code wiki / _hdl_build / nx_oo_extract.nx
`nx_oo_extract.nx` source

↩ module page · 653 lines · 37236 B
1// nx_oo_extract.nx -- BYTE-PROVEN OO DUP-FUNCTION EXTRACTOR (the real "object-oriented without losing
2// functionality" operation, unblocked by the 2026-07-21 byte-equiv proof). Moves functions that are
3// DUPLICATED byte-identically across N consumers into a shared base lib, repoints each consumer to
4// import it, and COMMITS only if EVERY consumer's rebuild is BYTE-IDENTICAL to before (else REVERTS all).
5// never-brick + rule-13 (originals backed up). Every refusal carries verdict+reason+fix (operator law).
6//   argv: <funcname[,funcname...]> <baselib-srcpath> <buildonly-elf> <consumer-srcpath1> [consumer-srcpath2 ...]
7//         [--proof=bytes|behave] [--workload=<path>]
8// exit: 0 EXTRACTED | 1 REFUSED(reverted) | 2 usage/precondition | 3 io/build error(reverted)
9//
10// v2 (2026-08-18, the /compare generator dedup): TWO capabilities the single-function v1 could not do.
11//  (1) N FUNCTIONS IN ONE PASS. A comma-separated funcname list moves the whole shared set at once with ONE
12//      import line and ONE proof cycle. v1 needed N runs and each run left the consumer importing a lib that
13//      the NEXT run would rewrite -- and a base lib holding one function is not a base class, it is a shard.
14//  (2) BEHAVIOURAL PROOF. `--proof=behave` proves the extraction by the consumer's OUTPUT, not its image:
15//      each consumer is run BEFORE and AFTER over every argv line in --workload that names it, and the
16//      captured stdout must be byte-identical. Needed because an added `import` line legitimately reorders
17//      the compiled image (functions are laid out in source order), so `--proof=bytes` REFUSES a correct
18//      extraction; the byte proof stays the default because it is the stronger claim when it holds.
19//      Workload format: one line per run, `<consumer-target> <argv1> <argv2> ...`; a consumer with no
20//      workload line has NO proof and the run REFUSES (a proof over an empty set is not a proof).
21// A function is extracted only if its body is byte-identical across EVERY consumer; a divergent body is
22// REFUSED by name -- resolve by rename or by making them equal first, never by picking one.
23// license_tier: ORIGINAL   No hw writes (Rule 26).
24import "nx_seat_drive_lib.nx"
25import "nx_seg_store.nx"
26import "nx_deploy_lib.nx"
27import "nx_syscalls.nx"
28
29const OE_CAP: i64 = 2097152
30const OE_MAXC: i64 = 128
31const OE_MAXF: i64 = 64            // functions per extraction (argv[1] list); a REFUSED-by-count if exceeded
32const OE_NAME: i64 = 128           // one function-name slot
33const OE_MAXW: i64 = 256           // workload lines
34const OE_WARGV: i64 = 32           // argv tokens per workload line
35const OE_ABSPATH: i64 = 1024       // an absolute path buffer: start-cwd + /buildroot/_build/<target>.sov.elf
36
37func oe_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0
  var r: i64 = sys_read(fd, buf, cap - 1)
  while r > 0 { n = n + r; if n >= cap - 1 { r = 0 } else { r = sys_read(fd, buf + n, cap - 1 - n) } }
  sys_close(fd)
  return n
45}
46func oe_isid(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 48 { if c <= 57 { return 1 } }
  if c == 95 { return 1 }
  return 0
52}
53func oe_eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 { if an != bn { return 0 } var i: i64 = 0; while i < an { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
54func oe_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
55func oe_starts(s: *u8, p: *u8) -> i64 { var i: i64 = 0; while p[i] != (0 as u8) { if s[i] != p[i] { return 0 } i = i + 1 } return 1 }
56// find func <fname>( at a line start; out[0]=body-start(the 'f'), out[1]=body-end(next func or n); ret 1/0
57func oe_find_func(buf: *u8, n: i64, fname: *u8, out: *i64) -> i64 {
  var nl: i64 = 0
  while fname[nl] != (0 as u8) { nl = nl + 1 }
  var i: i64 = 0
  var bol: i64 = 1
  var fstart: i64 = 0 - 1
  while i < n {
      if bol == 1 {
          var m: i64 = 1
          if i + 5 + nl + 1 > n { m = 0 }
          if m == 1 { if buf[i] != (102 as u8) { m = 0 } }
          if m == 1 { if buf[i+1] != (117 as u8) { m = 0 } }
          if m == 1 { if buf[i+2] != (110 as u8) { m = 0 } }
          if m == 1 { if buf[i+3] != (99 as u8) { m = 0 } }
          if m == 1 { if buf[i+4] != (32 as u8) { m = 0 } }
          if m == 1 {
              var k: i64 = 0
              while k < nl { if buf[i+5+k] != fname[k] { m = 0; k = nl } else { k = k + 1 } }
          }
          if m == 1 { if buf[i+5+nl] != (40 as u8) { m = 0 } }
          if m == 1 {
              if fstart < 0 {
                  fstart = i
              } else {
                  out[0] = fstart; out[1] = i; return 1
              }
          } else {
              // any OTHER top-level declaration after we found ours ends the range: `func `, `const `,
              // `struct `, `import ` (2026-08-18: a `const` between two functions was being swallowed
              // into the earlier body, so two consumers differing only by a const's PLACEMENT read as
              // divergent functions).
