code wiki / _hdl_build / nx_lease_wedge_gate.nx
`nx_lease_wedge_gate.nx` source

↩ module page · 441 lines · 21908 B
1// nx_lease_wedge_gate.nx -- THE LEASE-WEDGE DETECTOR (2026-09-04).
2//
3// WHY THIS EXISTS. On 2026-09-04 all four knowledge/lease/heavyio-slot-N.lock slots were found
4// PERMANENTLY WEDGED. The crawler AND the shard-compactor had been dead for 18 HOURS and NOTHING in
5// the estate noticed: /search kept answering 200, every daemon read UP, and the only symptom was a
6// status log whose mtime stopped advancing. The operator's report was "search still searches nothing".
7//
8// THE MECHANISM, read out of buildroot/runtime/nx_lease_lib.nx rather than guessed. A takeover is
9// arbitrated by mkdir on a monotonic generation: ls_acquire_root parses the stamp, and for a released
10// or expired lease calls ls_claim(dir, owner, ttl, g_nonce + 1, g_nonce + 1), whose FIRST act is
11//     if ls_mkdir(dir + "/g" + gate) != 0 { return 0 }        // 0 == LOST == "busy"
12// and whose stamp write is a SEPARATE, LATER, NON-ATOMIC step:
13//     let tfd = sys_openat_wr(tp, LS_MODE)   ... sys_write ... sys_renameat(tp, sp)
14// A process killed between the mkdir and the rename leaves g<N> ON DISK with the stamp still reading
15// N-1. Every later acquirer then re-derives the SAME gate from the SAME stamp, retries mkdir g<N>,
16// gets EEXIST, and correctly reports BUSY -- forever, with no recovery path and no diagnostic.
17// The host bugchecked 3x in 72 h (GPU driver), which is exactly the kill this window needs.
18//
19// THE TEST IS THE FAILING CALL ITSELF, NOT A PROXY. This gate does not ask "does maxdir exceed the
20// stamp"; it asks the one question that decides the outcome: DOES THE DIRECTORY THE NEXT TAKEOVER
21// WILL TRY TO CREATE ALREADY EXIST? That is stat of <lease>/g<stamp_gen + 1>. A proxy could be right
22// for the wrong reason; this cannot.
23// THE PROBE PATH IS NEVER CREATED. Calling mkdir on g<gen+1> to test for it WOULD ITSELF WEDGE THE
24// LEASE -- the detector would manufacture the defect it reports. Existence is read with fstatat and
25// nothing here writes to a live lease, ever.
26//
27// CHECK-BEFORE-BUILD (rule: "I didn't know it existed" is a retrieval failure). nx_spendgate reports
28// presubmit=FREE and nx_capsearch over 7,341 organs (corpus_complete=1) returns nx_lease and
29// nx_lease_probe -- the PRIMITIVE itself -- plus nx_lease_lib and nx_vault_lease. None censuses lease
30// HEALTH; there is no acquire/release verb that can even express "this lease can never be claimed
31// again". This is a new capability, not a duplicate ruler.
32//
33// SCOPE, STATED SO NOBODY TRUSTS IT AS EXACT: this detects the WEDGE. It does not detect a lease held
34// by a dead process (that is a TTL question and ls_acquire already expires it), and it says nothing
35// about whether the holder is making progress.
36//
37// OWED, DELIBERATELY NOT ATTEMPTED HERE: ls_claim mkdir-then-stamp has no crash recovery. Fixing a
38// shared estate-wide mutex is not a safe act under load, and that file own comments record TWO prior
39// attempts at exactly this which wedged it or double-admitted. A detector first is the right order.
