`nx_normdiff.nx` source

↩ module page · 1551 lines · 72638 B
1// nx_normdiff.nx -- IS THIS DIFFERENCE MADE OF CODE, OR OF COSMETICS? The escalation ruler.
2//
3// WHY IT EXISTS. nx_srcdiff answers "is a direction merge safe?" on the RAW line multiset, and that
4// strictness is correct as a GUARD -- it is what caught the escaped nx_media_extract mutant that a
5// symbol-set ruler waved through. But as a CENSUS it overstates the fork: it reports BIDIRECTIONAL
6// for two files that differ only because a NAS cron lifted `4096` into `FOO_MAGIC_4096`, or because
7// one side carries a trailing `// why` comment the other lacks. Measured on the standing residual:
8// the raw ruler could decide 3.6% of 3,073 forked files; normalising first decides 8.6%. The other
9// 91% is REAL CODE -- surplus shapes censused as control-flow 1408, bindings 1042, func-decls 278 --
10// which is the finding that matters most: NO FURTHER NORMALISER WILL CRACK IT, so stop building them.
11//   => ★A RULER TUNED TO BE A SAFE GUARD IS THE WRONG RULER FOR A CENSUS. Report BOTH verdicts and
12//     let the caller pick: the guard decides whether to ACT, the census decides what to LOOK AT.
13//
14// WHAT IT NORMALISES, and nothing else:
15//   1. a trailing `//` comment -- ONLY when outside a string literal (backslash-escape aware, so
16//      `"http://x"` and `"a\"b // c"` are not mistaken for comments)
17//   2. runs of whitespace -> one space; leading/trailing stripped
18//   3. a const identifier -> ITS DECLARED VALUE TEXT, read out of the file that declares it.
19//      !!THE OBVIOUS SHORTCUT IS UNSOUND, measured: reading the digits out of `FOO_MAGIC_4096` breaks
20//      on nx_lz4_header's `const LZ4_MAGIC_0: i64 = 0x04` and nx_nxtask_store's `NXT_MAGIC_0 = 0x4E`.
21//      There the trailing digit is a FIELD INDEX ("magic byte 0"), and the value is an unrelated hex
22//      byte. A name-digit un-lift equates 0 with 4 and calls two different files identical.
23//      ⇒ ★A NAMING CONVENTION IS A COMMENT: IT IS EVIDENCE ABOUT INTENT, NEVER ABOUT VALUE.
24//      The value is substituted as its DECLARED TEXT, verbatim and unparsed. That is deliberate: a
25//      parser that "helpfully" normalised 0x04 to 4 would need to be right about every literal form
26//      in the language, and being wrong about one is how the line above got mis-measured TWICE (a
27//      decimal regex silently matched the `0` out of `0x04` and reported the const as declared zero).
28//      ⇒ ★DON'T PARSE WHAT YOU ONLY NEED TO COMPARE.
29//
30// WHERE THE TABLE COMES FROM, and why there is no tree walk here: NishiLang requires consts above
31// use, and the NAS magicsweep lifts a literal into a const IN THE SAME FILE. Measured across both
32// trees: 3,728 of 3,730 lifted-const uses (99.946%) are declared in the file that uses them -- the
33// only two exceptions tree-wide are nx_archive_server's K_MAGIC_8080 and nx_web_crawl_step_gate's
34// WC_MAGIC_2048. So each side's table is built FROM THAT SIDE'S OWN SOURCE, which is also the
35// semantically correct scope: a const means what ITS file declares it to mean. Two files that
36// declare the same name differently therefore normalise DIFFERENTLY and stay visible as surplus,
37// which a single shared table would have silently equated.
38//   ⇒ ★A SYMBOL'S MEANING IS SCOPED; A LOOKUP TABLE THAT FORGETS THE SCOPE INVENTS AGREEMENT.
39//   [consttab] remains as an optional FALLBACK for the cross-file residual; file-local always wins.
40//
41// !!NORMALISING IS LOSSY BY DESIGN, SO IT MUST NEVER SILENTLY DECIDE A MERGE. Adopting A on a
42// COSMETIC-ONLY verdict is code-safe but can still DROP B'S COMMENTS -- the "why" that Rule 23 exists
43// to protect. So this organ also counts, and prints, every B-only trailing comment that adopting A
44// would destroy. Measured on the 237 cosmetic-only files: only 3 such comments existed, but all 3
45// were load-bearing (a syscall-translation footnote naming its debt id, a 1<<40 ranking rationale,
46// and a "EXISTS but unreadable -> destructive, REFUSE" safety note).
47//   => ★A LOSSY COMPARISON MUST REPORT WHAT IT DISCARDED, OR IT IS LAUNDERING THE LOSS.
48//
49// THE SAFETY PROPERTY, and it is tested not asserted: a single-operator mutation MUST still read as
50// BIDIRECTIONAL. `if hit == 0` and `if hit != 0` normalise to DIFFERENT strings, so the escaped
51// mutant that motivated nx_srcdiff survives this ruler too. A RULER MUST BE TESTED AGAINST THE WORST
52// DEFECT YOU ALREADY FOUND -- see nx_normdiff_gate.
53//
54// DIALECT: plain-if, <=6 params, consts above use. Tables are mmap'd through static POINTERS --
55// a BSS static ARRAY silently crashes the module at startup (banked gotcha).
56// license_tier: ORIGINAL  expect_exit: 0  No hw writes (Rule 26).
57import "nx_syscalls.nx"
58const ND_MAGIC_8192: i64 = 8192
59
60const ND_SLOTS: i64 = 131072        // power of two; a 1000-line file loads at <1% -- headroom is cheap
61const ND_MASK: i64 = 131071
62const ND_OUTBUF: i64 = 4194304
63const ND_NUMBUF: i64 = 64
64const ND_TOK: i64 = 512             // longest identifier we will try to resolve
65const ND_ARENA: i64 = 8388608       // fixed per-side arena for census mode; a source over this is REFUSED, never truncated
66const ND_SURP_CAP: i64 = 16384      // surplus lines tracked per side for the supersede match
67const ND_MAXIMP: i64 = 128          // direct imports followed; a .nx file today declares <20
68const ND_BCL_CAP: i64 = 65536       // B comment-sites tracked; a 1000-line file uses <2%
69const ND_SLACK: i64 = 65536         // normalise can only shrink a line, but never trust that alone
70const ND_FNV_OFF: i64 = 1469598103934665603
71const ND_FNV_PRIME: i64 = 1099511628211
72const ND_SAMPLE_CAP: i64 = 25       // stdout sample; the FULL surplus list always goes to [outfile]
73const ND_LF: i64 = 10
74const ND_CR: i64 = 13
75const ND_TAB: i64 = 9
76const ND_SP: i64 = 32
77const ND_SLASH: i64 = 47
78const ND_QUOTE: i64 = 34
79const ND_BSLASH: i64 = 92
80const ND_USCORE: i64 = 95
81
82// raw multisets (the GUARD ruler -- byte-for-byte lines, nx_srcdiff semantics)
83static nd_rka: *i64
84static nd_rca: *i64
85static nd_rkb: *i64
86static nd_rcb: *i64
87// normalised multisets (the CENSUS ruler)
88static nd_nka: *i64
89static nd_nca: *i64
90static nd_nkb: *i64
91static nd_ncb: *i64
92// A's comments, keyed by normalised line -> used to find B-only comments we would destroy
93static nd_ack: *i64
94static nd_acv: *i64
95// const name -> declared value TEXT, ONE TABLE PER SIDE (a const is scoped to its file)
96static nd_ctka: *i64
97static nd_ctva: *i64
98static nd_ctkb: *i64
99static nd_ctvb: *i64
100static nd_carena: *u8      // arena holding copied const names/values
101static nd_carena_n: *i64
102
103static nd_n: *i64      // [0]lA [1]lB [2]rsA [3]rsB [4]crA [5]crB [6]shown [7]nsA [8]nsB [9]lostcmt [10]consts
104static nd_out: *u8
105static nd_out_n: *i64
106static nd_num: *u8
107static nd_rev: *u8
108static nd_tok: *u8
109static nd_na: *u8      // normalised-line arena, side A
110static nd_na_n: *i64
111static nd_nb: *u8
112static nd_nb_n: *i64
113static nd_ca_buf: *u8  // comment arena, SHARED by both sides
114static nd_ca_n: *i64
115static nd_bcl: *i64    // B comment sites: [norm-line ptr, comment ptr] pairs
116static nd_bcl_n: *i64
117// A's COMPILATION UNIT = A's own lines + the lines of every module A directly imports.
118static nd_uka: *i64
119static nd_uca: *i64
120static nd_ua: *u8
121static nd_ua_n: *i64
122static nd_imp: *i64    // resolved import path strings
123static nd_imp_n: *i64
124// surplus lines, collected so each B line can be matched against the A lines
125static nd_asl: *i64
126static nd_asl_n: *i64
127static nd_bsl: *i64
128static nd_bsl_n: *i64
129// GENERATION-STAMPED SLOTS. Census mode compares thousands of pairs in ONE process, so every hash
130// table must be emptied between pairs. Zeroing them is 12 MB of memset per pair (33 GB over the
131// residual); instead each slot carries the generation it was written in and a slot counts as EMPTY
132// unless its stamp equals the current generation. Clearing all twelve tables is then `nd_gen + 1`.
133//   => *AN O(1) RESET IS WHAT MAKES A BATCH MODE POSSIBLE AT ALL -- WITHOUT IT THE ORGAN IS FORCED
134//      BACK OUT INTO A SHELL LOOP, ONE PROCESS PER PAIR, AND THE SHELL STARTS DOING THE WORK AGAIN.
