded (fail-closed: no verdict over no data): " as *u8) 1289 gv_puts(prefix) 1290 gv_puts("\n" as *u8) 1291 sys_exit(1) 1292 return 1 1293 } 1294 1295 // RACI owner join (F207): the whole raci- plane as text; -1 bytes = plane unreadable = UNMEASURED 1296 let rb: *u8 = sys_mmap(LW_PLANE) 1297 let rn: i64 = sts_load("knowledge/store/raci-\x00" as *u8, rb, LW_PLANE) 1298 1299 // NOTE: the unregistered detector reads its allowlist from the law row's own param -- the conf path is 1300 // DATA like every other policy input, so the registry can never describe a file the code does not read. 1301 1302 let jb: *u8 = sys_mmap(LW_OUT) 1303 var j: i64=0 1304 let fb: *u8 = sys_mmap(LW_OUT) 1305 var fp: i64=0 1306 let now: i64 = sys_now_realtime_sec() 1307 j=lw_cat(jb,j,"{\x22v\x22:1,\x22domain\x22:\x22law-warden\x22,\x22title\x22:\x22Written laws, mechanically detected -- no human needs to name the breach\x22,\x22laws\x22:[" as *u8) 1308 1309 let fs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1310 let fl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1311 let cx: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1312 let worst: *u8 = sys_mmap(LW_NAMEMAX) 1313 let corpus: *u8 = sys_mmap(LW_PATH) 1314 let param: *u8 = sys_mmap(LW_PATH) 1315 let role: *u8 = sys_mmap(LW_NAMEMAX) 1316 let excl: *u8 = sys_mmap(LW_PATH) 1317 1318 var nlaw: i64=0 1319 var nmeas: i64=0 1320 var nbreach: i64=0 1321 var nunowned: i64=0 1322 var sevall: i64=0 1323 var sevbr: i64=0 1324 var first: i64=1 1325 var i: i64=0 1326 while i<mn { 1327 let ls: i64=i 1328 var le: i64=ls 1329 var go: i64=1 1330 while go==1 { if le>=mn { go=0 } else { if mb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 1331 let lend: i64=le 1332 i=le+1 1333 let llen: i64=lend-ls 1334 if llen>3 { if mb[ls]!=(LW_HASH as u8) { 1335 var nf: i64=0 1336 var p: i64=ls 1337 var fstart: i64=ls 1338 while p<lend { 1339 if mb[p]==(LW_TAB as u8) { 1340 if nf<LW_COLS_MAX { fs[nf]=fstart; fl[nf]=p-fstart; nf=nf+1 } 1341 fstart=p+1 1342 } 1343 p=p+1 1344 } 1345 if nf<LW_COLS_MAX { fs[nf]=fstart; fl[nf]=lend-fstart; nf=nf+1 } 1346 if nf>=LW_COLS { 1347 let sev: i64 = (mb[fs[5]] as i64)-48 1348 // zero-terminate the fields the detectors need as C strings 1349 lw_catf(param,0,(mb as i64+fs[4]) as *u8,fl[4]) 1350 param[fl[4]]=0 as u8 1351 lw_catf(corpus,0,(mb as i64+fs[7]) as *u8,fl[7]) 1352 corpus[fl[7]]=0 as u8 1353 lw_catf(role,0,(mb as i64+fs[6]) as *u8,fl[6]) 1354 role[fl[6]]=0 as u8 1355 // optional 9th column = a substring that marks a line as NOT-A-PROPOSAL (e.g. the warden's 1356 // own report frames). Absent -> no exclusion, identical to the 8-column contract (rule 19). 