40import "nx_gate_verdict.nx"
41import "nx_syscalls.nx"
42import "nx_lease_lib.nx"   // THE REMEDY under test (2026-09-06): ls_claim_x reclaims an AGED orphan gate and refuses a fresh one
43
44const LW_ROOT: *u8 = "knowledge/lease"
45const LW_PATHCAP: i64 = 1024
46const LW_STAMPCAP: i64 = 512
47const LW_DENTBUF: i64 = 65536
48const LW_STATBUF: i64 = 160
49const LW_TAB: i64 = 9
50const LW_NL: i64 = 10
51const LW_D0: i64 = 48
52const LW_D9: i64 = 57
53const LW_B10: i64 = 10
54const LW_GEN_FIELD: i64 = 4
55const LW_DOT: i64 = 46
56const LW_SLASH: i64 = 47
57const LW_SCRATCH: i64 = 32
58const LW_SMALL: i64 = 64
59const LW_BOX: i64 = 16
60
61const LW_HEALTHY: i64 = 0
62const LW_WEDGED: i64 = 1
63const LW_UNREADABLE: i64 = 2
64
65func lw_cat(d: *u8, o: i64, s: *u8) -> i64 {
  var i: i64 = 0
  var p: i64 = o
  while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 }
  return p
70}
71func lw_catn(d: *u8, o: i64, v: i64) -> i64 {
  if v == 0 { d[o] = LW_D0 as u8; return o + 1 }
  var tmp: i64 = v
  var n: i64 = 0
  let sc: *u8 = sys_mmap(LW_SCRATCH)
  while tmp > 0 { sc[n] = (LW_D0 + (tmp % LW_B10)) as u8; n = n + 1; tmp = tmp / LW_B10 }
  var p: i64 = o
  var k: i64 = n
  while k > 0 { k = k - 1; d[p] = sc[k]; p = p + 1 }
  sys_munmap(sc, LW_SCRATCH)
  return p
82}
83func lw_pos(v: i64) -> i64 { if v > 0 { return 1 } return 0 }
84// READ-ONLY existence. 1 if the path exists, 0 if not. NEVER creates.
85func lw_exists(path: *u8) -> i64 {
  let sb: *u8 = sys_mmap(LW_STATBUF)
  let r: i64 = sys_fstatat(path, sb)
  sys_munmap(sb, LW_STATBUF)
  if r == 0 { return 1 }
  return 0
91}
92// Parse the stamp GENERATION (field 4, tab-separated). Returns the generation, or -1 when the stamp
93// cannot be read or does not carry five fields. A malformed stamp is UNREADABLE, never "generation 0":
94// defaulting here would let a corrupt stamp probe g1 and read HEALTHY on a wedged lease.
95func lw_stamp_gen(dir: *u8) -> i64 {
  let sp: *u8 = sys_mmap(LW_PATHCAP)
  var o: i64 = lw_cat(sp, 0, dir)
  o = lw_cat(sp, o, "/stamp")
  sp[o] = 0 as u8
  let fd: i64 = sys_openat_rd(sp)
  sys_munmap(sp, LW_PATHCAP)
  if fd < 0 { return 0 - 1 }
  let buf: *u8 = sys_mmap(LW_STAMPCAP)
  let n: i64 = sys_read(fd, buf, LW_STAMPCAP - 1)
  sys_close(fd)
  if n <= 0 { sys_munmap(buf, LW_STAMPCAP); return 0 - 1 }
  var field: i64 = 0
  var v: i64 = 0
  var seen: i64 = 0
  var i: i64 = 0
  while i < n {
      let c: i64 = buf[i] as i64
      if c == LW_TAB {
          field = field + 1
          v = 0
          seen = 0
      } else {
          if c == LW_NL { i = n } else {
              if field == LW_GEN_FIELD {
                  if c >= LW_D0 { if c <= LW_D9 { v = v * LW_B10 + (c - LW_D0); seen = 1 } }
              }
          }
      }
      i = i + 1
  }
  sys_munmap(buf, LW_STAMPCAP)
  if field < LW_GEN_FIELD { return 0 - 1 }
  if seen == 0 { return 0 - 1 }
  return v
130}
131// THE CLASSIFIER. Returns LW_HEALTHY / LW_WEDGED / LW_UNREADABLE and writes the observed generation
132// into genout[0] (-1 when unreadable) so a caller prints evidence rather than a bare verdict.
