code wiki / _hdl_build / nx_orchestrate.nx
`nx_orchestrate.nx` source

↩ module page · 421 lines · 24799 B
1// nx_orchestrate.nx -- auto lane (eats debt seq163). WAIT-FOR-OPENING QUEUE: sessions QUEUE actions blocked
2// by a sibling's in-flight work instead of colliding. Each knowledge/store/deployq- row =
3//   id | title | precondition | status | planid | note
4// precondition = a CHECKABLE predicate, now COMPOUND-capable (v2, 2026-07-20 -- for safe mgmt deploys that
5// must fire only when the fix is STAGED *and* mgmt is CALM):
6//   exists:<path> | contains:<path>:<needle>   -- single, OR
7//   headroom:[<floor_mb>[:<max_centiload>]]     -- the box has build headroom NOW (2026-08-18): forks
8//        nx_build_admit check [floor] [max]; satisfied iff it GRANTS (exit 0). QUEUE/DENY-MEM/
9//        unreadable-proc all WAIT -- a guard that cannot measure must not fire (fail-closed). This is
10//        the wait-for-opening absorber nx_build_admit's own header says its QUEUE verdict was designed
11//        for, and that /api/build's REFUSED-LOAD ("nothing is queued for you anywhere") had never
12//        been given: a queued build row `headroom: -> plan build-<target>` now fires on the poller
13//        pass after the opening appears, instead of a human re-issuing it by hand.
14//   <pred> && <pred>                            -- AND of two (BOTH must hold to fire)
15// (e.g. exists:nx_mgmt_api.elf.new && contains:knowledge/status/api_contract.log:VERDICT=GREEN).
16// This POLLER (cron */5, non-blocking) evaluates every `queued` row: satisfied -> FIRE the row's plan via
17// nx_plan_run (reusing its allowlist+pinned-arg security WHOLESALE -- an action is a pre-seeded plan-
18// workflow, never arbitrary exec) and re-put the row status=fired-rc<N>; unsatisfied -> WAIT (logged, no
19// dead thread, no clobber). SOTA: Temporal durable await-condition, sovereign. Never-brick: fires only plans.
20//   nx_orchestrate run [qprefix] [outlog]
21// ENVELOPE v4 (2026-08-29): scan UNCAPPED -- the v3 cap counted SCANNED lines, so 63 dead history rows
22// at the plane head exhausted it and every queued row past index 63 was silently unreachable (measured
23// live: 135 queued rows, fired=0 on every pass, first queued row at plane index exactly 64). A CAP MUST
24// BOUND WORK, NOT SCAN: evaluations of queued rows cap at OC_EVAL_CAP, fires at OC_FIRE_CAP, overflow is
25// COUNTED AND PRINTED (deferred= / fire_deferred=), never dropped in silence. ONE pass at a time (flock;
26// a slow pass makes the next refuse rather than double-fire rows still marked queued).
27// exit: 0 ran (counts printed, or PASS-ALREADY-RUNNING) | 4 queue unreadable | 2 usage.
28// license_tier: ORIGINAL   expect_exit: 0
29import "nx_tool_run.nx"
30const K_MAGIC_30000: i64 = 30000
31const K_MAGIC_262144: i64 = 262144
32const K_MAGIC_262160: i64 = 262160
33const K_MAGIC_65536: i64 = 65536
34const K_MAGIC_32768: i64 = 32768
35const K_MAGIC_65535: i64 = 65535
36// v4 work caps (see ENVELOPE above). OC_EVAL_CAP keeps the incumbent 64-per-pass envelope but counts
37// EVALUATIONS of queued rows (each may fork the admit check), never scanned lines. OC_FIRE_CAP: a fire
38// is a sequential nx_plan_run build measured ~40 s at load1_centi=1060; 4 keeps a typical pass inside
39// one */5 cron interval while draining 48+ rows/hour -- pacing, not correctness (the flock owns
40// correctness). OC_FIRE_TIMEOUT_MS: a wedged plan_run must not hold the pass lock forever; ~15x the
41// measured loaded build time.