1357 excl[0]=0 as u8 1358 if nf>=LW_COLS_MAX { lw_catf(excl,0,(mb as i64+fs[8]) as *u8,fl[8]); excl[fl[8]]=0 as u8 } 1359 1360 // owner join: role must resolve in the raci- plane, else UNOWNED 1361 var owner_ok: i64 = 0-1 1362 if rn>0 { owner_ok=0; if lw_count(rb,rn,role)>0 { owner_ok=1 } } 1363 if owner_ok==0 { nunowned=nunowned+1 } 1364 1365 cx[0]=0 1366 cx[1]=0 1367 cx[2]=0 1368 cx[3]=0 1369 cx[4]=0 1370 cx[5]=0 1371 cx[6]=0 1372 worst[0]=0 as u8 1373 var measured: i64 = 0-1 1374 var files: i64 = 0 1375 1376 if lw_span_eq(mb,fs[3],fl[3],"inlinelit" as *u8)==1 { 1377 var thr: i64=0 1378 var q: i64=0 1379 while q<fl[4] { let dch: i64=param[q] as i64; if dch>=48 { if dch<=57 { thr=thr*10+(dch-48) } } q=q+1 } 1380 cx[0]=LW_MODE_LIT 1381 cx[1]=thr 1382 if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] } 1383 } 1384 if lw_span_eq(mb,fs[3],fl[3],"valuenamed" as *u8)==1 { 1385 cx[0]=LW_MODE_VNAME 1386 if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] } 1387 } 1388 if lw_span_eq(mb,fs[3],fl[3],"gatedry" as *u8)==1 { 1389 cx[0]=LW_MODE_GATEDRY 1390 if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] } 1391 } 1392 if lw_span_eq(mb,fs[3],fl[3],"helperdup" as *u8)==1 { 1393 cx[0]=LW_MODE_HELPERDUP 1394 if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] } 1395 } 1396 if lw_span_eq(mb,fs[3],fl[3],"scancap" as *u8)==1 { 1397 cx[0]=LW_MODE_SCANCAP 1398 if lw_walk(corpus,cx,worst,mb)==0 { measured=cx[3]; files=cx[2] } 1399 } 1400 if lw_span_eq(mb,fs[3],fl[3],"unregistered" as *u8)==1 { 1401 let csz: *i64 = sys_mmap(LW_SCRATCH) as *i64 1402 let cb: *u8 = sys_read_file(param, csz) 1403 if (cb as i64)!=0 { 1404 cx[0]=LW_MODE_ELF 1405 cx[6]=csz[0] 1406 if lw_walk(corpus,cx,worst,cb)==0 { measured=cx[3]; files=cx[2] } 1407 } 1408 } 1409 if lw_span_eq(mb,fs[3],fl[3],"token" as *u8)==1 { 1410 cx[0]=0 1411 cx[1]=0 1412 if lw_token_scan(corpus,param,cx,worst,excl)==0 { measured=cx[0]; files=cx[1] } 1413 } 1414 if lw_span_eq(mb,fs[3],fl[3],"tokendir" as *u8)==1 { 1415 cx[0]=LW_MODE_TOK 1416 if lw_walk(corpus,cx,worst,param)==0 { measured=cx[3]; files=cx[2] } 1417 } 1418 if lw_span_eq(mb,fs[3],fl[3],"segamp" as *u8)==1 { 1419 var thr2: i64=0 1420 var q2: i64=0 1421 while q2<fl[4] { let dc: i64=param[q2] as i64; if dc>=48 { if dc<=57 { thr2=thr2*10+(dc-48) } } q2=q2+1 } 1422 cx[0]=0 1423 cx[1]=0 1424 cx[2]=0 1425 cx[3]=0 1426 if lw_segamp(corpus,thr2,cx,worst)==0 { measured=cx[1]; files=cx[0]; if cx[3]==1 { cx[5]=1 } } 1427 } 1428 1429 nlaw=nlaw+1 1430 sevall=sevall+sev 1431 if measured>=0 { nmeas=nmeas+1 } 1432 if measured>0 { nbreach=nbreach+1; sevbr=sevbr+sev } 1433 1434 // one APPEND-ONLY frame per law per scan -- this is what makes a TREND derivable 1435 fp=lw_catn(fb,fp,now) 1436 fp=lw_cat(fb,fp,"\tLAW\t" as *u8) 1437 fp=lw_catf(fb,fp,(mb as i64+fs[0]) as *u8,fl[0]) 1438 fp=lw_cat(fb,fp,"\t" as *u8) 1439 fp=lw_catf(fb,fp,(mb as i64+fs[3]) as *u8,fl[3]) 1440 