nx_magicratchet.nx source

1// nx_magicratchet.nx -- F881 MAGIC-NUMBER RATCHET (the enforcement the operator demanded 2026-07-21: catch 2// me at submission, not by re-sweeping). A build must NOT INCREASE an organ's inline-magic-number count vs 3// its stored baseline. First build self-baselines (grandfathers existing violations); a build that ADDS a 4// magic number is REFUSED. Non-breaking (existing organs build). 5// 6// ⚠⚠DO NOT RESTATE THE WIRING STATE IN THIS COMMENT. ASK THE INSTRUMENT: 7// nx_shelltool grep nx_magicratchet buildroot/runtime nx -> nx_wiredclaim nx_magicratchet <out> 8// This header has now been WRONG IN BOTH DIRECTIONS. It first claimed "unbypassable (wired into 9// /api/build)" when nothing called it (sev-8 1785530277). That was corrected to "NOT CURRENTLY REACHED 10// FROM /api/build ... nx_wiredclaim call_sites=0" -- and then the wiring LANDED THE SAME DAY 11// (2026-08-15: md_exec_magicratchet in nx_mgmt_data, called from nx_mgmt_api:1502) and the correction 12// itself went stale, now understating the organ instead of overstating it. 13// MEASURED 2026-08-16: nx_wiredclaim -> WIRED call_sites=3. A reader trusting the stale line was one 14// step from re-wiring an already-wired guard, or from editing the estate's BUILD RUNNER to do it. 15// ★★A COMMENT THAT MIRRORS A MEASURABLE STATE IS A CACHE WITH NO INVALIDATION -- IT DRIFTS IN WHICHEVER 16// DIRECTION THE CODE MOVED LAST, AND IT IS BELIEVED BECAUSE IT IS SPECIFIC. Name the instrument, not the 17// answer; the instrument is never stale. 18// fail-OPEN on any count/read uncertainty (a false refusal would be worse than a miss). Counting is DELEGATED 19// to `nx_law_warden countfile` -- ONE canonical L001 counter, no divergent reimplementation. Rule-11 CLEAN 20// itself (named consts, no inline magic). license_tier: ORIGINAL No hw writes (Rule 26). 21import "nx_syscalls.nx" 22import "nx_estr.nx" 23import "nx_tool_run.nx" 24// THE SCANNER, IN-PROCESS AND NOT FORKED (2026-08-25). This organ needs a second number -- what the 25// threshold HIDES -- and there were two ways to get it: fork `nx_magic` and parse its JSON, or call the 26// scanner directly. Forking would have put a SECOND ruler behind one law and added a process to every 27// build in the estate. Importing it means the floor number printed on a refusal and the floor number 28// nx_magic prints are produced by the same code, so they cannot drift. 29import "nx_magic_lib.nx" 30 31const MR_CAPBUF: i64 = 4096 32const MR_SMALLBUF: i64 = 64 33const MR_ARGVN: i64 = 64 34const MR_BASEDIR: *u8 = "knowledge/status/magicbase/" // the per-organ baselines: <organ>.cnt literals, <organ>.ph placeholder-named consts 35const MR_PH_SFX: *u8 = ".ph" 36// ★★★THE MAGIC-NUMBER RATCHET WAS CARRYING ITS OWN PRIVATE COPIES OF THE TWO FILE MODES. Both were 37// NAMED, so this organ passed the very rule it enforces -- and that is the point: rule-11 compliance is 38// satisfied by a name, while the DUPLICATE-RULER defect is about there being TWO OF THEM. Measured 39// 2026-08-14: 1,148 sites carry a literal 420 and 569 carry 0x1ed, plus at least eleven private named 40// copies of 0644 scattered across organs -- this was the eleventh, sitting inside the enforcement. 41// ★A GUARD THAT KEEPS A PRIVATE COPY OF THE THING IT POLICES IS STILL A DUPLICATE, AND ITS NAME IS WHAT 42// HIDES THAT FROM ITS OWN RULE. 43const MR_MODE: i64 = MODE_0644 44const MR_DIRMODE: i64 = MODE_0755 45const MR_REFUSE: i64 = 3 46const MR_FEEDBUF: i64 = 8192 47const MR_MAPCAP: i64 = 1600 // bounded embed of nx_magic map output (keeps the refusal under the mgmt read cap) 48 49// parse the integer following "magic" in a {"magic":N} blob. -1 if absent (=> caller fails open). 