nx_models_page_emit.nx source
↩ module page · 426 lines · 20985 B
1// nx_models_page_emit.nx -- THE /world/models GALLERY IS EMITTED, NEVER HAND-WRITTEN (2026-08-23).
2// Until now the models page was a hand-maintained served file (proven: zero emitter matches over
3// 23,108 sources, corpus_complete=1) -- every new rig cost a hand edit and the numbers could drift
4// from the assets with nothing to catch it. This organ owns the page:
5// data knowledge/models_page.rows (one row per card: id|artifact|png|title|suffix|bodyhtml)
6// chrome knowledge/models_page.tmpl (head/css/lead/footer with @TOKENS@)
7// numbers MEASURED on every emit -- it forks _offc/nx_rigfloor.elf derive over the cards' own
8// artifact column (composing THE ruler, never a second measurement path) and refuses to
9// emit any card whose artifact it could not measure. The floor footer reads
10// knowledge/rigfloor.conf, the same conf the floor gate enforces -- one owner per number.
11// A new rig is ONE data row. The page cannot drift from the assets because it is re-measured.
12// FAIL-CLOSED: empty rows REFUSE (an empty gallery would silently unpublish every model);
13// a malformed row REFUSES BY LINE; a truncated derive capture REFUSES; the write is atomic
14// (tmp + renameat) so the served page is never half-written.
15// license_tier: ORIGINAL expect_exit: 0
16import "nx_syscalls.nx"
17import "nx_gatekit_lib.nx"
18// ONE DEFINITION OF HOW AN img TAG IS WRITTEN, shared with the compare generator and with the ruler
19// that CHECKS them -- so this page's emitter and nx_page_verify cannot drift into two answers.
20import "nx_imgattr_lib.nx"
21
22const MPE_EXIT_OK: i64 = 0
23const MPE_EXIT_USAGE: i64 = 2
24const MPE_EXIT_UNOBS: i64 = 3
25
26const MPE_A_NL: i64 = 10
27const MPE_A_CR: i64 = 13
28const MPE_A_HASH: i64 = 35
29const MPE_A_PIPE: i64 = 124
30const MPE_A_AT: i64 = 64
31const MPE_A_LT: i64 = 60
32const MPE_A_BANG: i64 = 33
33const MPE_A_DASH: i64 = 45
34const MPE_A_GT: i64 = 62
35const MPE_A_SP: i64 = 32
36const MPE_A_EQ: i64 = 61
37const MPE_A_D0: i64 = 48
38const MPE_A_D9: i64 = 57
39
40// A gallery is a curated page, not a directory dump: 256 cards is 32x the current 8 and past any
41// legible page. At the cap the organ REFUSES AND SAYS SO -- a capped emit must refuse, not truncate.
42const MPE_MAX_ROWS: i64 = 256
43const MPE_FIELDS: i64 = 6
44// Output buffer: 1 MiB = 128x the current 7,921 B page. Appends are BOUNDED and overflow REFUSES.
45const MPE_OUT_CAP: i64 = 1048576
46// Derive prints ~90 B per member plus a header; 256 KiB covers MPE_MAX_ROWS with 10x headroom.
47// outlen == cap is treated as TRUNCATED and refused -- a partial capture must not become numbers.
48const MPE_DERIVE_CAP: i64 = 262144
49const MPE_WORD: i64 = 8
50const MPE_PATH_CAP: i64 = 4096
51
52const MPE_DEF_ROWS: *u8 = "knowledge/models_page.rows"
53const MPE_DEF_OUT: *u8 = "sites/nishifamily/world/models.html"
54const MPE_TMPL: *u8 = "knowledge/models_page.tmpl"
55const MPE_FLOOR: *u8 = "knowledge/rigfloor.conf"
56const MPE_RIGFLOOR: *u8 = "_offc/nx_rigfloor.elf"
57const MPE_TMP_DIR: *u8 = "/tmp/nx_models_page_emit"
58const MPE_TMP_ROSTER: *u8 = "/tmp/nx_models_page_emit/roster"
59const MPE_TMP_FCONF: *u8 = "/tmp/nx_models_page_emit/floor_scratch.conf"
60
61func mpe_out(s: *u8) -> i64 { gk_say(s, gk_len(s)); return 0 }
62
63func mpe_say_kv(k: *u8, v: i64) -> i64 {
64 let b: *u8 = sys_mmap(MPE_PATH_CAP)
65 var p: i64 = gk_cat(b, 0, k)
66 p = gk_catn(b, p, v)
67 b[p] = MPE_A_NL as u8
68 gk_say(b, p + 1)
69 return 0
70}
71
72// find needle in hay[from..hn) -- returns index or -1. Plain scan; pages are KBs, not GBs.
