`nx_mf_hold.nx` source

↩ module page · 640 lines · 26830 B
1// nx_mf_hold.nx -- ADVANCE A SYNC WATERMARK EXCEPT WHERE IT WAS NEVER EARNED.
2//
3// WHY IT EXISTS (measured 2026-08-16, treecanon flow-back lane):
4//   sync_nas_ahead.ps1 ended with `if ($Apply) { Copy-Item $cur $base -Force }` -- it advanced the
5//   baseline manifest to the CURRENT NAS manifest WHOLESALE. For a REFUSE that is correct: the file
6//   was examined, declined, and durably queued in conflicts.log for conflicts.ps1 to rank. But a
7//   FETCH FAILURE `continue`d BEFORE that ledger append, so it was recorded NOWHERE -- and the
8//   watermark then advanced past a file the lane had never even looked at, marking it synced
9//   permanently and silently.
10// => A TRANSIENT FAILURE THAT IS NEITHER RETRIED NOR RECORDED IS A PERMANENT ONE.
11//
12// SCOPE CORRECTION WORTH KEEPING, because the first version of this header got it wrong: the
13// watermark answers "what changed on the NAS", NOT "what is still unreconciled". Those are different
14// questions with different readers, and conflicts.log/conflicts.ps1 already answer the second (837
15// distinct files / 1185 events, measured the same day). Holding every refusal here would re-fetch all
16// 837 on every hourly run to rebuild a worklist that already exists -- a duplicate ruler that also
17// hammers the NAS. BEFORE BUILDING A QUEUE, CHECK WHETHER THE REFUSAL LEDGER IS ALREADY ONE.
18//
19// WHAT IT DOES
20//   out = current, EXCEPT that any path named in holdlist keeps its BASELINE row -- or is OMITTED
21//   entirely when the baseline has no row for it, so it re-surfaces next run as B-ONLY rather than
22//   being silently blessed.
23//   PER-PATH, deliberately. Holding the WHOLE watermark whenever anything was held would let one
24//   stuck file pin it forever and turn every later run into a full re-fetch: one silence traded for
25//   one flood.
26//
27// SELF-TESTS ON EVERY RUN AND REFUSES TO WRITE IF ANY TOOTH FAILS. Precedent in this same lane:
28// nx_normdiff withholds its verdict when its supersede predicate regresses, so the failure mode is
29// "no adopt", never "wrong adopt". Emitting a CORRUPT baseline is strictly worse than emitting none,
30// because a corrupt watermark is indistinguishable from a converged one.
31//
32// ROW FORMAT: "<64hex> <bytes> <relpath>\n" -- what nx_treehash writes and nx_hashdiverge parses.
33// IMPRECISION ACCEPTED AND NAMED: relpath is the bytes between the second space and the newline, so
34// a relpath CONTAINING A SPACE parses short. nx_treehash never emits one. The parse is deliberately
35// the SAME SHAPE as nx_hashdiverge's rather than a cleverer one, because two parsers that disagree
36// under the same input is the duplicate-ruler defect wearing a bugfix.
37//
38// sys_openat_wr has NO O_TRUNC, so a shorter rewrite over a longer file leaves a live tail -- on a
39// BASELINE manifest that is corrupt trailing rows that read as real. There is no sys_openat_trunc
40// (proven absent over buildroot/runtime, corpus_complete=1), so: UNLINK FIRST.
41//
42// NO CAPS THAT HAVE TO BE GUESSED. Every table and buffer is DERIVED from the input it must hold:
43// the output can never exceed current+baseline bytes (each emitted row comes from exactly one of
44// them), and each hash table is sized to a power of two at MH_LOAD_NUM x its own row upper bound.
45// A guessed ceiling is a defect generator in both directions and raising it only moves the guess.
46//
47// BITE-PROVEN BOTH DIRECTIONS 2026-08-16, two mutants each killing a different tooth class:
48//   copy-current-instead-of-baseline -> 6/8, kills ONLY the anti-vacuity pair (all six count teeth
49//     still pass, which is exactly why that pair exists)
50//   hold-every-path                  -> 5/8, kills the positive control (a guard that refuses
51//     everything passes every negative test)
52//
53// DIALECT: plain-if, <=6 params, consts above use, tables via static POINTERS (a BSS static array
54// crashes the module at startup -- banked gotcha).