135static nd_g_rka: *i64
136static nd_g_rkb: *i64
137static nd_g_nka: *i64
138static nd_g_nkb: *i64
139static nd_g_uka: *i64
140static nd_g_ack: *i64
141static nd_g_ctka: *i64
142static nd_g_ctkb: *i64
143static nd_gen: *i64
144static nd_ipath: *u8
145static nd_used: *u8
146static nd_la: *i64
147static nd_lb: *i64
148
149func nd_puts(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  sys_write(1, s, n)
  return 0
154}
155func nd_putn(v: i64) -> i64 {
  var m: i64 = v
  if m == 0 { nd_num[0] = 48 as u8; sys_write(1, nd_num, 1); return 0 }
  if m < 0 { nd_puts("-" as *u8); m = 0 - m }
  var k: i64 = 0
  while m > 0 { nd_rev[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { nd_num[i] = nd_rev[k - 1 - i]; i = i + 1 }
  sys_write(1, nd_num, k)
  return 0
165}
166func nd_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  var go: i64 = 1
  var eq: i64 = 1
  while go == 1 {
      if a[i] != b[i] { eq = 0; go = 0 } else {
          if a[i] == (0 as u8) { go = 0 } else { i = i + 1 }
      }
  }
  return eq
176}
177func nd_hash(s: *u8) -> i64 {
  var h: i64 = ND_FNV_OFF
  var i: i64 = 0
  while s[i] != (0 as u8) {
      h = h ^ (s[i] as i64)
      h = h * ND_FNV_PRIME
      i = i + 1
  }
  if h < 0 { h = 0 - h }
  return h
187}
188func nd_add(keys: *i64, counts: *i64, gen: *i64, line: *u8) -> i64 {
  var s: i64 = nd_hash(line) & ND_MASK
  var go: i64 = 1
  while go == 1 {
      if gen[s] != nd_gen[0] { gen[s] = nd_gen[0]; keys[s] = 0 }
      if keys[s] == 0 {
          keys[s] = line as i64
          counts[s] = 1
          go = 0
      } else {
          if nd_streq(keys[s] as *u8, line) == 1 { counts[s] = counts[s] + 1; go = 0 } else { s = (s + 1) & ND_MASK }
      }
  }
  return 0
202}
203func nd_get(keys: *i64, counts: *i64, gen: *i64, line: *u8) -> i64 {
  var s: i64 = nd_hash(line) & ND_MASK
  var go: i64 = 1
  while go == 1 {
      if gen[s] != nd_gen[0] { return 0 }
      if keys[s] == 0 { return 0 }
      if nd_streq(keys[s] as *u8, line) == 1 { return counts[s] }
      s = (s + 1) & ND_MASK
  }
  return 0
213}
214// key -> string value map (const table, and A's comment map). First writer wins: a duplicate
215// declaration is reported by the caller's census, not silently overwritten here.
216func nd_put_kv(keys: *i64, vals: *i64, gen: *i64, k: *u8, v: *u8) -> i64 {
  var s: i64 = nd_hash(k) & ND_MASK
  var go: i64 = 1
  while go == 1 {
      if gen[s] != nd_gen[0] { gen[s] = nd_gen[0]; keys[s] = 0 }
      if keys[s] == 0 { keys[s] = k as i64; vals[s] = v as i64; go = 0 } else {
          if nd_streq(keys[s] as *u8, k) == 1 { go = 0 } else { s = (s + 1) & ND_MASK }
      }
  }
  return 0
226}
227func nd_get_kv(keys: *i64, vals: *i64, gen: *i64, k: *u8) -> i64 {
  var s: i64 = nd_hash(k) & ND_MASK
  var go: i64 = 1
  while go == 1 {
      if gen[s] != nd_gen[0] { return 0 }
      if keys[s] == 0 { return 0 }
      if nd_streq(keys[s] as *u8, k) == 1 { return vals[s] }
      s = (s + 1) & ND_MASK
  }
  return 0
237}
238func nd_is_id_char(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 48 { if c <= 57 { return 1 } }
  if c == ND_USCORE { return 1 }
  return 0
244}
245func nd_is_id_start(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c == ND_USCORE { return 1 }
  return 0
250}
251// Index of the `//` that starts a trailing comment, or -1. STRING-AWARE and ESCAPE-AWARE: without
252// this, every `"http://host"` in the tree reads as a comment and the two sides "agree" on a truncated
253// line. Returns the cut index; the caller uses it for BOTH the body and the comment text.
254func nd_comment_at(src: *u8) -> i64 {
  var i: i64 = 0
  var ins: i64 = 0
  var esc: i64 = 0
  var go: i64 = 1
  var cut: i64 = 0 - 1
  while go == 1 {
      let c: i64 = src[i] as i64
      if c == 0 { go = 0 } else {
          if esc == 1 { esc = 0 } else {
              if c == ND_BSLASH { esc = 1 } else {
                  if c == ND_QUOTE {
                      if ins == 0 { ins = 1 } else { ins = 0 }
                  } else {
                      if ins == 0 {
                          if c == ND_SLASH {
                              if (src[i + 1] as i64) == ND_SLASH { cut = i; go = 0 }
                          }
                      }
                  }
              }
          }
          if go == 1 { i = i + 1 }
      }
  }
  return cut
280}
281func nd_len(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  return n
285}
286// Normalise src into dst (NUL-terminated). Returns bytes written.
287// One pass: drop the comment, collapse whitespace, and resolve any identifier the const table knows
288// to its DECLARED value. Identifiers absent from the table are copied verbatim.
289func nd_norm(src: *u8, dst: *u8, ctk: *i64, ctv: *i64, ctg: *i64) -> i64 {
  let cut: i64 = nd_comment_at(src)
  var end: i64 = cut
  if end < 0 { end = nd_len(src) }
  var o: i64 = 0
  var p: i64 = 0
  var pend: i64 = 0
  while p < end {
      let c: i64 = src[p] as i64
      var ws: i64 = 0
      if c == ND_SP { ws = 1 }
      if c == ND_TAB { ws = 1 }
      if c == ND_CR { ws = 1 }
      if ws == 1 { pend = 1; p = p + 1 } else {
          if pend == 1 {
              if o > 0 { dst[o] = ND_SP as u8; o = o + 1 }
              pend = 0
          }
          if nd_is_id_start(c) == 1 {
              var q: i64 = p
              var gi: i64 = 1
              while gi == 1 {
                  if q >= end { gi = 0 } else {
                      if nd_is_id_char(src[q] as i64) == 1 { q = q + 1 } else { gi = 0 }
                  }
              }
              var tl: i64 = q - p
              if tl >= ND_TOK { tl = ND_TOK - 1 }
              var t: i64 = 0
              while t < tl { nd_tok[t] = src[p + t]; t = t + 1 }
              nd_tok[tl] = 0 as u8
              let hit: i64 = nd_get_kv(ctk, ctv, ctg, nd_tok)
              if hit == 0 {
                  t = 0
                  while t < tl { dst[o] = nd_tok[t]; o = o + 1; t = t + 1 }
              } else {
                  let vs: *u8 = hit as *u8
                  var k: i64 = 0
                  while vs[k] != (0 as u8) { dst[o] = vs[k]; o = o + 1; k = k + 1 }
              }
              p = q
          } else {
              dst[o] = src[p] as u8
              o = o + 1
              p = p + 1
          }
      }
  }
  dst[o] = 0 as u8
  return o
339}
340// Harvest `const NAME: TYPE = <literal>` out of one side's source into that side's table.
341// READ-ONLY over buf: names and values are COPIED into an arena, because nd_load later rewrites this
342// same buffer in place to NUL-terminate its lines, and a table of pointers into a buffer someone else
343// mutates is a use-after-write waiting to happen.
344//   ⇒ ★IF TWO PASSES SHARE A BUFFER AND ONE OF THEM WRITES, THE OTHER MUST OWN ITS COPY.
345// A value that does not START with a digit or '-' is SKIPPED, not chased: `const A = B` is an alias,
346// and resolving it needs transitive lookup this organ deliberately does not do. Skipping leaves the
347// identifier in place, which can only ever cost a missed match -- never a false one.
348func nd_scan_consts(buf: *u8, n: i64, ctk: *i64, ctv: *i64, ctg: *i64) -> i64 {
  var p: i64 = 0
  var found: i64 = 0
  while p < n {
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      // skip leading whitespace
      var i: i64 = p
      var gw: i64 = 1
      while gw == 1 {
          if i >= e { gw = 0 } else {
              var w: i64 = 0
              if buf[i] == (ND_SP as u8) { w = 1 }
              if buf[i] == (ND_TAB as u8) { w = 1 }
              if w == 1 { i = i + 1 } else { gw = 0 }
          }
      }
      // literal "const" followed by a space
      var isc: i64 = 0
      if i + 6 <= e {
          if buf[i] == (99 as u8) { if buf[i+1] == (111 as u8) { if buf[i+2] == (110 as u8) {
          if buf[i+3] == (115 as u8) { if buf[i+4] == (116 as u8) { if buf[i+5] == (ND_SP as u8) {
              isc = 1
          } } } } } }
      }
      if isc == 1 {
          i = i + 6
          var gs: i64 = 1
          while gs == 1 {
              if i >= e { gs = 0 } else {
                  if buf[i] == (ND_SP as u8) { i = i + 1 } else { gs = 0 }
              }
          }
          let ns: i64 = i
          var gn: i64 = 1
          while gn == 1 {
              if i >= e { gn = 0 } else {
                  if nd_is_id_char(buf[i] as i64) == 1 { i = i + 1 } else { gn = 0 }
              }
          }
          let ne: i64 = i
          // find '=' on this line
          var eq: i64 = 0 - 1
          var j: i64 = i
          while j < e {
              if buf[j] == (61 as u8) { if eq < 0 { eq = j } }
              j = j + 1
          }
          if ne > ns { if eq > 0 {
              var v: i64 = eq + 1
              var gv: i64 = 1
              while gv == 1 {
                  if v >= e { gv = 0 } else {
                      var w2: i64 = 0
                      if buf[v] == (ND_SP as u8) { w2 = 1 }
                      if buf[v] == (ND_TAB as u8) { w2 = 1 }
                      if w2 == 1 { v = v + 1 } else { gv = 0 }
                  }
              }
              let vs: i64 = v
              var gt: i64 = 1
              while gt == 1 {
                  if v >= e { gt = 0 } else {
                      var stop: i64 = 0
                      if buf[v] == (ND_SP as u8) { stop = 1 }
                      if buf[v] == (ND_TAB as u8) { stop = 1 }
                      if buf[v] == (ND_CR as u8) { stop = 1 }
                      if buf[v] == (ND_SLASH as u8) { stop = 1 }
                      if stop == 1 { gt = 0 } else { v = v + 1 }
                  }
              }
              let ve: i64 = v
              var lit: i64 = 0
              if ve > vs {
                  let c0: i64 = buf[vs] as i64
                  if c0 >= 48 { if c0 <= 57 { lit = 1 } }
                  if c0 == 45 { lit = 1 }
              }
              if lit == 1 {
                  let kd: *u8 = ((nd_carena as i64) + nd_carena_n[0]) as *u8
                  var k: i64 = 0
                  while k < (ne - ns) { kd[k] = buf[ns + k]; k = k + 1 }
                  kd[k] = 0 as u8
                  nd_carena_n[0] = nd_carena_n[0] + k + 1
                  let vd: *u8 = ((nd_carena as i64) + nd_carena_n[0]) as *u8
                  var m: i64 = 0
                  while m < (ve - vs) { vd[m] = buf[vs + m]; m = m + 1 }
                  vd[m] = 0 as u8
                  nd_carena_n[0] = nd_carena_n[0] + m + 1
                  nd_put_kv(ctk, ctv, ctg, kd, vd)
                  found = found + 1
              }
          } }
      }
      p = e + 1
  }
  return found
450}
451// Collect `import "X"` paths out of a PRISTINE buffer (before nd_load terminates its lines in place).