42const OC_EVAL_CAP: i64 = 64
43const OC_FIRE_CAP: i64 = 4
44const OC_FIRE_TIMEOUT_MS: i64 = 600000
45const OC_LOCK: *u8 = "knowledge/status/orchestrate.lock"
46
47func oc_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
48func oc_b(rep: *u8, pos: i64, s: *u8) -> i64 { var p: i64 = pos; var i: i64 = 0; while s[i] != (0 as u8) { if p < K_MAGIC_30000 { rep[p] = s[i]; p = p + 1 } i = i + 1 } return p }
49func oc_bn(rep: *u8, pos: i64, v: i64) -> i64 { var p: i64 = pos; var m: i64 = v; if m < 0 { if p < K_MAGIC_30000 { rep[p] = 45 as u8; p = p + 1 } m = 0 - m } let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { if p < K_MAGIC_30000 { rep[p] = t[k - 1 - i]; p = p + 1 } i = i + 1 } return p }
50func oc_reads(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  return n
58}
59func oc_has(buf: *u8, s: i64, e: i64, pat: *u8) -> i64 {
  var pl: i64 = 0
  while pat[pl] != (0 as u8) { pl = pl + 1 }
  if pl == 0 { return 0 }
  var i: i64 = s
  var hit: i64 = 0
  while i + pl <= e {
      var k: i64 = 0
      var m: i64 = 1
      while k < pl { if buf[i + k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
      if m == 1 { hit = 1; i = e } else { i = i + 1 }
  }
  return hit
72}
73func oc_cpz(dst: *u8, cap: i64, buf: *u8, s: i64, e: i64) -> i64 {
  var d: i64 = 0
  var i: i64 = s
  while i < e { if d < cap - 1 { dst[d] = buf[i]; d = d + 1 } i = i + 1 }
  dst[d] = 0 as u8
  return d
79}
80// nx_build_admit is the ONE ruler for "does the box have headroom" (the same binary nx_sov_build_run
81// consults before every compile) -- composed, never re-derived. Bounded: a stuck admit cannot stall
82// the poller past OC_ADMIT_TIMEOUT_MS (it reads /proc; measured well under 100 ms).
83const OC_ADMIT: *u8 = "/volume1/homes/elderwesto/nishihost/nx_build_admit.elf"
84const OC_ADMIT_TIMEOUT_MS: i64 = 10000
85func oc_pre(s: *u8, pre: *u8) -> i64 {
  var i: i64 = 0
  while pre[i] != (0 as u8) { if s[i] != pre[i] { return 0 - 1 } i = i + 1 }
  return i
89}
90// evaluate ONE predicate (null-term): 1 satisfied, 0 unsatisfied, -2 malformed. fbuf = scratch 256KB.
91func oc_eval(pred: *u8, fpath: *u8, fneedle: *u8, fbuf: *u8) -> i64 {
  let ex: i64 = oc_pre(pred, "exists:" as *u8)
  if ex > 0 {
      var d2: i64 = 0
      var s2: i64 = ex
      while pred[s2] != (0 as u8) { if d2 < 598 { fpath[d2] = pred[s2]; d2 = d2 + 1 } s2 = s2 + 1 }
      fpath[d2] = 0 as u8
      let tfd: i64 = sys_openat_rd(fpath)
      if tfd >= 0 { sys_close(tfd); return 1 }
      return 0
  }
  let hr: i64 = oc_pre(pred, "headroom:" as *u8)
  if hr > 0 {
      // optional "<floor_mb>[:<max_centiload>]" -- passed through as the admit organ's own argv,
      // so its parsing (and its refusal of malformed numbers) stays the single source of truth.