133func lw_classify(dir: *u8, genout: *i64) -> i64 {
  let g: i64 = lw_stamp_gen(dir)
  genout[0] = g
  if g < 0 { return LW_UNREADABLE }
  let gp: *u8 = sys_mmap(LW_PATHCAP)
  var o: i64 = lw_cat(gp, 0, dir)
  o = lw_cat(gp, o, "/g")
  o = lw_catn(gp, o, g + 1)
  gp[o] = 0 as u8
  let ex: i64 = lw_exists(gp)
  sys_munmap(gp, LW_PATHCAP)
  if ex == 1 { return LW_WEDGED }
  return LW_HEALTHY
146}
147// Census every lease under root. counts[0]=healthy counts[1]=wedged counts[2]=unreadable
148// counts[3]=leases seen. Prints one line per NON-healthy lease: a count without a worklist is not
149// actionable, so every offender is NAMED with the exact path the next takeover will collide on.
150func lw_census(root: *u8, counts: *i64, verbose: i64) -> i64 {
  counts[0] = 0
  counts[1] = 0
  counts[2] = 0
  counts[3] = 0
  let fd: i64 = sys_openat_rd(root)
  if fd < 0 { return 0 - 1 }
  let db: *u8 = sys_mmap(LW_DENTBUF)
  let gen: *i64 = sys_mmap(LW_BOX) as *i64
  let dp: *u8 = sys_mmap(LW_PATHCAP)
  var more: i64 = 1
  while more == 1 {
      let nb: i64 = sys_getdents64(fd, db, LW_DENTBUF)
      if nb <= 0 { more = 0 } else {
          var off: i64 = 0
          while off < nb {
              let rec: *u8 = ((db as i64) + off) as *u8
              let rl: i64 = dirent_reclen(rec)
              if dirent_type(rec) == DT_DIR {
                  let nm: *u8 = dirent_name(rec)
                  var skip: i64 = 0
                  if nm[0] == (LW_DOT as u8) { skip = 1 }
                  if skip == 0 {
                      var o2: i64 = lw_cat(dp, 0, root)
                      dp[o2] = LW_SLASH as u8
                      o2 = o2 + 1
                      o2 = lw_cat(dp, o2, nm)
                      dp[o2] = 0 as u8
                      let cls: i64 = lw_classify(dp, gen)
                      counts[3] = counts[3] + 1
                      counts[cls] = counts[cls] + 1
                      if verbose == 1 { if cls != LW_HEALTHY {
                          if cls == LW_WEDGED { gv_puts("  WEDGED     ") } else { gv_puts("  UNREADABLE ") }
                          gv_puts(dp)
                          gv_puts(" stamp_gen=")
                          gv_num(gen[0])
                          gv_puts(" -- the next takeover mkdirs g")
                          gv_num(gen[0] + 1)
                          gv_puts(" and that path ALREADY EXISTS, so every acquire returns BUSY forever\n")
                      } }
                  }
              }
              if rl <= 0 { off = nb } else { off = off + rl }
          }
      }
  }
  sys_munmap(db, LW_DENTBUF)
  sys_munmap(gen as *u8, LW_BOX)
  sys_munmap(dp, LW_PATHCAP)
  sys_close(fd)
  return 0
201}
202// Fixtures are built at RUNTIME under /tmp and never share a path with a production beat: a gate that
203// shares a fixture with a live writer measures the writer, and its RED tracks the fixture not the code.