452// Paths are copied into the const arena because the source buffer is about to be rewritten.
453func nd_scan_imports(buf: *u8, n: i64) -> i64 {
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var i: i64 = p
      var gw2: i64 = 1
      while gw2 == 1 {
          if i >= e { gw2 = 0 } else {
              var w: i64 = 0
              if buf[i] == (ND_SP as u8) { w = 1 }
              if buf[i] == (ND_TAB as u8) { w = 1 }
              if w == 1 { i = i + 1 } else { gw2 = 0 }
          }
      }
      var isi: i64 = 0
      if i + 7 <= e {
          if buf[i] == (105 as u8) { if buf[i+1] == (109 as u8) { if buf[i+2] == (112 as u8) {
          if buf[i+3] == (111 as u8) { if buf[i+4] == (114 as u8) { if buf[i+5] == (116 as u8) {
              isi = 1
          } } } } } }
      }
      if isi == 1 {
          var q: i64 = i + 6
          var gq: i64 = 1
          var s0: i64 = 0 - 1
          while gq == 1 {
              if q >= e { gq = 0 } else {
                  if buf[q] == (ND_QUOTE as u8) { s0 = q + 1; gq = 0 } else { q = q + 1 }
              }
          }
          if s0 > 0 {
              var q2: i64 = s0
              var g2: i64 = 1
              var s1: i64 = 0 - 1
              while g2 == 1 {
                  if q2 >= e { g2 = 0 } else {
                      if buf[q2] == (ND_QUOTE as u8) { s1 = q2; g2 = 0 } else { q2 = q2 + 1 }
                  }
              }
              if s1 > s0 {
                  if nd_imp_n[0] < ND_MAXIMP {
                      let d: *u8 = ((nd_carena as i64) + nd_carena_n[0]) as *u8
                      var k: i64 = 0
                      while k < (s1 - s0) { d[k] = buf[s0 + k]; k = k + 1 }
                      d[k] = 0 as u8
                      nd_carena_n[0] = nd_carena_n[0] + k + 1
                      nd_imp[nd_imp_n[0]] = d as i64
                      nd_imp_n[0] = nd_imp_n[0] + 1
                  }
              }
          }
      }
      p = e + 1
  }
  return nd_imp_n[0]
514}
515// "-" in a positional slot means "not supplied". Without it, a caller who wants [importroot]
516// (arg 5) but no [outfile]/[consttab] cannot say so, and the organ tries to OPEN a file called "-" --
517// turning an optional argument into a hard failure.
518//   => *POSITIONAL OPTIONALS NEED A SKIP TOKEN, OR ONLY THE LAST ONE IS REALLY OPTIONAL.
519func nd_is_dash(s: *u8) -> i64 {
  if s[0] != (45 as u8) { return 0 }
  if s[1] != (0 as u8) { return 0 }
  return 1
523}
524// root + "/" + name -> out (the fallback resolution root).
525func nd_join_root(root: *u8, name: *u8, out: *u8) -> i64 {
  var o: i64 = 0
  while root[o] != (0 as u8) { out[o] = root[o]; o = o + 1 }
  if o > 0 { if out[o-1] != (47 as u8) { out[o] = 47 as u8; o = o + 1 } }
  var k: i64 = 0
  while name[k] != (0 as u8) { out[o] = name[k]; o = o + 1; k = k + 1 }
  out[o] = 0 as u8
  return o
533}
534// dir(path) + "/" + name -> out. Imports resolve RELATIVE TO THE IMPORTING FILE, which is how the
535// compiler resolves them; `../nxasm/x.nx` is left to the kernel to flatten.
536func nd_join_dir(path: *u8, name: *u8, out: *u8) -> i64 {
  var last: i64 = 0 - 1
  var i: i64 = 0
  while path[i] != (0 as u8) {
      if path[i] == (47 as u8) { last = i }
      i = i + 1
  }
  var o: i64 = 0
  if last >= 0 {
      while o <= last { out[o] = path[o]; o = o + 1 }
  }
  var k: i64 = 0
  while name[k] != (0 as u8) { out[o] = name[k]; o = o + 1; k = k + 1 }
  out[o] = 0 as u8
  return o
551}
552// Fold one imported module's lines into A's UNIT multiset. The module is normalised under ITS OWN
553// const table -- a const means what its own file declares it to mean (same scoping law as the sides).
554func nd_fold_module(path: *u8) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  ln[0] = 0
  let buf: *u8 = sys_read_file(path, ln)
  if (buf as i64) == 0 { return 0 }
  let n: i64 = ln[0]
  let mk: *i64 = sys_mmap(ND_SLOTS * 8) as *i64
  let mv: *i64 = sys_mmap(ND_SLOTS * 8) as *i64
  // a FRESH mmap is zero-filled, and nd_gen starts at 1, so every slot reads as empty. No memset.
  let mg: *i64 = sys_mmap(ND_SLOTS * 8) as *i64
  nd_scan_consts(buf, n, mk, mv, mg)
  var p: i64 = 0
  var added: i64 = 0
  while p < n {
      let base: i64 = buf as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var t: i64 = e
      if t > p { if buf[t-1] == (ND_CR as u8) { t = t - 1 } }
      buf[t] = 0 as u8
      let line: *u8 = (base + p) as *u8
      let dst: *u8 = ((nd_ua as i64) + nd_ua_n[0]) as *u8
      let w: i64 = nd_norm(line, dst, mk, mv, mg)
      if w > 0 {
          nd_add(nd_uka, nd_uca, nd_g_uka, dst)
          nd_ua_n[0] = nd_ua_n[0] + w + 1
          added = added + 1
      }
      p = e + 1
  }
  // !!FREE THE PER-MODULE TABLES. Single-pair mode leaked ~15 MB and nobody noticed; CENSUS mode runs
  // thousands of pairs in ONE process, so the same leak becomes 3 MB x imports x pairs -- tens of GB of
  // mapping, and the run went from an expected ~1 minute to a 10-minute timeout THROUGH THRASHING, not
  // through doing more work.
  //   => *A LEAK IS A CONSTANT COST UNTIL YOU PUT THE CODE IN A LOOP, AND THEN IT IS THE WHOLE COST.
  //   => *A BATCH MODE DOES NOT JUST RUN THE SAME CODE MORE TIMES -- IT RE-PRICES EVERY ALLOCATION
  //      THAT THE SINGLE-SHOT PATH WAS QUIETLY GETTING AWAY WITH.
  sys_munmap(mk as *u8, ND_SLOTS * 8)
  sys_munmap(mv as *u8, ND_SLOTS * 8)
  sys_munmap(mg as *u8, ND_SLOTS * 8)
  if n > 0 { sys_munmap(buf, n + 16) }
  sys_munmap(ln as *u8, 16)
  return added
602}
603// IS `b` THE SAME LINE AS `a` WITH ONE CONTIGUOUS RUN DELETED?
604// If so, every character of b survives in a, in order, and a only ADDS -- so b is the PRE-EDIT version
605// and adopting a loses nothing. This is the shape a bulk sweep leaves behind: on 2026-08-07 another
606// seat fixed a sign-printing bug across 2,308 gates, each gate carrying its own copy of the helper
607// under a different local name (49 names / 151 files measured), and every delta was exactly
608// `;sys_write(fd,"-" as *u8,1)` inserted into one line.
609//   => ★A BULK SWEEP IS ONE DECISION REPLICATED N TIMES; WITHOUT THIS TEST THE LANE REFUSES ALL N.
610//
611// !!IT CANNOT EXPRESS THE ESCAPED MUTANT. `if hit == 0` -> `if hit != 0` is a SUBSTITUTION: same
612// length, so the `blen >= alen` guard rejects it before the shape test runs. The ruler that motivated
613// this whole lane still refuses. A RULER MUST BE TESTED AGAINST THE WORST DEFECT YOU ALREADY FOUND --
614// see nd_selftest, which asserts that case and 12 others BEFORE any verdict is printed.
615// 1 if the line is an `import "..."` declaration. An import path is a LAYOUT fact, never a version
616// fact, and the supersede predicate must never be applied to one.
617// MEASURED 2026-08-07, and it was about to propose breaking a build: extending the supersede check to
618// the LAPTOP-AHEAD direction flagged 157 files, and 132 of the 133 clean pairs were exactly
619//     NAS    : import "nxasm_v2.nx"
620//     laptop : import "../nxasm/nxasm_v2.nx"
621// The NAS line IS the laptop line minus the contiguous run `../nxasm/`, so the shape test says
622// "laptop ahead" -- but the two trees have DIFFERENT LAYOUTS by design (this is the standing
623// structural-exclusion class), and pushing the laptop form to the NAS makes the import unresolvable
624// and the build fail. The token-boundary guard does not catch it: every boundary is a quote or a
625// slash, not a word character.
626//   => ★★★★★★A PATH IS NOT CODE. A TEXTUAL "SUPERSEDE" ON AN IMPORT LINE PROPOSES BREAKING THE OTHER
627//      TREE'S BUILD, AND IT LOOKS EXACTLY LIKE PROGRESS.
628//   => ★★★★★A PREDICATE THAT IS SOUND IN ONE DIRECTION IS NOT THEREBY SOUND IN THE MIRROR -- I HAD
629//      RUN IT 151/151 SAFELY ONE WAY BEFORE THE OTHER WAY EXPOSED THE CLASS.
630func nd_is_import(l: *u8) -> i64 {
  var i: i64 = 0
  while l[i] == (ND_SP as u8) { i = i + 1 }
  if l[i] != (105 as u8) { return 0 }
  if l[i+1] != (109 as u8) { return 0 }
  if l[i+2] != (112 as u8) { return 0 }
  if l[i+3] != (111 as u8) { return 0 }
  if l[i+4] != (114 as u8) { return 0 }
  if l[i+5] != (116 as u8) { return 0 }
  return 1
640}
641func nd_supersedes(a: *u8, b: *u8) -> i64 {
  if nd_is_import(a) == 1 { return 0 }
  if nd_is_import(b) == 1 { return 0 }
  let alen: i64 = nd_len(a)
  let blen: i64 = nd_len(b)
  if blen >= alen { return 0 }
  var pfx: i64 = 0
  var g1: i64 = 1
  while g1 == 1 {
      if pfx >= blen { g1 = 0 } else {
          if a[pfx] == b[pfx] { pfx = pfx + 1 } else { g1 = 0 }
      }
  }
  var sfx: i64 = 0
  var g2: i64 = 1
  while g2 == 1 {
      if sfx >= (blen - pfx) { g2 = 0 } else {
          if a[alen - 1 - sfx] == b[blen - 1 - sfx] { sfx = sfx + 1 } else { g2 = 0 }
      }
  }
  if pfx + sfx != blen { return 0 }
  // !!THE DELETION MUST NOT SPLIT A TOKEN. Found by this organ's OWN hex-trap fixture, AFTER the
  // predicate had self-tested 8/8 and classified 151 real files: normalised, A is
  // `let b: i64 = 0x04` and B is `let b: i64 = 0`, and B *is* textually A minus the contiguous run
  // "x04" -- so the raw shape test said SUPERSEDED and would have adopted a file where a numeric
  // LITERAL was truncated from 4 to 0. A purely textual predicate cannot see that it cut a token in
  // half.