      var d5: i64 = 0
      var s5: i64 = hr
      var seg: i64 = 0
      var stop5: i64 = 0
      while stop5 == 0 {
          let c: i64 = pred[s5]
          if c == 0 { stop5 = 1 } else {
              if c == 58 { seg = 1; s5 = s5 + 1; d5 = 0 } else {
                  if seg == 0 { if d5 < 62 { fpath[d5] = c as u8; d5 = d5 + 1; fpath[d5] = 0 as u8 } }
                  if seg == 1 { if d5 < 62 { fneedle[d5] = c as u8; d5 = d5 + 1; fneedle[d5] = 0 as u8 } }
                  s5 = s5 + 1
              }
          }
      }
      if seg == 0 { fneedle[0] = 0 as u8 }
      if hr == s5 { fpath[0] = 0 as u8 }   // bare "headroom:" -> defaults
      let av: *i64 = sys_mmap(8 * 5) as *i64
      av[0] = OC_ADMIT as i64
      av[1] = "check" as *u8 as i64
      var na: i64 = 2
      if fpath[0] != (0 as u8) { av[na] = fpath as i64; na = na + 1 }
      if fneedle[0] != (0 as u8) { av[na] = fneedle as i64; na = na + 1 }
      av[na] = 0
      let olen: *i64 = sys_mmap(16) as *i64
      let arc: i64 = tr_run_capture_to(OC_ADMIT, av, fbuf, K_MAGIC_262144, olen, OC_ADMIT_TIMEOUT_MS)
      if arc == 0 { return 1 }
      return 0
  }
  let co: i64 = oc_pre(pred, "contains:" as *u8)
  if co > 0 {
      var d3: i64 = 0
      var s3: i64 = co
      var stop: i64 = 0
      while stop == 0 { let c: i64 = pred[s3]; if c == 0 { stop = 1 } else { if c == 58 { stop = 2 } else { if d3 < 598 { fpath[d3] = c as u8; d3 = d3 + 1 } s3 = s3 + 1 } } }
      fpath[d3] = 0 as u8
      if stop != 2 { return 0 - 2 }
      var d4: i64 = 0
      var s4: i64 = s3 + 1
      while pred[s4] != (0 as u8) { if d4 < 598 { fneedle[d4] = pred[s4]; d4 = d4 + 1 } s4 = s4 + 1 }
      fneedle[d4] = 0 as u8
      let fn2: i64 = oc_reads(fpath, fbuf, K_MAGIC_262144)
      if fn2 < 0 { return 0 }
      return oc_has(fbuf, 0, fn2, fneedle)
  }
  return 0 - 2
151}
152// evaluate a (possibly compound A && B) precondition string.
153func oc_eval_pre(fpre: *u8, fpath: *u8, fneedle: *u8, fbuf: *u8, lbuf: *u8, rbuf: *u8) -> i64 {
  // find "&&"
  var amp: i64 = 0 - 1
  var i: i64 = 0
  while fpre[i] != (0 as u8) { if fpre[i] == (38 as u8) { if fpre[i+1] == (38 as u8) { amp = i; } } if amp >= 0 { i = i } i = i + 1 }
  if amp < 0 { return oc_eval(fpre, fpath, fneedle, fbuf) }
  // left = [0, amp) trimmed of trailing spaces; right = after amp+2, skipping leading spaces
  var le: i64 = amp
  while le > 0 { if fpre[le-1] == (32 as u8) { le = le - 1 } else { let z: i64 = le; le = 0 - 2 - z } }
  if le < 0 { le = 0 - 2 - le }
  var d: i64 = 0
  var j: i64 = 0
  while j < le { if d < 700 { lbuf[d] = fpre[j]; d = d + 1 } j = j + 1 }
  lbuf[d] = 0 as u8
  var rs: i64 = amp + 2
  var sk: i64 = 1
  while sk == 1 { if fpre[rs] == (32 as u8) { rs = rs + 1 } else { sk = 0 } }
  var d2: i64 = 0
  while fpre[rs] != (0 as u8) { if d2 < 700 { rbuf[d2] = fpre[rs]; d2 = d2 + 1 } rs = rs + 1 }
  rbuf[d2] = 0 as u8
  let l: i64 = oc_eval(lbuf, fpath, fneedle, fbuf)
  if l == (0 - 2) { return 0 - 2 }
  let r: i64 = oc_eval(rbuf, fpath, fneedle, fbuf)
  if r == (0 - 2) { return 0 - 2 }
  if l == 1 { if r == 1 { return 1 } }
  return 0
179}
180// THE RUNNER'S OWN ADMISSION REFUSAL, RECOGNISED IN THE FIRE CAPTURE (2026-09-02). nx_plan_run relays
181// nx_sov_build_run's stdout, and the runner prints the ONE literal `REFUSED-BUILD-ADMIT` when its admission
182// check (the same nx_build_admit ruler this poller consulted a moment earlier) says QUEUE. Keyed on the
183// runner's own verdict token rather than on the plan_run rc, because rc=5 is also what a genuine compile
184// failure returns -- and those two need OPPOSITE remedies (re-fire later vs fix the source). Composes
185// oc_has, the file's one substring scanner. Returns 1 iff the capture carries the refusal.