204// CLEAR BEFORE PLANT (2026-09-12): lw_mkfix is sys_mkdir-only and removes NOTHING, so every .lock and
205// every g<n> it has ever created survives between runs -- measured 7 dirs where the census tooth expects
206// 4, plus g0 dirs dated 2026-09-04 that no current call site can emit (every ls_claim gate is g_nonce+1,
207// whose floor is 1). The residue is NOT inert: a leftover g<n> IS the EEXIST the takeover under test must
208// not find, so the two neg-controls ALTERNATED on how long ago this gate last ran -- fresh.lock failed
209// once the residue aged past 3600 s, plain.lock failed while it had not, and both runs scored 21/25 with
210// a different pair red. A GATE WHOSE ONLY DISCRIMINATOR IS AGE MUST NOT LET THAT AGE ACCUMULATE ACROSS
211// RUNS. The bound is DERIVED BY ENUMERATION, never a guessed generation ceiling, so the fossils go too.
212// Files are unlinked as well as dirs removed: a surviving stamp makes the parent rmdir fail ENOTEMPTY.
213func lw_clearlock(dir: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(dir)
  if fd < 0 { return 0 }
  let db: *u8 = sys_mmap(LW_DENTBUF)
  let dp: *u8 = sys_mmap(LW_PATHCAP)
  var removed: i64 = 0
  var more: i64 = 1
  while more == 1 {
      let nb: i64 = sys_getdents64(fd, db, LW_DENTBUF)
      if nb <= 0 { more = 0 } else {
          var off: i64 = 0
          while off < nb {
              let rec: *u8 = ((db as i64) + off) as *u8
              let rl: i64 = dirent_reclen(rec)
              let nm: *u8 = dirent_name(rec)
              if nm[0] != (LW_DOT as u8) {
                  var o2: i64 = lw_cat(dp, 0, dir)
                  dp[o2] = LW_SLASH as u8
                  o2 = o2 + 1
                  o2 = lw_cat(dp, o2, nm)
                  dp[o2] = 0 as u8
                  if dirent_type(rec) == DT_DIR { if ls_rmdir(dp) == 0 { removed = removed + 1 } } else { if sys_unlinkat(dp) == 0 { removed = removed + 1 } }
              }
              if rl <= 0 { off = nb } else { off = off + rl }
          }
      }
  }
  sys_munmap(dp, LW_PATHCAP)
  sys_munmap(db, LW_DENTBUF)
  sys_close(fd)
  return removed
244}
245// ONE pass over the root: clear each lock, then remove it. Returns how many locks went, because REMOVING
246// ENTRIES DURING A getdents WALK CAN SKIP ENTRIES -- one pass is a FLOOR, not a clear. The caller repeats
247// while a pass still removes something; that terminates by construction, since the root is finite and
248// every non-zero pass strictly shrinks it, so no pass ceiling is guessed here.
249func lw_clearroot(root: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(root)
  if fd < 0 { return 0 }
  let db: *u8 = sys_mmap(LW_DENTBUF)
  let dp: *u8 = sys_mmap(LW_PATHCAP)
  var removed: i64 = 0
  var more: i64 = 1
  while more == 1 {
      let nb: i64 = sys_getdents64(fd, db, LW_DENTBUF)
      if nb <= 0 { more = 0 } else {
          var off: i64 = 0
          while off < nb {
              let rec: *u8 = ((db as i64) + off) as *u8
              let rl: i64 = dirent_reclen(rec)
              if dirent_type(rec) == DT_DIR {
                  let nm: *u8 = dirent_name(rec)
                  if nm[0] != (LW_DOT as u8) {
                      var o2: i64 = lw_cat(dp, 0, root)
                      dp[o2] = LW_SLASH as u8
                      o2 = o2 + 1
                      o2 = lw_cat(dp, o2, nm)
                      dp[o2] = 0 as u8
                      lw_clearlock(dp)
                      if ls_rmdir(dp) == 0 { removed = removed + 1 }
                  }
              }
              if rl <= 0 { off = nb } else { off = off + rl }
          }
      }
  }
  sys_munmap(dp, LW_PATHCAP)
  sys_munmap(db, LW_DENTBUF)
  sys_close(fd)
  return removed
283}
284// The clear's OWN witness: entries under root, 0 when empty OR absent. A setup step that is not asserted
285// is a setup step nobody can tell ran -- and this one is the precondition of four teeth.