73func mpe_find(hay: *u8, hn: i64, from: i64, ned: *u8) -> i64 {
74 let nl: i64 = gk_len(ned)
75 if nl == 0 { return 0 - 1 }
76 var i: i64 = from
77 while i + nl <= hn {
78 var k: i64 = 0
79 var hit: i64 = 1
80 while k < nl {
81 if hay[i + k] != ned[k] { hit = 0; k = nl } else { k = k + 1 }
82 }
83 if hit == 1 { return i }
84 i = i + 1
85 }
86 return 0 - 1
87}
88
89func mpe_num_at(b: *u8, n: i64, pos: i64) -> i64 {
90 var i: i64 = pos
91 var v: i64 = 0
92 var any: i64 = 0
93 while i < n {
94 let c: i64 = b[i] as i64
95 if c >= MPE_A_D0 { if c <= MPE_A_D9 { v = v * (MPE_A_D9 - MPE_A_D0 + 1) + (c - MPE_A_D0); any = 1; i = i + 1 } else { i = n } } else { i = n }
96 }
97 if any == 0 { return 0 - 1 }
98 return v
99}
100
101// conf reader: value of `key=` at line start; -1 when absent (caller REFUSES -- never a default).
102func mpe_conf_i64(buf: *u8, n: i64, key: *u8) -> i64 {
103 var i: i64 = 0
104 let kl: i64 = gk_len(key)
105 while i < n {
106 var at_line: i64 = 0
107 if i == 0 { at_line = 1 }
108 if i > 0 { if buf[i - 1] == (MPE_A_NL as u8) { at_line = 1 } }
109 if at_line == 1 {
110 var k: i64 = 0
111 var hit: i64 = 1
112 while k < kl {
113 if i + k >= n { hit = 0; k = kl } else { if buf[i + k] != key[k] { hit = 0; k = kl } else { k = k + 1 } }
114 }
115 if hit == 1 {
116 if i + kl < n {
117 if buf[i + kl] == (MPE_A_EQ as u8) { return mpe_num_at(buf, n, i + kl + 1) }
118 }
119 }
120 }
121 i = i + 1
122 }
123 return 0 - 1
124}
125
126// bounded append: refuses growth past cap by returning -1 (checked at every call site via mpe_ck)
127func mpe_ap(out: *u8, pos: i64, s: *u8, cap: i64) -> i64 {
128 if pos < 0 { return pos }
129 let l: i64 = gk_len(s)
130 if pos + l >= cap { return 0 - 1 }
131 return gk_cat(out, pos, s)
132}
133
134func mpe_apn(out: *u8, pos: i64, v: i64, cap: i64) -> i64 {
135 if pos < 0 { return pos }
136 if pos + 24 >= cap { return 0 - 1 }
137 return gk_catn(out, pos, v)
138}
139
140// the generated-artefact stamp; '<' '?' punctuation built from named bytes because the nx lexer
141// reserves some punctuation inside string literals -- and an organ-authored stamp must be AUTHORED.
