code wiki / _hdl_build / nx_page_verify.nx
`nx_page_verify.nx` source

↩ module page · 1006 lines · 59259 B
1// nx_page_verify.nx -- BROWSER-GRADE LIVE PAGE VERIFIER (the "my verify was shit" cure, operator 2026-07-16).
2// Status-200-on-the-page is NOT verification: a page can 200 while every image on it is broken (the /render3d
3// incident: the edge 301-strips trailing slashes, so RELATIVE img srcs resolve to the site root -> 404/fallback
4// -> broken images that a direct asset fetch never catches). This organ verifies a page THE WAY A BROWSER
5// EXPERIENCES IT:
6//   1. fetch the page (sovereign TLS, redirects followed) -- must be 200
7//   2. extract every asset ref (img/script src=, link href=)
8//   3. LAW CHECK: a RELATIVE asset ref = RED by construction on our slash-stripping edge (use absolute /path)
9//   4. fetch every same-origin asset -- 200 required
10//   5. DEEP-DECODE: PNG assets run through the full sovereign decoder (nx_png_decode: signature, IHDR,
11//      zlib inflate, unfilter incl Paeth) -- "200 + magic bytes" is not proof; DECODED WxH is
12//   6. an asset that answers with HTML (the 404-fallback class) = RED even though its status is 200
13// Composes nx_https_fetch_follow (the games_url_check fetch spine) + nx_png_decode. Exit = broken count.
14//   usage: nx_page_verify <https-url> [connect-host:port]     (run from repo root: needs data/mozilla_certdata.txt)
15//   [connect-host:port] = OPTIONAL connect-override (curl --connect-to): page + every asset fetch opens
16//   TCP+TLS to THIS endpoint while SNI/Host/cert-name stay the URL host -- use 127.0.0.1:8443 to verify
17//   our OWN vhosts deterministically from the sovereign edge (kills the DSM-nginx :443 coin-flip false-RED).
18// license_tier: ORIGINAL
19import "nx_syscalls.nx"
20import "nx_x509_trust_store.nx"
21import "nx_trust_store_load_from_certdata.nx"
22import "nx_https_url_connect.nx"
23import "nx_https_fetch_follow.nx"
24import "nx_png_decoder.nx"
25// ONE DEFINITION OF -AN IMG WITH USABLE ATTRIBUTES-, shared with the compare generator that WRITES
26// them, so the emitter and this ruler cannot drift into two answers (2026-08-26).
27import "nx_imgattr_lib.nx"
28import "nx_pageref_lib.nx"   // the asset-reference vocabulary: ONE owner, shared with nx_pageref_gate
29import "nx_sha256.nx"       // canonical artifact/evidence identity hashing
30
31const PV_CAP: i64 = 8388608      // the EYE must out-read the pages it audits (the 2MiB-truncation lesson)
32const PV_MAXREF: i64 = 256    // per-page ref ceiling; the compare gallery lane emits 15+ figures beside
                            // chrome refs and pushed 64 -- reaching this cap now ANNOUNCES (never a silent floor)
34// hoisted to satisfy the magic-number ratchet (rule 11 / LAW L001+L006, enforced at the
35// build gate by nx_magicratchet -- it REFUSED the seq911 build until the count went down).
36// Named for what they bound, not for their value, so a future reader can judge the size.
37const PV_CERTDATA_CAP: i64 = 4194304   // trust-store parse arena for mozilla_certdata.txt
38const PV_URL_CAP: i64 = 4096           // one absolute URL (origin, and each resolved ref)
39const PV_REF_MAX: i64 = 2048           // longest relative ref we will resolve
40// scratch for nx_pageref_lib's pr_attr_hit: [0]=bytes to skip to the value, [1]=the closing quote.
41// Two slots because the vocabulary answers two questions per hit, and one i64 is eight bytes.
42const PV_PROUT_SLOTS: i64 = 2
43const PV_WORD_BYTES:  i64 = 8
44const PV_FULLURL_CAP: i64 = 8192       // origin + ref joined
45// ATTRIBUTE DELIMITERS (2026-08-25) -- named so the BARE (unquoted) attribute scan reads as intent
46// rather than as character codes. HTML permits an unquoted attribute value, terminated by whitespace
47// or '>'. The 2026-08-18 fix taught this scanner BOTH QUOTE STYLES and stopped at two; our own
48// sites/nishifamily/world/foundation.html emits <img src=nx_worldpipe.png ...> with NO quotes, and
49// that page reported img tags=16 but refs resolved=1.
50const PV_ATTR_DQ: i64 = 34             // "
51const PV_ATTR_SQ: i64 = 39             // '
52const PV_ATTR_GT: i64 = 62             // >
53const PV_ATTR_SP: i64 = 32             // space
54const PV_ATTR_TAB: i64 = 9             // tab
55const PV_ATTR_LF: i64 = 10             // newline
56const PV_ATTR_CR: i64 = 13
57const PV_ATTR_LT: i64 = 60             // <
58// PV_TAG_LOOKBACK / pv_in_tag -- ADDED 2026-08-25, after the first POPULATION-SCALE run of the new
59// nx_sitesweep measured THIS scanner's bare-attribute branch firing on INLINE JAVASCRIPT. Adjudicated
60// by hand over four pages: /world/skull (3 refs) and /world/models (9) were REAL broken images, while
61// /atlashygiene reported AI_SYNTHESIZED / PRIMARY_EMPIRICAL x3 / COORDINATION_ROW and /listen reported
62// a fragment of minified script -- six refs that are JavaScript, not markup.