  //   => ★★★★★★A TEXTUAL TEST THAT LANDS INSIDE A TOKEN IS NOT A CODE TEST. Require both deletion
  //      boundaries to fall between a word character and a non-word one.
  //   => ★★★★★A PREDICATE THAT PASSED ITS OWN SUITE AND A 151-FILE POPULATION WAS STILL UNSOUND --
  //      THE COUNTEREXAMPLE CAME FROM A FIXTURE BUILT FOR A DIFFERENT DEFECT ENTIRELY. Keep old
  //      fixtures running against new logic; they are the cheapest adversary you have.
  // The real sweep is unaffected: its deletions begin at ';' (a non-word char), so no token splits.
  if pfx > 0 { if nd_is_id_char(a[pfx-1] as i64) == 1 { if nd_is_id_char(a[pfx] as i64) == 1 { return 0 } } }
  if sfx > 0 {
      let lastdel: i64 = alen - sfx - 1
      if lastdel >= 0 { if nd_is_id_char(a[lastdel] as i64) == 1 { if nd_is_id_char(a[alen - sfx] as i64) == 1 { return 0 } } }
  }
  return 1
680}
681// SELF-TEST THE PREDICATE BEFORE TRUSTING IT WITH A MERGE DECISION. Runs on EVERY invocation (8
682// string compares, unmeasurable) and its result gates whether a supersede verdict is printed at all.
683// ★A CLASSIFIER WHOSE OWN CASES ARE UNPROVEN CLASSIFIES NOTHING · ★A PREDICATE THAT SILENTLY REGRESSED
684// MUST NOT BE TRUSTED WITH A MERGE -- so the failure mode is "no verdict", never "wrong verdict".
685// Case 2 is THE ESCAPED MUTANT that motivated this entire lane; it must read 0 forever.
686func nd_selftest() -> i64 {
  var bad: i64 = 0
  if nd_supersedes("func f(a){x;EXTRA}" as *u8, "func f(a){x}" as *u8) != 1 { bad = bad + 1 }
  if nd_supersedes("if hit == 0 { h = 1 }" as *u8, "if hit != 0 { h = 1 }" as *u8) != 0 { bad = bad + 1 }
  if nd_supersedes("abc" as *u8, "abc" as *u8) != 0 { bad = bad + 1 }
  if nd_supersedes("let x = 1" as *u8, "let y = 1" as *u8) != 0 { bad = bad + 1 }
  if nd_supersedes("a;b;c" as *u8, "a;c" as *u8) != 1 { bad = bad + 1 }
  if nd_supersedes("short" as *u8, "muchlongerline" as *u8) != 0 { bad = bad + 1 }
  if nd_supersedes("f(1,2,3)" as *u8, "f(1,3)" as *u8) != 1 { bad = bad + 1 }
  if nd_supersedes("xAyBz" as *u8, "xyz" as *u8) != 0 { bad = bad + 1 }
  // THE HEX TRAP: a deletion inside a numeric literal changes the VALUE, not just the text.
  if nd_supersedes("let b: i64 = 0x04" as *u8, "let b: i64 = 0" as *u8) != 0 { bad = bad + 1 }
  // and inside an identifier
  if nd_supersedes("call_widget(x)" as *u8, "call(x)" as *u8) != 0 { bad = bad + 1 }
  // the REAL sweep shape still passes -- deletion starts at ';', a token boundary
  if nd_supersedes("if m<0{m=0-m;sys_write(fd,1)}" as *u8, "if m<0{m=0-m}" as *u8) != 1 { bad = bad + 1 }
  // THE LAYOUT TRAP: the NAS form IS the laptop form minus "../nxasm/", and adopting either way
  // breaks the other tree's build. An import line is never a supersede candidate.
  if nd_supersedes("import \"../nxasm/nxasm_v2.nx\"" as *u8, "import \"nxasm_v2.nx\"" as *u8) != 0 { bad = bad + 1 }
  if nd_supersedes("import \"nxasm_v2.nx\"" as *u8, "import \"../nxasm/nxasm_v2.nx\"" as *u8) != 0 { bad = bad + 1 }
  return bad
707}
708func nd_emit(tag: *u8, n: i64, line: *u8) -> i64 {
  var o: i64 = nd_out_n[0]
  let ll: i64 = nd_len(line)
  if o + ll + 32 >= ND_OUTBUF { return 0 }
  var i: i64 = 0
  while tag[i] != (0 as u8) { nd_out[o] = tag[i]; o = o + 1; i = i + 1 }
  nd_out[o] = ND_SP as u8; o = o + 1
  nd_out[o] = 120 as u8; o = o + 1                      // 'x'
  var k: i64 = 0
  var m: i64 = n
  if m == 0 { nd_num[k] = 48 as u8; k = k + 1 }
  var j: i64 = 0
  while m > 0 { nd_rev[j] = (48 + (m % 10)) as u8; m = m / 10; j = j + 1 }
  while j > 0 { nd_num[k] = nd_rev[j - 1]; k = k + 1; j = j - 1 }
  i = 0
  while i < k { nd_out[o] = nd_num[i]; o = o + 1; i = i + 1 }
  nd_out[o] = ND_SP as u8; o = o + 1
  i = 0
  while i < ll { nd_out[o] = line[i]; o = o + 1; i = i + 1 }
  nd_out[o] = ND_LF as u8; o = o + 1
  nd_out_n[0] = o
  return 0
730}
731func nd_sample(tag: *u8, n: i64, line: *u8) -> i64 {
  if nd_n[6] >= ND_SAMPLE_CAP { return 0 }
  nd_puts("    " as *u8); nd_puts(tag); nd_puts(" x" as *u8); nd_putn(n)
  nd_puts("  " as *u8); nd_puts(line); nd_puts("\n" as *u8)
  nd_n[6] = nd_n[6] + 1
  return 0
737}
738// Split buf into NUL-terminated lines in place; load the RAW line into (rk,rc) and the NORMALISED
739// line into (nk,nc). A trailing CR is stripped from the line but COUNTED -- it is the classic delta a
740// text diff hides and a byte gate reports.
741func nd_load(buf: *u8, n: i64, rk: *i64, rc: *i64, rg: *i64, side: i64) -> i64 {
  var p: i64 = 0
  while p < n {
      let base: i64 = buf as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var t: i64 = e
      var cslot: i64 = 4
      var lslot: i64 = 0
      if side == 1 { cslot = 5; lslot = 1 }
      if t > p { if buf[t-1] == (ND_CR as u8) { t = t - 1; nd_n[cslot] = nd_n[cslot] + 1 } }
      buf[t] = 0 as u8
      let line: *u8 = (base + p) as *u8
      nd_add(rk, rc, rg, line)
      nd_n[lslot] = nd_n[lslot] + 1
      // normalised copy into this side's arena
      if side == 0 {
          let dst: *u8 = ((nd_na as i64) + nd_na_n[0]) as *u8
          let w: i64 = nd_norm(line, dst, nd_ctka, nd_ctva, nd_g_ctka)
          if w > 0 {
              nd_add(nd_nka, nd_nca, nd_g_nka, dst)
              nd_add(nd_uka, nd_uca, nd_g_uka, dst)      // A's own lines are part of A's unit
              nd_na_n[0] = nd_na_n[0] + w + 1
              // remember A's comment for this normalised line, so we can spot B-only ones later
              let cut: i64 = nd_comment_at(line)
              if cut >= 0 {
                  let cdst: *u8 = ((nd_ca_buf as i64) + nd_ca_n[0]) as *u8
                  var ci: i64 = 0
                  while line[cut + ci] != (0 as u8) { cdst[ci] = line[cut + ci]; ci = ci + 1 }
                  cdst[ci] = 0 as u8
                  nd_ca_n[0] = nd_ca_n[0] + ci + 1
                  nd_put_kv(nd_ack, nd_acv, nd_g_ack, dst, cdst)
              }
          }
      } else {
          let dst: *u8 = ((nd_nb as i64) + nd_nb_n[0]) as *u8
          let w: i64 = nd_norm(line, dst, nd_ctkb, nd_ctvb, nd_g_ctkb)
          if w > 0 {
              nd_add(nd_nkb, nd_ncb, nd_g_nkb, dst)
              nd_nb_n[0] = nd_nb_n[0] + w + 1
              // capture B's comments HERE, while the buffer still has its line structure --
              // nd_lost_comments cannot recover it later (see that function's header).
              let cut2: i64 = nd_comment_at(line)
              if cut2 >= 0 {
                  if nd_bcl_n[0] < ND_BCL_CAP {
                      let cd: *u8 = ((nd_ca_buf as i64) + nd_ca_n[0]) as *u8
                      var ci: i64 = 0
                      while line[cut2 + ci] != (0 as u8) { cd[ci] = line[cut2 + ci]; ci = ci + 1 }
                      cd[ci] = 0 as u8
                      nd_ca_n[0] = nd_ca_n[0] + ci + 1
                      let sl: i64 = nd_bcl_n[0]
                      nd_bcl[sl * 2] = dst as i64
                      nd_bcl[sl * 2 + 1] = cd as i64
                      nd_bcl_n[0] = sl + 1
                  }
              }
          }
      }
      p = e + 1
  }
  return 0
807}
808// Every B comment whose normalised line carries NO comment on A's side. These are exactly the "why"
809// notes that adopting A would destroy. Printed in full -- never summarised to a count -- because a
810// comment you cannot read is a comment you cannot decide to keep.