186func oc_runner_refused(cap: *u8, n: i64) -> i64 {
  if n <= 0 { return 0 }
  return oc_has(cap, 0, n, "REFUSED-BUILD-ADMIT" as *u8)
189}
190
191// ---- LIVE LINES (2026-09-02). A pass used to print NOTHING until it finished: its whole report sat in `rep`
192// and was written at the end, so a pass stalled inside a fire, a plane load or a plane put was indistinguishable
193// from one that had not started, and later cron passes could only say PASS-ALREADY-RUNNING (measured that day:
194// 25+ minutes of silence while the box was I/O-bound). A PROCESS THAT SAYS NOTHING UNTIL IT IS DONE CANNOT BE
195// TOLD FROM ONE THAT IS STUCK. These lines go straight to stdout AND the pass log BEFORE the step they announce,
196// so the last line of the log names the step a stalled pass is inside. The plane load, the one unbounded call
197// left in the pass, is now deadline-bounded like every fire.
198const OC_LOAD_TIMEOUT_MS: i64 = 120000   // nx_store_put load: 2x the worst fsync convoy measured (~60 s), well under one cron interval
199const OC_LIVE_CAP: i64 = 4096
200func oc_dec(v: i64, out: *u8) -> i64 {
  var m: i64 = v
  var o: i64 = 0
  if m < 0 { out[0] = 45 as u8; o = 1; m = 0 - m }
  if m == 0 { out[o] = 48 as u8; out[o + 1] = 0 as u8; return o + 1 }
  var nd: i64 = 0
  var mm: i64 = m
  while mm > 0 { nd = nd + 1; mm = mm / 10 }
  var i: i64 = nd - 1
  while m > 0 { out[o + i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
  out[o + nd] = 0 as u8
  return o + nd
212}
213func oc_live(outlog: *u8, a: *u8, b: *u8, c: *u8, d: *u8) -> i64 {
  let ln: *u8 = sys_mmap(OC_LIVE_CAP)
  var o: i64 = 0
  var i: i64 = 0
  while a[i] != (0 as u8) { if o < OC_LIVE_CAP - 2 { ln[o] = a[i]; o = o + 1 } i = i + 1 }
  i = 0
  while b[i] != (0 as u8) { if o < OC_LIVE_CAP - 2 { ln[o] = b[i]; o = o + 1 } i = i + 1 }
  i = 0
  while c[i] != (0 as u8) { if o < OC_LIVE_CAP - 2 { ln[o] = c[i]; o = o + 1 } i = i + 1 }
  i = 0
  while d[i] != (0 as u8) { if o < OC_LIVE_CAP - 2 { ln[o] = d[i]; o = o + 1 } i = i + 1 }
  ln[o] = 10 as u8
  o = o + 1
  sys_write(1, ln, o)
  let fd: i64 = sys_openat_append(outlog, 420)
  if fd >= 0 { sys_write(fd, ln, o); sys_close(fd) }
  sys_munmap(ln, OC_LIVE_CAP)
  return 0
231}
232
233func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { oc_w(2, "usage: nx_orchestrate run [qprefix] [outlog]\n" as *u8); sys_exit(2); return 2 }
  var qprefix: *u8 = "knowledge/store/deployq-" as *u8
  var outlog: *u8 = "knowledge/status/orchestrate.log" as *u8
  if argc >= 3 { qprefix = argv[2] as *u8 }
  if argc >= 4 { outlog = argv[3] as *u8 }
  // ONE PASS AT A TIME (v4): fires are sequential child builds, so a slow pass can outlive the cron
  // interval; the next pass must REFUSE, not double-fire rows still marked queued. flock releases on
  // process death by construction, so a crashed pass can never wedge the queue closed. The fd is held
  // open for the whole pass ON PURPOSE -- closing it would release the lock.