142func mpe_stamp(out: *u8, pos: i64, cap: i64) -> i64 {
143 var p: i64 = pos
144 if p < 0 { return p }
145 if p + 8 >= cap { return 0 - 1 }
146 out[p] = MPE_A_LT as u8; p = p + 1
147 out[p] = MPE_A_BANG as u8; p = p + 1
148 out[p] = MPE_A_DASH as u8; p = p + 1
149 out[p] = MPE_A_DASH as u8; p = p + 1
150 out[p] = MPE_A_SP as u8; p = p + 1
151 p = mpe_ap(out, p, "NX-DERIVED: regenerated artefact, not authored memory -- emitted by nx_models_page_emit from knowledge/models_page.rows + knowledge/models_page.tmpl; verts/tris/joints re-measured from each card's artifact via nx_rigfloor derive on every emit" as *u8, cap)
152 if p < 0 { return p }
153 if p + 8 >= cap { return 0 - 1 }
154 out[p] = MPE_A_SP as u8; p = p + 1
155 out[p] = MPE_A_DASH as u8; p = p + 1
156 out[p] = MPE_A_DASH as u8; p = p + 1
157 out[p] = MPE_A_GT as u8; p = p + 1
158 out[p] = MPE_A_NL as u8; p = p + 1
159 return p
160}
161
162// token match at tmpl[i] (which holds '@'): returns token length INCLUDING both '@' or 0
163func mpe_tok(t: *u8, tn: i64, i: i64, name: *u8) -> i64 {
164 let nl: i64 = gk_len(name)
165 if i + nl + 2 > tn { return 0 }
166 var k: i64 = 0
167 while k < nl {
168 if t[i + 1 + k] != name[k] { return 0 }
169 k = k + 1
170 }
171 if t[i + 1 + nl] != (MPE_A_AT as u8) { return 0 }
172 return nl + 2
173}
174
175func mpe_usage() -> i64 {
176 mpe_out("usage: nx_models_page_emit [rows out] -- defaults knowledge/models_page.rows -> sites/nishifamily/world/models.html; tmpl knowledge/models_page.tmpl; numbers measured via _offc/nx_rigfloor.elf derive\n" as *u8)
177 return MPE_EXIT_USAGE
178}
179
180func mpe_refuse(why: *u8) -> i64 {
181 mpe_out("NX-MODELS-PAGE REFUSED " as *u8)
182 mpe_out(why)
183 mpe_out("\n" as *u8)
184 return MPE_EXIT_UNOBS
185}
186
187func main(argc: i64, argv: *i64) -> i64 {
188 var rowsp: *u8 = MPE_DEF_ROWS
189 var outp: *u8 = MPE_DEF_OUT
190 if argc == 3 {
191 rowsp = argv[1] as *u8
192 outp = argv[2] as *u8
193 }
194 if argc != 1 { if argc != 3 { return mpe_usage() } }
195
196 // ---- rows ----
197 let rp: *i64 = sys_mmap(MPE_WORD * 2) as *i64
198 let rb: *u8 = sys_read_file(rowsp, rp)
199 if (rb as i64) == 0 { return mpe_refuse("rows-unreadable (path in argv or default)" as *u8) }
200 let rn: i64 = rp[0]
201 let fld: *i64 = sys_mmap(MPE_WORD * MPE_MAX_ROWS * MPE_FIELDS) as *i64
202 var nrows: i64 = 0
203 var lineno: i64 = 0
204 var i: i64 = 0
205 var shape_bad_line: i64 = 0
206 while i < rn {
207 let e: i64 = gk_eol(rb, i, rn)
208 lineno = lineno + 1
209 var len: i64 = e - i
210 if len > 0 { if rb[i + len - 1] == (MPE_A_CR as u8) { len = len - 1 } }
211 var skip: i64 = 0
212 if len <= 0 { skip = 1 }
213 if skip == 0 { if rb[i] == (MPE_A_HASH as u8) { skip = 1 } }
214 if skip == 0 {
215 if nrows >= MPE_MAX_ROWS { return mpe_refuse("row-cap-reached (MPE_MAX_ROWS; a capped emit refuses, never truncates)" as *u8) }
216 var f: i64 = 0
217 fld[nrows * MPE_FIELDS + 0] = (rb as i64) + i