50// "sites":<n> from a nx_magic map JSON, same anchored discipline as mr_parse_magic; -1 = absent. 51func mr_parse_sites(buf: *u8, n: i64) -> i64 { 52 var pos: i64 = 0 - 1 53 var i: i64 = 0 54 while i + 8 <= n { 55 if buf[i] == (34 as u8) { if buf[i+1] == (115 as u8) { if buf[i+2] == (105 as u8) { if buf[i+3] == (116 as u8) { if buf[i+4] == (101 as u8) { if buf[i+5] == (115 as u8) { if buf[i+6] == (34 as u8) { if buf[i+7] == (58 as u8) { 56 if pos < 0 { pos = i } 57 } } } } } } } } 58 i = i + 1 59 } 60 if pos < 0 { return 0 - 1 } 61 var j: i64 = pos + 8 62 var v: i64 = 0 63 var any: i64 = 0 64 while j < n { let c: i64 = buf[j] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; j = j + 1 } else { j = n } } else { j = n } } 65 if any == 0 { return 0 - 1 } 66 return v 67} 68func mr_parse_magic(buf: *u8, n: i64) -> i64 { 69 var pos: i64 = 0 - 1 70 // ANCHOR ON THE FIELD, NOT A WORD (2026-08-14). This matched the bare bytes `magic` ANYWHERE in 71 // the buffer, and tr_run_capture MERGES stdout+stderr -- so any diagnostic containing the word 72 // "magic" emitted before the JSON would hijack the parse and hand /api/build a number taken from 73 // PROSE. The estate has already paid for this exact class twice: an unanchored verdict match read 74 // gate SOURCE echoed in output, and a greedy match took a field name out of an explanatory 75 // sentence. Anchor on the whole field token `"magic":` -- 8 bytes, quoted and colon-terminated, 76 // which prose does not produce by accident. Failure direction is unchanged and safe: no match 77 // still returns -1, which the caller treats as ALLOW-UNCOUNTED (fail-OPEN, never a false refusal). 78 var i: i64 = 0 79 while i + 8 <= n { 80 if buf[i] == (34 as u8) { if buf[i+1] == (109 as u8) { if buf[i+2] == (97 as u8) { if buf[i+3] == (103 as u8) { if buf[i+4] == (105 as u8) { if buf[i+5] == (99 as u8) { if buf[i+6] == (34 as u8) { if buf[i+7] == (58 as u8) { 81 if pos < 0 { pos = i } 82 } } } } } } } } 83 i = i + 1 84 } 85 if pos < 0 { return 0 - 1 } 86 var j: i64 = pos + 8 87 // SIGN FIRST -- the scanner below skips EVERY non-digit until it meets the first digit, so a leading 88 // '-' was swallowed as noise and {"magic":-1} parsed as 1. That is not a rounding error, it is the 89 // inversion of a control: -1 is nx_law_warden's UNMEASURED signal, and reading it as a COUNT OF 1 90 // means `if count < 0` -- the fail-open branch that exists precisely to prevent a false refusal -- 91 // CAN NEVER RUN. The comment above even promises "no match still returns -1, which the caller treats 92 // as ALLOW-UNCOUNTED"; that promise held for NO MATCH and silently failed for a MEASURED -1. 93 // MEASURED 2026-08-15: countfile on an absent source returns {"magic":-1}; this function returned 1. 94 // Every organ whose source is not under _hdl_build/ (this organ builds that path unconditionally) was 95 // therefore banking a baseline of 1 from a file it never read -- arming a false REFUSE on its next 96 // honest build. That is the wall-at-a-shared-chokepoint failure the L009 enforcement was withdrawn 97 // for, sitting armed in a guard nobody had wired yet. 98 // A SIGN-LOSING PARSER TURNS "I COULD NOT MEASURE" INTO "I MEASURED ONE". 