811//
812// !!THIS WALKS A LIST CAPTURED DURING nd_load, IT DOES NOT RE-READ THE SOURCE BUFFER. The first
813// version re-scanned bb looking for '\n' -- but nd_load has already overwritten every separator with
814// NUL to terminate its lines in place, so the rescan saw the ENTIRE FILE as one line, found no
815// trailing comment on it, and reported lostComments=0 on a file that plainly had one. It failed
816// SILENTLY and in the SAFE-LOOKING direction: "nothing would be lost" is exactly the answer that
817// invites the destructive adopt. Caught only because a fixture asserted the count, not the verdict.
818//   ⇒ ★A SECOND PASS OVER A BUFFER THE FIRST PASS MUTATED IS READING A DIFFERENT FILE.
819//   ⇒ ★TEST THE NUMBER A GUARD REPORTS, NOT JUST THE VERDICT IT PRINTS -- a guard that under-counts
820//     losses agrees with you about the verdict right up until it is wrong.
821func nd_lost_comments() -> i64 {
  var i: i64 = 0
  let n: i64 = nd_bcl_n[0]
  while i < n {
      let normp: *u8 = nd_bcl[i * 2] as *u8
      let cmtp: *u8 = nd_bcl[i * 2 + 1] as *u8
      if nd_get_kv(nd_ack, nd_acv, nd_g_ack, normp) == 0 {
          nd_n[9] = nd_n[9] + 1
          nd_puts("    LOST-COMMENT  " as *u8); nd_puts(cmtp)
          nd_puts("\n        on line: " as *u8); nd_puts(normp); nd_puts("\n" as *u8)
          nd_emit("LOST-COMMENT" as *u8, 1, cmtp)
      }
      i = i + 1
  }
  return 0
836}
837// consttab format, one per line: NAME <TAB> VALUE. Anything else is skipped, not guessed at.
838func nd_load_consttab(path: *u8) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  ln[0] = 0
  let buf: *u8 = sys_read_file(path, ln)
  if (buf as i64) == 0 { return 0 - 1 }
  let n: i64 = ln[0]
  var p: i64 = 0
  while p < n {
      let base: i64 = buf as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if buf[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var t: i64 = e
      if t > p { if buf[t-1] == (ND_CR as u8) { t = t - 1 } }
      buf[t] = 0 as u8
      // split on the first TAB
      var s: i64 = p
      var tabat: i64 = 0 - 1
      while s < t {
          if buf[s] == (ND_TAB as u8) { if tabat < 0 { tabat = s } }
          s = s + 1
      }
      if tabat > p {
          buf[tabat] = 0 as u8
          let k: *u8 = (base + p) as *u8
          let v: *u8 = (base + tabat + 1) as *u8
          if v[0] != (0 as u8) {
              // FALLBACK ONLY: file-local consts are already in place and win, because nd_put_kv
              // is first-writer-wins. An external table must never override what the file itself
              // says -- that is the scope rule this organ is built on.
              nd_put_kv(nd_ctka, nd_ctva, nd_g_ctka, k, v)
              nd_put_kv(nd_ctkb, nd_ctvb, nd_g_ctkb, k, v)
              nd_n[10] = nd_n[10] + 1
          }
      }
      p = e + 1
  }
  return 0
880}
881
882func nd_run_pair(apath: *u8, bpath: *u8, iroot: *u8, quiet: i64, argc: i64, argv: *i64) -> i64 {
  // O(1) CLEAR OF EVERY TABLE: one generation bump invalidates all twelve at once. The arenas are
  // reused by resetting their offsets -- safe precisely BECAUSE the tables were invalidated, so no
  // pointer into the old arena bytes can still be reached.
  //   => *AN ARENA RESET IS ONLY SAFE IF EVERY INDEX INTO IT DIED IN THE SAME BREATH.
  nd_gen[0] = nd_gen[0] + 1
  var zz: i64 = 0
  while zz < 16 { nd_n[zz] = 0; zz = zz + 1 }
  nd_out_n[0] = 0
  nd_na_n[0] = 0
  nd_nb_n[0] = 0
  nd_ca_n[0] = 0
  nd_carena_n[0] = 0
  nd_bcl_n[0] = 0
  nd_imp_n[0] = 0
  nd_asl_n[0] = 0
  nd_bsl_n[0] = 0
  // !!THE ONE I MISSED. I hand-enumerated nine arena offsets here and left out the UNIT arena, so
  // nd_ua grew monotonically across pairs and eventually walked off its 8 MB mapping. It crashed at
  // EXACTLY pair 1,241 every time -- not the 1,241st FILE (that file alone is fine, and rows
  // 1200-1400 as their own run are fine) but the 1,241st ACCUMULATION. Bisecting by content would
  // never have found it; only 'n=1200 passes, n=1241 dies, the suffix alone passes' separates a
  // cumulative fault from an input fault.
  //   => *A HAND-ENUMERATED RESET LIST IS A LIST YOU WILL MISS ONE ITEM FROM, AND THE ITEM YOU MISS
  //      STAYS INVISIBLE UNTIL THE LOOP IS LONG ENOUGH.
  //   => *A FAILURE THAT IS DETERMINISTIC AT AN ODD COUNT IS AN ACCUMULATOR, NOT AN INPUT.
  nd_ua_n[0] = 0
  let la: *i64 = nd_la
  let ba: *u8 = sys_read_file(apath, la)
  if (ba as i64) == 0 {
      nd_puts("# NORMDIFF RED -- cannot read fileA\n" as *u8)
      sys_exit(3); return 3
  }
  let lb: *i64 = nd_lb
  let bb: *u8 = sys_read_file(bpath, lb)
  if (bb as i64) == 0 {
      nd_puts("# NORMDIFF RED -- cannot read fileB\n" as *u8)
      sys_exit(3); return 3
  }
  // !!ARENAS ARE ALLOCATED ONCE IN main AND REUSED, NOT MAPPED PER PAIR. Nine sys_mmap calls used to
  // live in this function with ZERO munmaps -- invisible in single-pair mode (one process, ~10 MB,
  // then exit) and fatal in census mode: 200 pairs alone exceeded a 10-minute budget through
  // THRASHING, not through work. Fixing the module-table leak was not enough because the arenas
  // leaked too; the same defect had five more sites.
  //   => *AN ALLOCATION WITHOUT A FREE IS NOT A LEAK UNTIL THE CODE ENTERS A LOOP -- AND THEN EVERY
  //      SITE MATTERS, NOT THE FIRST ONE YOU FOUND.
  //   => *WHEN A BATCH MODE IS SLOWER THAN N SINGLE RUNS, SUSPECT MEMORY, NOT ALGORITHM: the
  //      per-pair CPU was measured at 19 ms and never changed.
  // A source too large for the fixed arena is REFUSED, never silently truncated.
  if la[0] * 2 + ND_SLACK > ND_ARENA { nd_puts("# NORMDIFF RED -- fileA exceeds the arena; refusing rather than truncating\n" as *u8); return 0 }
  if lb[0] * 2 + ND_SLACK > ND_ARENA { nd_puts("# NORMDIFF RED -- fileB exceeds the arena; refusing rather than truncating\n" as *u8); return 0 }
933
  nd_puts("=== nx_normdiff -- code difference vs cosmetic difference ===\n" as *u8)
  // ORDER IS LOad-BEARING: harvest each side's consts while its buffer is still pristine, BEFORE
  // nd_load rewrites that same buffer in place to terminate its lines. Then the optional external
  // table fills only what neither file declared.
  let ca: i64 = nd_scan_consts(ba, la[0], nd_ctka, nd_ctva, nd_g_ctka)
  nd_scan_imports(ba, la[0])          // MUST precede nd_load: it rewrites this buffer in place
  let cb: i64 = nd_scan_consts(bb, lb[0], nd_ctkb, nd_ctvb, nd_g_ctkb)
  nd_n[10] = ca + cb
  if argc > 4 { if nd_is_dash(argv[4] as *u8) == 0 {
      if nd_load_consttab(argv[4] as *u8) < 0 {
          nd_puts("# NORMDIFF RED -- cannot read consttab\n" as *u8)
          sys_exit(3); return 3
      }
  } }
  nd_load(ba, la[0], nd_rka, nd_rca, nd_g_rka, 0)
  nd_load(bb, lb[0], nd_rkb, nd_rcb, nd_g_rkb, 1)
  // ---- A'S COMPILATION UNIT ----
  // ★★★★★★A FILE IS NOT THE COMPILATION UNIT. COMPARING FILES WHILE THE LANGUAGE COMPARES UNITS
  //   MANUFACTURES DIFFERENCES THAT DO NOT EXIST. Measured 2026-08-07: 267 gates on the laptop each
  //   carry an inline `func gw(s: *u8)`, and the NAS copies carry NONE -- because the NAS refactored
  //   them to `import "nx_gate_base.nx"`, whose definition is BYTE-IDENTICAL to the inline one. A
  //   file-vs-file ruler calls that 267 files of lost work; it is one DRY refactor (Rule 15).
  //   Import-aware, 550 of 2,590 laptop-only lines (21.2%) turn out to be present in a module the NAS
  //   side imports, and 221 files become fully covered.
  // DEPTH IS 1 BY MEASUREMENT, NOT BY LAZINESS: transitive resolution to depth 4 was measured at
  //   568/2,590 and 231 files -- +10 files for a fixpoint walk and a cycle guard. ★FILE THE CEILING
  //   WITH THE REMEDY so the next reader does not re-derive it.
  // This NEVER relaxes verdict_raw or verdict_norm; it is reported as its own third verdict.
  let uarena: i64 = la[0] * 4 + ND_SLACK
  // uarena bound is enforced by the ND_ARENA guard above
  var ii: i64 = 0
  var folded: i64 = 0
  let ipath: *u8 = nd_ipath
  // TWO RESOLUTION SITES, and the second is not optional. NishiLang resolves a bare
  // `import "nx_syscalls.nx"` from a file in _hdl_build/ against the RUNTIME ROOT, not the file's own
  // directory -- so dirname-only resolution silently folds ~1 of 5 imports and presents a nearly
  // EMPTY unit. That fails in the SAFE direction (an empty unit cannot cover B, so it refuses), but
  // it is a refusal for a FALSE REASON: measured, dirname-only found 1 adoptable file where full
  // resolution finds hundreds. ⇒ ★★★★★A RESOLVER THAT SILENTLY MISSES IS NOT CONSERVATIVE, IT IS
  //   BLIND -- AND A BLIND INSTRUMENT THAT FAILS SAFE STILL REPORTS THE WRONG NUMBER.