218 var c: i64 = i
219 while c < i + len {
220 if rb[c] == (MPE_A_PIPE as u8) {
221 rb[c] = 0 as u8
222 f = f + 1
223 if f < MPE_FIELDS { fld[nrows * MPE_FIELDS + f] = (rb as i64) + c + 1 }
224 }
225 c = c + 1
226 }
227 rb[i + len] = 0 as u8
228 if f != MPE_FIELDS - 1 { shape_bad_line = lineno }
229 nrows = nrows + 1
230 }
231 i = e + 1
232 }
233 if shape_bad_line != 0 {
234 mpe_say_kv("NX-MODELS-PAGE REFUSED row-shape (need id|artifact|png|title|suffix|bodyhtml) line=" as *u8, shape_bad_line)
235 return MPE_EXIT_UNOBS
236 }
237 if nrows == 0 { return mpe_refuse("empty-rows (an empty gallery would silently unpublish every model; retirement is nx_retire_path, not an empty emit)" as *u8) }
238
239 // ---- measure: ONE derive over the cards' own artifacts, composing THE ruler ----
240 gk_mkdir(MPE_TMP_DIR)
241 let rosterbuf: *u8 = sys_mmap(MPE_PATH_CAP * MPE_MAX_ROWS)
242 var rpos: i64 = 0
243 var r: i64 = 0
244 while r < nrows {
245 rpos = gk_cat(rosterbuf, rpos, fld[r * MPE_FIELDS + 1] as *u8)
246 rosterbuf[rpos] = MPE_A_NL as u8
247 rpos = rpos + 1
248 r = r + 1
249 }
250 rosterbuf[rpos] = 0 as u8
251 gk_rm(MPE_TMP_ROSTER)
252 gk_rm(MPE_TMP_FCONF)
253 if gk_write(MPE_TMP_ROSTER, rosterbuf) < 0 { return mpe_refuse("scratch-roster-unwritable (/tmp/nx_models_page_emit)" as *u8) }
254 let cap_out: *u8 = sys_mmap(MPE_DERIVE_CAP)
255 let cap_len: *i64 = sys_mmap(MPE_WORD) as *i64
256 let drc: i64 = gk_run_capture(MPE_RIGFLOOR, "derive" as *u8, MPE_TMP_ROSTER, MPE_TMP_FCONF, 0 as *u8, cap_out, MPE_DERIVE_CAP, cap_len)
257 if drc != 0 { mpe_say_kv("NX-MODELS-PAGE REFUSED rigfloor-derive-rc=" as *u8, drc); return MPE_EXIT_UNOBS }
258 let cn: i64 = cap_len[0]
259 if cn >= MPE_DERIVE_CAP { return mpe_refuse("derive-capture-truncated (raise MPE_DERIVE_CAP deliberately; a partial capture must not become numbers)" as *u8) }
260
261 let mv: *i64 = sys_mmap(MPE_WORD * MPE_MAX_ROWS) as *i64
262 let mt: *i64 = sys_mmap(MPE_WORD * MPE_MAX_ROWS) as *i64
263 let mj: *i64 = sys_mmap(MPE_WORD * MPE_MAX_ROWS) as *i64
264 let ned: *u8 = sys_mmap(MPE_PATH_CAP)
265 r = 0
266 while r < nrows {
267 var np: i64 = gk_cat(ned, 0, " - " as *u8)
268 np = gk_cat(ned, np, fld[r * MPE_FIELDS + 1] as *u8)
269 ned[np] = MPE_A_NL as u8
270 ned[np + 1] = 0 as u8
271 let blk: i64 = mpe_find(cap_out, cn, 0, ned)
272 if blk < 0 { mpe_out("NX-MODELS-PAGE REFUSED artifact-not-in-derive-output artifact=" as *u8); mpe_out(fld[r * MPE_FIELDS + 1] as *u8); mpe_out("\n" as *u8); return MPE_EXIT_UNOBS }
273 var nxt: i64 = mpe_find(cap_out, cn, blk + np, "\n - " as *u8)
274 if nxt < 0 { nxt = cn }
275 let pv: i64 = mpe_find(cap_out, nxt, blk, "verts=" as *u8)
276 if pv < 0 { return mpe_refuse("artifact-not-NXANIM01 (no verts axis in derive block; the gallery measures rigged assets only)" as *u8) }
277 mv[r] = mpe_num_at(cap_out, nxt, pv + gk_len("verts=" as *u8))
278 let pt: i64 = mpe_find(cap_out, nxt, pv, "tris=" as *u8)