63// THE CAUSE IS STRUCTURAL, NOT A VOCABULARY GAP: a BARE attribute has no delimiter, so el.src=url
64// inside a script is byte-for-byte the same SHAPE as an unquoted src= on an img tag. A DETECTOR WITH
65// FALSE POSITIVES IS WORSE THAN NONE -- it teaches everyone to ignore it -- and this branch had just
66// been handed the whole site to shout at.
67// THE FIX IS HTML, NOT A BLOCKLIST: an attribute can only occur INSIDE an open tag, so scan back and
68// require the nearest angle bracket to be the opener. Inline script always sits after the bracket that
69// closed its script tag, so every JS occurrence is rejected BY CONSTRUCTION and no keyword list can
70// ever go stale.
71// APPLIED ONLY TO THE BARE FORM. The quoted forms are deliberately untouched: a quoted src assigned in
72// a script IS an asset the browser really fetches, and a relative one really does break under the same
73// edge rule -- narrowing those would LOSE true positives instead of removing false ones.
74// UNDECIDABLE REJECTS. A genuine attribute is always a few dozen bytes from its own opening bracket,
75// so the bound is unreachable for real markup; and an accusation is the wrong thing to make on a guess.
76const PV_TAG_LOOKBACK: i64 = 4096
77func pv_in_tag(page: *u8, at: i64) -> i64 {
  var b: i64 = at
  var back: i64 = 0
  while back < PV_TAG_LOOKBACK {
      if b <= 0 { return 0 }
      b = b - 1
      let c: i64 = page[b] as i64
      if c == PV_ATTR_LT { return 1 }
      if c == PV_ATTR_GT { return 0 }
      back = back + 1
  }
  return 0
89}             // carriage return
90
91// ============================================================================================
92// THE THIRD STATE -- "I COULD NOT REACH IT" IS NOT "IT IS BROKEN" (2026-08-22).
93// MEASURED: a seat ran this organ on a HEALTHY page from a CWD where the domain registry did not
94// resolve, the auto-override silently fell to DNS, :443 on the NAS is the co-squatting side, the
95// fetch NEVER CONNECTED (status=0 bytes=-2), and the verdict said RED. Two untouched control pages
96// returned byte-identical output; the loopback vantage served the same page 200 with every asset.
97// The page was fine. The verifier could not see it. And it reported that in the same word as a
98// page that is genuinely broken -- which is the failure mode that teaches everyone to ignore a
99// detector. AN AXIS THAT CANNOT SEE MUST ABSTAIN, NOT ACQUIT -- AND EQUALLY MUST NOT CONVICT.
100// The discriminator is already in the fetch layer's return contract and this organ was throwing it
101// away: nx_https_fetch_follow returns -NX_FF_<stage> with out_status[0] UNTOUCHED (0) when no HTTP
102// response was ever received. So: (n<0 AND status==0) = no server answered = UNOBSERVABLE, exit 3.
103// Any run where status!=0 means a server DID answer, and a wrong answer stays RED.
104// Exit 3 is the fleet's SKIP/UNOBSERVABLE code (nx_gate_verdict returns 3; /api/gate_run maps 3 ->
105// SKIP, excluded from RED). The trust-store-load failure below already exits 3 for the same reason:
106// it is a "could not look", not a "looked and it is broken". The RED exit (1) and the broken-count
107// exit are UNCHANGED, so every consumer that branches on 0/1 keeps its meaning; only runs that
108// previously LIED now say so. The verdict line stays LAST (gv_last_line anchors by position).
109const PV_EXIT_GREEN:        i64 = 0
110const PV_EXIT_RED:          i64 = 1
111const PV_EXIT_USAGE:        i64 = 2
112const PV_EXIT_UNOBSERVABLE: i64 = 3
113const PV_EXIT_UNMEASURED:   i64 = 4   // our-domain host with a malformed registry endpoint
114// fetch-layer stage codes, mirrored from nx_https_fetch_follow so the UNOBSERVABLE line can NAME
115// the stage that never completed instead of printing a bare negative number
116const PV_FF_BAD_URL:   i64 = 1
117const PV_FF_CONNECT:   i64 = 2
118const PV_FF_HANDSHAKE: i64 = 3
119const PV_FF_GET:       i64 = 4
120const PV_VANTAGE_CAP:  i64 = 320      // "dns:<host>" or "pinned:<a.b.c.d:port>" for the verdict line
121const PV_NO_STATUS:    i64 = 0        // out_status when no HTTP response was ever parsed
122
123// append NUL-terminated s into the vantage buffer at off; bounded by PV_VANTAGE_CAP (a vantage
124// string that does not fit is truncated AND announced by the cap, never silently overrun)
125func pv_vcat(d: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while s[i] != (0 as u8) { if o < PV_VANTAGE_CAP - 1 { d[o] = s[i]; o = o + 1 } i = i + 1 }
  d[o] = 0 as u8
  return o
131}
132func pv_stage_name(n: i64) -> *u8 {
  let code: i64 = 0 - n
  if code == PV_FF_BAD_URL   { return "bad-url" as *u8 }
  if code == PV_FF_CONNECT   { return "connect" as *u8 }
  if code == PV_FF_HANDSHAKE { return "tls-handshake" as *u8 }
  if code == PV_FF_GET       { return "http-get" as *u8 }
  return "fetch" as *u8
139}
140// 1 iff the fetch never produced an HTTP response: negative length AND no status was parsed.