  let lkfd: i64 = sys_openat_wr(OC_LOCK, 420)
  if lkfd >= 0 {
      if sys_flock(lkfd, SYS_LOCK_EX + SYS_LOCK_NB) != 0 {
          oc_w(1, "ORCHESTRATE verdict=PASS-ALREADY-RUNNING (pass lock held by a live pass; not an error)\n" as *u8)
          sys_exit(0)
      }
  } else {
      oc_w(1, "ORCHESTRATE note=LOCK-UNAVAILABLE (cannot open lockfile; proceeding UNGUARDED -- overlap possible)\n" as *u8)
  }
  let ep: *u8 = sys_mmap(32)
  oc_dec(sys_now_realtime_sec(), ep)
  oc_live(outlog, "PASS-START epoch=", ep, " step=plane-load (bounded 120s; every fire bounded 600s; a pass that goes silent after this line is inside the step it last named)", "" as *u8)
  let SP: *u8 = "/volume1/homes/elderwesto/nishihost/nx_store_put.elf" as *u8
  let PR: *u8 = "/volume1/homes/elderwesto/nishihost/nx_plan_run.elf" as *u8
  let qcap: i64 = K_MAGIC_262144
  let qbuf: *u8 = sys_mmap(qcap + 16)
  let olen: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(16 * 8) as *i64
  av[0] = SP as i64
  av[1] = qprefix as i64
  av[2] = "load" as *u8 as i64
  av[3] = 0
  let lrc: i64 = tr_run_capture_to(SP, av, qbuf, qcap, olen, OC_LOAD_TIMEOUT_MS)   // BOUNDED (2026-09-02): the one call in this pass that could stall forever
  if lrc == (0 - 5) { oc_live(outlog, "ORCHESTRATE verdict=QUEUE-LOAD-TIMEOUT (nx_store_put load exceeded the 120 s bound -- the plane is fsync-bound; nothing fired, nothing changed; the next cron pass re-tries)", "" as *u8, "" as *u8, "" as *u8); sys_exit(4); return 4 }
  let qn: i64 = olen[0]
  if lrc == 127 { oc_w(1, "ORCHESTRATE verdict=QUEUE-UNREADABLE exec-127\n" as *u8); sys_exit(4); return 4 }
  if lrc < 0 { oc_w(1, "ORCHESTRATE verdict=QUEUE-UNREADABLE harness\n" as *u8); sys_exit(4); return 4 }
  let fid: *u8 = sys_mmap(128)
  let ftitle: *u8 = sys_mmap(800)
  let fpre: *u8 = sys_mmap(800)
  let fstat: *u8 = sys_mmap(64)
  let fplan: *u8 = sys_mmap(128)
  let fnote: *u8 = sys_mmap(800)
  let fpath: *u8 = sys_mmap(700)
  let fneedle: *u8 = sys_mmap(700)
  let lbuf: *u8 = sys_mmap(800)
  let rbuf: *u8 = sys_mmap(800)
  let stat2: *u8 = sys_mmap(64)
  let fbuf: *u8 = sys_mmap(K_MAGIC_262160)
  let cbuf: *u8 = sys_mmap(K_MAGIC_65536)
  let rep: *u8 = sys_mmap(K_MAGIC_32768)
  var p: i64 = 0
  p = oc_b(rep, p, "ORCHESTRATE run queue_bytes=" as *u8); p = oc_bn(rep, p, qn)
  p = oc_b(rep, p, " (v4 work-capped: scan uncapped, evals<=64, fires<=4/pass, overflow COUNTED as deferred; 256KB precond; predicates exists:/contains:/headroom: [&&]; fire=nx_plan_run timeout-bounded; pass flock)\n" as *u8)
  if qn >= qcap { p = oc_b(rep, p, "QUEUE-AT-CAPTURE-CAP: the plane load filled the 256KB buffer -- the TAIL (newest rows) may be MISSING from this pass; compact the plane or raise the cap DELIBERATELY\n" as *u8) }
  var fired: i64 = 0
  var waiting: i64 = 0
  var skipped: i64 = 0
  var malformed: i64 = 0
  var rows: i64 = 0
  var evald: i64 = 0
  var deferred: i64 = 0
  var fdeferred: i64 = 0
  var requeued: i64 = 0   // fires the RUNNER refused on its own admission -- the row stays queued (2026-09-02)
  var i: i64 = 0
  var ls: i64 = 0
  while i <= qn {
      var isend: i64 = 0
      if i == qn { isend = 1 } else { if qbuf[i] == (10 as u8) { isend = 1 } }
      if isend == 1 {
          if i > ls { if rows > (0 - 1) {
              rows = rows + 1
              let fs2: *i64 = sys_mmap(64) as *i64
              let fe2: *i64 = sys_mmap(64) as *i64
              var nf: i64 = 1
              fs2[0] = ls
              var q: i64 = ls