99 var neg: i64 = 0 100 var k: i64 = j 101 var look: i64 = 1 102 while look == 1 { 103 if k >= n { look = 0 } else { 104 let c0: i64 = buf[k] as i64 105 if c0 == 32 { k = k + 1 } else { 106 if c0 == 45 { neg = 1 } 107 look = 0 108 } 109 } 110 } 111 var started: i64 = 0 112 var v: i64 = 0 113 var go: i64 = 1 114 while go == 1 { 115 if j >= n { go = 0 } else { 116 let c: i64 = buf[j] as i64 117 if c >= 48 { if c <= 57 { started = 1; v = v * 10 + (c - 48); j = j + 1 } else { if started == 1 { go = 0 } else { j = j + 1 } } } 118 else { if started == 1 { go = 0 } else { j = j + 1 } } 119 } 120 } 121 if started == 0 { return 0 - 1 } 122 if neg == 1 { return 0 - v } 123 return v 124} 125 126// CARRY THE BAR, DO NOT DROP IT. nx_law_warden countfile answers {"magic":0,"threshold":1024} -- it 127// STATES its bar honestly -- and this organ parsed `magic` and threw `threshold` away, so /api/build saw 128// a bare ALLOW. MEASURED 2026-08-17: nx_artifactdrift reports magic=0/baseline=0/ALLOW here while 129// `nx_magic map <file> 2` finds 49 sites / 13 distinct in the same file. 130// ★★★★★★AN ENVELOPE MEASURED, PRINTED, AND THEN DROPPED AT THE NEXT HOP IS AN ENVELOPE THAT WAS 131// NEVER PUBLISHED: by the time the number reaches the decision, the thing that makes it interpretable is 132// gone, and a thresholded zero reads as clean. This is the estate's "never filter out an envelope" law 133// happening ACROSS A CALL CHAIN rather than inside one read. 134// STRICTLY ADDITIVE: the verdict arithmetic is untouched, so no build that passed before can now refuse. 135// ⚠mr_parse_magic above is DELIBERATELY NOT REFACTORED, though it spells `"magic":` as the character 136// codes 34,109,97,103,105,99,34,58 -- the same unreadable-literal class fixed elsewhere today. It is the 137// proven parser on the refusal path of every build in the estate; making it prettier is not worth the 138// blast radius today. Named here so the next reader knows it is seen, not missed. 139func mr_parse_thr(buf: *u8, n: i64) -> i64 { 140 let key: *u8 = "\"threshold\":" as *u8 141 var klen: i64 = 0 142 while key[klen] != (0 as u8) { klen = klen + 1 } 143 var i: i64 = 0 144 var pos: i64 = 0 - 1 145 while i + klen <= n { 146 var m: i64 = 1 147 var k: i64 = 0 148 while k < klen { if buf[i+k] != key[k] { m = 0; k = klen } else { k = k + 1 } } 149 if m == 1 { if pos < 0 { pos = i + klen } } 150 i = i + 1 151 } 152 if pos < 0 { return 0 - 1 } 153 var j: i64 = pos 154 var started: i64 = 0 155 var v: i64 = 0 156 var go: i64 = 1 157 while go == 1 { 158 if j >= n { go = 0 } else { 159 let c: i64 = buf[j] as i64 160 if c >= 48 { if c <= 57 { started = 1; v = v * 10 + (c - 48); j = j + 1 } else { if started == 1 { go = 0 } else { j = j + 1 } } } 161 else { if started == 1 { go = 0 } else { j = j + 1 } } 162 } 163 } 164 if started == 0 { return 0 - 1 } 165 return v 166} 167 168// read a non-negative int from a file; -1 if unreadable/empty. 169func mr_read_int(path: *u8) -> i64 { 170 let fd: i64 = sys_openat_rd(path) 171 if fd < 0 { return 0 - 1 } 172 let b: *u8 = sys_mmap(MR_SMALLBUF) 173 let r: i64 = sys_read(fd, b, MR_SMALLBUF - 1) 174 sys_close(fd) 175 if r <= 0 { return 0 - 1 } 176 var v: i64 = 0 177 var started: i64 = 0 178 var i: i64 = 0 179 while i < r { let c: i64 = b[i] as i64; if c >= 48 { if c <= 57 { started = 1; v = v * 10 + (c - 48) } } i = i + 1 } 180 if started == 0 { return 0 - 1 } 181 return v 182} 183 184// write an int + newline to path (atomic enough for a single-writer baseline). 