fp=lw_cat(fb,fp,"\t" as *u8) 1441 fp=lw_catn(fb,fp,measured) 1442 fp=lw_cat(fb,fp,"\t" as *u8) 1443 if measured<0 { fp=lw_cat(fb,fp,"UNMEASURED" as *u8) } else { if measured>0 { fp=lw_cat(fb,fp,"BREACH" as *u8) } else { fp=lw_cat(fb,fp,"CLEAN" as *u8) } } 1444 fp=lw_cat(fb,fp,"\t" as *u8) 1445 fp=lw_catesc(fb,fp,worst,lw_slen(worst)) 1446 fp=lw_cat(fb,fp,"\n" as *u8) 1447 1448 if first==0 { j=lw_cat(jb,j,"," as *u8) } 1449 first=0 1450 j=lw_cat(jb,j,"{\x22law\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[0]) as *u8,fl[0]) 1451 j=lw_cat(jb,j,"\x22,\x22title\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[1]) as *u8,fl[1]) 1452 j=lw_cat(jb,j,"\x22,\x22rule\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[2]) as *u8,fl[2]) 1453 j=lw_cat(jb,j,"\x22,\x22detector\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[3]) as *u8,fl[3]) 1454 j=lw_cat(jb,j,"\x22,\x22param\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[4]) as *u8,fl[4]) 1455 j=lw_cat(jb,j,"\x22,\x22sev\x22:" as *u8); j=lw_catn(jb,j,sev) 1456 j=lw_cat(jb,j,",\x22owner_role\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[6]) as *u8,fl[6]) 1457 j=lw_cat(jb,j,"\x22,\x22owner_resolved\x22:" as *u8); j=lw_catn(jb,j,owner_ok) 1458 j=lw_cat(jb,j,",\x22corpus\x22:\x22" as *u8); j=lw_catesc(jb,j,(mb as i64+fs[7]) as *u8,fl[7]) 1459 j=lw_cat(jb,j,"\x22,\x22measured\x22:" as *u8); j=lw_catn(jb,j,measured) 1460 j=lw_cat(jb,j,",\x22scanned\x22:" as *u8); j=lw_catn(jb,j,files) 1461 j=lw_cat(jb,j,",\x22capped\x22:" as *u8); j=lw_catn(jb,j,cx[5]) 1462 j=lw_cat(jb,j,",\x22worst\x22:\x22" as *u8); j=lw_catesc(jb,j,worst,lw_slen(worst)) 1463 j=lw_cat(jb,j,"\x22,\x22status\x22:\x22" as *u8) 1464 if measured<0 { j=lw_cat(jb,j,"UNMEASURED" as *u8) } else { if measured>0 { j=lw_cat(jb,j,"BREACH" as *u8) } else { j=lw_cat(jb,j,"CLEAN" as *u8) } } 1465 j=lw_cat(jb,j,"\x22}" as *u8) 1466 } 1467 } } 1468 } 1469 1470 var enforced: i64=0 1471 var breachw: i64=0 1472 if nlaw>0 { enforced=(nmeas*1000)/nlaw } 1473 if sevall>0 { breachw=(sevbr*1000)/sevall } 1474 1475 j=lw_cat(jb,j,"],\x22laws_total\x22:" as *u8); j=lw_catn(jb,j,nlaw) 1476 j=lw_cat(jb,j,",\x22laws_measured\x22:" as *u8); j=lw_catn(jb,j,nmeas) 1477 j=lw_cat(jb,j,",\x22laws_breached\x22:" as *u8); j=lw_catn(jb,j,nbreach) 1478 j=lw_cat(jb,j,",\x22laws_unowned\x22:" as *u8); j=lw_catn(jb,j,nunowned) 1479 j=lw_cat(jb,j,",\x22enforced_permil\x22:" as *u8); j=lw_catn(jb,j,enforced) 1480 j=lw_cat(jb,j,",\x22breach_weight_permil\x22:" as *u8); j=lw_catn(jb,j,breachw) 1481 j=lw_cat(jb,j,",\x22raci_plane_bytes\x22:" as *u8); j=lw_catn(jb,j,rn) 1482 j=lw_cat(jb,j,",\x22formula\x22:\x22enforced_permil = laws with a detector that actually RAN over laws in the registry; breach_weight_permil = severity share of breached laws. UNMEASURED is counted as un-enforced, never as clean.