  // [importroot] (argv[5]) is the fallback; without it only same-directory imports resolve.
  while ii < nd_imp_n[0] {
      nd_join_dir(apath, nd_imp[ii] as *u8, ipath)
      var got: i64 = nd_fold_module(ipath)
      if got == 0 {
          nd_join_root(iroot, nd_imp[ii] as *u8, ipath)
          got = nd_fold_module(ipath)
      }
      if got > 0 { folded = folded + 1 }
      ii = ii + 1
  }
  nd_n[11] = folded
  // ★ASSERT THE MACHINE RAN: an unresolved import is REPORTED, never absorbed into a clean number.
  if folded < nd_imp_n[0] {
      nd_puts("  !! UNRESOLVED IMPORTS: " as *u8); nd_putn(nd_imp_n[0] - folded)
      nd_puts(" of " as *u8); nd_putn(nd_imp_n[0])
      nd_puts(" -- A unit INCOMPLETE; unitSurplusB may overstate. Pass [importroot].\n" as *u8)
  }
992
  // raw surplus (the guard ruler)
  var s: i64 = 0
  while s < ND_SLOTS {
      if nd_g_rka[s] == nd_gen[0] { if nd_rka[s] != 0 {
          let line: *u8 = nd_rka[s] as *u8
          let d: i64 = nd_rca[s] - nd_get(nd_rkb, nd_rcb, nd_g_rkb, line)
          if d > 0 { nd_n[2] = nd_n[2] + d }
      } }
      s = s + 1
  }
  s = 0
  while s < ND_SLOTS {
      if nd_g_rkb[s] == nd_gen[0] { if nd_rkb[s] != 0 {
          let line: *u8 = nd_rkb[s] as *u8
          let d: i64 = nd_rcb[s] - nd_get(nd_rka, nd_rca, nd_g_rka, line)
          if d > 0 { nd_n[3] = nd_n[3] + d }
      } }
      s = s + 1
  }
  // normalised surplus (the census ruler) -- these are the lines that are REALLY different
  if quiet == 0 { nd_puts("  A-SURPLUS after normalisation (real code A holds and B lacks):\n" as *u8) }
  s = 0
  while s < ND_SLOTS {
      if nd_g_nka[s] == nd_gen[0] { if nd_nka[s] != 0 {
          let line: *u8 = nd_nka[s] as *u8
          let d: i64 = nd_nca[s] - nd_get(nd_nkb, nd_ncb, nd_g_nkb, line)
          if d > 0 {
              nd_n[7] = nd_n[7] + d
              if nd_asl_n[0] < ND_SURP_CAP { nd_asl[nd_asl_n[0]] = line as i64; nd_asl_n[0] = nd_asl_n[0] + 1 }
              nd_emit("A-SURPLUS-NORM" as *u8, d, line)
              if quiet == 0 { nd_sample("A" as *u8, d, line) }
          }
      } }
      s = s + 1
  }
  nd_n[6] = 0
  if quiet == 0 { nd_puts("  B-SURPLUS after normalisation (real code B holds and A lacks):\n" as *u8) }
  s = 0
  while s < ND_SLOTS {
      if nd_g_nkb[s] == nd_gen[0] { if nd_nkb[s] != 0 {
          let line: *u8 = nd_nkb[s] as *u8
          let d: i64 = nd_ncb[s] - nd_get(nd_nka, nd_nca, nd_g_nka, line)
          if d > 0 {
              nd_n[8] = nd_n[8] + d
              if nd_bsl_n[0] < ND_SURP_CAP { nd_bsl[nd_bsl_n[0]] = line as i64; nd_bsl_n[0] = nd_bsl_n[0] + 1 }
              nd_emit("B-SURPLUS-NORM" as *u8, d, line)
              if quiet == 0 { nd_sample("B" as *u8, d, line) }
          }
      } }
      s = s + 1
  }
  // What would adopting A destroy? Only meaningful when A actually covers B's code.
  // !!THE WALK MUST RUN EVEN WHEN QUIET -- it is what SETS nd_n[9]. Gating the whole block instead
  // of only its printing would make census mode report lostComments=0 for every file and adopt
  // straight through the one veto that protects a "why".
  //   => *GATE THE OUTPUT, NEVER THE MEASUREMENT.
  if nd_n[8] == 0 {
      if quiet == 0 { nd_puts("  B-ONLY COMMENTS that adopting A would DESTROY:\n" as *u8) }
      nd_lost_comments()
      if quiet == 0 { if nd_n[9] == 0 { nd_puts("    (none)\n" as *u8) } }
  }
1054
  if quiet == 0 { if argc > 3 { if nd_is_dash(argv[3] as *u8) == 0 {
      let fd: i64 = sys_openat_wr(argv[3] as *u8, 0x1a4)
      if fd < 0 {
          nd_puts("# NORMDIFF RED -- cannot open outfile\n" as *u8)
          sys_exit(3)
      }
      sys_write(fd, nd_out, nd_out_n[0])
      sys_close(fd)
      nd_puts("# rows written: " as *u8); nd_puts(argv[3] as *u8)
      nd_puts(" bytes=" as *u8); nd_putn(nd_out_n[0]); nd_puts("\n" as *u8)
  } } }
1066
  // unit surplus: lines B holds that A's WHOLE UNIT (own lines + directly imported modules) lacks.
  // !!THIS COMPUTATION WAS DELETED BY A REGION REWRITE THAT WAS ONLY MEANT TO GATE THE PRINTING --
  // the same error the comment three blocks up warns about, committed in the very edit that added
  // the warning. The build caught it as "usb is not defined", which is the good outcome; had the
  // variable still existed with a stale value it would have shipped a silently wrong verdict.
  //   => *WHEN YOU REWRITE A REGION TO CHANGE ITS OUTPUT, DIFF WHAT COMPUTATION LEFT WITH IT.
  var usb: i64 = 0
  var s2: i64 = 0
  while s2 < ND_SLOTS {
      if nd_g_nkb[s2] == nd_gen[0] { if nd_nkb[s2] != 0 {
          let line: *u8 = nd_nkb[s2] as *u8
          let d: i64 = nd_ncb[s2] - nd_get(nd_uka, nd_uca, nd_g_uka, line)
          if d > 0 { usb = usb + d }
      } }
      s2 = s2 + 1
  }
  nd_n[13] = usb          // census reads it from here; a local cannot be reported by the caller
  if quiet == 0 {
      nd_puts("# NORMDIFF linesA=" as *u8); nd_putn(nd_n[0])
      nd_puts(" linesB=" as *u8); nd_putn(nd_n[1])
      nd_puts(" rawSurplusA=" as *u8); nd_putn(nd_n[2])
      nd_puts(" rawSurplusB=" as *u8); nd_putn(nd_n[3])
      nd_puts(" normSurplusA=" as *u8); nd_putn(nd_n[7])
      nd_puts(" normSurplusB=" as *u8); nd_putn(nd_n[8])
      nd_puts(" crA=" as *u8); nd_putn(nd_n[4])
      nd_puts(" crB=" as *u8); nd_putn(nd_n[5])
      nd_puts(" unitSurplusB=" as *u8); nd_putn(usb)
      nd_puts(" importsFolded=" as *u8); nd_putn(nd_n[11])
      nd_puts(" lostComments=" as *u8); nd_putn(nd_n[9])
      nd_puts(" constsLoaded=" as *u8); nd_putn(nd_n[10])
      nd_puts("\n" as *u8)
  }
1099
  // verdict_raw -- nx_srcdiff semantics, unchanged. THIS is the one a guard may act on.
  nd_puts("# verdict_raw=" as *u8)
  if nd_n[2] == 0 { if nd_n[3] == 0 { nd_puts("IDENTICAL" as *u8) } }
  if nd_n[2] > 0 { if nd_n[3] == 0 { nd_puts("A-SUPERSET" as *u8) } }
  if nd_n[2] == 0 { if nd_n[3] > 0 { nd_puts("B-SUPERSET" as *u8) } }
  if nd_n[2] > 0 { if nd_n[3] > 0 { nd_puts("BIDIRECTIONAL" as *u8) } }
  nd_puts("\n" as *u8)
1107
  nd_puts("# verdict_norm=" as *u8)
  if nd_n[7] == 0 { if nd_n[8] == 0 { nd_puts("IDENTICAL" as *u8) } }
  if nd_n[7] > 0 { if nd_n[8] == 0 { nd_puts("A-SUPERSET" as *u8) } }
  if nd_n[7] == 0 { if nd_n[8] > 0 { nd_puts("B-SUPERSET" as *u8) } }
  if nd_n[7] > 0 { if nd_n[8] > 0 { nd_puts("BIDIRECTIONAL" as *u8) } }
  nd_puts("\n" as *u8)
1114
  nd_puts("# verdict_unit=" as *u8)
  if usb == 0 { nd_puts("A-UNIT-COVERS-B -- every line B holds is present in A or in a module A imports\n" as *u8) }
  if usb > 0 { nd_puts("B-HAS-UNIQUE -- B holds lines absent from A AND from every module A imports\n" as *u8) }
1118
  // ---- SUPERSEDE MATCH ----
  // Every B-surplus line must be some A-surplus line minus one contiguous run, each A line used at
  // most once. That is the bulk-sweep shape: the laptop holds the PRE-EDIT copy of a line the NAS
  // edited in place, so adopting A loses nothing but the older text.
  var supall: i64 = 0
  let stbad: i64 = nd_selftest()
  nd_puts("# supersedeSelfTest=" as *u8)
  if stbad == 0 { nd_puts("13/13" as *u8) } else { nd_puts("FAILED" as *u8); nd_putn(stbad) }
  nd_puts("\n" as *u8)
  if stbad == 0 {
      let used: *u8 = nd_used
      var u: i64 = 0
      while u < nd_asl_n[0] { used[u] = 0 as u8; u = u + 1 }
      var matched: i64 = 0
      var bi: i64 = 0
      while bi < nd_bsl_n[0] {
          let bl: *u8 = nd_bsl[bi] as *u8
          var ai: i64 = 0
          var hit: i64 = 0
          while ai < nd_asl_n[0] {
              if hit == 0 { if used[ai] == (0 as u8) {
                  if nd_supersedes(nd_asl[ai] as *u8, bl) == 1 {
                      used[ai] = 1 as u8
                      matched = matched + 1
                      hit = 1
                  }
              } }
              ai = ai + 1
          }
          bi = bi + 1
      }
      nd_puts("# verdict_supersede=" as *u8)
      if nd_bsl_n[0] == 0 { nd_puts("N/A (B holds no surplus lines)" as *u8) }
      if nd_bsl_n[0] > 0 {
          if matched == nd_bsl_n[0] {
              supall = 1
              nd_n[14] = 1
              nd_puts("SUPERSEDED-BY-A -- every laptop-only line is a NAS line minus one contiguous insertion; the laptop holds the PRE-EDIT copy" as *u8)
          } else {
              nd_puts("NO (" as *u8); nd_putn(matched)
              nd_puts(" of " as *u8); nd_putn(nd_bsl_n[0])
              nd_puts(" laptop-only lines superseded)" as *u8)
          }
      }
      nd_puts("\n" as *u8)
  }
1165
  // ---- THE DECISION ----
  // THE ESCALATION CHAIN LIVES HERE, NOT IN A LAUNCHER. It was briefly implemented in
  // sync_nas_ahead.ps1 -- four verdicts and their precedence, expressed in PowerShell regexes -- which
  // is exactly what the standing doctrine forbids: "never write a .ps1 that judges anything". A shell
  // script may LAUNCH a sovereign ELF and move laptop<->NAS bytes (irreducibly laptop-side, since the
  // MCP transport is remote http); it may not decide. Emitting one machine-readable DECISION line
  // leaves the launcher with nothing to do but copy bytes.