55// license_tier: ORIGINAL  expect_exit: 0  No hw writes (Rule 26).
56import "nx_syscalls.nx"
57
58const MH_SHA_CHARS: i64 = 64
59const MH_NUMBUF: i64 = 64
60const MH_FNV_OFF: i64 = 1469598103934665603
61const MH_FNV_PRIME: i64 = 1099511628211
62// 64 sha + space + at least one size digit + space + at least one path byte + newline.
63const MH_MIN_MF_ROW: i64 = MH_SHA_CHARS + 4
64// shortest possible holdlist line: one path byte + newline.
65const MH_MIN_HOLD_ROW: i64 = 2
66// open-addressed tables stay under 25% load, so a probe walk is short and cannot degrade to a scan.
67const MH_LOAD_NUM: i64 = 4
68const MH_MIN_SLOTS: i64 = 16
69const MH_FIXTURE_BYTES: i64 = 4096
70const MH_OK: i64 = 0
71const MH_PARTITION_FAIL: i64 = 1
72const MH_USAGE: i64 = 2
73const MH_UNREADABLE: i64 = 3
74const MH_SELFTEST_FAIL: i64 = 4
75
76static mh_bkey: *i64
77static mh_bsha: *i64
78static mh_bsz: *i64
79static mh_bslots: *i64
80static mh_hkey: *i64
81static mh_hseen: *i64
82static mh_hslots: *i64
83static mh_c: *i64
84static mh_out: *u8
85static mh_out_n: *i64
86static mh_outcap: *i64
87static mh_num: *u8
88static mh_rev: *u8
89static mh_bad: *i64
90static mh_t: *i64
91
92func mh_puts(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  sys_write(1, s, n)
  return 0
97}
98func mh_putn(v: i64) -> i64 {
  var m: i64 = v
  if m == 0 { mh_num[0] = 48 as u8; sys_write(1, mh_num, 1); return 0 }
  if m < 0 { mh_puts("-" as *u8); m = 0 - m }
  var k: i64 = 0
  while m > 0 { mh_rev[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { mh_num[i] = mh_rev[k - 1 - i]; i = i + 1 }
  sys_write(1, mh_num, k)
  return 0
108}
109func mh_slen(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  return n
113}
114func mh_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  var go: i64 = 1
  var eq: i64 = 1
  while go == 1 {
      if a[i] != b[i] { eq = 0; go = 0 } else {
          if a[i] == (0 as u8) { go = 0 } else { i = i + 1 }
      }
  }
  return eq
124}
125func mh_hash(s: *u8) -> i64 {
  var h: i64 = MH_FNV_OFF
  var i: i64 = 0
  while s[i] != (0 as u8) {
      h = h ^ (s[i] as i64)
      h = h * MH_FNV_PRIME
      i = i + 1
  }
  if h < 0 { h = 0 - h }
  return h
135}
136// smallest power of two >= v, never below MH_MIN_SLOTS. Derived sizing, so there is no ceiling to tune.
137func mh_pow2ge(v: i64) -> i64 {
  var p: i64 = MH_MIN_SLOTS
  while p < v { p = p * 2 }
  return p
141}
142
143// ---- baseline table: relpath -> (sha, size) ----
144func mh_bput(rel: *u8, sha: *u8, sz: *u8) -> i64 {
  let mask: i64 = mh_bslots[0] - 1
  var s: i64 = mh_hash(rel) & mask
  var probes: i64 = 0
  var go: i64 = 1
  while go == 1 {
      // A FULL OPEN-ADDRESSED TABLE HANGS RATHER THAN TRUNCATES -- announce, never spin.