\x22" as *u8) 1483 j=lw_cat(jb,j,",\x22envelope\x22:\x22law roster = the lawreg- plane (grows by appended rows, NOT exhaustive); dir walks are one level, non-recursive, capped at LW_FILECAP files with capped=1 declared; owner join is substring presence in the raci- plane; -1 = UNMEASURED. tokendir counts MENTIONS not endorsements -- an anti-mention (no python) counts too, so token findings are review candidates for the router, never auto-verdicts.\x22" as *u8) 1484 j=lw_cat(jb,j,",\x22honest\x22:\x22VERDICT=GREEN means THE WARDEN MEASURED -- not that the ecosystem is clean; read laws_breached for that. A law with no row here is UNENFORCED and therefore invisible: adding a row is how a written rule becomes mechanically checkable, and doing so RAISES the breach count (that is the system working).\x22}" as *u8) 1485 1486 sys_write(1,jb,j) 1487 sys_write(1,"\n" as *u8,1) 1488 1489 // APPEND-ONLY evidence journal (rule 13: history is sacred; ws_sync/claims/actlog lineage). The old 1490 // truncating .log ERASED every prior scan, so the hourly beat could never yield a trend -- each run 1491 // overwrote the last. O_APPEND frames are conflict-free under parallel seats too. 1492 let lf: i64 = sys_openat_append("knowledge/status/law_warden.jrnl\x00" as *u8, LW_MODE) 1493 if lf>=0 { 1494 fp=lw_catn(fb,fp,now) 1495 fp=lw_cat(fb,fp,"\tVERDICT=GREEN\tlaws=" as *u8) 1496 fp=lw_catn(fb,fp,nlaw) 1497 fp=lw_cat(fb,fp,"\tmeasured=" as *u8) 1498 fp=lw_catn(fb,fp,nmeas) 1499 fp=lw_cat(fb,fp,"\tbreached=" as *u8) 1500 fp=lw_catn(fb,fp,nbreach) 1501 fp=lw_cat(fb,fp,"\tunowned=" as *u8) 1502 fp=lw_catn(fb,fp,nunowned) 1503 fp=lw_cat(fb,fp,"\tenforced_permil=" as *u8) 1504 fp=lw_catn(fb,fp,enforced) 1505 fp=lw_cat(fb,fp,"\n" as *u8) 1506 sys_write(lf,fb,fp) 1507 sys_close(lf) 1508 } 1509 1510 // TRUNCATE-WRITE STATUS ARTIFACT -- RESTORED 2026-09-03, ALONGSIDE the journal, not instead of it. 1511 // When the append-only .jrnl above replaced the truncating .log, the .log was left ON DISK and 1512 // NOTHING REWROTE IT. It therefore froze at a 4-law generation and went on publishing 1513 // "laws=4 measured=4 breached=3 VERDICT=GREEN" while this organ had grown to 11 laws, 11 breached, 1514 // including the sev-9 segamp row. Nothing was lying: the file simply had no writer, and from the 1515 // outside a stale artifact and a stalled beat are the same observation -- which is exactly why it 1516 // went unnoticed. ABSENT-PROVEN the same day (corpus_complete=1, both source trees): no .nx reads 1517 // this path, so the fossil was pure misinformation with an authoritative name. 1518 // AND THE JOURNAL CANNOT DO THIS JOB: a status reader grepping an append-only file matches the 1519 // OLDEST frame as happily as the newest, i.e. it is vacuously green forever. The trend needs an 1520 // append; a current verdict needs a rewrite. ONE writer, TWO artifacts, agreeing by construction -- 1521 // the GREEN token below is the same one the journal frame emits, so they cannot drift apart. 