0 ok. 185func mr_write_int(path: *u8, v: i64) -> i64 { 186 let b: *u8 = sys_mmap(MR_SMALLBUF) 187 var o: i64 = es_catn(b, 0, v) 188 b[o] = 10 as u8 189 o = o + 1 190 let fd: i64 = sys_openat_wr(path, MR_MODE) 191 if fd < 0 { return 0 - 1 } 192 sys_write(fd, b, o) 193 sys_close(fd) 194 return 0 195} 196 197// ---- THE FLOOR VIEW: PUBLISH WHAT THE BAR HIDES, BESIDE THE VERDICT (2026-08-25) ---------------- 198// MEASURED, and this is the whole reason the block exists: `nx_magicratchet check nx_uvunwrap_lib` 199// answered ALLOW magic:0 baseline:0 threshold:1024 while that same file has 19 sites / 1 distinct at 200// floor 2. Both numbers are correct. The verdict was unreadable because only one of them was printed. 201// ★A DETECTOR WHOSE THRESHOLD SITS ABOVE EVERY REAL INSTANCE IS A PERMANENT GREEN WEARING AN 202// ENFORCER'S NAME -- and the fix is NOT to move the bar. 203// 204// WHY THE BAR IS NOT MOVED, ON EVIDENCE AND NOT PREFERENCE. The threshold is LW_MAGIC_THR inside 205// nx_law_warden, whose own comment says changing it "re-baselines every organ at once". The refusal 206// below fires when `count > base`, and knowledge/status/magicbase/ currently holds 911 baseline files 207// all written against 1024 -- so re-denominating the count would arm a refusal on the next honest 208// build of every organ whose floor count exceeds its stored baseline, which for a baseline of 0 is 209// nearly all of them. And the floor population is structural, not policy: of nx_uvunwrap_lib's 19 210// floor sites, floor_distinct is 1 -- they are ALL the literal `2`. Hoisting those to UV_MAGIC_2 is 211// noise. A floor-2 ENFORCEMENT bar is the permanently-red detector everyone learns to ignore. 212// So: floor_* is measured on every call, printed on every verdict, and GATES NOTHING. 213const MR_I64: i64 = 8 214const MR_FV_SITES: i64 = 0 215const MR_FV_DISTINCT: i64 = 1 216const MR_FV_HEX: i64 = 2 217const MR_FV_OVERSIZE: i64 = 3 218const MR_FV_TRUNC: i64 = 4 219const MR_FV_READ_TRUNC: i64 = 5 220const MR_FV_THR_HEX: i64 = 6 221const MR_FV_N: i64 = 7 222const MR_FV_MEASURED: i64 = 1 223const MR_FV_UNMEASURED: i64 = 0 224 225// Fill fv with the floor measurement. Returns MEASURED / UNMEASURED -- never a fabricated zero, because 226// "I could not read the source" and "the source is clean" are the two things a rule-11 report must never 227// spell the same way. 228func mr_floor_view(src: *u8, thr: i64, fv: *i64) -> i64 { 229 var z: i64 = 0 230 while z < MR_FV_N { fv[z] = 0 - 1; z = z + 1 } 231 let q: *u8 = sys_mmap(MG_CAP) 232 let n: i64 = mg_read(src, q, MG_CAP - 1) 233 if n <= 0 { return MR_FV_UNMEASURED } 234 let ab: i64 = MG_MAXSITES * MR_I64 235 let a_line: *i64 = sys_mmap(ab) as *i64 236 let a_col: *i64 = sys_mmap(ab) as *i64 237 let a_len: *i64 = sys_mmap(ab) as *i64 238 let a_val: *i64 = sys_mmap(ab) as *i64 239 let a_ls: *i64 = sys_mmap(ab) as *i64 240 let a_le: *i64 = sys_mmap(ab) as *i64 241 let a_base: *i64 = sys_mmap(ab) as *i64 242 let st: *i64 = sys_mmap(MG_STAT_N * MR_I64) as *i64 243 let sites: i64 = mg_scan(q, n, MG_FLOOR, a_line, a_col, a_len, a_val, a_ls, a_le, a_base, st) 244 let dv: *i64 = sys_mmap(MG_MAXVALS * MR_I64) as *i64 245 fv[MR_FV_SITES] = sites 246 fv[MR_FV_DISTINCT] = mg_distinct(a_val, sites, dv, MG_MAXVALS) 247 fv[MR_FV_HEX] = st[MG_STAT_HEX] 248 fv[MR_FV_OVERSIZE] = st[MG_STAT_HEX_OVERSIZE] 249 fv[MR_FV_TRUNC] = 0 250 if sites >= MG_MAXSITES { fv[MR_FV_TRUNC] = 1 } 251 fv[MR_FV_READ_TRUNC] = 0 252 if n >= MG_CAP - 1 { fv[MR_FV_READ_TRUNC] = 1 } 253 // HOW MUCH OF THE *ENFORCED* COUNT IS STRUCTURALLY INVISIBLE TO IT. The count comes from 254 // nx_law_warden countfile, whose lw_line_lits reads the leading `0` of `0x1ed` and stops at the 255 // `x`, so every hex literal contributes the value 0 and is never counted. Re-scanning at the SAME 256 // threshold in both bases says exactly how many literals the enforced number cannot see. This is 257 // REPORTING, not enforcement: the count is untouched, so no build that passed can now refuse. 