286func lw_rootcount(root: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(root)
  if fd < 0 { return 0 }
  let db: *u8 = sys_mmap(LW_DENTBUF)
  var n: i64 = 0
  var more: i64 = 1
  while more == 1 {
      let nb: i64 = sys_getdents64(fd, db, LW_DENTBUF)
      if nb <= 0 { more = 0 } else {
          var off: i64 = 0
          while off < nb {
              let rec: *u8 = ((db as i64) + off) as *u8
              let rl: i64 = dirent_reclen(rec)
              let nm: *u8 = dirent_name(rec)
              if nm[0] != (LW_DOT as u8) { n = n + 1 }
              if rl <= 0 { off = nb } else { off = off + rl }
          }
      }
  }
  sys_munmap(db, LW_DENTBUF)
  sys_close(fd)
  return n
308}
309func lw_mkfix(base: *u8, name: *u8, stamp: *u8, topgen: i64, out: *u8) -> i64 {
  var o: i64 = lw_cat(out, 0, base)
  out[o] = 0 as u8
  sys_mkdir(out, MODE_0755)
  o = lw_cat(out, o, "/")
  o = lw_cat(out, o, name)
  out[o] = 0 as u8
  sys_mkdir(out, MODE_0755)
  let sp: *u8 = sys_mmap(LW_PATHCAP)
  var so: i64 = lw_cat(sp, 0, out)
  so = lw_cat(sp, so, "/stamp")
  sp[so] = 0 as u8
  if stamp[0] != (0 as u8) {
      let fd: i64 = sys_openat_wr(sp, MODE_0644)
      if fd >= 0 {
          var sl: i64 = 0
          while stamp[sl] != (0 as u8) { sl = sl + 1 }
          sys_write(fd, stamp, sl)
          sys_close(fd)
      }
  }
  sys_munmap(sp, LW_PATHCAP)
  var k: i64 = 2
  while k <= topgen {
      let gp: *u8 = sys_mmap(LW_PATHCAP)
      var go: i64 = lw_cat(gp, 0, out)
      go = lw_cat(gp, go, "/g")
      go = lw_catn(gp, go, k)
      gp[go] = 0 as u8
      sys_mkdir(gp, MODE_0755)
      sys_munmap(gp, LW_PATHCAP)
      k = k + 1
  }
  return 0
343}
344func main(argc: i64, argv: *i64) -> i64 {
  gv_head("nx_lease_wedge_gate -- a lease whose next takeover cannot mkdir its generation is BUSY FOREVER")
  let ctr: *i64 = gv_ctr()
  let fx: *u8 = sys_mmap(LW_PATHCAP)
  let gen: *i64 = sys_mmap(LW_BOX) as *i64
  let counts: *i64 = sys_mmap(LW_SMALL) as *i64
  let probe: *u8 = sys_mmap(LW_PATHCAP)
351
  // SETUP CLEAR, BEFORE ANY FIXTURE IS PLANTED (2026-09-12). It CANNOT live inside lw_mkfix: the census
  // below runs after only FOUR of the seven fixtures are planted, so remedy/fresh/plain would still be
  // holding the PREVIOUS run's state when it counts -- measured 7 where the tooth expects 4, and healthy
  // 4 where it expects 1. Repeat while a pass still removes something: deleting during a getdents walk
  // can skip entries, and the loop terminates because the root is finite and every non-zero pass shrinks
  // it. ASSERT THE CLEAR RATHER THAN ASSUMING IT -- it is the precondition of four teeth below.
  var cleared: i64 = 1
  while cleared > 0 { cleared = lw_clearroot("/tmp/nx_lease_wedge_gate") }
  gv_check_eq("setup-cleared-the-fixture-root-so-no-run-inherits-its-predecessor", lw_rootcount("/tmp/nx_lease_wedge_gate"), 0, ctr)
361
  // FIXTURE 1: the EXACT shape found live on 2026-09-04 -- stamp generation 26, g27 present.