141// A non-200 WITH a status is a server that answered (404, 500, a redirect loop) -> that is RED
142// territory and must NOT land here.
143func pv_unobservable(n: i64, status: i64) -> i64 {
  if n < 0 { if status == PV_NO_STATUS { return 1 } }
  return 0
146}
147
148func hw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
149// pv_normpath -- RFC 3986 5.2.4 remove_dot_segments over an ABSOLUTE PATH (2026-08-18). A browser
150// resolves src='/compare/graphics/../../world/x.png' to /world/x.png before it ever asks the edge; this
151// EYE fetched the literal string, got the client's own bad-url body (status=0, 82 bytes) and reported
152// BROKEN x5 / VERDICT=RED on a page whose every asset served 200 -- a false red on the ruler, the kind
153// everyone learns to ignore. Segments: '.' dropped, '..' pops one (never above root), else copied. In
154// place, same buffer, returns the new length. Only path bytes are touched (stops at '?' or '#').
155func pv_normpath(p: *u8) -> i64 {
  var r: i64 = 0
  var wpos: i64 = 0
  var n: i64 = 0
  while p[n] != (0 as u8) { if p[n] == (63 as u8) { break } if p[n] == (35 as u8) { break } n = n + 1 }
  let tail: i64 = n
  while r < n {
      // r sits on a '/', segment = bytes after it up to next '/' or end
      var e: i64 = r + 1
      while e < n { if p[e] == (47 as u8) { break } e = e + 1 }
      let sl: i64 = e - r - 1
      var dot: i64 = 0
      if sl == 1 { if p[r+1] == (46 as u8) { dot = 1 } }
      if sl == 2 { if p[r+1] == (46 as u8) { if p[r+2] == (46 as u8) { dot = 2 } } }
      if dot == 2 {
          // pop the last written segment (leave at least the root '/')
          if wpos > 0 { wpos = wpos - 1; while wpos > 0 { if p[wpos] == (47 as u8) { break } wpos = wpos - 1 } }
      } else { if dot == 0 {
          var k: i64 = r
          while k < e { p[wpos] = p[k]; wpos = wpos + 1; k = k + 1 }
      } }
      r = e
  }
  if wpos == 0 { p[0] = 47 as u8; wpos = 1 }
  // carry query/fragment forward untouched
  var t: i64 = tail
  var w2: i64 = wpos
  while p[t] != (0 as u8) { p[w2] = p[t]; w2 = w2 + 1; t = t + 1 }
  p[w2] = 0 as u8
  return w2
185}
186func pn(v: i64) -> i64 { let t: *u8=sys_mmap(24); var m: i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(24); var j: i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(1,b,k); return 0 }
187func pw(s: *u8, n: i64) -> i64 { sys_write(1, s, n); return 0 }
188
189func sw_starts(b: *u8, off: i64, lit: *u8) -> i64 {
  var i: i64 = 0
  while lit[i] != (0 as u8) { if b[off+i] != lit[i] { return 0 } i = i + 1 }
  return 1
193}
194
195// PV_RAW_* / pv_in_rawtext -- ADDED 2026-08-25 after the SECOND fleet sweep, because pv_in_tag ALONE
196// still admits inline JavaScript, and A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE. MEASURED
197// from source, not inferred, at sites/nishifamily/listen/index.html line 29, whose script assigns
198// au.src from a variable inside a function body; the extractor read the JavaScript that follows as a
199// RELATIVE ASSET REF and the page reported RED with law=1. Five live pages carried this one shape.
200// pv_in_tag cannot see it and is not wrong to miss it: JavaScript uses the less-than character as a
201// comparison operator, so inside a script the nearest preceding bracket genuinely IS an opener.
202// THE FIX IS HTML AGAIN, NEVER A KEYWORD LIST: script and style are RAW TEXT elements -- a browser
203// tokenizer does not look for attributes inside them at all -- so a position between such an open tag
204// and its matching close is not attribute context, whatever the surrounding bytes look like.
205// SCOPED TO THE BARE FORM ONLY, DELIBERATELY, AND THIS DIRECTION CANNOT LOSE A TRUE POSITIVE: a
206// QUOTED src assigned in a script IS a literal the browser really fetches and a relative one really
207// does break under the same edge rule, so narrowing those would lose real findings; JavaScript has no
208// UNQUOTED string literal, so a bare src= inside a script can never have been a real ref.