279 if pt < 0 { return mpe_refuse("derive-block-missing-tris" as *u8) }
280 mt[r] = mpe_num_at(cap_out, nxt, pt + gk_len("tris=" as *u8))
281 let pj: i64 = mpe_find(cap_out, nxt, pt, "joints=" as *u8)
282 if pj < 0 { return mpe_refuse("derive-block-missing-joints" as *u8) }
283 mj[r] = mpe_num_at(cap_out, nxt, pj + gk_len("joints=" as *u8))
284 if mv[r] <= 0 { return mpe_refuse("measured-verts-nonpositive" as *u8) }
285 if mt[r] <= 0 { return mpe_refuse("measured-tris-nonpositive" as *u8) }
286 if mj[r] <= 0 { return mpe_refuse("measured-joints-nonpositive" as *u8) }
287 r = r + 1
288 }
289
290 // ---- floor conf (footer numbers have ONE owner: the same conf the floor gate enforces) ----
291 let fp: *i64 = sys_mmap(MPE_WORD * 2) as *i64
292 let fb: *u8 = sys_read_file(MPE_FLOOR, fp)
293 if (fb as i64) == 0 { return mpe_refuse("floor-conf-unreadable knowledge/rigfloor.conf" as *u8) }
294 let fn: i64 = fp[0]
295 let nread: i64 = mpe_conf_i64(fb, fn, "n_read" as *u8)
296 let vlo: i64 = mpe_conf_i64(fb, fn, "verts_min" as *u8)
297 let vhi: i64 = mpe_conf_i64(fb, fn, "verts_max" as *u8)
298 let tlo: i64 = mpe_conf_i64(fb, fn, "tris_min" as *u8)
299 let thi: i64 = mpe_conf_i64(fb, fn, "tris_max" as *u8)
300 let jlo: i64 = mpe_conf_i64(fb, fn, "joints_min" as *u8)
301 let jhi: i64 = mpe_conf_i64(fb, fn, "joints_max" as *u8)
302 if nread < 0 { return mpe_refuse("floor-conf-missing-n_read" as *u8) }
303 if vlo < 0 { return mpe_refuse("floor-conf-missing-verts-band" as *u8) }
304 if vhi < 0 { return mpe_refuse("floor-conf-missing-verts-band" as *u8) }
305 if tlo < 0 { return mpe_refuse("floor-conf-missing-tris-band" as *u8) }
306 if thi < 0 { return mpe_refuse("floor-conf-missing-tris-band" as *u8) }
307 if jlo < 0 { return mpe_refuse("floor-conf-missing-joints-band" as *u8) }
308 if jhi < 0 { return mpe_refuse("floor-conf-missing-joints-band" as *u8) }
309
310 // ---- template + emit ----
311 let tp: *i64 = sys_mmap(MPE_WORD * 2) as *i64
312 let tb: *u8 = sys_read_file(MPE_TMPL, tp)
313 if (tb as i64) == 0 { return mpe_refuse("tmpl-unreadable knowledge/models_page.tmpl" as *u8) }
314 let tn: i64 = tp[0]
315 let out: *u8 = sys_mmap(MPE_OUT_CAP)
316 var pos: i64 = 0
317 var ti: i64 = 0
318 while ti < tn {
319 var consumed: i64 = 0
320 if tb[ti] == (MPE_A_AT as u8) {
321 var tl: i64 = mpe_tok(tb, tn, ti, "STAMP" as *u8)
322 if tl > 0 { pos = mpe_stamp(out, pos, MPE_OUT_CAP); consumed = tl }
323 if consumed == 0 {
324 tl = mpe_tok(tb, tn, ti, "CARDS" as *u8)
325 if tl > 0 {
326 r = 0
327 while r < nrows {
328 // THE TAG IS BUILT BY nx_imgattr_lib, NOT CONCATENATED HERE (2026-08-26). The
329 // title is DATA, and one row's title carries an apostrophe: written raw into a
330 // single-quoted alt it ended the value at -RETARGET: DARK WITCH DRIVEN BY NISHI-
331 // and read the rest of the sentence as attribute names, so that is the whole
332 // accessible name a browser gives the card.