258 fv[MR_FV_THR_HEX] = 0 - 1 259 if thr > 0 { 260 let t2: *i64 = sys_mmap(MG_STAT_N * MR_I64) as *i64 261 mg_scan(q, n, thr, a_line, a_col, a_len, a_val, a_ls, a_le, a_base, t2) 262 fv[MR_FV_THR_HEX] = t2[MG_STAT_HEX] 263 } 264 return MR_FV_MEASURED 265} 266 267// ONE emitter, used by BOTH verdicts. A fix wired into one branch and not its sibling is half a fix, 268// and this organ has already paid that price once (the threshold carry landed in ALLOW's sibling first). 269func mr_emit_floor(rb: *u8, ro: i64, ok: i64, fv: *i64) -> i64 { 270 var o: i64 = ro 271 o = es_cat(rb, o, ",\"floor\":" as *u8) 272 o = es_catn(rb, o, MG_FLOOR) 273 if ok == MR_FV_MEASURED { 274 o = es_cat(rb, o, ",\"floor_sites\":" as *u8) 275 o = es_catn(rb, o, fv[MR_FV_SITES]) 276 o = es_cat(rb, o, ",\"floor_distinct\":" as *u8) 277 o = es_catn(rb, o, fv[MR_FV_DISTINCT]) 278 o = es_cat(rb, o, ",\"floor_hex_sites\":" as *u8) 279 o = es_catn(rb, o, fv[MR_FV_HEX]) 280 o = es_cat(rb, o, ",\"floor_hex_oversize\":" as *u8) 281 o = es_catn(rb, o, fv[MR_FV_OVERSIZE]) 282 o = es_cat(rb, o, ",\"floor_truncated\":" as *u8) 283 o = es_catn(rb, o, fv[MR_FV_TRUNC]) 284 o = es_cat(rb, o, ",\"source_read_truncated\":" as *u8) 285 o = es_catn(rb, o, fv[MR_FV_READ_TRUNC]) 286 o = es_cat(rb, o, ",\"count_hex_blind\":" as *u8) 287 o = es_catn(rb, o, fv[MR_FV_THR_HEX]) 288 } else { 289 o = es_cat(rb, o, ",\"floor_view\":\"UNMEASURED-source-unreadable\"" as *u8) 290 } 291 o = es_cat(rb, o, ",\"bar_note\":\"magic counts ONLY literals at or above threshold and comes from nx_law_warden countfile, which is DECIMAL-ONLY -- so magic:0 means 'none at or above that bar, in decimal', NEVER 'no magic numbers'. floor_* re-measures the same file at floor 2 in BOTH bases and is REPORTED, NOT ENFORCED: it gates nothing. count_hex_blind is how many hex literals sit at or above threshold and are therefore invisible to the enforced count.\"" as *u8) 292 return o 293} 294 295func main(argc: i64, argv: *i64) -> i64 { 296 // usage: nx_magicratchet check <organ-name> (or just <organ-name>) 297 if argc < 2 { es_puts("usage: nx_magicratchet check <organ-name>\n" as *u8); sys_exit(2); return 2 } 298 var name: *u8 = argv[1] as *u8 299 if argc >= 3 { name = argv[2] as *u8 } 300 301 // RESOLVE THE SOURCE THE WAY THE BUILDER DOES, OR COUNT A FILE THAT IS NOT THE ONE BEING COMPILED. 302 // This built buildroot/runtime/_hdl_build/<name>.nx UNCONDITIONALLY, so it was structurally blind to 303 // every organ that lives in buildroot/runtime/ -- half the tree. Measured 2026-08-15: nx_sweepgate 304 // and nx_compile_x86 both resolved to paths that do not exist, and before the sign fix above that 305 // returned a fabricated count of 1 rather than UNMEASURED. 306 // A GUARD THAT COVERS ONE DIRECTORY WHILE REPORTING SUCCESS IS THE PARTIAL-AS-COMPLETE DEFECT ITS 307 // OWN L011 LAW NAMES -- and here it would have been worse than blind, because the miscount armed a 308 // false REFUSE against organs it had never read. 309 // ORDER MATTERS AND IS NOT ARBITRARY: the builder probes runtime/_hdl_build/ FIRST and then runtime/, 310 // so this probes in exactly that order. Reversing it would count the OTHER copy of a dual-copied 311 // organ -- a wrong-subject measurement wearing a correct-looking number. 312 // If NEITHER resolves, src is left as the runtime/ candidate and countfile returns -1, which the 313 // fail-open branch below turns into ALLOW-UNCOUNTED. Unresolvable is never a refusal. 