              while q < i { if qbuf[q] == (9 as u8) { if nf < 6 { fe2[nf-1] = q; fs2[nf] = q + 1; nf = nf + 1 } } q = q + 1 }
              fe2[nf-1] = i
              if nf >= 4 {
                  oc_cpz(fid, 128, qbuf, fs2[0], fe2[0])
                  oc_cpz(ftitle, 800, qbuf, fs2[1], fe2[1])
                  oc_cpz(fpre, 800, qbuf, fs2[2], fe2[2])
                  oc_cpz(fstat, 64, qbuf, fs2[3], fe2[3])
                  fplan[0] = 0 as u8
                  fnote[0] = 0 as u8
                  if nf >= 5 { oc_cpz(fplan, 128, qbuf, fs2[4], fe2[4]) }
                  if nf >= 6 { oc_cpz(fnote, 800, qbuf, fs2[5], fe2[5]) }
                  var isq: i64 = 0
                  if fstat[0] == 113 { if fstat[1] == 117 { if fstat[2] == 101 { if fstat[3] == 117 { if fstat[4] == 101 { if fstat[5] == 100 { if fstat[6] == (0 as u8) { isq = 1 } } } } } } }
                  if isq == 0 { skipped = skipped + 1 } else { if evald >= OC_EVAL_CAP { deferred = deferred + 1 } else {
                      evald = evald + 1
                      let sat: i64 = oc_eval_pre(fpre, fpath, fneedle, fbuf, lbuf, rbuf)
                      if sat == (0 - 2) {
                          malformed = malformed + 1
                          p = oc_b(rep, p, "MALFORMED-PRED id=" as *u8); p = oc_b(rep, p, fid); p = oc_b(rep, p, "\n" as *u8)
                      } else { if sat == 1 {
                          if fired >= OC_FIRE_CAP {
                              fdeferred = fdeferred + 1
                              p = oc_b(rep, p, "FIRE-DEFERRED id=" as *u8); p = oc_b(rep, p, fid); p = oc_b(rep, p, " (fire cap reached this pass; row stays queued)\n" as *u8)
                          } else {
                          if fplan[0] == (0 as u8) {
                              malformed = malformed + 1
                              p = oc_b(rep, p, "NO-PLANID id=" as *u8); p = oc_b(rep, p, fid); p = oc_b(rep, p, "\n" as *u8)
                          } else {
                              let av2: *i64 = sys_mmap(16 * 8) as *i64
                              av2[0] = PR as i64
                              av2[1] = fplan as i64
                              av2[2] = 0
                              let olen2: *i64 = sys_mmap(16) as *i64
                              oc_live(outlog, "FIRING id=", fid, " plan=", fplan)   // announced BEFORE the fire (bounded 600 s), so a silent pass names the fire it is inside
                              let prc: i64 = tr_run_capture_to(PR, av2, cbuf, K_MAGIC_65535, olen2, OC_FIRE_TIMEOUT_MS)
                              // A FIRE THE RUNNER REFUSED IS NOT A FIRE (2026-09-02). This pass's headroom: check GRANTed,
                              // then nx_sov_build_run consulted the SAME ruler milliseconds later and said QUEUE (the D-state
                              // count is volatile: MEASURED live this day, BQ-nx_mgmt_api fired rc=5 at procs_blocked=10 of 8
                              // right after a sibling fire loaded the box). The row used to be re-put as fired-rc5 and the
                              // build was FORGOTTEN by the very queue that exists to remember it -- 13 fired-rc5 rows sat on
                              // the plane that day, every one a build nobody re-issued. A QUEUE THAT MARKS A REFUSED BUILD
                              // AS FIRED IS DECORATION. Now: the row STAYS queued, the pass fires nothing further (the box
                              // just said no), and the report names it so a reader can tell a refusal from a compile failure.