      if probes > mh_bslots[0] { mh_bad[0] = 1; return 0 }
      if mh_bkey[s] == 0 {
          mh_bkey[s] = rel as i64
          mh_bsha[s] = sha as i64
          mh_bsz[s] = sz as i64
          go = 0
      } else {
          if mh_streq(mh_bkey[s] as *u8, rel) == 1 { go = 0 } else { s = (s + 1) & mask; probes = probes + 1 }
      }
  }
  return 0
162}
163func mh_bfind(rel: *u8) -> i64 {
  let mask: i64 = mh_bslots[0] - 1
  var s: i64 = mh_hash(rel) & mask
  var probes: i64 = 0
  while probes <= mh_bslots[0] {
      if mh_bkey[s] == 0 { return 0 - 1 }
      if mh_streq(mh_bkey[s] as *u8, rel) == 1 { return s }
      s = (s + 1) & mask
      probes = probes + 1
  }
  return 0 - 1
174}
175
176// ---- hold set: relpath -> seen-in-current flag ----
177func mh_hput(rel: *u8) -> i64 {
  let mask: i64 = mh_hslots[0] - 1
  var s: i64 = mh_hash(rel) & mask
  var probes: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if probes > mh_hslots[0] { mh_bad[0] = 1; return 0 }
      if mh_hkey[s] == 0 {
          mh_hkey[s] = rel as i64
          mh_hseen[s] = 0
          mh_c[4] = mh_c[4] + 1
          go = 0
      } else {
          if mh_streq(mh_hkey[s] as *u8, rel) == 1 { go = 0 } else { s = (s + 1) & mask; probes = probes + 1 }
      }
  }
  return 0
194}
195func mh_hfind(rel: *u8) -> i64 {
  let mask: i64 = mh_hslots[0] - 1
  var s: i64 = mh_hash(rel) & mask
  var probes: i64 = 0
  while probes <= mh_hslots[0] {
      if mh_hkey[s] == 0 { return 0 - 1 }
      if mh_streq(mh_hkey[s] as *u8, rel) == 1 { return s }
      s = (s + 1) & mask
      probes = probes + 1
  }
  return 0 - 1
206}
207
208func mh_emit_row(sha: *u8, sz: *u8, rel: *u8) -> i64 {
  var o: i64 = mh_out_n[0]
  let need: i64 = MH_SHA_CHARS + 1 + mh_slen(sz) + 1 + mh_slen(rel) + 1
  if o + need > mh_outcap[0] { mh_bad[0] = 2; return 0 }
  var i: i64 = 0
  while i < MH_SHA_CHARS { mh_out[o] = sha[i]; o = o + 1; i = i + 1 }
  mh_out[o] = 32 as u8; o = o + 1
  i = 0
  while sz[i] != (0 as u8) { mh_out[o] = sz[i]; o = o + 1; i = i + 1 }
  mh_out[o] = 32 as u8; o = o + 1
  i = 0
  while rel[i] != (0 as u8) { mh_out[o] = rel[i]; o = o + 1; i = i + 1 }
  mh_out[o] = 10 as u8; o = o + 1
  mh_out_n[0] = o
  return 0
223}
224
225// Parse a treehash manifest IN PLACE. side 0 = load into the baseline table, side 1 = stream current
226// and decide per row. Same field walk as nx_hashdiverge's hd_scan, on purpose.
227func mh_scan_mf(buf: *u8, n: i64, side: i64) -> i64 {
  var p: i64 = 0
  while p < n {
      let base: i64 = buf as i64
      let sha: *u8 = (base + p) as *u8
      if p + MH_SHA_CHARS + 2 > n { return 0 }
      buf[p + MH_SHA_CHARS] = 0 as u8
      var q: i64 = p + MH_SHA_CHARS + 1
      let szs: *u8 = (base + q) as *u8
      var gq: i64 = 1
      while gq == 1 {
          if q >= n { gq = 0 } else {
              if buf[q] == (32 as u8) { gq = 0 } else { q = q + 1 }
          }
      }
      if q >= n { return 0 }
      buf[q] = 0 as u8
      var r: i64 = q + 1
      let rel: *u8 = (base + r) as *u8
      var gr: i64 = 1
      while gr == 1 {
          if r >= n { gr = 0 } else {
              if buf[r] == (10 as u8) { gr = 0 } else { r = r + 1 }
          }
      }
      if r >= n { return 0 }
      buf[r] = 0 as u8
      if side == 0 {
          mh_c[6] = mh_c[6] + 1
          mh_bput(rel, sha, szs)
      }
      if side == 1 {
          mh_c[0] = mh_c[0] + 1
          let h: i64 = mh_hfind(rel)
          if h < 0 {
              mh_emit_row(sha, szs, rel)
              mh_c[1] = mh_c[1] + 1
          } else {
              mh_hseen[h] = 1
              let b: i64 = mh_bfind(rel)
              if b < 0 {
                  // held but the baseline never knew it: OMIT, so it returns as B-ONLY next run.