              var isdecl: i64 = 0
              if i + 5 <= n { if buf[i] == (102 as u8) { if buf[i+1] == (117 as u8) { if buf[i+2] == (110 as u8) { if buf[i+3] == (99 as u8) { if buf[i+4] == (32 as u8) { isdecl = 1 } } } } } }
              if i + 6 <= n { if buf[i] == (99 as u8) { if buf[i+1] == (111 as u8) { if buf[i+2] == (110 as u8) { if buf[i+3] == (115 as u8) { if buf[i+4] == (116 as u8) { if buf[i+5] == (32 as u8) { isdecl = 1 } } } } } } }
              if i + 7 <= n { if buf[i] == (115 as u8) { if buf[i+1] == (116 as u8) { if buf[i+2] == (114 as u8) { if buf[i+3] == (117 as u8) { if buf[i+4] == (99 as u8) { if buf[i+5] == (116 as u8) { if buf[i+6] == (32 as u8) { isdecl = 1 } } } } } } } }
              if i + 7 <= n { if buf[i] == (105 as u8) { if buf[i+1] == (109 as u8) { if buf[i+2] == (112 as u8) { if buf[i+3] == (111 as u8) { if buf[i+4] == (114 as u8) { if buf[i+5] == (116 as u8) { if buf[i+6] == (32 as u8) { isdecl = 1 } } } } } } } }
              if isdecl == 1 { if fstart >= 0 { out[0] = fstart; out[1] = i; return 1 } }
          }
      }
      let c: i64 = buf[i] as i64
      if c == 10 { bol = 1 } else { bol = 0 }
      i = i + 1
  }
  if fstart >= 0 { out[0] = fstart; out[1] = n; return 1 }
  return 0
102}
103// TRIM TRAILING BLANK LINES from a found body (2026-08-18): the extent above runs to the next `func`
104// line, so it swallows the blank lines BETWEEN functions -- and two consumers that differ only by
105// "one blank line after kv_n" read as DIVERGENT. Blank lines are not part of a function; the move
106// carries the body up to its last non-blank line and the byte-identity test judges the code.
107func oe_trim_body_end(buf: *u8, out: *i64) -> i64 {
  // Walk back WHOLE LINES: a trailing line that is blank or begins with `//` (after indentation) is
  // not the function's -- it is whitespace, or the header comment of the NEXT declaration (the estate
  // documents a function in the lines ABOVE it). Stop at the first trailing line holding code.
  var e: i64 = out[1]
  let s: i64 = out[0]
  var go: i64 = 1
  while go == 1 {
      if e <= s { go = 0 } else {
          // find start of the last line ending at e (buf[e-1] is its last byte, or the '\n' before it)
          var le: i64 = e
          if le > s { if buf[le-1] == (10 as u8) { le = le - 1 } }
          var ls: i64 = le
          while ls > s { if buf[ls-1] == (10 as u8) { break } ls = ls - 1 }
          // classify the line buf[ls..le)
          var i: i64 = ls
          while i < le { if buf[i] != (32 as u8) { if buf[i] != (9 as u8) { break } } i = i + 1 }
          var drop: i64 = 0
          if i >= le { drop = 1 }
          if drop == 0 { if i + 1 < le { if buf[i] == (47 as u8) { if buf[i+1] == (47 as u8) { drop = 1 } } } }
          if ls == s { drop = 0 }   // never eat the function's own first line
          if drop == 1 { e = ls } else { go = 0 }
      }
  }
  out[1] = e
  return e
133}
134func oe_find_func_trim(buf: *u8, n: i64, fname: *u8, out: *i64) -> i64 {
  let r: i64 = oe_find_func(buf, n, fname, out)
  if r == 1 { oe_trim_body_end(buf, out) }
  return r
138}
139// build target (basename of srcpath minus .nx) via buildonly; snapshot buildroot/_build/<target>.sov.elf -> snappath
140func oe_build_snap(buildelf: *u8, target: *u8, snappath: *u8, buf: *u8) -> i64 {
  let art: *u8 = sys_mmap(512)
  // buildroot/_build/, NOT /tmp/: nx_sov_build_run has written _build/ (anchoring its own CWD to
  // buildroot/) since 2026-07-30. Reading /tmp here meant the baseline artifact was NEVER found, so
  // oe_build_snap returned 0 and every extraction ABORTED with no-baseline-artifact -- the byte-proof
  // that makes this extractor safe has been inoperative, and it reported the fault as the CONSUMER's
  // ("does-not-build-standalone") rather than its own.
  var o: i64 = sd_cat(art, 0, "buildroot/_build/" as *u8)
  o = sd_cat(art, o, target)
  o = sd_cat(art, o, ".sov.elf" as *u8)
  sys_unlinkat(art)
  let av: *i64 = sys_mmap(16) as *i64
  av[0] = target as i64
  dep_run_capture(buildelf, av, 1, "/tmp/oe_build.log" as *u8)
  let n: i64 = oe_read(art, buf, OE_CAP)
  if n > 0 {
      // the builder writes _build/<t>.sov.elf WITHOUT +x on this host, so a behavioural run's execve
      // failed EACCES -> silent exit 127 -> an empty capture that read as "the consumer emits nothing"
      // (the estate's inert-artifact landmine, measured 2026-08-19 on this very organ's first behave
      // run). The extractor owns this baseline artifact's lifecycle, so it makes it runnable itself.