  // The fixture-reached-the-condition tooth fires BEFORE any outcome tooth: a fixture the defect
  // cannot fail is not a test.
  lw_mkfix("/tmp/nx_lease_wedge_gate", "wedged.lock", "released\tpid25751\t1788453609\t0\t26\n", 27, fx)
  gv_check_eq("fixture-wedged-stamp-parsed-as-26", lw_stamp_gen(fx), 26, ctr)
  var po: i64 = lw_cat(probe, 0, fx)
  po = lw_cat(probe, po, "/g27")
  probe[po] = 0 as u8
  gv_check("fixture-reached-the-condition-g27-exists", lw_exists(probe), ctr)
  gv_check_eq("wedged-lease-classified-WEDGED", lw_classify(fx, gen), LW_WEDGED, ctr)
  gv_check_eq("wedged-lease-reports-its-generation", gen[0], 26, ctr)
373
  // FIXTURE 2: the SAME shape one generation on -- stamp 27, g27 present, g28 absent. That is
  // precisely the repair applied to production, so this GREEN is the repair own regression test.
  lw_mkfix("/tmp/nx_lease_wedge_gate", "healthy.lock", "released\tpid25751\t1788453609\t0\t27\n", 27, fx)
  var po2: i64 = lw_cat(probe, 0, fx)
  po2 = lw_cat(probe, po2, "/g28")
  probe[po2] = 0 as u8
  gv_check("fixture-reached-the-condition-g28-absent", 1 - lw_exists(probe), ctr)
  gv_check_eq("healthy-lease-classified-HEALTHY", lw_classify(fx, gen), LW_HEALTHY, ctr)
  gv_check_eq("healthy-lease-reports-its-generation", gen[0], 27, ctr)
383
  // NEG-CONTROL: a stampless directory is the crash-mid-acquire window. It must be UNREADABLE, NOT
  // healthy: an instrument that cannot see must ABSTAIN, never ACQUIT.
  lw_mkfix("/tmp/nx_lease_wedge_gate", "stampless.lock", "", 3, fx)
  gv_check_eq("neg-control-stampless-abstains-UNREADABLE", lw_classify(fx, gen), LW_UNREADABLE, ctr)
  gv_check_eq("neg-control-unreadable-reports-gen-minus-1", gen[0], 0 - 1, ctr)
389
  // NEG-CONTROL: a truncated stamp carrying only four fields has NO generation. It must abstain
  // rather than default to 0 -- a defaulted generation would probe g1 and read HEALTHY on a wedge.
  lw_mkfix("/tmp/nx_lease_wedge_gate", "short.lock", "released\tpid1\t1788453609\t0\n", 9, fx)
  gv_check_eq("neg-control-4-field-stamp-abstains", lw_classify(fx, gen), LW_UNREADABLE, ctr)
394
  // FIXTURE CENSUS: prove the walk partitions. 4 fixtures = 1 wedged + 1 healthy + 2 unreadable, and
  // the partition MUST SUM -- an unexplained residual is a leak, an explained one is a decision.
  lw_census("/tmp/nx_lease_wedge_gate", counts, 0)
  gv_check_eq("census-saw-all-4-fixture-leases", counts[3], 4, ctr)
  gv_check_eq("census-wedged-count", counts[1], 1, ctr)
  gv_check_eq("census-healthy-count", counts[0], 1, ctr)
  gv_check_eq("census-unreadable-count", counts[2], 2, ctr)
  gv_check_eq("census-partition-SUMS", counts[0] + counts[1] + counts[2], counts[3], ctr)
403
  // THE REMEDY (2026-09-06, after the second wedge in two days): a takeover over a released stamp whose next
  // generation gate already exists reclaims that gate IFF it is older than the orphan age -- an orphan of a dead
  // takeover -- and refuses it when it is fresh (a live claim in flight). Planted here, never on the live root.