                              if oc_runner_refused(cbuf, olen2[0]) == 1 {
                                  requeued = requeued + 1
                                  p = oc_b(rep, p, "ADMIT-REFUSED-AT-FIRE id=" as *u8); p = oc_b(rep, p, fid)
                                  p = oc_b(rep, p, " plan=" as *u8); p = oc_b(rep, p, fplan)
                                  p = oc_b(rep, p, " (the runner's own admission said QUEUE after this pass's headroom check GRANTed; row STAYS queued, no further fires this pass)\n" as *u8)
                                  fired = OC_FIRE_CAP
                              } else {
                              fired = fired + 1
                              var sp2: i64 = 0
                              let sfx: *u8 = "fired-rc" as *u8
                              while sfx[sp2] != (0 as u8) { stat2[sp2] = sfx[sp2]; sp2 = sp2 + 1 }
                              var m2: i64 = prc
                              if m2 < 0 { m2 = 99 }
                              if m2 >= 100 { m2 = 99 }
                              if m2 >= 10 { stat2[sp2] = (48 + (m2 / 10)) as u8; sp2 = sp2 + 1 }
                              stat2[sp2] = (48 + (m2 % 10)) as u8
                              stat2[sp2 + 1] = 0 as u8
                              let av3: *i64 = sys_mmap(16 * 8) as *i64
                              av3[0] = SP as i64
                              av3[1] = qprefix as i64
                              av3[2] = "put" as *u8 as i64
                              av3[3] = "nx_orchestrate" as *u8 as i64
                              av3[4] = fid as i64
                              av3[5] = ftitle as i64
                              av3[6] = fpre as i64
                              av3[7] = stat2 as i64
                              av3[8] = fplan as i64
                              av3[9] = fnote as i64
                              av3[10] = 0
                              let olen3: *i64 = sys_mmap(16) as *i64
                              tr_run_capture(SP, av3, cbuf, K_MAGIC_65535, olen3)
                              p = oc_b(rep, p, "FIRED id=" as *u8); p = oc_b(rep, p, fid)
                              p = oc_b(rep, p, " plan=" as *u8); p = oc_b(rep, p, fplan)
                              p = oc_b(rep, p, " rc=" as *u8); p = oc_bn(rep, p, prc)
                              p = oc_b(rep, p, "\n" as *u8)
                              }   // end of the not-refused branch (2026-09-02)
                          }
                          }
                      } else {
                          waiting = waiting + 1
                          p = oc_b(rep, p, "WAITING id=" as *u8); p = oc_b(rep, p, fid)
                          p = oc_b(rep, p, " precond=" as *u8); p = oc_b(rep, p, fpre)
                          p = oc_b(rep, p, "\n" as *u8)
                      } }
                  } }
              }
          } }
          ls = i + 1
      }
      i = i + 1
  }
  p = oc_b(rep, p, "SUMMARY rows=" as *u8); p = oc_bn(rep, p, rows)
  p = oc_b(rep, p, " fired=" as *u8); p = oc_bn(rep, p, fired)
  p = oc_b(rep, p, " waiting=" as *u8); p = oc_bn(rep, p, waiting)
  p = oc_b(rep, p, " skipped=" as *u8); p = oc_bn(rep, p, skipped)
  p = oc_b(rep, p, " malformed=" as *u8); p = oc_bn(rep, p, malformed)
  p = oc_b(rep, p, " evaluated=" as *u8); p = oc_bn(rep, p, evald)
  p = oc_b(rep, p, " deferred=" as *u8); p = oc_bn(rep, p, deferred)
  p = oc_b(rep, p, " fire_deferred=" as *u8); p = oc_bn(rep, p, fdeferred)
  p = oc_b(rep, p, " requeued=" as *u8); p = oc_bn(rep, p, requeued)
  p = oc_b(rep, p, "\n" as *u8)
  sys_write(1, rep, p)
  let lfd: i64 = sys_openat_append(outlog, 420)
  if lfd >= 0 { sys_write(lfd, rep, p); sys_close(lfd) }
  let tfd2: i64 = sys_openat_wr("knowledge/status/orchestrate.out.tmp" as *u8, 420)
  if tfd2 >= 0 { sys_write(tfd2, rep, p); sys_close(tfd2); sys_renameat("knowledge/status/orchestrate.out.tmp" as *u8, "knowledge/status/orchestrate.out" as *u8) }
  sys_exit(0)
  return 0
421}
nx_orchestrate.nx source

`nx_orchestrate.nx` source