333 // FOUND ON THE LIVE PAGE, not by review: nx_page_verify's quote-break axis --
334 // the READER half of this same lib -- convicted it while the substring counter it
335 // replaced reported img=21 with-alt=21, every one clean.
336 let mfile: *u8 = fld[r * MPE_FIELDS + 2] as *u8
337 let mtitle: *u8 = fld[r * MPE_FIELDS + 3] as *u8
338 let msneed: i64 = ia_slen("/world/models/" as *u8) + ia_slen(mfile) + IA_SEP_AND_NUL
339 let msrc: *u8 = sys_mmap(msneed)
340 var mso: i64 = ia_cat(msrc, 0, "/world/models/" as *u8, msneed)
341 mso = ia_cat(msrc, mso, mfile, msneed)
342 msrc[mso] = 0 as u8
343 let maltcap: i64 = ia_alt_cap_for(mtitle, mfile)
344 let malt: *u8 = sys_mmap(maltcap)
345 ia_alt_derive(mtitle, mfile, malt, maltcap)
346 let mtagcap: i64 = ia_img_cap_for(msrc, malt, "" as *u8)
347 let mtag: *u8 = sys_mmap(mtagcap)
348 let mtw: i64 = ia_img_emit(mtag, 0, mtagcap, msrc, malt, "" as *u8)
349 pos = mpe_ap(out, pos, "<div class='card'>" as *u8, MPE_OUT_CAP)
350 if mtw > 0 { pos = mpe_ap(out, pos, mtag, MPE_OUT_CAP) }
351 if mtw == 0 { pos = mpe_ap(out, pos, "<p>no alt could be derived from this row, so no image is emitted: an image no reader can have described is not published here.</p>" as *u8, MPE_OUT_CAP) }
352 pos = mpe_ap(out, pos, "\n<h2>" as *u8, MPE_OUT_CAP)
353 pos = mpe_ap(out, pos, fld[r * MPE_FIELDS + 3] as *u8, MPE_OUT_CAP)
354 pos = mpe_ap(out, pos, "</h2>\n<p><b>verts " as *u8, MPE_OUT_CAP)
355 pos = mpe_apn(out, pos, mv[r], MPE_OUT_CAP)
356 pos = mpe_ap(out, pos, " · tris " as *u8, MPE_OUT_CAP)
357 pos = mpe_apn(out, pos, mt[r], MPE_OUT_CAP)
358 pos = mpe_ap(out, pos, " · joints " as *u8, MPE_OUT_CAP)
359 pos = mpe_apn(out, pos, mj[r], MPE_OUT_CAP)
360 pos = mpe_ap(out, pos, "</b> " as *u8, MPE_OUT_CAP)
361 pos = mpe_ap(out, pos, fld[r * MPE_FIELDS + 4] as *u8, MPE_OUT_CAP)
362 pos = mpe_ap(out, pos, "</p>\n" as *u8, MPE_OUT_CAP)
363 pos = mpe_ap(out, pos, fld[r * MPE_FIELDS + 5] as *u8, MPE_OUT_CAP)
364 pos = mpe_ap(out, pos, "</div>\n" as *u8, MPE_OUT_CAP)
365 r = r + 1
366 }
367 consumed = tl
368 }
369 }
370 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "NREAD" as *u8); if tl > 0 { pos = mpe_apn(out, pos, nread, MPE_OUT_CAP); consumed = tl } }
371 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "VLO" as *u8); if tl > 0 { pos = mpe_apn(out, pos, vlo, MPE_OUT_CAP); consumed = tl } }
372 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "VHI" as *u8); if tl > 0 { pos = mpe_apn(out, pos, vhi, MPE_OUT_CAP); consumed = tl } }