                  mh_c[3] = mh_c[3] + 1
              } else {
                  mh_emit_row(mh_bsha[b] as *u8, mh_bsz[b] as *u8, mh_bkey[b] as *u8)
                  mh_c[2] = mh_c[2] + 1
              }
          }
      }
      p = r + 1
  }
  return 0
279}
280
281// One path per line; blank lines and '#' comments ignored. Cursor and terminator are SEPARATE
282// variables -- writing the exit sentinel into the cursor erases where the line ended.
283func mh_scan_hold(buf: *u8, n: i64) -> i64 {
  var p: i64 = 0
  while p < n {
      let base: i64 = buf as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (10 as u8) { go = 0 } else { e = e + 1 }
          }
      }
      // A HOLDLIST IS EXTERNAL INPUT AND ARRIVES CRLF WHEN A WINDOWS CALLER WRITES IT. .NET's
      // WriteAllLines emits \r\n, so every key would carry a trailing CR -- and a hash lookup cannot
      // report "almost", it reports NOT FOUND. The watermark would then advance past exactly the
      // paths being held, which is the defect this organ exists to prevent, reintroduced silently.
      // MEASURED 2026-08-16 on the first real wiring: hold_rows=3 hold_not_in_current=3
      // held_omitted=0 for three paths provably present in the manifest. Only the third-state
      // counter made it visible; a two-state answer would have read as a clean no-op.
      //   * VALIDATE AT THE BOUNDARY: THE PRODUCER OF THIS FILE RUNS ON A DIFFERENT OS.
      var t: i64 = e
      if t > p {
          if buf[t - 1] == (13 as u8) { t = t - 1 }
      }
      if t < n { buf[t] = 0 as u8 }
      let line: *u8 = (base + p) as *u8
      if line[0] != (0 as u8) {
          if line[0] != (35 as u8) { mh_hput(line) }
      }
      p = e + 1
  }
  return 0
314}
315
316// A held path the current manifest does not carry is REPORTED, never silently dropped: it usually
317// means the file was deleted on the far side while a conflict about it was still open.
318func mh_sweep_hold() -> i64 {
  var s: i64 = 0
  while s < mh_hslots[0] {
      if mh_hkey[s] != 0 {
          if mh_hseen[s] == 0 { mh_c[5] = mh_c[5] + 1 }
      }
      s = s + 1
  }
  return 0
327}
328
329// Read a file and hand back a buffer that is ALWAYS newline-terminated, so the last row can never be
330// the one silently dropped by a parser that needs a trailing separator.
331func mh_slurp(path: *u8, lenout: *i64) -> *u8 {
  let l: *i64 = sys_mmap(16) as *i64
  let raw: *u8 = sys_read_file(path, l)
  if (raw as i64) == 0 { lenout[0] = 0; return 0 as *u8 }
  var n: i64 = l[0]
  let b: *u8 = sys_mmap(n + 2)
  var i: i64 = 0
  while i < n { b[i] = raw[i]; i = i + 1 }
  if n > 0 {
      if b[n - 1] != (10 as u8) { b[n] = 10 as u8; n = n + 1 }
  }
  lenout[0] = n
  return b
344}
345
346// brows/hrows are UPPER BOUNDS derived from input bytes, so the tables cannot overflow by construction.
347func mh_alloc(brows: i64, hrows: i64) -> i64 {
  mh_bslots[0] = mh_pow2ge(brows * MH_LOAD_NUM)
  mh_hslots[0] = mh_pow2ge(hrows * MH_LOAD_NUM)
  mh_bkey = sys_mmap(mh_bslots[0] * 8) as *i64
  mh_bsha = sys_mmap(mh_bslots[0] * 8) as *i64
  mh_bsz = sys_mmap(mh_bslots[0] * 8) as *i64
  mh_hkey = sys_mmap(mh_hslots[0] * 8) as *i64
  mh_hseen = sys_mmap(mh_hslots[0] * 8) as *i64
  var z: i64 = 0
  while z < 8 { mh_c[z] = 0; z = z + 1 }
  mh_out_n[0] = 0
  return 0
359}
360
361func mh_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
  return o
366}
367func mh_fill(dst: *u8, off: i64, ch: i64, cnt: i64) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while i < cnt { dst[o] = ch as u8; o = o + 1; i = i + 1 }
  return o
372}
373// A fixture row whose sha is 64 copies of ONE character: it can never collide with a real hash, and a
374// failure dump says at a glance which side the surviving row came from.