209// COST: one backward scan per bare candidate that ALREADY passed pv_in_tag -- that is, only on the
210// false positives this exists to remove. Bounded by page size (PV_CAP) times PV_MAXREF, both bounded.
211const PV_RAW_NONE:   i64 = 0
212const PV_RAW_SCRIPT: i64 = 1
213const PV_RAW_STYLE:  i64 = 2
214func pv_in_rawtext(page: *u8, at: i64) -> i64 {
  var b: i64 = at
  while b > 0 {
      b = b - 1
      if page[b] == (PV_ATTR_LT as u8) {
          if sw_starts(page, b, "</script" as *u8) == 1 { return PV_RAW_NONE }
          if sw_starts(page, b, "</style" as *u8) == 1 { return PV_RAW_NONE }
          if sw_starts(page, b, "<script" as *u8) == 1 { return PV_RAW_SCRIPT }
          if sw_starts(page, b, "<style" as *u8) == 1 { return PV_RAW_STYLE }
      }
  }
  return PV_RAW_NONE
226}
227
228// origin = "https://host" prefix of url (through the 3rd slash, exclusive)
229func pv_origin(url: *u8, out: *u8) -> i64 {
  var i: i64 = 0
  var slashes: i64 = 0
  while url[i] != (0 as u8) {
      if url[i] == (47 as u8) {
          slashes = slashes + 1
          if slashes == 3 { out[i] = 0 as u8; return i }
      }
      out[i] = url[i]
      i = i + 1
  }
  out[i] = 0 as u8
  return i
242}
243
244// check one asset URL: fetch + validate. kind: 1=img-ish (png expected ok), 0=other. returns 0 ok / 1 broken
245// assets this run could not READ. Counted apart from `broken` because they are a different question with
246// a different remedy, and a reader who cannot tell them apart cannot audit either.
247static PV_UNOBS: i64
248// HEAD-RANGE VERIFICATION (2026-09-05). MEASURED on the live surface: /world/ref9d.nxa is 10,758,232 B
249// against PV_CAP 8,388,608, so the whole-body fetch returned -NX_FF_GET and the declared rig read
250// UNOBSERVABLE -- the seed-san.vrm class named in pv_check_asset, now hit by the FIRST asset the declared-asset
251// rule ever resolved. The proof a rig asset needs is its MAGIC, eight bytes at offset 0; reading ten megabytes
252// to check eight is the cap-as-a-guess defect wearing a verifier's clothes. So when the whole-body read does
253// not complete, the asset is re-fetched as a HEAD RANGE (bytes 0..PV_HEAD_CAP-1) through the fetch spine's own
254// range entry, and a head that carries a known magic is VERIFIED-BY-HEAD: counted apart from the whole-body
255// checks and apart from unobservable, because it answers a narrower question and a reader must see which.
256// A head that reads but carries no known magic stays UNOBSERVABLE (abstain -- a partial read may not convict),
257// and a head that cannot be read at all keeps the old UNOBSERVABLE line. The window is the fetch spine's own
258// padding unit (NX_MAGIC_65536, the smallest read it already sizes for), not a fresh number. MEASURED LIVE
259// 2026-09-05 on /world/rigview: the retry's TLS 1.3 handshake completed on the pinned edge and the GET stage
260// failed with NO status (head-range status=0 bytes=-4) -- the edge answered the Range request with the whole
261// 10 MB body and the spine's completing reader FAILS on overflow rather than handing back a prefix, so on
262// this edge the retry adds one honest measurement per asset and no verdict. It can never remove one: every
263// path out of the retry is the old UNOBSERVABLE line or a magic-carrying head. The verdict it was built for
264// needs an edge that honours Range (206 + Content-Range) or a bounded-prefix reader in the fetch spine.
265// The reader landed the same day (nx_https_fetch_head over nx_https_req_prefix, browser BR48) and this retry
266// composes it; the edge half is browser BR49, the traffic owner's, and lights the 206 branch when it lands.
267const PV_HEAD_CAP: i64 = 65536
268const PV_HTTP_PARTIAL: i64 = 206       // RFC 9110 Partial Content: the server honoured the Range
269const PV_HTTP_OK: i64 = 200            // a server that ignored the Range and answered whole; the spine bounds the body
270static PV_HEADVER: i64
271
272// NXA (Nishi Animated 3D) magic: the eight ASCII bytes NXANIM01, owned by nx_nxa.nx. Compared byte for byte here
273// so the verifier proves a declared rig asset is a rig and not the edge's error page, without forking a decoder.