1522 // Format is byte-compatible with the fossil (JSON line, then the canonical VERDICT line LAST) so 1523 // any positional last-line judge keeps working. 1524 var sj: i64 = j 1525 sj=lw_cat(jb,sj,"\nVERDICT=GREEN laws=" as *u8) 1526 sj=lw_catn(jb,sj,nlaw) 1527 sj=lw_cat(jb,sj," measured=" as *u8) 1528 sj=lw_catn(jb,sj,nmeas) 1529 sj=lw_cat(jb,sj," breached=" as *u8) 1530 sj=lw_catn(jb,sj,nbreach) 1531 sj=lw_cat(jb,sj," unowned=" as *u8) 1532 sj=lw_catn(jb,sj,nunowned) 1533 sj=lw_cat(jb,sj," enforced_permil=" as *u8) 1534 sj=lw_catn(jb,sj,enforced) 1535 sj=lw_cat(jb,sj,"\n" as *u8) 1536 jb[sj]=0 as u8 1537 lw_wfile("knowledge/status/law_warden.log\x00" as *u8, jb) 1538 1539 return 0 1540} 1541 1542// find the lawreg- row whose col0 == lawid; fills gs/gl with its 8 column spans 1543func lw_plane_find(rb: *u8, rn: i64, lawid: *u8, gs: *i64, gl: *i64) -> i64 { 1544 var i: i64=0 1545 while i<rn { 1546 let ls: i64=i 1547 var le: i64=ls 1548 var go: i64=1 1549 while go==1 { if le>=rn { go=0 } else { if rb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 1550 i=le+1 1551 if le>ls { if rb[ls]!=(LW_HASH as u8) { 1552 var nf: i64=0 1553 var p: i64=ls 1554 var st: i64=ls 1555 while p<le { 1556 if rb[p]==(LW_TAB as u8) { if nf<LW_COLS_MAX { gs[nf]=st; gl[nf]=p-st; nf=nf+1 } st=p+1 } 1557 p=p+1 1558 } 1559 if nf<LW_COLS_MAX { gs[nf]=st; gl[nf]=le-st; nf=nf+1 } 1560 if nf>=LW_COLS { if lw_span_eq(rb,gs[0],gl[0],lawid)==1 { return 1 } } 1561 } } 1562 } 1563 return 0 1564} 1565 1566func lw_file(prefix: *u8, toolname: *u8) -> i64 { 1567 let szp: *i64 = sys_mmap(LW_SCRATCH) as *i64 1568 // the filing organ is resolved from the REGISTRY, never from a hardcoded path 1569 let az: *i64 = sys_mmap(LW_SCRATCH) as *i64 1570 let ab: *u8 = sys_read_file("tool_allowlist.conf\x00" as *u8, az) 1571 let elfpath: *u8 = sys_mmap(LW_PATH) 1572 var okp: i64 = 0 1573 if (ab as i64)!=0 { okp=lw_allow_path(ab,az[0],toolname,elfpath) } 1574 if okp==0 { 1575 gv_puts("LAW-FILE RED -- filing organ has no tool_allowlist.conf row; refusing to fork a guessed path: " as *u8) 1576 gv_puts(toolname) 1577 gv_puts("\n" as *u8) 1578 sys_exit(1) 1579 return 1 1580 } 1581 let rb: *u8 = sys_mmap(LW_PLANE) 1582 let rn: i64 = sts_load(prefix, rb, LW_PLANE) 1583 if rn<=0 { 1584 gv_puts("LAW-FILE RED -- law plane unseeded (fail-closed): " as *u8) 1585 gv_puts(prefix) 1586 gv_puts("\n" as *u8) 1587 sys_exit(1) 1588 return 1 1589 } 1590 let jb: *u8 = sys_read_file("knowledge/status/law_warden.jrnl\x00" as *u8, szp) 1591 if (jb as i64)==0 { 1592 gv_puts("LAW-FILE RED -- no evidence journal yet; run scan first (never files on no data)\n" as *u8) 1593 sys_exit(1) 1594 return 1 1595 } 1596 let jl: i64 = szp[0] 1597 let last: i64 = lw_last_ts(jb,jl) 1598 let fz: *i64 = sys_mmap(LW_SCRATCH) as *i64 1599 let fb: *u8 = sys_read_file("knowledge/status/law_filed.jrnl\x00" as *u8, fz) 1600 var fn2: i64 = 0 1601 if (fb as i64)!