375func mh_row(dst: *u8, off: i64, shachar: i64, sz: *u8, path: *u8) -> i64 {
  var o: i64 = mh_fill(dst, off, shachar, MH_SHA_CHARS)
  dst[o] = 32 as u8; o = o + 1
  o = mh_cat(dst, o, sz)
  dst[o] = 32 as u8; o = o + 1
  o = mh_cat(dst, o, path)
  dst[o] = 10 as u8; o = o + 1
  return o
383}
384func mh_holdline(dst: *u8, off: i64, path: *u8) -> i64 {
  var o: i64 = mh_cat(dst, off, path)
  dst[o] = 10 as u8; o = o + 1
  return o
388}
389// The SAME line as a Windows caller writes it. One fixture entry uses this so the CRLF path is
390// exercised by the ordinary teeth rather than by a special case nobody runs.
391func mh_holdline_crlf(dst: *u8, off: i64, path: *u8) -> i64 {
  var o: i64 = mh_cat(dst, off, path)
  dst[o] = 13 as u8; o = o + 1
  dst[o] = 10 as u8; o = o + 1
  return o
396}
397func mh_find_sub(hay: *u8, hn: i64, needle: *u8) -> i64 {
  let nl: i64 = mh_slen(needle)
  if nl == 0 { return 0 - 1 }
  if nl > hn { return 0 - 1 }
  var i: i64 = 0
  while i <= hn - nl {
      var k: i64 = 0
      var ok: i64 = 1
      while k < nl {
          if hay[i + k] != needle[k] { ok = 0; k = nl } else { k = k + 1 }
      }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
412}
413// declared == executed by construction: both counters move on the same call, so a tooth that stops
414// running lowers the denominator too instead of quietly reading green.
415func mh_check(name: *u8, cond: i64) -> i64 {
  mh_t[1] = mh_t[1] + 1
  if cond == 1 { mh_t[0] = mh_t[0] + 1 } else {
      mh_puts("  SELFTEST FAIL: " as *u8); mh_puts(name); mh_puts("\n" as *u8)
  }
  return cond
421}
422
423// Fixtures are ASSEMBLED AT RUNTIME and never read from disk: a check that shares a fixture with a
424// production file measures the file. Buffers are rebuilt for the second scenario because mh_scan_mf
425// terminates fields IN PLACE -- re-parsing an already-parsed buffer would read a mangled manifest and
426// the tooth would be testing the mangling.
427func mh_selftest() -> i64 {
  mh_t[0] = 0
  mh_t[1] = 0
430
  let bb: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  let cb: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  let hb: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  var bn: i64 = 0
  bn = mh_row(bb, bn, 97, "100" as *u8, "alpha.nx" as *u8)
  bn = mh_row(bb, bn, 98, "200" as *u8, "beta.nx" as *u8)
  bn = mh_row(bb, bn, 99, "300" as *u8, "gamma.nx" as *u8)
  var cn: i64 = 0
  cn = mh_row(cb, cn, 97, "100" as *u8, "alpha.nx" as *u8)
  cn = mh_row(cb, cn, 122, "250" as *u8, "beta.nx" as *u8)
  cn = mh_row(cb, cn, 99, "300" as *u8, "gamma.nx" as *u8)
  cn = mh_row(cb, cn, 100, "400" as *u8, "delta.nx" as *u8)
  var hn: i64 = 0
  // beta is written CRLF ON PURPOSE: the real caller is a Windows script, so the ordinary held-path
  // teeth below must pass through the CRLF path rather than only ever seeing LF.