274func pv_nxa_magic(b: *u8, n: i64) -> i64 {
  if n < 8 { return 0 }
  let m: *u8 = "NXANIM01" as *u8
  var i: i64 = 0
  while i < 8 { if b[i] != m[i] { return 0 } i = i + 1 }
  return 1
280}
281
282func pv_check_asset(store: *TrustStore, aurl: *u8, body: *u8) -> i64 {
  let st: *i64 = sys_mmap(8) as *i64
  let n: i64 = nx_https_fetch_follow(aurl, store, body, PV_CAP, 6, st)
  hw("  asset " as *u8); hw(aurl)
  hw(" -> status=" as *u8); pn(st[0]); hw(" bytes=" as *u8); pn(n)
  // A READ THAT NEVER COMPLETED IS NOT A BROKEN ASSET. A negative n is a fetch-STAGE code, not a body:
  // the asset may serve perfectly and merely exceed PV_CAP. MEASURED 2026-08-26 -- seed-san.vrm is
  // 10,917,800 B against a PV_CAP of 8,388,608 and came back n=-4, which this function spelled
  // "BROKEN (non-200)", while an independent client fetching the same URL got 200 OK with the full
  // Content-Length. This organ already carries the third state on the PAGE path (could not connect ->
  // UNOBSERVABLE, never RED); it was never carried on the ASSET path, and the half of a law left undone
  // is the half that ships. n >= 0 with a non-200 status is a REAL failure and still counts as broken --
  // that is exactly how a 404 whose body we could read is caught.
  if n < 0 {
      // HEAD-RANGE RETRY (see PV_HEAD_CAP): the whole body did not arrive; ask for its head and let the magic decide.
      let hst: *i64 = sys_mmap(8) as *i64
      hst[0] = PV_NO_STATUS
      let hn: i64 = nx_https_fetch_head(aurl, store, body, PV_HEAD_CAP, 0, PV_HEAD_CAP - 1, hst, 0)
      hw(" head-range status=" as *u8); pn(hst[0]); hw(" bytes=" as *u8); pn(hn)
      var hok: i64 = 0
      if hst[0] == PV_HTTP_PARTIAL { hok = 1 }
      if hst[0] == PV_HTTP_OK { hok = 1 }
      if hn > 0 { if hok == 1 {
          if pv_nxa_magic(body, hn) == 1 {
              hw("  NXA MAGIC-OK VERIFIED-BY-HEAD (the whole body exceeds the read budget; the head carries the rig magic)\n" as *u8)
              PV_HEADVER = PV_HEADVER + 1
              return 0
          }
          hw("  head read but carries no known magic -- a partial read may not convict, so this stays UNOBSERVABLE\n" as *u8)
      } }
      hw("  UNOBSERVABLE (could not read this asset; fetch stage " as *u8); pn(0 - n)
      hw(" -- it may exceed the read budget, so it is NOT counted as broken)\n" as *u8)
      PV_UNOBS = PV_UNOBS + 1
      return 0
  }
  if st[0] != 200 { hw("  BROKEN (non-200)\n" as *u8); return 1 }
  if n <= 0 { hw("  BROKEN (empty body)\n" as *u8); return 1 }
  // PNG? deep-decode (signature + IHDR + inflate + unfilter) -- the real proof
  if n > 8 {
      if body[0] == (137 as u8) {
          if body[1] == (80 as u8) {
              let res: *NxPngResult = nx_png_decode(body, n)
              if (res as i64) == 0 { hw("  BROKEN (png decode null)\n" as *u8); return 1 }
              if res.error_code != 0 { hw("  BROKEN (png decode err=" as *u8); pn(res.error_code); hw(")\n" as *u8); return 1 }
              let hdr: *NxPngHeader = res.header
              if hdr.width <= 0 { hw("  BROKEN (png w=0)\n" as *u8); return 1 }
              hw("  PNG DECODE-OK " as *u8); pn(hdr.width); hw("x" as *u8); pn(hdr.height); hw("\n" as *u8)
              return 0
          }
      }
      // NXA (Nishi Animated 3D): a declared rig asset must open with the NXANIM01 magic (pv_nxa_magic above)
      if pv_nxa_magic(body, n) == 1 { hw("  NXA MAGIC-OK bytes=" as *u8); pn(n); hw("\n" as *u8); return 0 }
      // AN ARTIFACT THAT ANSWERS HTML IS THE 404-FALLBACK CLASS, and the status was 200. The decision
      // moved into nx_pageref_lib so this organ and nx_pageref_gate read ONE table: the chain that used
      // to live here knew four extensions -- png, jpg, css, js -- so a mesh, a VRM, a wasm module or a
      // viewer blob that answered the edge's error page with status 200 read as OK, and those are
      // precisely what an /exceed asset page is made of. The extension match is also exact to
      // end-of-url now, where the old chain accepted any suffix beginning at the dot.