      nx_chmod(art, MODE_0755)
      if (snappath as i64) != 0 { ss_writefile(snappath, buf, n) }
  }
  return n
164}
165// basename of a path (after last '/') into out; returns len
166func oe_base(path: *u8, out: *u8) -> i64 {
  var last: i64 = 0 - 1
  var i: i64 = 0
  while path[i] != (0 as u8) { if path[i] == (47 as u8) { last = i } i = i + 1 }
  var o: i64 = 0
  var j: i64 = last + 1
  while path[j] != (0 as u8) { out[o] = path[j]; o = o + 1; j = j + 1 }
  out[o] = 0 as u8
  return o
175}
176// target = basename minus ".nx"
177func oe_target(path: *u8, out: *u8) -> i64 {
  let bl: i64 = oe_base(path, out)
  if bl >= 3 { if out[bl-3] == (46 as u8) { out[bl-3] = 0 as u8; return bl - 3 } }
  return bl
181}
182// CONSUMER-CONST DEPENDENCY CHECK (2026-08-18, first real run): a moved body that reads a `const` the
183// CONSUMER declares compiles into a lib the parser reads BEFORE that const -- nx_parse: "module const
184// used before its declaration -- it would silently read 0". The extractor must see this in pass 1 and
185// refuse BY NAME, never discover it as a broken build in pass 5. Scans the consumer's `const NAME`
186// declarations and asks whether the body mentions NAME as a whole identifier. Returns 1 + prints the
187// name on the first hit, 0 when clean.
188func oe_body_uses_consumer_const(body: *u8, bn: i64, src: *u8, sn: i64, fname: *u8, cp: *u8) -> i64 {
  var i: i64 = 0
  var bol: i64 = 1
  while i + 6 < sn {
      if bol == 1 { if src[i] == (99 as u8) { if src[i+1] == (111 as u8) { if src[i+2] == (110 as u8) { if src[i+3] == (115 as u8) { if src[i+4] == (116 as u8) { if src[i+5] == (32 as u8) {
          // const NAME ... -> NAME = identifier run after "const "
          var ns: i64 = i + 6
          var ne: i64 = ns
          while ne < sn { if oe_isid(src[ne] as i64) == 0 { break } ne = ne + 1 }
          let nl: i64 = ne - ns
          if nl > 0 {
              // whole-identifier search of NAME inside body
              var j: i64 = 0
              while j + nl <= bn {
                  var m: i64 = 1
                  var k: i64 = 0
                  while k < nl { if body[j+k] != src[ns+k] { m = 0; k = nl } else { k = k + 1 } }
                  if m == 1 {
                      var lb: i64 = 0
                      if j > 0 { lb = oe_isid(body[j-1] as i64) }
                      var rb: i64 = 0
                      if j + nl < bn { rb = oe_isid(body[j+nl] as i64) }
                      if lb == 0 { if rb == 0 {
                          sd_w("NX-OO-EXTRACT verdict=REFUSED reason=function-" as *u8); sd_w(fname); sd_w("-reads-consumer-const-" as *u8)
                          let nm: *u8 = sys_mmap(nl + 1); var q: i64 = 0; while q < nl { nm[q] = src[ns+q]; q = q + 1 } nm[nl] = 0 as u8
                          sd_w(nm); sd_w("-declared-in:" as *u8); sd_w(cp)
                          sd_w(" fix=a-lib-is-parsed-BEFORE-the-consumer,-so-that-const-would-read-0;-either-move-the-const-into-the-lib-too,-pass-it-as-a-parameter,-or-leave-this-function-out-of-the-list. no-changes-made\n" as *u8)
                          return 1
                      } }
                  }
                  j = j + 1
              }
          }
      } } } } } } }
      if src[i] == (10 as u8) { bol = 1 } else { bol = 0 }
      i = i + 1
  }
  return 0
226}
227// LIB-IMPORT PLACEMENT (2026-08-18): the import goes AFTER the consumer's leading block of comments,
228// imports and consts -- never at byte 0. Placed first, the lib's bodies were parsed before the
229// consumer's own `import "nx_syscalls.nx"` and every MODE_*/K_MAGIC_* const they read "would silently
230// read 0" (measured). Returns the byte offset of the first line that is none of: blank, //, import, const.
231func oe_import_insert_at(src: *u8, sn: i64) -> i64 {
  var p: i64 = 0
  var last_ok: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if p >= sn { go = 0 } else {
          var e: i64 = p
          while e < sn { if src[e] == (10 as u8) { break } e = e + 1 }
          var i: i64 = p
          while i < e { if src[i] != (32 as u8) { break } i = i + 1 }
          var ok: i64 = 0
          if i >= e { ok = 1 }
          if ok == 0 { if i + 1 < e { if src[i] == (47 as u8) { if src[i+1] == (47 as u8) { ok = 1 } } } }
          if ok == 0 { if oe_starts(((src as i64) + i) as *u8, "import " as *u8) == 1 { ok = 1 } }
          if ok == 0 { if oe_starts(((src as i64) + i) as *u8, "const " as *u8) == 1 { ok = 1 } }
          if ok == 1 { last_ok = e + 1; p = e + 1 } else { go = 0 }
      }
  }
  if last_ok > sn { last_ok = sn }
  return last_ok
251}
252// split argv[1] "a,b,c" into the names table (OE_NAME stride, NUL-terminated); returns count (0 = empty/overflow)
253func oe_split_names(s: *u8, names: *u8) -> i64 {
  var cnt: i64 = 0
  var i: i64 = 0
  var o: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let c: i64 = s[i] as i64
      if c == 44 { names[cnt*OE_NAME + o] = 0 as u8; if o > 0 { cnt = cnt + 1 } o = 0; if cnt >= OE_MAXF { return 0 } }
      else { if c == 0 { names[cnt*OE_NAME + o] = 0 as u8; if o > 0 { cnt = cnt + 1 } go = 0 } else { if o < OE_NAME - 1 { names[cnt*OE_NAME + o] = c as u8; o = o + 1 } } }
      i = i + 1
  }
  return cnt
265}
266// BEHAVIOURAL RUN: execute buildroot/_build/<target>.sov.elf with the workload line's argv, stdout -> outfile.