  lw_mkfix("/tmp/nx_lease_wedge_gate", "remedy.lock", "released\tpid1\t1\t0\t26\n", 27, fx)
  gv_check_eq("remedy-fixture-reached-the-condition-WEDGED (stamp 26, g27 present)", lw_classify(fx, gen), LW_WEDGED, ctr)
  let rem1: i64 = ls_claim_x(fx, "pidremedy", 900, 27, 27, 0)
  gv_check_eq("remedy-aged-orphan-gate-is-reclaimed-and-the-takeover-WINS (orphan age 0: any age qualifies)", rem1, 1, ctr)
  gv_check_eq("remedy-stamp-advanced-to-the-reclaimed-generation (27)", lw_stamp_gen(fx), 27, ctr)
  gv_check_eq("remedy-lease-reads-HEALTHY-afterwards (g28 absent)", lw_classify(fx, gen), LW_HEALTHY, ctr)
  lw_mkfix("/tmp/nx_lease_wedge_gate", "fresh.lock", "released\tpid1\t1\t0\t26\n", 27, fx)
  let rem2: i64 = ls_claim_x(fx, "pidremedy", 900, 27, 27, 3600)
  gv_check_eq("neg-control-a-FRESH-gate-is-a-live-claim-in-flight-and-the-takeover-is-LOST (orphan age 3600 s)", rem2, 0, ctr)
  gv_check_eq("neg-control-fresh-gate-left-in-place-and-stamp-untouched (still 26)", lw_stamp_gen(fx), 26, ctr)
  lw_mkfix("/tmp/nx_lease_wedge_gate", "plain.lock", "released\tpid1\t1\t0\t27\n", 27, fx)
  let rem3: i64 = ls_claim_x(fx, "pidremedy", 900, 28, 28, 3600)
  gv_check_eq("neg-control-a-HEALTHY-lease-takes-over-normally (no gate to reclaim, orphan age irrelevant)", rem3, 1, ctr)
  gv_check_eq("neg-control-healthy-takeover-installs-28", lw_stamp_gen(fx), 28, ctr)
  gv_check_eq("remedy-floor-is-max(ttl, 30 s): ttl 900 -> 900, ttl 0 -> 30", ls_orphan_age_s(900) * 1000 + ls_orphan_age_s(0), 900030, ctr)
422
  // LIVE CENSUS. This is the alarm: it would have been RED for the whole 18-hour outage.
  gv_puts("\n-- LIVE LEASE CENSUS (knowledge/lease) --\n")
  let live: *i64 = sys_mmap(LW_SMALL) as *i64
  let rc: i64 = lw_census(LW_ROOT, live, 1)
  gv_values_head()
  gv_kv("live_leases_seen", live[3])
  gv_kv("live_healthy", live[0])
  gv_kv("live_wedged", live[1])
  gv_kv("live_unreadable", live[2])
  gv_kv("census_rc", rc)
  gv_kv("fixture_wedged", counts[1])
  gv_kv("fixture_healthy", counts[0])
  gv_kv("fixture_unreadable", counts[2])
  // gv_need, not gv_check: if the lease root cannot be read this axis is UNOBSERVABLE and must SKIP
  // rather than pass. A gate that acquits because it could not look is worse than no gate.
  gv_need("live-lease-root-readable", 1 - lw_pos(0 - rc), ctr)
  gv_check("live-no-wedged-lease", 1 - lw_pos(live[1]), ctr)
  return gv_verdict("nx_lease_wedge_gate", ctr, "the wedge test IS the failing call: stat the g<stamp_gen+1> that the next takeover will mkdir. Fixtures are built under /tmp at runtime and the live census NEVER writes.")
441}
nx_lease_wedge_gate.nx source

`nx_lease_wedge_gate.nx` source