      if pr_is_fallback(aurl, body, n) == 1 {
          hw("  BROKEN (artifact answers HTML -- 404-fallback class, extension class " as *u8)
          pn(pr_ext_class(aurl))
          hw(")\n" as *u8)
          return 1
      }
  }
  hw("  OK\n" as *u8)
  return 0
349}
350
351// a11y-lite: integer substring presence + count over the page (axe-core / Lighthouse-class checks, NO float)
352func pv_has(b: *u8, n: i64, lit: *u8) -> i64 {
  var i: i64 = 0
  while i < n { if sw_starts(b, i, lit) == 1 { return 1 } i = i + 1 }
  return 0
356}
357func pv_count(b: *u8, n: i64, lit: *u8) -> i64 {
  var c: i64 = 0
  var i: i64 = 0
  while i < n { if sw_starts(b, i, lit) == 1 { c = c + 1 } i = i + 1 }
  return c
362}
363
364// heading-level skip detector (axe/Lighthouse structural rule: no downward jump >1, e.g. h1->h3) -- integer scan
365func pv_hskip(b: *u8, n: i64) -> i64 {
  var prev: i64 = 0
  var skips: i64 = 0
  var i: i64 = 0
  while i < n - 3 {
      if b[i] == (60 as u8) { if b[i+1] == (104 as u8) {
          let d: i64 = b[i+2] as i64
          if d >= 49 { if d <= 54 {
              let lvl: i64 = d - 48
              if prev > 0 { if lvl > prev + 1 { skips = skips + 1 } }
              prev = lvl
          } }
      } }
      i = i + 1
  }
  return skips
381}
382
383// does s start with pfx? returns the offset just past pfx, or -1. Lets the optional
384// args be recognised by NAME in any position, so adding them cannot disturb the existing
385// positional [connect-host:port] callers (rule 19: adding is safe, reordering is not).
386func pv_pfx(s: *u8, pfx: *u8) -> i64 {
  var i: i64 = 0
  while pfx[i] != (0 as u8) {
      if s[i] != pfx[i] { return 0 - 1 }
      i = i + 1
  }
  return i
393}
394// ============================================================================================
395// AUTO CONNECT-OVERRIDE -- RECOVERED 2026-07-25 (debt seq1008 / frontier F1144).
396// The DEPLOYED nx_page_verify.elf implemented this; NO SOURCE IN THE TREE DID. It was built
397// ~2026-07-20, deployed and documented, and its source was lost, so the ordinary /api/build +
398// /api/promote loop would have SILENTLY DELETED it -- turning every our-domain verification back
399// into a :443 coin flip against the co-squatting DSM nginx. That failure mode already manufactured
400// one false sev-7 debt (seq984, retracted). Reimplemented here from the contract documented in the
401// registry header so the binary is reproducible from source again.
402// CONTRACT: rows are <host><TAB><a.b.c.d:port>, '#' comments skipped, an explicit argv[2] override
403// ALWAYS wins, and an absent registry is FAIL-SAFE (verification still runs) -- but never silently:
404// see the vantage line in main(), which is now unconditional.
405const PV_DOMCONF: *u8 = "knowledge/registry/our_domains.conf"
406const PV_DOMCAP: i64 = 65536
407const PV_EP_CAP: i64 = 256
408
409// host of "https://HOST[:port]/path" -> out. 1 ok, 0 if not an https url.
410func pv_host(url: *u8, out: *u8, cap: i64) -> i64 {
  if sw_starts(url, 0, "https://" as *u8) != 1 { return 0 }
  var i: i64 = 8
  var o: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let c: i64 = url[i] as i64
      if c == 0 { go = 0 }
      else {
          if c == 47 { go = 0 }
          else {
              if c == 58 { go = 0 }
              else {
                  if o < (cap - 1) { out[o] = url[i]; o = o + 1 }
                  i = i + 1
              }
          }
      }
  }
  out[o] = 0 as u8
  if o == 0 { return 0 }
  return 1
432}
433
434// 1 = hit (ep filled) | 0 = not one of ours | -1 = registry unreadable (caller must SAY SO)
435func pv_dom_lookup(host: *u8, ep: *u8, epcap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(PV_DOMCONF)
  if fd < 0 { return 0 - 1 }
  let buf: *u8 = sys_mmap(PV_DOMCAP)
  var total: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if total >= PV_DOMCAP { go = 0 }
      else {
          let n: i64 = sys_read(fd, (buf as i64 + total) as *u8, PV_DOMCAP - total)
          if n > 0 { total = total + n } else { go = 0 }
      }
  }
  sys_close(fd)
  var hl: i64 = 0
  while host[hl] != (0 as u8) { hl = hl + 1 }
  var found: i64 = 0
  var ls: i64 = 0
  var i: i64 = 0
  while i <= total {
      var nl: i64 = 0
      if i >= total { nl = 1 } else { if buf[i] == (10 as u8) { nl = 1 } }
      if nl == 1 {
          if found == 0 {
              let len: i64 = i - ls
              if len > 0 {
                  if buf[ls] != (35 as u8) {
                      var t: i64 = ls
                      var tab: i64 = 0 - 1
                      while t < i { if buf[t] == (9 as u8) { if tab < 0 { tab = t } } t = t + 1 }