  hn = mh_holdline_crlf(hb, hn, "beta.nx" as *u8)
  hn = mh_holdline(hb, hn, "delta.nx" as *u8)
  hn = mh_holdline(hb, hn, "zeta.nx" as *u8)
449
  mh_alloc(8, 8)
  mh_outcap[0] = MH_FIXTURE_BYTES * 2
  mh_out = sys_mmap(mh_outcap[0])
  mh_out_n[0] = 0
  mh_scan_hold(hb, hn)
  mh_scan_mf(bb, bn, 0)
  mh_scan_mf(cb, cn, 1)
  mh_sweep_hold()
458
  mh_check("partition-reconciles current == advanced + held + omitted" as *u8,
           (mh_c[0] == mh_c[1] + mh_c[2] + mh_c[3]) as i64)
  mh_check("advanced-exactly-the-two-unheld-rows" as *u8, (mh_c[1] == 2) as i64)
  mh_check("held-exactly-one" as *u8, (mh_c[2] == 1) as i64)
463
  // ANTI-VACUITY PAIR. An implementation that simply copies `current` passes every count tooth
  // above. Only these two refute it, and they must BOTH hold at once: the baseline row present AND
  // the current row absent. Either alone is satisfied by a trivial wrong answer.
  let ex: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  var en: i64 = mh_row(ex, 0, 98, "200" as *u8, "beta.nx" as *u8)
  ex[en] = 0 as u8
  mh_check("held-row-carries-the-BASELINE-bytes" as *u8, (mh_find_sub(mh_out, mh_out_n[0], ex) >= 0) as i64)
  let ex2: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  var e2: i64 = mh_row(ex2, 0, 122, "250" as *u8, "beta.nx" as *u8)
  ex2[e2] = 0 as u8
  mh_check("held-row-does-NOT-carry-the-CURRENT-bytes" as *u8, (mh_find_sub(mh_out, mh_out_n[0], ex2) < 0) as i64)
475
  let ex3: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  var e3: i64 = mh_cat(ex3, 0, "delta.nx" as *u8)
  ex3[e3] = 0 as u8
  mh_check("held-without-a-baseline-row-is-OMITTED-so-it-resurfaces" as *u8,
           ((mh_c[3] == 1) && (mh_find_sub(mh_out, mh_out_n[0], ex3) < 0)) as i64)
  mh_check("neg-control-held-path-absent-from-current-is-REPORTED-not-dropped" as *u8, (mh_c[5] == 1) as i64)
  // All three holdlist lines PARSED, and exactly one (zeta) failed to match the manifest. If the
  // CRLF line were mis-keyed, beta would miss too and this would read 2 -- which is precisely how
  // the live defect presented before it was fixed.
  mh_check("crlf-holdline-is-not-silently-missed" as *u8,
           ((mh_c[4] == 3) && (mh_c[5] == 1)) as i64)
487
  // POSITIVE CONTROL. A guard that holds EVERYTHING passes every negative tooth above while being
  // completely broken, so one scenario must prove the organ still ADVANCES.