  //   => ★A JUDGMENT EXPRESSED IN THE GLUE IS A RULER NO OTHER SEAT CAN RUN, GATE, OR BITE-PROVE.
  // Precedence is strongest-proof-first, and EVERY adopting branch additionally requires
  // lostComments=0 -- code safety never buys the right to destroy a "why" (Rule 23).
  var dec: i64 = 0
  if quiet == 0 { nd_puts("# DECISION=" as *u8) }
  if nd_n[3] == 0 {
      if quiet == 0 { nd_puts("ADOPT-A raw-safe (verdict_raw covers B; no escalation needed)" as *u8) }; dec = 1
  }
  if dec == 0 { if nd_n[9] == 0 { if nd_n[8] == 0 {
      if quiet == 0 { nd_puts("ADOPT-A cosmetic-only (normalised A covers B; 0 comments lost)" as *u8) }; dec = 1
  } } }
  if dec == 0 { if nd_n[9] == 0 { if usb == 0 { if nd_n[11] > 0 {
      if quiet == 0 { nd_puts("ADOPT-A unit-covered (A's imports supply every line B holds; 0 comments lost)" as *u8) }; dec = 1
  } } } }
  if dec == 0 { if nd_n[9] == 0 { if stbad == 0 { if supall == 1 {
      if quiet == 0 { nd_puts("ADOPT-A superseded (every B line is an A line minus one insertion; selftest 13/13)" as *u8) }; dec = 1
  } } } }
  if dec == 0 {
      if quiet == 0 { nd_puts("REFUSE -- B holds work A does not, or adopting would destroy a comment. Merge by hand." as *u8) }
  }
  nd_puts("\n" as *u8)
1194
  // The escalation the whole organ exists for.
  var cosmetic: i64 = 0
  if nd_n[8] == 0 {
      if nd_n[3] > 0 { cosmetic = 1 }
  }
  if cosmetic == 1 {
      nd_puts("# COSMETIC-ONLY=yes -- the raw ruler refuses this file, but every line B holds is\n" as *u8)
      nd_puts("#   present in A once comments/whitespace/const-lifting are normalised away.\n" as *u8)
      nd_puts("#   Adopting A is CODE-safe. lostComments=" as *u8); nd_putn(nd_n[9])
      nd_puts(" -- carry those into A FIRST if non-zero.\n" as *u8)
  } else {
      nd_puts("# COSMETIC-ONLY=no\n" as *u8)
  }
  // the two source buffers are the last per-pair mappings; release them or census leaks the corpus
  if la[0] > 0 { sys_munmap(ba, la[0] + 16) }
  if lb[0] > 0 { sys_munmap(bb, lb[0] + 16) }
  nd_n[12] = dec
  return dec
1213}
1214// ATOMIC ADOPT: write to <dst>.ndtmp, fsync, then rename over <dst>. A partial write left in place
1215// is worse than no write at all -- the authoring tree would hold a truncated source that still parses
1216// far enough to mislead. rename(2) within a directory is the only step that is atomic for a reader.
1217//   => *A CAMPAIGN THAT CAN BE INTERRUPTED MUST LEAVE EITHER THE OLD FILE OR THE NEW ONE, NEVER HALF.
1218func nd_copy_atomic(src: *u8, dst: *u8) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  ln[0] = 0
  let buf: *u8 = sys_read_file(src, ln)
  if (buf as i64) == 0 { sys_munmap(ln as *u8, 16); return 0 - 1 }
  let n: i64 = ln[0]
  let tmp: *u8 = sys_mmap(ND_MAGIC_8192)
  var o: i64 = 0
  while dst[o] != (0 as u8) { tmp[o] = dst[o]; o = o + 1 }
  let sfx: *u8 = ".ndtmp" as *u8
  var k: i64 = 0
  while sfx[k] != (0 as u8) { tmp[o] = sfx[k]; o = o + 1; k = k + 1 }
  tmp[o] = 0 as u8
  let fd: i64 = sys_openat_wr(tmp, 0x1a4)
  if fd < 0 {
      if n > 0 { sys_munmap(buf, n + 16) }
      sys_munmap(ln as *u8, 16); sys_munmap(tmp, ND_MAGIC_8192); return 0 - 2
  }
  let w: i64 = sys_write(fd, buf, n)
  sys_fsync(fd)
  sys_close(fd)
  if w != n {
      if n > 0 { sys_munmap(buf, n + 16) }
      sys_munmap(ln as *u8, 16); sys_munmap(tmp, ND_MAGIC_8192); return 0 - 3
  }
  let r: i64 = sys_renameat(tmp, dst)
  if n > 0 { sys_munmap(buf, n + 16) }
  sys_munmap(ln as *u8, 16)
  sys_munmap(tmp, ND_MAGIC_8192)
  if r != 0 { return 0 - 4 }
  return n
1249}
1250func nd_is_adopt(s: *u8) -> i64 {
  if s[0] != (97 as u8) { return 0 }
  if s[1] != (100 as u8) { return 0 }
  if s[2] != (111 as u8) { return 0 }
  if s[3] != (112 as u8) { return 0 }
  if s[4] != (116 as u8) { return 0 }
  if s[5] != (0 as u8) { return 0 }
  return 1
1258}
1259func nd_is_apply(s: *u8) -> i64 {
  let a: *u8 = "--apply" as *u8
  var i: i64 = 0
  while i < 7 { if s[i] != a[i] { return 0 } i = i + 1 }
  if s[7] != (0 as u8) { return 0 }
  return 1
1265}
1266func nd_is_census(s: *u8) -> i64 {
  if s[0] != (99 as u8) { return 0 }
  if s[1] != (101 as u8) { return 0 }
  if s[2] != (110 as u8) { return 0 }
  if s[3] != (115 as u8) { return 0 }
  if s[4] != (117 as u8) { return 0 }
  if s[5] != (115 as u8) { return 0 }
  if s[6] != (0 as u8) { return 0 }
  return 1
1275}
1276// THE WHOLE CENSUS, IN THE ORGAN. Reads a relpath list, compares each pair under both roots, and
1277// writes one machine row per pair to stdout. No shell loop, no sed, no second implementation of any
1278// ruler -- every emitted field is read straight out of nd_n[] after the SAME nd_run_pair the
1279// single-pair mode calls.
1280//   => *THE CURE FOR TWO IMPLEMENTATIONS OF ONE RULER IS NOT TO SYNC THEM, IT IS TO DELETE ONE.
1281// A row that cannot be read emits decision=UNREADABLE rather than being skipped: a census that
1282// silently drops rows reports a denominator it did not measure.
1283// JUDGE AND ADOPT IN ONE ORGAN. The converge_*.sh scripts this replaces each looped over a list,
1284// invoked the organ, parsed `unitSurplusB` and `lostComments` back out with sed, re-implemented the
1285// precedence in shell, and then copied. Three of the four steps were the organ's job.
1286// Dry by default: `adopt` reports, `adopt ... --apply` writes. A campaign whose default is to mutate
1287// is a campaign that will mutate by accident.
1288func nd_adopt(listp: *u8, aroot: *u8, broot: *u8, iroot: *u8, apply: i64) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  ln[0] = 0
  let lb: *u8 = sys_read_file(listp, ln)
  if (lb as i64) == 0 {
      nd_puts("# ADOPT RED -- cannot read the relpath list\n" as *u8)
      sys_exit(3)
      return 3
  }
  let n: i64 = ln[0]
  let pa: *u8 = sys_mmap(ND_MAGIC_8192)
  let pb: *u8 = sys_mmap(ND_MAGIC_8192)
  // THE CAMPAIGN HANDS ITS VERIFIER A POPULATION ONLY IT COULD HAVE WRITTEN. <list>.adopted is
  // truncated here and appended to ONLY on a successful write, so nx_campaign_verify's denominator
  // is exactly what this run changed -- not what a dry run listed, and not what a previous run left
  // behind. That is not hypothetical: a shell version of this campaign appended from its DRY RUN
  // too, and a later proof reported rows=89 (54 distinct, 35 duplicates) for a run that had adopted
  // 40. It PASSED, on a population that was not the one reported.
  //   => *A VERIFIER IS ONLY AS HONEST AS THE LIST IT IS HANDED.
  let alp: *u8 = sys_mmap(ND_MAGIC_8192)
  var ao: i64 = 0
  while listp[ao] != (0 as u8) { alp[ao] = listp[ao]; ao = ao + 1 }
  let asfx: *u8 = ".adopted" as *u8
  var ak: i64 = 0
  while asfx[ak] != (0 as u8) { alp[ao] = asfx[ak]; ao = ao + 1; ak = ak + 1 }
  alp[ao] = 0 as u8
  var afd: i64 = 0 - 1
  if apply == 1 { afd = sys_openat_wr(alp, 0x1a4) }
  var rows: i64 = 0
  var ok: i64 = 0
  var wrote: i64 = 0
  var failed: i64 = 0
  var p: i64 = 0
  while p < n {
      let base: i64 = lb as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if lb[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var t: i64 = e
      if t > p { if lb[t-1] == (ND_CR as u8) { t = t - 1 } }
      lb[t] = 0 as u8
      let rel: *u8 = (base + p) as *u8
      if rel[0] != (0 as u8) {
          nd_join_root(aroot, rel, pa)
          nd_join_root(broot, rel, pb)
          let d: i64 = nd_run_pair(pa, pb, iroot, 1, 0, 0 as *i64)
          rows = rows + 1
          if d == 1 {
              ok = ok + 1
              if apply == 1 {
                  let rc: i64 = nd_copy_atomic(pa, pb)
                  if rc >= 0 {
                      wrote = wrote + 1
                      if afd >= 0 {
                          var rl: i64 = 0
                          while rel[rl] != (0 as u8) { rl = rl + 1 }
                          sys_write(afd, rel, rl)
                          sys_write(afd, "\n" as *u8, 1)
                      }
                  } else {
                      failed = failed + 1
                      nd_puts("  WRITE-FAILED rc=" as *u8); nd_putn(rc)
                      nd_puts(" " as *u8); nd_puts(rel); nd_puts("\n" as *u8)
                  }
              }
          }
      }
      p = e + 1
  }
  if afd >= 0 { sys_fsync(afd); sys_close(afd) }
  if apply == 1 { nd_puts("# adopted list: " as *u8); nd_puts(alp); nd_puts("\n" as *u8) }
  nd_puts("# ADOPT rows=" as *u8); nd_putn(rows)
  nd_puts(" adoptable=" as *u8); nd_putn(ok)
  nd_puts(" written=" as *u8); nd_putn(wrote)
  nd_puts(" writeFailed=" as *u8); nd_putn(failed)
  if apply == 0 { nd_puts(" (DRY RUN -- pass --apply to write)" as *u8) }
  nd_puts("\n" as *u8)
  // A write that failed must not be reported as a clean run: the caller's next step is a proof over
  // the adopted list, and a silent shortfall would make that proof measure a smaller population.