314 let src: *u8 = sys_mmap(512) 315 var so: i64 = es_cat(src, 0, "buildroot/runtime/_hdl_build/" as *u8) 316 so = es_cat(src, so, name) 317 so = es_cat(src, so, ".nx" as *u8) 318 src[so] = 0 as u8 319 let sprobe: i64 = sys_openat_rd(src) 320 if sprobe < 0 { 321 so = es_cat(src, 0, "buildroot/runtime/" as *u8) 322 so = es_cat(src, so, name) 323 so = es_cat(src, so, ".nx" as *u8) 324 src[so] = 0 as u8 325 } else { sys_close(sprobe) } 326 327 // count via the ONE canonical counter (nx_law_warden countfile) 328 let warden: *u8 = "./nx_law_warden.elf" as *u8 329 let av: *i64 = sys_mmap(8 * MR_ARGVN) as *i64 330 av[0] = warden as i64 331 av[1] = "countfile" as *u8 as i64 332 av[2] = src as i64 333 av[3] = 0 334 let out: *u8 = sys_mmap(MR_CAPBUF) 335 let olen: *i64 = sys_mmap(16) as *i64 336 tr_run_capture(warden, av, out, MR_CAPBUF - 1, olen) 337 let count: i64 = mr_parse_magic(out, olen[0]) 338 let thr: i64 = mr_parse_thr(out, olen[0]) 339 340 // Measured on EVERY call and printed on EVERY verdict below. Computed HERE rather than inside 341 // either branch on purpose: a number derived in one arm and not the other is exactly how two 342 // verdicts of one organ drift apart. 343 let fv: *i64 = sys_mmap(MR_FV_N * MR_I64) as *i64 344 let fvok: i64 = mr_floor_view(src, thr, fv) 345 346 // FAIL-OPEN: if we could not count, allow the build (never a false refusal on a counting failure) 347 if count < 0 { 348 es_puts("{\"tool\":\"nx_magicratchet\",\"organ\":\"" as *u8) 349 es_puts(name) 350 es_puts("\",\"verdict\":\"ALLOW-UNCOUNTED\"}\n" as *u8) 351 sys_exit(0) 352 return 0 353 } 354 355 // baseline path 356 sys_mkdir("knowledge/status/magicbase\x00" as *u8, MR_DIRMODE) 357 let bp: *u8 = sys_mmap(512) 358 var bo: i64 = es_cat(bp, 0, "knowledge/status/magicbase/" as *u8) 359 bo = es_cat(bp, bo, name) 360 bo = es_cat(bp, bo, ".cnt" as *u8) 361 bp[bo] = 0 as u8 362 363 let base: i64 = mr_read_int(bp) 364 365 // REFUSE if a baseline exists and the count INCREASED 366 if base >= 0 { 367 if count > base { 368 // CLEAR ACTIONABLE FEEDBACK (operator 2026-07-21: a refusal must tell the AI+human exactly what 369 // and how, not throw a weird error). Fork `nx_magic map <src>` to list the exact offending literals 370 // (line/col/value/proposed-const) and name the ONE-COMMAND auto-fix. 371 let mav: *i64 = sys_mmap(8 * MR_ARGVN) as *i64 372 mav[0] = "./nx_magic.elf" as *u8 as i64 373 mav[1] = "map" as *u8 as i64 374 mav[2] = src as i64 375 mav[3] = 0 376 let mout: *u8 = sys_mmap(MR_FEEDBUF) 377 let molen: *i64 = sys_mmap(16) as *i64 378 tr_run_capture("./nx_magic.elf" as *u8, mav, mout, MR_FEEDBUF - 1, molen) 379 let rb: *u8 = sys_mmap(MR_FEEDBUF) 380 var ro: i64 = es_cat(rb, 0, "{\"tool\":\"nx_magicratchet\",\"organ\":\"" as *u8) 381 ro = es_cat(rb, ro, name) 382 ro = es_cat(rb, ro, "\",\"verdict\":\"REFUSE\",\"magic\":" as *u8) 383 ro = es_catn(rb, ro, count) 384 ro = es_cat(rb, ro, ",\"baseline\":" as *u8) 385 ro = es_catn(rb, ro, base) 386 ro = es_cat(rb, ro, ",\"threshold\":" as *u8) 387 ro = es_catn(rb, ro, thr) 388 ro = es_cat(rb, ro, ",\"why\":\"this build ADDS " as *u8) 389 ro = es_catn(rb, ro, count - base) 390 ro = es_cat(rb, ro, " inline magic number(s) (rule 11); the ratchet only lets the count go DOWN\",\"fix\":\"DERIVE each number from the resource it describes. A literal hoisted into a named const is a RENAME and is not a fix: a person still typed the number, and a build that adds a placeholder-named const is refused the same way. Every offender row below carries its KIND, and derivations says where a number of that kind comes from. Only a UNIT (a conversion or a platform fact) is answered