  let bb2: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  let cb2: *u8 = sys_mmap(MH_FIXTURE_BYTES)
  var bn2: i64 = 0
  bn2 = mh_row(bb2, bn2, 97, "100" as *u8, "alpha.nx" as *u8)
  bn2 = mh_row(bb2, bn2, 98, "200" as *u8, "beta.nx" as *u8)
  var cn2: i64 = 0
  cn2 = mh_row(cb2, cn2, 97, "100" as *u8, "alpha.nx" as *u8)
  cn2 = mh_row(cb2, cn2, 122, "250" as *u8, "beta.nx" as *u8)
  mh_alloc(8, 8)
  mh_out_n[0] = 0
  mh_scan_hold(hb, 0)
  mh_scan_mf(bb2, bn2, 0)
  mh_scan_mf(cb2, cn2, 1)
  mh_check("positive-control-empty-holdlist-advances-every-row" as *u8,
           ((mh_c[1] == 2) && ((mh_c[2] == 0) && (mh_c[3] == 0))) as i64)
505
  mh_puts("# MFHOLD selftest " as *u8); mh_putn(mh_t[0])
  mh_puts("/" as *u8); mh_putn(mh_t[1]); mh_puts("\n" as *u8)
  if mh_t[0] == mh_t[1] { return 1 }
  return 0
510}
511
512func main(argc: i64, argv: *i64) -> i64 {
  mh_num = sys_mmap(MH_NUMBUF)
  mh_rev = sys_mmap(MH_NUMBUF)
  mh_c = sys_mmap(128) as *i64
  mh_t = sys_mmap(32) as *i64
  mh_bad = sys_mmap(16) as *i64
  mh_out_n = sys_mmap(16) as *i64
  mh_outcap = sys_mmap(16) as *i64
  mh_bslots = sys_mmap(16) as *i64
  mh_hslots = sys_mmap(16) as *i64
  mh_bad[0] = 0
523
  if argc < 5 {
      mh_puts("usage: nx_mf_hold <baseline.mf> <current.mf> <holdlist> <out.mf>\n" as *u8)
      mh_puts("  Emits <current> EXCEPT that every path in <holdlist> keeps its <baseline> row,\n" as *u8)
      mh_puts("  or is OMITTED when the baseline has none so it resurfaces as B-ONLY next run.\n" as *u8)
      mh_puts("  For a sync watermark: advance only where the reconcile was actually EARNED, so a\n" as *u8)
      mh_puts("  file the run never examined is offered again instead of being blessed as synced.\n" as *u8)
      mh_puts("  Manifests are nx_treehash rows. Self-tests every run and refuses to write on fail.\n" as *u8)
      sys_exit(MH_USAGE)
      return MH_USAGE
  }
534
  // THE SELFTEST RUNS BEFORE ANYTHING IS READ. A merge organ that cannot prove its own merge must
  // not be handed a real watermark. Its tables are small and short-lived; the process exits below.
  if mh_selftest() == 0 {
      mh_puts("# MFHOLD RED -- selftest failed, REFUSING to write. The old baseline is untouched.\n" as *u8)
      sys_exit(MH_SELFTEST_FAIL)
      return MH_SELFTEST_FAIL
  }
542
  let lb: *i64 = sys_mmap(16) as *i64
  let bbuf: *u8 = mh_slurp(argv[1] as *u8, lb)
  if (bbuf as i64) == 0 {
      mh_puts("# MFHOLD RED -- cannot read baseline manifest\n" as *u8)
      sys_exit(MH_UNREADABLE); return MH_UNREADABLE
  }
  let lc: *i64 = sys_mmap(16) as *i64
  let cbuf: *u8 = mh_slurp(argv[2] as *u8, lc)
  if (cbuf as i64) == 0 {
      mh_puts("# MFHOLD RED -- cannot read current manifest\n" as *u8)
      sys_exit(MH_UNREADABLE); return MH_UNREADABLE
  }
  let lh: *i64 = sys_mmap(16) as *i64
  let hbuf: *u8 = mh_slurp(argv[3] as *u8, lh)
  if (hbuf as i64) == 0 {
      // AN ABSENT HOLDLIST IS NOT AN EMPTY ONE. Treating "could not read" as "nothing to hold"
      // would advance the whole watermark on exactly the failure this organ exists to prevent.
      mh_puts("# MFHOLD RED -- cannot read holdlist. An unreadable holdlist is not an empty one;\n" as *u8)
      mh_puts("#   pass a zero-byte file to mean 'nothing was held'. Refusing to write.\n" as *u8)
      sys_exit(MH_UNREADABLE); return MH_UNREADABLE
  }
564
  // Upper bounds from bytes: every row costs at least its minimum, so rows can never exceed this.
  let bub: i64 = (lb[0] / MH_MIN_MF_ROW) + 1
  let hub: i64 = (lh[0] / MH_MIN_HOLD_ROW) + 1
  mh_alloc(bub, hub)
  // Each emitted row is copied from current or from baseline, so their sum is a true ceiling.