=0 { fn2=fz[0] } 1602 1603 let ob: *u8 = sys_mmap(LW_OUT) 1604 var o: i64=0 1605 o=lw_cat(ob,o,"{\x22v\x22:1,\x22domain\x22:\x22law-file\x22,\x22scan_ts\x22:" as *u8) 1606 o=lw_catn(ob,o,last) 1607 o=lw_cat(ob,o,",\x22actions\x22:[" as *u8) 1608 1609 let fs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1610 let fl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1611 let gs: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1612 let gl: *i64 = sys_mmap(LW_FLD_BYTES) as *i64 1613 let lawid: *u8 = sys_mmap(LW_NAMEMAX) 1614 let sevb: *u8 = sys_mmap(LW_NAMEMAX) 1615 let scope: *u8 = sys_mmap(LW_NAMEMAX) 1616 let desc: *u8 = sys_mmap(LW_OUT) 1617 let capb: *u8 = sys_mmap(LW_OUT) 1618 let ol: *i64 = sys_mmap(LW_SCRATCH) as *i64 1619 let av: *i64 = sys_mmap(LW_ST_SLOTS) as *i64 1620 let fr: *u8 = sys_mmap(LW_OUT) 1621 var fp: i64=0 1622 var nfiled: i64=0 1623 var nskip: i64=0 1624 var nerr: i64=0 1625 var first: i64=1 1626 1627 var i: i64=0 1628 while i<jl { 1629 let ls: i64=i 1630 var le: i64=ls 1631 var go: i64=1 1632 while go==1 { if le>=jl { go=0 } else { if jb[le]==(LW_NL as u8) { go=0 } else { le=le+1 } } } 1633 i=le+1 1634 if le>ls { 1635 var nf: i64=0 1636 var p: i64=ls 1637 var st: i64=ls 1638 while p<le { 1639 if jb[p]==(LW_TAB as u8) { if nf<LW_COLS { fs[nf]=st; fl[nf]=p-st; nf=nf+1 } st=p+1 } 1640 p=p+1 1641 } 1642 if nf<LW_COLS { fs[nf]=st; fl[nf]=le-st; nf=nf+1 } 1643 if nf>=6 { 1644 var ts: i64=0 1645 var k: i64=fs[0] 1646 var g2: i64=1 1647 while g2==1 { 1648 if k>=fs[0]+fl[0] { g2=0 } else { 1649 let d: i64=jb[k] as i64 1650 if d>=48 { if d<=57 { ts=ts*10+(d-48); k=k+1 } else { g2=0 } } else { g2=0 } 1651 } 1652 } 1653 if ts==last { if lw_span_eq(jb,fs[1],fl[1],"LAW" as *u8)==1 { if lw_span_eq(jb,fs[5],fl[5],"BREACH" as *u8)==1 { 1654 lw_catf(lawid,0,(jb as i64+fs[2]) as *u8,fl[2]) 1655 lawid[fl[2]]=0 as u8 1656 if first==0 { o=lw_cat(ob,o,"," as *u8) } 1657 first=0 1658 o=lw_cat(ob,o,"{\x22law\x22:\x22" as *u8) 1659 o=lw_catesc(ob,o,lawid,lw_slen(lawid)) 1660 o=lw_cat(ob,o,"\x22,\x22action\x22:\x22" as *u8) 1661 if lw_filed_has(fb,fn2,lawid)==1 { 1662 nskip=nskip+1 1663 o=lw_cat(ob,o,"SKIP-ALREADY-FILED" as *u8) 1664 } else { 1665 if lw_plane_find(rb,rn,lawid,gs,gl)==0 { 1666 nerr=nerr+1 1667 o=lw_cat(ob,o,"ERR-LAW-NOT-IN-PLANE" as *u8) 1668 } else { 1669 sevb[0]=rb[gs[5]] 1670 sevb[1]=0 as u8 1671 var sp: i64=0 1672 sp=lw_cat(scope,sp,"law-" as *u8) 1673 sp=lw_catf(scope,sp,lawid,lw_slen(lawid)) 1674 scope[sp]=0 as u8 1675 var dp: i64=0 1676 dp=lw_cat(desc,dp,"LAW " as *u8) 1677 dp=lw_catf(desc,dp,lawid,lw_slen(lawid)) 1678 dp=lw_cat(desc,dp," BREACH (nx_law_warden AUTOFILED by the hourly beat, zero-Claude): " as *u8) 1679 dp=lw_catf(desc,dp,(rb as i64+gs[1]) as *u8,gl[1]) 1680 dp=lw_cat(desc,dp," | rule=" as *u8) 1681 dp=lw_catf(desc,dp,(rb as i64+gs[2]) as *u8,gl[2]) 1682 dp=lw_cat(desc,dp," detector=" as *u8) 1683 dp=lw_catf(desc,dp,(jb as i64+fs[3]) as *u8,fl[3]) 1684 dp=lw_cat(desc,dp," measured=" as *u8) 1685 dp=lw_catf(desc,dp,(jb as i64+fs[4]) as *u8,fl[4]) 1686 dp=lw_cat(desc,dp," worst=" as *u8) 1687 if nf>=7 { dp=lw_catf(desc,dp,(jb as i64+fs[6]) as *u8,fl[6]) } 1688 dp=lw_cat(desc,dp," owner_role=" as *u8) 1689 dp=lw_catf(desc,dp,(rb as i64+gs[6]) as *u8,gl[6]) 1690 dp=lw_cat(desc,dp,". Corpus " as *u8) 1691 dp=lw_catf(desc,dp,(rb as i64+gs[7]) as *u8,gl[7]) 1692 dp=lw_cat(desc,dp,". COVERAGE (added 2026-07-31, debts 1785519276 + 1785519488): this measurement is a ONE-LEVEL, NON-RECURSIVE directory walk CAPPED at LW_FILECAP files. It is a FLOOR, NOT A CORPUS TOTAL -- the named corpus is typically an order of magnitude larger (buildroot/runtime/_hdl_build alone holds 6555 one-level .nx, so the cap is about 9pct coverage). Do NOT size effort or trend from this number without reading files_seen/capped in the scan envelope. The warden's OWN L011 scancap law calls presenting partial coverage as complete a BUG, not a declared floor, so this sentence exists to stop the naked number travelling without its denominator." as *u8) 1693 dp=lw_cat(desc,dp,". Evidence knowledge/status/law_warden.jrnl (append-only, one frame per law per beat = the trend). Filed ONCE and never re-filed; the journal carries movement." as *u8) 1694 desc[dp]=0 as u8 1695 av[0]=elfpath as i64 1696 av[1]=("add\x00" as *u8) as i64 1697 av[2]=sevb as i64 1698 av[3]=scope as i64 1699 av[4]=desc as i64 1700 av[5]=0 1701 let rc: i64 = tr_run_capture(elfpath, av, capb, LW_OUT, ol) 1702 if rc==0 { 1703 nfiled=nfiled+1 1704 o=lw_cat(ob,o,"FILED" as *u8) 1705 fp=lw_catn(fr,fp,last) 1706 fr[fp]=LW_TAB as u8 1707 fp=fp+1 1708 fp=lw_cat(fr,fp,"FILED" as *u8) 1709 fr[fp]=LW_TAB as u8 1710 fp=fp+1 1711 fp=lw_catf(fr,fp,lawid,lw_slen(lawid)) 1712 fr[fp]=LW_TAB as u8 1713 fp=fp+1 1714 fp=lw_catf(fr,fp,(jb as i64+fs[4]) as *u8,fl[4]) 1715 // col 5 = the debt id parsed from the reply, or -1 if the reply was not an 1716 // unambiguous DEBT-ADDED. ADDITIVE (rule 19): lw_filed_has keys on the 1717 // "\tFILED\t<lawid>\t" substring, which is unchanged, so every existing 1718 // reader of cols 0-3 is unaffected. -1 is recorded rather than omitted, so 1719 // an unparseable reply is VISIBLE instead of looking like it never happened. 