by a constant, named once for the unit. Source: " as *u8) 391 ro = es_cat(rb, ro, src) 392 ro = es_cat(rb, ro, "\"" as *u8) 393 // COUNTER-VS-WORKLIST DISAGREEMENT MUST BE SAID OUT LOUD (2026-08-18). The count comes from 394 // nx_law_warden countfile; the worklist from nx_magic map, whose envelope DELIBERATELY skips 395 // the named-index table write (s[S_X] = 10000 -- fitted table data, a drain there moves a 396 // tuner's output away from its tuner). The warden counts that shape. So a refusal can carry 397 // magic=1 beside rows=[] -- an enforcer that says no and cannot say where, which the operator 398 // named as the unactionable-count defect. When map lists FEWER sites than the count, name the 399 // gap and the class, and tell the reader how to find it (bisect the file with countfile -- 400 // proven in ~12 halvings on nx_wasm_craft_gate). The count is untouched: no build that refused 401 // now passes; the refusal simply stops being mute. 402 let msites: i64 = mr_parse_sites(mout, molen[0]) 403 if msites >= 0 { if msites < count { 404 ro = es_cat(rb, ro, ",\"worklist_gap\":\"count=" as *u8) 405 ro = es_catn(rb, ro, count) 406 ro = es_cat(rb, ro, " but map lists " as *u8) 407 ro = es_catn(rb, ro, msites) 408 ro = es_cat(rb, ro, " site(s): the difference is a class map skips and countfile counts (named-index table write 'a[NAME] = literal', or a base outside map's decimal envelope). Locate it by bisecting the file with 'nx_law_warden countfile <prefix>', then DERIVE it as fix says: a rename is not a fix.\"" as *u8) 409 } } 410 // THE REVERSE GAP, WHICH NAMES A BLIND SPOT IN THIS ORGAN'S OWN ENFORCED COUNT (2026-08-25). 411 // Until today nx_magic was decimal-only as well, so map could only ever list FEWER sites than 412 // countfile and only that direction was handled. Now map reads 0x literals and countfile still 413 // does not, so the opposite disagreement is possible for the first time -- and when it happens 414 // the COUNT is the number that is wrong, not the worklist. Say which, rather than leaving the 415 // next reader to rediscover it from a refusal that lists more than it claims to have counted. 416 if msites >= 0 { if msites > count { 417 ro = es_cat(rb, ro, ",\"count_understated\":\"map lists " as *u8) 418 ro = es_catn(rb, ro, msites) 419 ro = es_cat(rb, ro, " site(s) but the enforced count is " as *u8) 420 ro = es_catn(rb, ro, count) 421 ro = es_cat(rb, ro, ": nx_law_warden countfile is DECIMAL-ONLY -- lw_line_lits reads the leading 0 of a 0x literal and stops at the x, so every hex constant contributes the value 0 and is never counted -- while nx_magic now reads both bases. The literals map names are real; the count is the instrument that cannot see them.\"" as *u8) 422 } } 423 ro = mr_emit_floor(rb, ro, fvok, fv) 424 ro = es_cat(rb, ro, ",\"offenders\":" as *u8) 425 var mi: i64 = 0 426 var mn: i64 = molen[0] 427 if mn > MR_MAPCAP { mn = MR_MAPCAP } 428 while mi < mn { rb[ro] = mout[mi]; ro = ro + 1; mi = mi + 1 } 429 // strip a trailing newline from the embedded map JSON so the outer object stays well-formed 430 if ro > 0 { if rb[ro - 1] == (10 as u8) { ro = ro - 1 } } 431 ro = es_cat(rb, ro, "}\n" as *u8) 432 rb[ro] = 0 as u8 433 es_puts(rb) 434 sys_exit(MR_REFUSE) 435 return MR_REFUSE 436 } 437 } 438 439 // THE SECOND AXIS (operator standing order 2026-09-17: derived numbers, not literals replaced with constants). A const named 440 // PFX_MAGIC_value is a literal wearing a name, and it is INVISIBLE to the literal count above: hoisting is how 13,375 of 441 // them entered the tree while every build passed this ratchet. Counted in process by the ONE scanner's lib over the whole 442 // source (sys_read_file sizes from the file), baselined at first sight exactly like the literal count -- existing debt is 443 // grandfathered, so no organ that builds today stops building -- and a build that ADDS one is refused. 