                      if tab > 0 {
                          if (tab - ls) == hl {
                              var k: i64 = 0
                              var same: i64 = 1
                              while k < hl { if buf[ls + k] != host[k] { same = 0 } k = k + 1 }
                              if same == 1 {
                                  var o: i64 = 0
                                  var p: i64 = tab + 1
                                  while p < i {
                                      if buf[p] != (13 as u8) { if o < (epcap - 1) { ep[o] = buf[p]; o = o + 1 } }
                                      p = p + 1
                                  }
                                  ep[o] = 0 as u8
                                  found = 1
                              }
                          }
                      }
                  }
              }
          }
          ls = i + 1
      }
      i = i + 1
  }
  return found
490}
491
492func pv_atoi(a: *u8) -> i64 {
  var v: i64 = 0
  var i: i64 = 0
  while a[i] != (0 as u8) {
      let c: i64 = a[i] as i64
      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } }
      i = i + 1
  }
  return v
501}
502
503
504const PV_CONTRACT_OK: i64 = 0
505const PV_CONTRACT_RED: i64 = 1
506const PV_CONTRACT_USAGE: i64 = 2
507const PV_CONTRACT_HEX_BYTES: i64 = 32
508const PV_CONTRACT_HEX_CHARS: i64 = 64
509const PV_CONTRACT_PATH_CAP: i64 = 4096
510const PV_CONTRACT_EVIDENCE_CAP: i64 = 262144
511const PV_CONTRACT_DEFAULT_MAX_AGE: i64 = 900
512
513func pv_contract_hex(c: i64) -> i64 {
  if c >= 48 { if c <= 57 { return c - 48 } }
  if c >= 65 { if c <= 70 { return c - 55 } }
  if c >= 97 { if c <= 102 { return c - 87 } }
  return 0 - 1
518}
519func pv_contract_copy(dst: *u8, cap: i64, src: *u8, off: i64) -> i64 {
  var i: i64 = 0
  while src[off+i] != (0 as u8) {
      if i >= cap - 1 { return 0 - 1 }
      dst[i] = src[off+i]
      i = i + 1
  }
  dst[i] = 0 as u8
  return i
528}
529func pv_contract_hex_equal(text: *u8, digest: *u8) -> i64 {
  var i: i64 = 0
  while i < PV_CONTRACT_HEX_BYTES {
      let bv: i64 = digest[i] as i64
      let hi: i64 = (bv >> 4) & 15
      let lo: i64 = bv & 15
      var hc: i64 = 48 + hi
      if hi >= 10 { hc = 87 + hi }
      var lc: i64 = 48 + lo
      if lo >= 10 { lc = 87 + lo }
      if text[i*2] as i64 != hc { return 0 }
      if text[i*2+1] as i64 != lc { return 0 }
      i = i + 1
  }
  if text[PV_CONTRACT_HEX_CHARS] != (0 as u8) { return 0 }
  return 1
545}
546func pv_contract_has(buf: *u8, n: i64, lit: *u8) -> i64 {
  var q: i64 = 0
  var m: i64 = 0
  while lit[m] != (0 as u8) { m = m + 1 }
  if m == 0 { return 1 }
  while q + m <= n {
      var j: i64 = 0
      var same: i64 = 1
      while j < m { if buf[q+j] != lit[j] { same = 0; j = m } else { j = j + 1 } }
      if same == 1 { return 1 }
      q = q + 1
  }
  return 0
559}
560func pv_contract_verify(url: *u8, page: *u8, page_n: i64, artifact: *u8, evidence_path: *u8, evidence_sha: *u8, interaction: *u8, runtime: *u8, observed: *u8, max_age: i64) -> i64 {
  if (artifact as i64) == 0 { hw("served-review RED reason=missing-artifact-identity\n" as *u8); return PV_CONTRACT_RED }
  if (evidence_path as i64) == 0 { hw("served-review RED reason=missing-evidence-path\n" as *u8); return PV_CONTRACT_RED }
  if (evidence_sha as i64) == 0 { hw("served-review RED reason=missing-evidence-identity\n" as *u8); return PV_CONTRACT_RED }
  if (interaction as i64) == 0 { hw("served-review RED reason=missing-interaction-assertion\n" as *u8); return PV_CONTRACT_RED }
  if (runtime as i64) == 0 { hw("served-review RED reason=missing-runtime-backend\n" as *u8); return PV_CONTRACT_RED }
  let digest: *u8 = sys_mmap(PV_CONTRACT_HEX_BYTES)
  if sha256_digest(page, page_n, digest) != 0 { hw("served-review RED reason=artifact-hash-failed\n" as *u8); return PV_CONTRACT_RED }
  if pv_contract_hex_equal(artifact, digest) == 0 {
      hw("served-review RED reason=artifact-hash-mismatch actual_sha256=" as *u8)
      var hx: i64 = 0
      while hx < PV_CONTRACT_HEX_BYTES {
          let bv: i64 = digest[hx] as i64
          let hi: i64 = (bv >> 4) & 15
          let lo: i64 = bv & 15
          let hc: *u8 = sys_mmap(2)
          if hi < 10 { hc[0] = (48 + hi) as u8 } else { hc[0] = (87 + hi) as u8 }
          if lo < 10 { hc[1] = (48 + lo) as u8 } else { hc[1] = (87 + lo) as u8 }
          sys_write(1, hc, 2)
          hx = hx + 1
      }
      hw("\n" as *u8)
      return PV_CONTRACT_RED
  }
  let ep_len: *i64 = sys_mmap(8) as *i64
  let ev: *u8 = sys_read_file(evidence_path, ep_len)