  mh_outcap[0] = lb[0] + lc[0] + MH_NUMBUF
  mh_out = sys_mmap(mh_outcap[0])
  mh_out_n[0] = 0
573
  mh_scan_hold(hbuf, lh[0])
  mh_scan_mf(bbuf, lb[0], 0)
  mh_scan_mf(cbuf, lc[0], 1)
  mh_sweep_hold()
578
  let emitted: i64 = mh_c[1] + mh_c[2]
  let sums: i64 = mh_c[1] + mh_c[2] + mh_c[3]
581
  mh_puts("=== nx_mf_hold -- advance the watermark only where it was earned ===\n" as *u8)
  mh_puts("# MFHOLD baseline_rows=" as *u8); mh_putn(mh_c[6])
  mh_puts(" current_rows=" as *u8); mh_putn(mh_c[0])
  mh_puts(" hold_rows=" as *u8); mh_putn(mh_c[4])
  mh_puts(" advanced=" as *u8); mh_putn(mh_c[1])
  mh_puts(" held=" as *u8); mh_putn(mh_c[2])
  mh_puts(" held_omitted=" as *u8); mh_putn(mh_c[3])
  mh_puts(" hold_not_in_current=" as *u8); mh_putn(mh_c[5])
  mh_puts(" emitted=" as *u8); mh_putn(emitted)
  mh_puts("\n" as *u8)
592
  if mh_bad[0] == 1 {
      mh_puts("# MFHOLD RED -- a hash table filled. Refusing to write a partial watermark.\n" as *u8)
      sys_exit(MH_PARTITION_FAIL); return MH_PARTITION_FAIL
  }
  if mh_bad[0] == 2 {
      mh_puts("# MFHOLD RED -- output ceiling reached, which should be unreachable because it is\n" as *u8)
      mh_puts("#   derived from baseline+current bytes. Refusing to write a truncated watermark.\n" as *u8)
      sys_exit(MH_PARTITION_FAIL); return MH_PARTITION_FAIL
  }
  // A PARTITION IS A CLAIM: CHECK THE PARTS SUM, AND PRINT THE CHECK.
  if sums != mh_c[0] {
      mh_puts("# MFHOLD RED -- partition does NOT reconcile: advanced+held+omitted=" as *u8)
      mh_putn(sums)
      mh_puts(" but current_rows=" as *u8); mh_putn(mh_c[0])
      mh_puts(". Refusing to write.\n" as *u8)
      sys_exit(MH_PARTITION_FAIL); return MH_PARTITION_FAIL
  }
  mh_puts("# MFHOLD partition RECONCILES: advanced+held+omitted == current_rows == " as *u8)
  mh_putn(mh_c[0]); mh_puts("\n" as *u8)
612
  // sys_openat_wr carries no O_TRUNC: without this unlink a shorter watermark leaves the tail of the
  // previous one live, and those trailing rows read as real manifest entries.
  sys_unlinkat(argv[4] as *u8)
  let fd: i64 = sys_openat_wr(argv[4] as *u8, MODE_0644)
  if fd < 0 {
      mh_puts("# MFHOLD RED -- cannot open outfile\n" as *u8)
      sys_exit(MH_UNREADABLE); return MH_UNREADABLE
  }
  let wrote: i64 = sys_write(fd, mh_out, mh_out_n[0])
  sys_close(fd)
  // ANNOUNCE THE PUBLISH so "did it land" is one number, never a hunt.
  mh_puts("# MFHOLD wrote=" as *u8); mh_putn(wrote)
  mh_puts(" of=" as *u8); mh_putn(mh_out_n[0])
  mh_puts(" path=" as *u8); mh_puts(argv[4] as *u8); mh_puts("\n" as *u8)
  if wrote != mh_out_n[0] {
      mh_puts("# MFHOLD RED -- short write; the watermark on disk is NOT the one measured above.\n" as *u8)
      sys_exit(MH_PARTITION_FAIL); return MH_PARTITION_FAIL
  }
  if mh_c[2] + mh_c[3] == 0 {
      mh_puts("# verdict=ADVANCED-IN-FULL (nothing was held: every path reconciled)\n" as *u8)
  }
  if mh_c[2] + mh_c[3] != 0 {
      mh_puts("# verdict=ADVANCED-WITH-HOLDS -- the held paths stay divergent on purpose and WILL be\n" as *u8)
      mh_puts("#   offered again next run. That is the point: an unexamined file must not read as a sync.\n" as *u8)
  }
  sys_exit(MH_OK)
  return MH_OK
640}
nx_mf_hold.nx source

`nx_mf_hold.nx` source