267// Workload lines: "<target> <a1> <a2> ..." ; only lines whose first token equals target are run; returns runs done.
268// Every run's capture is a separate file (outprefix + index) so a mismatch names the exact argv line.
269// WORKLOAD CWD (2026-08-18, first real run): consumers that read relative data paths (the /compare
270// generators open knowledge/compare/<dom>.matrix from CWD=buildroot) captured EMPTY when forked from the
271// extractor's own CWD -- an empty proof the organ correctly refused. A workload line `@cwd <dir>` sets
272// the directory every FOLLOWING run's child chdirs into before exec; the elf path is made absolute from
273// the extractor's start directory first, so the chdir cannot break the exec.
274func oe_run_in(elf_abs: *u8, av: *i64, na: i64, outfile: *u8, cwd: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      if (cwd as i64) != 0 { if cwd[0] != (0 as u8) { sys_chdir(cwd) } }
      let fd: i64 = sys_openat_wr(outfile, MODE_0644)
      if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) }
      let argv: *i64 = sys_mmap(8 * (na + 2)) as *i64
      let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
      argv[0] = elf_abs as i64
      var i: i64 = 0
      while i < na { argv[i+1] = av[i]; i = i + 1 }
      argv[na+1] = 0
      sys_execve_clean(elf_abs, argv, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return (st[0] >> 8) & 0xff
292}
293func oe_behave(target: *u8, wl: *u8, wn: i64, outprefix: *u8, tokbuf: *u8) -> i64 {
  let elf: *u8 = sys_mmap(OE_ABSPATH)
  let here: *u8 = sys_mmap(OE_ABSPATH)
  sys_getcwd(here, OE_ABSPATH)
  var eo: i64 = sd_cat(elf, 0, here); eo = sd_cat(elf, eo, "/buildroot/_build/" as *u8); eo = sd_cat(elf, eo, target); eo = sd_cat(elf, eo, ".sov.elf" as *u8)
  let cwd: *u8 = sys_mmap(512)
  cwd[0] = 0 as u8
  let av: *i64 = sys_mmap(8 * OE_WARGV) as *i64
  let outp: *u8 = sys_mmap(512)
  var runs: i64 = 0
  var p: i64 = 0
  var line: i64 = 0
  while p < wn {
      var e: i64 = p
      while e < wn { if wl[e] == (10 as u8) { break } e = e + 1 }
      // tokenize wl[p..e) by spaces into tokbuf (NUL-separated), av[] points at each
      var na: i64 = 0
      var i: i64 = p
      var to: i64 = 0
      while i < e {
          while i < e { if wl[i] != (32 as u8) { break } i = i + 1 }
          if i < e {
              if na < OE_WARGV { av[na] = ((tokbuf as i64) + to) as i64; na = na + 1 }
              while i < e { if wl[i] == (32 as u8) { break } tokbuf[to] = wl[i]; to = to + 1; i = i + 1 }
              tokbuf[to] = 0 as u8; to = to + 1
          }
      }
      // `@cwd <dir>` directive: applies to every following run line
      if na >= 2 { if oe_streq(av[0] as *u8, "@cwd" as *u8) == 1 {
          var ci: i64 = 0
          let cd: *u8 = av[1] as *u8
          while cd[ci] != (0 as u8) { cwd[ci] = cd[ci]; ci = ci + 1 }
          cwd[ci] = 0 as u8
          na = 0
      } }
      if na >= 1 { if oe_streq(av[0] as *u8, target) == 1 {
          var oo: i64 = sd_cat(outp, 0, outprefix); oo = sd_cat(outp, oo, "." as *u8); oo = sd_num(outp, oo, line); outp[oo] = 0 as u8
          // pass argv[1..] to the elf (av[0] is the target name, the elf is argv[0] itself); the
          // capture path is made absolute too, since the child may chdir before it opens it.
          // UNBOUNDED BY CONTRACT, NOT BY OVERSIGHT: this tree's nx_deploy_lib twin carries no
          // deadline runner (dep_run_capture_bounded lives only in runtime/, the two trees have
          // diverged -- named here, not silently duplicated). A workload line must therefore be a
          // TERMINATING CLI run (a generator emit, a census, a probe), never a daemon or a serve verb.
          let rrc: i64 = oe_run_in(elf, ((av as i64) + 8) as *i64, na - 1, outp, cwd)
          if rrc == 127 {
              // exec itself failed (inert artifact / wrong path) -- say so, or the empty capture
              // reads as "the consumer emits nothing" and the wrong subject gets investigated.
              sd_w("OO-EXEC-FAIL elf=" as *u8); sd_w(elf); sd_w(" (rc=127: not-executable-or-absent; the capture for this line is meaningless)\n" as *u8)
          }
          runs = runs + 1
      } }
      line = line + 1
      p = e + 1
  }
  return runs
348}
349// VOLATILE-FIELD MASK (2026-08-19, first run on the /compare generators): their json carries
350// `"generated_unix":<epoch>` -- two byte-equal captures taken seconds apart differ ONLY there, so a
351// perfect extraction read as OO-CHANGED. Which fields are volatile is a property of the CONSUMER, so it
352// is DATA: a workload line `@volatile <token>` masks every digit-run following `"<token>":` in BOTH
353// captures before the compare (digits -> '0'; nothing else touched, so any other drift still fails).