  if failed > 0 { sys_exit(1); return 1 }
  sys_exit(0)
  return 0
1374}
1375func nd_census(listp: *u8, aroot: *u8, broot: *u8, iroot: *u8) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  ln[0] = 0
  let lb: *u8 = sys_read_file(listp, ln)
  if (lb as i64) == 0 {
      nd_puts("# CENSUS RED -- cannot read the relpath list\n" as *u8)
      sys_exit(3)
      return 3
  }
  let n: i64 = ln[0]
  let pa: *u8 = sys_mmap(ND_MAGIC_8192)
  let pb: *u8 = sys_mmap(ND_MAGIC_8192)
  var rows: i64 = 0
  var adopt: i64 = 0
  var p: i64 = 0
  while p < n {
      let base: i64 = lb as i64
      var e: i64 = p
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if lb[e] == (ND_LF as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var t: i64 = e
      if t > p { if lb[t-1] == (ND_CR as u8) { t = t - 1 } }
      lb[t] = 0 as u8
      let rel: *u8 = (base + p) as *u8
      if rel[0] != (0 as u8) {
          nd_join_root(aroot, rel, pa)
          nd_join_root(broot, rel, pb)
          let d: i64 = nd_run_pair(pa, pb, iroot, 1, 0, 0 as *i64)
          rows = rows + 1
          if d == 1 { adopt = adopt + 1 }
          nd_puts(rel); nd_puts("	" as *u8)
          if d == 1 { nd_puts("ADOPT-A" as *u8) } else { nd_puts("REFUSE" as *u8) }
          nd_puts("	" as *u8); nd_putn(nd_n[7])
          nd_puts("	" as *u8); nd_putn(nd_n[8])
          nd_puts("	" as *u8); nd_putn(nd_n[13])
          nd_puts("	" as *u8); nd_putn(nd_n[9])
          nd_puts("	" as *u8); nd_putn(nd_n[14])
          nd_puts("\n" as *u8)
      }
      p = e + 1
  }
  nd_puts("# CENSUS rows=" as *u8); nd_putn(rows)
  nd_puts(" adoptable=" as *u8); nd_putn(adopt)
  nd_puts(" refused=" as *u8); nd_putn(rows - adopt)
  nd_puts("\n" as *u8)
  sys_exit(0)
  return 0
1426}
1427func main(argc: i64, argv: *i64) -> i64 {
  nd_num = sys_mmap(ND_NUMBUF)
  nd_rev = sys_mmap(ND_NUMBUF)
  nd_tok = sys_mmap(ND_TOK)
  if argc < 3 {
      nd_puts("usage: nx_normdiff <fileA> <fileB> [outfile] [consttab]\n" as *u8)
      nd_puts("  Answers: is this difference made of CODE, or of COSMETICS?\n" as *u8)
      nd_puts("  verdict_raw  = nx_srcdiff semantics (the GUARD -- what may safely be ACTED on)\n" as *u8)
      nd_puts("  verdict_norm = after dropping comments, collapsing whitespace, and resolving\n" as *u8)
      nd_puts("                 consts from [consttab] to their DECLARED values (the CENSUS).\n" as *u8)
      nd_puts("  COSMETIC-ONLY = raw says BIDIRECTIONAL but normalised says A covers B: adopting A\n" as *u8)
      nd_puts("                 is CODE-safe. Any B-only comment it would destroy is printed.\n" as *u8)
      nd_puts("  Const values come from EACH FILE'S OWN declarations (99.946% are file-local).\n" as *u8)
      nd_puts("  [consttab] is an optional NAME<TAB>VALUE fallback; file-local always wins.\n" as *u8)
      nd_puts("  [importroot] resolves A imports not in A own directory (e.g. a bare\n" as *u8)
      nd_puts("  nx_syscalls.nx imported from _hdl_build/). verdict_unit needs it.\n" as *u8)
      nd_puts("  Values are READ, never inferred: LZ4_MAGIC_0 is declared 0x04, so a name-digit\n" as *u8)
      nd_puts("  un-lift would equate 0 with 4 and call two different files identical.\n" as *u8)
      sys_exit(2)
      return 2
  }
  nd_rka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_rca = sys_mmap(ND_SLOTS * 8) as *i64
  nd_rkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_rcb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_nka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_nca = sys_mmap(ND_SLOTS * 8) as *i64
  nd_nkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ncb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ack = sys_mmap(ND_SLOTS * 8) as *i64
  nd_acv = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ctka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ctva = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ctkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ctvb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_carena_n = sys_mmap(16) as *i64
  nd_bcl = sys_mmap(ND_BCL_CAP * 16) as *i64
  nd_bcl_n = sys_mmap(16) as *i64
  nd_uka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_uca = sys_mmap(ND_SLOTS * 8) as *i64
  nd_ua_n = sys_mmap(16) as *i64
  nd_imp = sys_mmap(ND_MAXIMP * 8) as *i64
  nd_imp_n = sys_mmap(16) as *i64
  nd_asl = sys_mmap(ND_SURP_CAP * 8) as *i64
  nd_asl_n = sys_mmap(16) as *i64
  nd_bsl = sys_mmap(ND_SURP_CAP * 8) as *i64
  nd_bsl_n = sys_mmap(16) as *i64
  nd_gen = sys_mmap(16) as *i64
  nd_gen[0] = 1
  nd_la = sys_mmap(16) as *i64
  nd_lb = sys_mmap(16) as *i64
  nd_ipath = sys_mmap(ND_MAGIC_8192)
  nd_used = sys_mmap(ND_SURP_CAP)
  nd_na = sys_mmap(ND_ARENA)
  nd_nb = sys_mmap(ND_ARENA)
  nd_ca_buf = sys_mmap(ND_ARENA)
  nd_carena = sys_mmap(ND_ARENA)
  nd_ua = sys_mmap(ND_ARENA)
  nd_g_rka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_rkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_nka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_nkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_uka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_ack = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_ctka = sys_mmap(ND_SLOTS * 8) as *i64
  nd_g_ctkb = sys_mmap(ND_SLOTS * 8) as *i64
  nd_n = sys_mmap(128) as *i64
  nd_out_n = sys_mmap(16) as *i64
  nd_na_n = sys_mmap(16) as *i64
  nd_nb_n = sys_mmap(16) as *i64
  nd_ca_n = sys_mmap(16) as *i64
  nd_out = sys_mmap(ND_OUTBUF)
  nd_out_n[0] = 0
  nd_na_n[0] = 0
  nd_nb_n[0] = 0
  nd_ca_n[0] = 0
  nd_carena_n[0] = 0
  nd_bcl_n[0] = 0
  nd_ua_n[0] = 0
  nd_imp_n[0] = 0
  nd_asl_n[0] = 0
  nd_bsl_n[0] = 0
  var z: i64 = 0
  while z < 12 { nd_n[z] = 0; z = z + 1 }
1511
1512// ONE PAIR, ONE ANSWER -- extracted from main so a BATCH can call it without a shell loop.
1513// The operator directive is the estate doctrine: NishiLang for everything, shell is break-glass
1514// only, and "every step that computes, decides, filters, counts or formats is an organ". The
1515// census driver I had written used `sed` to parse this organ's own stdout and a `while read`
1516// loop to iterate -- shell doing the filtering and the formatting, one process per pair.
1517//   => *IF THE ANSWER HAS TO BE PARSED BACK OUT OF STDOUT BY A SHELL, THE ORGAN STOPPED ONE
1518//      STEP SHORT. Emit the row yourself.
1519// `quiet` suppresses the human report so census mode emits ONLY machine rows; every verdict is
1520// left in nd_n[] for the caller to format. Returns 1 if the DECISION was ADOPT-A, else 0.
  // ---- DISPATCH ----
  // census: iterate a relpath list IN THIS PROCESS. The shell driver it replaces launched one
  // process per pair (measured: 79 ms of bare `wsl` launch against 19 ms of actual work) and then
  // parsed the verdicts back out with `sed`. Both halves were the shell doing the organ's job.
  if argc > 1 { if nd_is_adopt(argv[1] as *u8) == 1 {
      if argc < 6 {
          nd_puts("usage: nx_normdiff adopt <relpath-list> <A-root> <B-root> <import-root> [--apply]\n" as *u8)
          nd_puts("  Judges every row and, with --apply, ATOMICALLY copies A over B where the DECISION\n" as *u8)
          nd_puts("  is ADOPT-A. Dry by default. Verify afterwards with nx_campaign_verify.\n" as *u8)
          sys_exit(2)
          return 2
      }
      var ap: i64 = 0
      if argc > 6 { if nd_is_apply(argv[6] as *u8) == 1 { ap = 1 } }
      return nd_adopt(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, argv[5] as *u8, ap)
  } }
  if argc > 1 { if nd_is_census(argv[1] as *u8) == 1 {
      if argc < 6 {
          nd_puts("usage: nx_normdiff census <relpath-list> <A-root> <B-root> <import-root>\n" as *u8)
          nd_puts("  Emits one TSV row per pair: relpath, decision, verdict_supersede, normSurplusA,\n" as *u8)
          nd_puts("  normSurplusB, unitSurplusB, lostComments -- every field COPIED from the same code\n" as *u8)
          nd_puts("  path the single-pair mode runs, so there is no second ruler to drift.\n" as *u8)
          sys_exit(2)
          return 2
      }
      return nd_census(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, argv[5] as *u8)
  } }
  nd_run_pair(argv[1] as *u8, argv[2] as *u8, argv[5] as *u8, 0, argc, argv)
  sys_exit(0)
  return 0
1551}
nx_normdiff.nx source

`nx_normdiff.nx` source