373 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "TLO" as *u8); if tl > 0 { pos = mpe_apn(out, pos, tlo, MPE_OUT_CAP); consumed = tl } }
374 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "THI" as *u8); if tl > 0 { pos = mpe_apn(out, pos, thi, MPE_OUT_CAP); consumed = tl } }
375 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "JLO" as *u8); if tl > 0 { pos = mpe_apn(out, pos, jlo, MPE_OUT_CAP); consumed = tl } }
376 if consumed == 0 { tl = mpe_tok(tb, tn, ti, "JHI" as *u8); if tl > 0 { pos = mpe_apn(out, pos, jhi, MPE_OUT_CAP); consumed = tl } }
377 }
378 if consumed > 0 { ti = ti + consumed } else {
379 if pos >= 0 { if pos + 1 >= MPE_OUT_CAP { pos = 0 - 1 } }
380 if pos >= 0 { out[pos] = tb[ti]; pos = pos + 1 }
381 ti = ti + 1
382 }
383 if pos < 0 { return mpe_refuse("out-cap-overflow (raise MPE_OUT_CAP deliberately)" as *u8) }
384 }
385
386 // ---- self-check BEFORE publishing: absent content must be loud, not discovered by a reader ----
387 var missing: i64 = 0
388 var firstmiss: i64 = 0 - 1
389 r = 0
390 while r < nrows {
391 if mpe_find(out, pos, 0, fld[r * MPE_FIELDS + 3] as *u8) < 0 { missing = missing + 1; if firstmiss < 0 { firstmiss = r } }
392 r = r + 1
393 }
394 if missing != 0 {
395 // THE REASON TRAVELS WITH THE COUNT: a count without a worklist is not actionable, so the
396 // refusal NAMES the first absent card (proven wanted by the M1/M2 bite mutants, 2026-08-23).
397 mpe_out("NX-MODELS-PAGE REFUSED self-check-title-missing first=" as *u8)
398 mpe_out(fld[firstmiss * MPE_FIELDS + 3] as *u8)
399 mpe_say_kv(" count=" as *u8, missing)
400 return MPE_EXIT_UNOBS
401 }
402 if mpe_find(out, pos, 0, "NX-DERIVED: regenerated artefact" as *u8) < 0 { return mpe_refuse("self-check-stamp-missing (tmpl lost its STAMP token)" as *u8) }
403
404 // ---- atomic publish ----
405 let tmp: *u8 = sys_mmap(MPE_PATH_CAP)
406 var tpn: i64 = gk_cat(tmp, 0, outp)
407 tpn = gk_cat(tmp, tpn, ".new" as *u8)
408 tmp[tpn] = 0 as u8
409 out[pos] = 0 as u8
410 if gk_write(tmp, out) < 0 { return mpe_refuse("tmp-write-failed" as *u8) }
411 if sys_renameat(tmp, outp) != 0 { return mpe_refuse("rename-failed (tmp written, out unchanged)" as *u8) }
412
413 r = 0
414 while r < nrows {
415 mpe_out("card id=" as *u8)
416 mpe_out(fld[r * MPE_FIELDS + 0] as *u8)
417 mpe_say_kv(" verts=" as *u8, mv[r])
418 r = r + 1
419 }
420 mpe_say_kv("NX-MODELS-PAGE cards=" as *u8, nrows)
421 mpe_say_kv("bytes=" as *u8, pos)
422 mpe_out("out=" as *u8)
423 mpe_out(outp)
424 mpe_out("\nNX-MODELS-PAGE verdict=EMITTED (every number re-measured from the artifact this run)\n" as *u8)
425 return MPE_EXIT_OK
426}