354func oe_mask_volatile(b: *u8, n: i64, tok: *u8) -> i64 {
  var tl: i64 = 0
  while tok[tl] != (0 as u8) { tl = tl + 1 }
  if tl == 0 { return 0 }
  var i: i64 = 0
  while i + tl < n {
      var m: i64 = 1
      var k: i64 = 0
      while k < tl { if b[i+k] != tok[k] { m = 0; k = tl } else { k = k + 1 } }
      if m == 1 {
          var j: i64 = i + tl
          while j < n { let c: i64 = b[j] as i64; if c == 34 { j = j + 1 } else { if c == 58 { j = j + 1 } else { if c == 32 { j = j + 1 } else { break } } } }
          while j < n { let d: i64 = b[j] as i64; if d >= 48 { if d <= 57 { b[j] = 48 as u8; j = j + 1 } else { break } } else { break } }
          i = j
      } else { i = i + 1 }
  }
  return 0
371}
372// compare every "<prefix>.<i>" capture pair (before vs after) for lines naming target; returns mismatches
373func oe_behave_cmp(target: *u8, wl: *u8, wn: i64, prefa: *u8, prefb: *u8, ba: *u8, bb: *u8) -> i64 {
  let pa: *u8 = sys_mmap(512)
  let pb: *u8 = sys_mmap(512)
  var bad: i64 = 0
  var p: i64 = 0
  var line: i64 = 0
  while p < wn {
      var e: i64 = p
      while e < wn { if wl[e] == (10 as u8) { break } e = e + 1 }
      // first token
      var i: i64 = p
      while i < e { if wl[i] != (32 as u8) { break } i = i + 1 }
      var j: i64 = i
      while j < e { if wl[j] == (32 as u8) { break } j = j + 1 }
      var same: i64 = 1
      var k: i64 = 0
      while i + k < j { if target[k] == (0 as u8) { same = 0; k = j } else { if wl[i+k] != target[k] { same = 0; k = j } else { k = k + 1 } } }
      if same == 1 { if target[k] != (0 as u8) { same = 0 } }
      if same == 1 { if j > i {
          var oa: i64 = sd_cat(pa, 0, prefa); oa = sd_cat(pa, oa, "." as *u8); oa = sd_num(pa, oa, line); pa[oa] = 0 as u8
          var ob: i64 = sd_cat(pb, 0, prefb); ob = sd_cat(pb, ob, "." as *u8); ob = sd_num(pb, ob, line); pb[ob] = 0 as u8
          let na: i64 = oe_read(pa, ba, OE_CAP)
          let nb: i64 = oe_read(pb, bb, OE_CAP)
          // apply every @volatile mask declared in the workload to BOTH captures
          var vp: i64 = 0
          while vp < wn {
              var ve: i64 = vp
              while ve < wn { if wl[ve] == (10 as u8) { break } ve = ve + 1 }
              if oe_starts(((wl as i64) + vp) as *u8, "@volatile " as *u8) == 1 {
                  let tk: *u8 = sys_mmap(128)
                  var to3: i64 = 0
                  var vs: i64 = vp + 10
                  while vs < ve { if wl[vs] == (32 as u8) { break } if to3 < 127 { tk[to3] = wl[vs]; to3 = to3 + 1 } vs = vs + 1 }
                  tk[to3] = 0 as u8
                  if na > 0 { oe_mask_volatile(ba, na, tk) }
                  if nb > 0 { oe_mask_volatile(bb, nb, tk) }
              }
              vp = ve + 1
          }
          if na <= 0 { bad = bad + 1; sd_w("OO-BEHAVE-EMPTY(before) " as *u8); sd_w(target); sd_w(" line=" as *u8); let t0: *u8 = sys_mmap(32); sd_num(t0, 0, line); sd_w(t0); sd_w("\n" as *u8) }
          else { if oe_eq(ba, na, bb, nb) == 0 { bad = bad + 1; sd_w("OO-CHANGED(output) " as *u8); sd_w(target); sd_w(" line=" as *u8); let t1: *u8 = sys_mmap(32); sd_num(t1, 0, line); sd_w(t1); sd_w(" before=" as *u8); let t2: *u8 = sys_mmap(32); sd_num(t2, 0, na); sd_w(t2); sd_w("B after=" as *u8); let t3: *u8 = sys_mmap(32); sd_num(t3, 0, nb); sd_w(t3); sd_w("B\n" as *u8) } }
      } }
      line = line + 1
      p = e + 1
  }
  return bad
419}
420
421func main(argc: i64, argv: *i64) -> i64 {
  if argc < 5 { sd_w("usage: nx_oo_extract <funcname[,f2,...]> <baselib-srcpath> <buildonly-elf> <consumer-src...> [--proof=bytes|behave] [--workload=<path>]\n" as *u8); sys_exit(2); return 2 }
  let basepath: *u8 = argv[2] as *u8
  let buildelf: *u8 = argv[3] as *u8
  // options are trailing "--" args; consumers are everything between argv[4] and the first option
  var proof_behave: i64 = 0
  var wlpath: *u8 = 0 as *u8
  var nc: i64 = 0
  var ai: i64 = 4
  while ai < argc {
      let a: *u8 = argv[ai] as *u8
      if oe_starts(a, "--proof=" as *u8) == 1 {
          if oe_streq(((a as i64) + 8) as *u8, "behave" as *u8) == 1 { proof_behave = 1 }
          else { if oe_streq(((a as i64) + 8) as *u8, "bytes" as *u8) == 0 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=unknown-proof-mode fix=--proof=bytes|behave\n" as *u8); sys_exit(2); return 2 } }
      } else { if oe_starts(a, "--workload=" as *u8) == 1 { wlpath = ((a as i64) + 11) as *u8 }
      else { if oe_starts(a, "--" as *u8) == 1 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=unknown-option:" as *u8); sd_w(a); sd_w(" fix=see-usage\n" as *u8); sys_exit(2); return 2 }