444 let plen: *i64 = sys_mmap(MR_I64) as *i64 445 plen[0] = 0 446 let psrc: *u8 = sys_read_file(src, plen) 447 var ph: i64 = 0 - 1 448 if plen[0] > 0 { ph = mg_placeholder_count(psrc, plen[0]) } 449 let pp: *u8 = sys_mmap(mg_slen(MR_BASEDIR) + mg_slen(name) + mg_slen(MR_PH_SFX) + 1) 450 var po: i64 = es_cat(pp, 0, MR_BASEDIR) 451 po = es_cat(pp, po, name) 452 po = es_cat(pp, po, MR_PH_SFX) 453 pp[po] = 0 as u8 454 let pbase: i64 = mr_read_int(pp) 455 if ph >= 0 { if pbase >= 0 { if ph > pbase { 456 let prb: *u8 = sys_mmap(MR_FEEDBUF) 457 var pr: i64 = es_cat(prb, 0, "{\"tool\":\"nx_magicratchet\",\"organ\":\"" as *u8) 458 pr = es_cat(prb, pr, name) 459 pr = es_cat(prb, pr, "\",\"verdict\":\"REFUSE\",\"axis\":\"placeholder-consts\",\"placeholder_consts\":" as *u8) 460 pr = es_catn(prb, pr, ph) 461 pr = es_cat(prb, pr, ",\"placeholder_baseline\":" as *u8) 462 pr = es_catn(prb, pr, pbase) 463 pr = es_cat(prb, pr, ",\"why\":\"this build ADDS " as *u8) 464 pr = es_catn(prb, pr, ph - pbase) 465 pr = es_cat(prb, pr, " placeholder-named constant(s), a name of the shape PFX_MAGIC_value: that is a literal wearing a name, and a person still typed the number\",\"fix\":\"DERIVE the number from the resource it describes. Run nx_magic map on the source: each row carries its KIND, and derivations says where a number of that kind comes from. Only a UNIT (a conversion or a platform fact) is answered by a constant, named once for the unit. Source: " as *u8) 466 pr = es_cat(prb, pr, src) 467 pr = es_cat(prb, pr, "\"}\n" as *u8) 468 prb[pr] = 0 as u8 469 es_puts(prb) 470 sys_exit(MR_REFUSE) 471 return MR_REFUSE 472 } } } 473 474 // ALLOW: update the baseline (ratchet down / first-sight grandfather) 475 mr_write_int(bp, count) 476 if ph >= 0 { mr_write_int(pp, ph) } 477 // 512 was enough for a four-field verdict and is not enough for one that carries its own envelope. 478 let ab: *u8 = sys_mmap(MR_FEEDBUF) 479 var ao: i64 = es_cat(ab, 0, "{\"tool\":\"nx_magicratchet\",\"organ\":\"" as *u8) 480 ao = es_cat(ab, ao, name) 481 ao = es_cat(ab, ao, "\",\"verdict\":\"ALLOW\",\"magic\":" as *u8) 482 ao = es_catn(ab, ao, count) 483 ao = es_cat(ab, ao, ",\"baseline\":" as *u8) 484 ao = es_catn(ab, ao, base) 485 // The bar this ALLOW was measured against. Without it, `magic:0` reads as "no magic numbers" when it 486 // means "none at or above the counter's threshold". 487 ao = es_cat(ab, ao, ",\"threshold\":" as *u8) 488 ao = es_catn(ab, ao, thr) 489 // the second axis, on EVERY verdict: how many placeholder-named consts (literals wearing a name) this organ carries, 490 // and the baseline it may not rise above; -1 means the source could not be read, never zero 491 ao = es_cat(ab, ao, ",\"placeholder_consts\":" as *u8) 492 ao = es_catn(ab, ao, ph) 493 ao = es_cat(ab, ao, ",\"placeholder_baseline\":" as *u8) 494 ao = es_catn(ab, ao, pbase) 495 // ...and the bar is still only half the answer. `threshold` says WHAT WAS ENFORCED; floor_* says 496 // WHAT THAT BAR HID. Printing the first without the second is what let ALLOW magic:0 threshold:1024 497 // read as "this file has no magic numbers" on a file with 19 of them. 498 ao = mr_emit_floor(ab, ao, fvok, fv) 499 ao = es_cat(ab, ao, "}\n" as *u8) 500 ab[ao] = 0 as u8 501 es_puts(ab) 502 sys_exit(0) 503 return 0 504}