1720 fr[fp]=LW_TAB as u8 1721 fp=fp+1 1722 fp=lw_catn(fr,fp,lw_debt_id(capb,ol[0])) 1723 fr[fp]=LW_NL as u8 1724 fp=fp+1 1725 } else { 1726 nerr=nerr+1 1727 o=lw_cat(ob,o,"ERR-DEBT-FORK-RC" as *u8) 1728 o=lw_catn(ob,o,rc) 1729 } 1730 } 1731 } 1732 o=lw_cat(ob,o,"\x22}" as *u8) 1733 } } } 1734 } 1735 } 1736 } 1737 1738 if fp>0 { 1739 let ff: i64 = sys_openat_append("knowledge/status/law_filed.jrnl\x00" as *u8, LW_MODE) 1740 if ff>=0 { sys_write(ff,fr,fp); sys_close(ff) } 1741 } 1742 o=lw_cat(ob,o,"],\x22filed\x22:" as *u8) 1743 o=lw_catn(ob,o,nfiled) 1744 o=lw_cat(ob,o,",\x22skipped\x22:" as *u8) 1745 o=lw_catn(ob,o,nskip) 1746 o=lw_cat(ob,o,",\x22errors\x22:" as *u8) 1747 o=lw_catn(ob,o,nerr) 1748 o=lw_cat(ob,o,",\x22honest\x22:\x22files ONCE per law (idempotent, rule 10) so an hourly beat never spams the plane; movement lives in law_warden.jrnl, not in duplicate rows. A law filed here is OWNED work in the debt plane -- written by forking nx_debt, which stays the single writer of its own plane.\x22}" as *u8) 1749 sys_write(1,ob,o) 1750 sys_write(1,"\n" as *u8,1) 1751 return 0 1752} 1753 1754func main(argc: i64, argv: *i64) -> i64 { 1755 // ★ANCHOR FIRST (2026-08-04). MEASURED: run from buildroot this warden printed 1756 // "LAW-WARDEN RED -- law plane unseeded (fail-closed: no verdict over no data)" while the SAME 1757 // binary run from nishihost returned all 11 laws with real breach counts. Every corpus path 1758 // here ("knowledge/store/lawreg-", "buildroot/runtime/_hdl_build") is estate-root relative, so 1759 // the CWD silently decided whether the estate had ANY laws. The cron row already spells 1760 // `cd .../nishihost &&`; this makes the warden independent of whether its caller remembered. 1761 ep_anchor() 1762 var verb: *u8 = "scan" as *u8 1763 if argc>1 { verb=argv[1] as *u8 } 1764 let vl: i64 = lw_slen(verb) 1765 if lw_span_eq(verb,0,vl,"selftest" as *u8)==1 { let rc: i64=lw_selftest(); sys_exit(rc); return rc } 1766 if lw_span_eq(verb,0,vl,"countfile" as *u8)==1 { 1767 if argc<3 { gv_puts("usage: nx_law_warden countfile <path>\n" as *u8); sys_exit(2); return 2 } 1768 let rc: i64=lw_countfile(argv[2] as *u8) 1769 sys_exit(rc) 1770 return rc 1771 } 1772 var prefix: *u8 = "knowledge/store/lawreg-" as *u8 1773 if argc>2 { prefix=argv[2] as *u8 } 1774 if lw_span_eq(verb,0,vl,"scan" as *u8)==1 { let rc: i64=lw_scan(prefix); sys_exit(rc); return rc } 1775 if lw_span_eq(verb,0,vl,"file" as *u8)==1 { 1776 var toolnm: *u8 = "nx_debt" as *u8 1777 if argc>3 { toolnm=argv[3] as *u8 } 1778 let rc: i64=lw_file(prefix,toolnm) 1779 sys_exit(rc) 1780 return rc 1781 } 1782 gv_puts("usage: nx_law_warden {scan [planeprefix] | file [planeprefix] [debtelf] | countfile <path> | selftest}\n" as *u8) 1783 sys_exit(2) 1784 return 2 1785}