      else { nc = nc + 1 } } }
      ai = ai + 1
  }
  if nc < 1 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=no-consumers fix=pass-at-least-one-consumer-src\n" as *u8); sys_exit(2); return 2 }
  if nc > OE_MAXC { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=too-many-consumers fix=split-the-run\n" as *u8); sys_exit(2); return 2 }
  let names: *u8 = sys_mmap(OE_MAXF * OE_NAME)
  let nf: i64 = oe_split_names(argv[1] as *u8, names)
  if nf < 1 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=funcname-list-empty-or-over-limit fix=comma-separated,-at-most-64\n" as *u8); sys_exit(2); return 2 }
  if proof_behave == 1 { if (wlpath as i64) == 0 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=proof=behave-needs---workload fix=pass---workload=<path>-with-one-'<target> <argv...>'-line-per-run\n" as *u8); sys_exit(2); return 2 } }
  let basebn: *u8 = sys_mmap(256)
  oe_base(basepath, basebn)
448
  let cbuf: *u8 = sys_mmap(OE_CAP)
  let rng: *i64 = sys_mmap(16) as *i64
  // PASS 1: every function must exist in every consumer with a byte-identical body. bodies[] holds the
  // reference copy of each (from consumer 0) for the lib; bl[] their lengths.
  let bodies: *u8 = sys_mmap(OE_CAP)
  let boff: *i64 = sys_mmap(8 * OE_MAXF) as *i64
  let blen: *i64 = sys_mmap(8 * OE_MAXF) as *i64
  var bused: i64 = 0
  var fi: i64 = 0
  while fi < nf {
      let fname: *u8 = ((names as i64) + fi*OE_NAME) as *u8
      var ci: i64 = 0
      var first: i64 = 1
      while ci < nc {
          let cp: *u8 = argv[4 + ci] as *u8
          let cn: i64 = oe_read(cp, cbuf, OE_CAP)
          if cn <= 0 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=consumer-unreadable:" as *u8); sd_w(cp); sd_w(" fix=verify-the-consumer-source-path\n" as *u8); sys_exit(2); return 2 }
          if oe_find_func_trim(cbuf, cn, fname, rng) != 1 {
              sd_w("NX-OO-EXTRACT verdict=ABORTED reason=function-" as *u8); sd_w(fname); sd_w("-not-defined-in:" as *u8); sd_w(cp)
              sd_w(" fix=only-pass-consumers-that-DEFINE-every-listed-function(check-funcmine-output)\n" as *u8); sys_exit(2); return 2
          }
          let bs: i64 = rng[0]
          let be: i64 = rng[1]
          if oe_body_uses_consumer_const(((cbuf as i64) + bs) as *u8, be - bs, cbuf, cn, fname, cp) == 1 { sys_exit(1); return 1 }
          if first == 1 {
              boff[fi] = bused; blen[fi] = be - bs
              var t: i64 = 0
              while t < be - bs { bodies[bused + t] = cbuf[bs + t]; t = t + 1 }
              bused = bused + (be - bs)
              first = 0
          } else {
              if oe_eq(((cbuf as i64) + bs) as *u8, be - bs, ((bodies as i64) + boff[fi]) as *u8, blen[fi]) == 0 {
                  sd_w("NX-OO-EXTRACT verdict=REFUSED reason=the-" as *u8); sd_w(fname); sd_w("-bodies-are-NOT-byte-identical-across-consumers(differs-in:" as *u8); sd_w(cp); sd_w(")" as *u8)
                  sd_w(" fix=only-byte-identical-duplicates-can-be-safely-extracted;-if-they-differ-they-are-DIVERGENT-resolve-by-rename-or-make-equal-first,-never-by-picking-one. no-changes-made\n" as *u8)
                  sys_exit(1); return 1
              }
          }
          ci = ci + 1
      }
      fi = fi + 1
  }
490
  // PASS 2: baseline every consumer (build snapshot; behavioural captures if asked) + backup its source
  let tgt: *u8 = sys_mmap(256)
  let snap: *u8 = sys_mmap(512)
  let bak: *u8 = sys_mmap(512)
  let wl: *u8 = sys_mmap(OE_CAP)
  var wn: i64 = 0
  if proof_behave == 1 {
      wn = oe_read(wlpath, wl, OE_CAP)
      if wn <= 0 { sd_w("NX-OO-EXTRACT verdict=ABORTED reason=workload-unreadable-or-empty:" as *u8); sd_w(wlpath); sd_w(" fix=one-'<target> <argv...>'-line-per-run\n" as *u8); sys_exit(2); return 2 }
  }
  let tokbuf: *u8 = sys_mmap(OE_CAP)
  let pref: *u8 = sys_mmap(512)
  var ci: i64 = 0
  while ci < nc {
      let cp: *u8 = argv[4 + ci] as *u8
      oe_target(cp, tgt)
      var so: i64 = sd_cat(snap, 0, "/tmp/oo_" as *u8); so = sd_cat(snap, so, tgt); so = sd_cat(snap, so, ".before" as *u8)
      let bn: i64 = oe_build_snap(buildelf, tgt, snap, cbuf)
      if bn <= 0 {
          // NAME THE RIGHT SUBJECT (2026-08-18, first real run): a missing baseline artifact was reported
          // as "consumer does not build standalone" when the builder had REFUSED ADMISSION under an I/O
          // storm (procs_blocked>=blocked_max) -- the box, not the consumer. Read the builder's own log
          // for its admission verdict and say which it was.
          let lg: *u8 = sys_mmap(OE_CAP)
          let ln: i64 = oe_read("/tmp/oe_build.log" as *u8, lg, OE_CAP)
          var admit_refused: i64 = 0
          if ln > 0 { if dp_contains(lg, ln, "REFUSED-BUILD-ADMIT" as *u8) == 1 { admit_refused = 1 } }
          if admit_refused == 1 {
              sd_w("NX-OO-EXTRACT verdict=ABORTED reason=builder-REFUSED-ADMISSION-under-load(box-saturated,-not-the-consumer:" as *u8); sd_w(tgt); sd_w(")" as *u8)
              sd_w(" fix=re-issue-when-/proc/loadavg-clears;-nothing-was-changed. no-changes-made\n" as *u8)
          } else {
              sd_w("NX-OO-EXTRACT verdict=ABORTED reason=consumer-" as *u8); sd_w(tgt); sd_w("-does-not-build-standalone(no-baseline-artifact)" as *u8)
              sd_w(" fix=byte-proof-needs-a-buildable-holder;-see-/tmp/oe_build.log. no-changes-made\n" as *u8)
          }
          sys_exit(3); return 3
      }
      if proof_behave == 1 {
          var po: i64 = sd_cat(pref, 0, "/tmp/oo_" as *u8); po = sd_cat(pref, po, tgt); po = sd_cat(pref, po, ".before" as *u8); pref[po] = 0 as u8
          let runs: i64 = oe_behave(tgt, wl, wn, pref, tokbuf)
          if runs == 0 {
              sd_w("NX-OO-EXTRACT verdict=ABORTED reason=consumer-" as *u8); sd_w(tgt); sd_w("-has-NO-workload-line(a-proof-over-the-empty-set-is-not-a-proof)" as *u8)
              sd_w(" fix=add-'<target> <argv...>'-lines-to-the-workload-for-every-consumer. no-changes-made\n" as *u8)
              sys_exit(2); return 2
          }
          sd_w("OO-BASELINE " as *u8); sd_w(tgt); sd_w(" runs=" as *u8); let rb: *u8 = sys_mmap(32); sd_num(rb, 0, runs); sd_w(rb); sd_w("\n" as *u8)
      }
      let cn: i64 = oe_read(cp, cbuf, OE_CAP)
      var bo: i64 = sd_cat(bak, 0, cp); bo = sd_cat(bak, bo, ".oobak" as *u8)
      ss_writefile(bak, cbuf, cn)
      ci = ci + 1
  }
542
  // PASS 3: write the base lib (header + every extracted body, in list order)
  let lib: *u8 = sys_mmap(OE_CAP)
  var lo: i64 = sd_cat(lib, 0, "// AUTO-EXTRACTED shared base (nx_oo_extract). license_tier: ORIGINAL  No hw writes (Rule 26).\n" as *u8)
  lo = sd_cat(lib, lo, "// functions: " as *u8); lo = sd_cat(lib, lo, argv[1] as *u8); lo = sd_cat(lib, lo, "\n" as *u8)
  // the lib declares its own foundation import so it reads standalone; the flattener dedups repeats
  lo = sd_cat(lib, lo, "import \"nx_syscalls.nx\"\n" as *u8)
  fi = 0
  while fi < nf {
      var t2: i64 = 0
      while t2 < blen[fi] { lib[lo] = bodies[boff[fi] + t2]; lo = lo + 1; t2 = t2 + 1 }
      if lo > 0 { if lib[lo-1] != (10 as u8) { lib[lo] = 10 as u8; lo = lo + 1 } }
      fi = fi + 1
  }
  ss_writefile(basepath, lib, lo)
557
  // PASS 4: edit each consumer (prepend ONE import, remove EVERY listed func def)
  let nfb: *u8 = sys_mmap(OE_CAP)
  ci = 0
  while ci < nc {
      let cp: *u8 = argv[4 + ci] as *u8
      var cn: i64 = oe_read(cp, cbuf, OE_CAP)
      fi = 0
      while fi < nf {
          let fname: *u8 = ((names as i64) + fi*OE_NAME) as *u8
          oe_find_func_trim(cbuf, cn, fname, rng)
          let bs: i64 = rng[0]
          let be: i64 = rng[1]
          var no: i64 = 0
          var t3: i64 = 0
          while t3 < bs { nfb[no] = cbuf[t3]; no = no + 1; t3 = t3 + 1 }
          t3 = be
          while t3 < cn { nfb[no] = cbuf[t3]; no = no + 1; t3 = t3 + 1 }
          // swap: cbuf <- nfb
          var t4: i64 = 0
          while t4 < no { cbuf[t4] = nfb[t4]; t4 = t4 + 1 }
          cn = no
          fi = fi + 1
      }
      // insert the ONE lib import after the consumer's leading comment/import/const block (see oe_import_insert_at)
      let at: i64 = oe_import_insert_at(cbuf, cn)
      var no2: i64 = 0
      var t5: i64 = 0
      while t5 < at { nfb[no2] = cbuf[t5]; no2 = no2 + 1; t5 = t5 + 1 }
      no2 = sd_cat(nfb, no2, "import \"" as *u8); no2 = sd_cat(nfb, no2, basebn); no2 = sd_cat(nfb, no2, "\"\n" as *u8)
      while t5 < cn { nfb[no2] = cbuf[t5]; no2 = no2 + 1; t5 = t5 + 1 }
      ss_writefile(cp, nfb, no2)
      ci = ci + 1
  }
591
  // PASS 5: rebuild each consumer and prove (bytes, or behaviour over the workload)
  var changed: i64 = 0
  let bufb: *u8 = sys_mmap(OE_CAP)
  let prefb: *u8 = sys_mmap(512)
  ci = 0
  while ci < nc {
      let cp: *u8 = argv[4 + ci] as *u8
      oe_target(cp, tgt)
      var so: i64 = sd_cat(snap, 0, "/tmp/oo_" as *u8); so = sd_cat(snap, so, tgt); so = sd_cat(snap, so, ".before" as *u8)
      let an: i64 = oe_build_snap(buildelf, tgt, 0 as *u8, cbuf)
      if an <= 0 {
          changed = changed + 1
          // same attribution as the pass-2 abort (a fix in one path and not its sibling is half a fix):
          // an admission-refused rebuild is the BOX, not the change -- it still counts as unverifiable
          // (so the revert below is correct), but the message must not indict the extraction.
          let lg2: *u8 = sys_mmap(OE_CAP)
          let ln2: i64 = oe_read("/tmp/oe_build.log" as *u8, lg2, OE_CAP)
          var adm2: i64 = 0
          if ln2 > 0 { if dp_contains(lg2, ln2, "REFUSED-BUILD-ADMIT" as *u8) == 1 { adm2 = 1 } }
          if adm2 == 1 { sd_w("OO-BUILD-ADMIT-REFUSED(box-saturated,-unverifiable-this-run) " as *u8); sd_w(tgt); sd_w(" fix=re-issue-when-load-clears\n" as *u8) }
          else { sd_w("OO-CHANGED(build-broke) " as *u8); sd_w(tgt); sd_w(" see=/tmp/oe_build.log\n" as *u8) }
      } else {
          if proof_behave == 0 {
              let sn: i64 = oe_read(snap, bufb, OE_CAP)
              if oe_eq(cbuf, an, bufb, sn) == 0 { changed = changed + 1; sd_w("OO-CHANGED(bytes) " as *u8); sd_w(tgt); sd_w("\n" as *u8) }
          } else {
              var po: i64 = sd_cat(pref, 0, "/tmp/oo_" as *u8); po = sd_cat(pref, po, tgt); po = sd_cat(pref, po, ".before" as *u8); pref[po] = 0 as u8
              var pb: i64 = sd_cat(prefb, 0, "/tmp/oo_" as *u8); pb = sd_cat(prefb, pb, tgt); pb = sd_cat(prefb, pb, ".after" as *u8); prefb[pb] = 0 as u8
              oe_behave(tgt, wl, wn, prefb, tokbuf)
              let bad: i64 = oe_behave_cmp(tgt, wl, wn, pref, prefb, cbuf, bufb)
              if bad > 0 { changed = changed + 1 }
          }
      }
      ci = ci + 1
  }
627
  if changed == 0 {
      sd_w("NX-OO-EXTRACT verdict=EXTRACTED reason=" as *u8); sd_w(argv[1] as *u8)
      sd_w("-moved-to-" as *u8); sd_w(basebn)
      sd_w("-and-all-" as *u8)
      let ob: *u8 = sys_mmap(32); sd_num(ob, 0, nc); sd_w(ob)
      if proof_behave == 0 { sd_w("-consumers-rebuilt-BYTE-IDENTICAL(behaviour-preserved)" as *u8) }
      else { sd_w("-consumers-rebuilt-and-every-workload-run-OUTPUT-IDENTICAL(behaviour-preserved-over-the-declared-workload)" as *u8) }
      sd_w(" fix=none-committed;-remove-the-.oobak-backups-when-satisfied\n" as *u8)
      sys_exit(0); return 0
  }
  // any consumer changed -> REVERT everything
  ci = 0
  while ci < nc {
      let cp: *u8 = argv[4 + ci] as *u8
      var bo: i64 = sd_cat(bak, 0, cp); bo = sd_cat(bak, bo, ".oobak" as *u8)
      let cn: i64 = oe_read(bak, cbuf, OE_CAP)
      if cn > 0 { ss_writefile(cp, cbuf, cn) }
      ci = ci + 1
  }
  sys_unlinkat(basepath)
  sd_w("NX-OO-EXTRACT verdict=REFUSED reason=" as *u8)
  let ob2: *u8 = sys_mmap(32); sd_num(ob2, 0, changed); sd_w(ob2)
  sd_w("-consumer(s)-changed-after-extraction(behaviour-NOT-preserved) fix=extraction-not-safe-here-see-OO-CHANGED-lines;-all-consumers-RESTORED-from-.oobak-and-the-base-lib-removed(safe)\n" as *u8)
  sys_exit(1)
  return 1
653}
nx_oo_extract.nx source

`nx_oo_extract.nx` source