  if (ev as i64) == 0 { hw("served-review RED reason=evidence-missing\n" as *u8); return PV_CONTRACT_RED }
  if ep_len[0] <= 0 { hw("served-review RED reason=evidence-empty\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  let edigest: *u8 = sys_mmap(PV_CONTRACT_HEX_BYTES)
  if sha256_digest(ev, ep_len[0], edigest) != 0 { hw("served-review RED reason=evidence-hash-failed\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_hex_equal(evidence_sha, edigest) == 0 { hw("served-review RED reason=evidence-hash-mismatch\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], "interaction=PASS\n" as *u8) == 0 { hw("served-review RED reason=interaction-evidence-missing-or-failed\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], "screenshot=" as *u8) == 0 { hw("served-review RED reason=screenshot-evidence-missing\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], "backend=" as *u8) == 0 { hw("served-review RED reason=backend-evidence-missing\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], "observed_epoch=" as *u8) == 0 { hw("served-review RED reason=observation-time-missing\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], interaction) == 0 { hw("served-review RED reason=interaction-assertion-not-in-evidence\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  if pv_contract_has(ev, ep_len[0], runtime) == 0 { hw("served-review RED reason=runtime-backend-assertion-not-in-evidence\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  let seen: i64 = pv_atoi(observed)
  if seen <= 0 { hw("served-review RED reason=invalid-observation-time\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  let now: i64 = sys_now_realtime_sec()
  if now < seen { hw("served-review RED reason=observation-in-future\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  let age: i64 = now - seen
  if age > max_age { hw("served-review RED reason=stale-evidence age=" as *u8); pn(age); hw("\n" as *u8); sys_free_file(ev, ep_len[0]); return PV_CONTRACT_RED }
  hw("served-review GREEN url=" as *u8); hw(url)
  hw(" status=200 artifact_verified=1 interaction_verified=1 screenshot_verified=1 runtime=" as *u8); hw(runtime)
  hw(" observed_epoch=" as *u8); hw(observed); hw(" evidence=" as *u8); hw(evidence_path); hw(" age=" as *u8); pn(age); hw("\n" as *u8)
  sys_free_file(ev, ep_len[0])
  return PV_CONTRACT_OK
608}
609
610func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { hw("usage: nx_page_verify <https-url> [connect-host:port] [expect=<substring>] [minbytes=<n>]\n" as *u8); sys_exit(PV_EXIT_USAGE); return PV_EXIT_USAGE }
  let url: *u8 = argv[1] as *u8
  var contract_mode: i64 = 0
  let contract_artifact: *u8 = sys_mmap(96)
  let contract_evidence: *u8 = sys_mmap(PV_CONTRACT_PATH_CAP)
  let contract_evidence_sha: *u8 = sys_mmap(96)
  let contract_interaction: *u8 = sys_mmap(96)
  let contract_runtime: *u8 = sys_mmap(96)
  let contract_observed: *u8 = sys_mmap(96)
  var contract_max_age: i64 = PV_CONTRACT_DEFAULT_MAX_AGE
  hw("=== nx_page_verify -- static HTTP asset checks (no browser execution) for " as *u8); hw(url); hw(" ===\n" as *u8)
  var expoff: i64 = 0
  var minbytes: i64 = 0
  var ov_given: i64 = 0
  // the vantage this run actually used, carried to the LAST line so a reader of the verdict alone
  // can tell which server was (or was not) reached -- "RED from :443" and "RED from :8443" are
  // different facts, and an UNOBSERVABLE is meaningless without the endpoint it failed to reach
  let vant: *u8 = sys_mmap(PV_VANTAGE_CAP)
  var vo: i64 = 0
  var ai: i64 = 2
  while ai < argc {
      let a: *u8 = argv[ai] as *u8
      let co: i64 = pv_pfx(a, "contract" as *u8)
      if co >= 0 {
          contract_mode = 1
      } else {
          let ao: i64 = pv_pfx(a, "artifact=" as *u8)
          let ep: i64 = pv_pfx(a, "evidence=" as *u8)
          let es: i64 = pv_pfx(a, "evidence_sha256=" as *u8)
          let io: i64 = pv_pfx(a, "interaction=" as *u8)
          let ro: i64 = pv_pfx(a, "runtime=" as *u8)
          let ob: i64 = pv_pfx(a, "observed_epoch=" as *u8)
          let ma: i64 = pv_pfx(a, "max_age=" as *u8)
          let eo: i64 = pv_pfx(a, "expect=" as *u8)
          let mo: i64 = pv_pfx(a, "minbytes=" as *u8)
          if ao >= 0 { pv_contract_copy(contract_artifact, 96, a, ao) }
          else {
              if ep >= 0 { pv_contract_copy(contract_evidence, PV_CONTRACT_PATH_CAP, a, ep) }
              else {
                  if es >= 0 { pv_contract_copy(contract_evidence_sha, 96, a, es) }
                  else {
                      if io >= 0 { pv_contract_copy(contract_interaction, 96, a, io) }
                      else {
                          if ro >= 0 { pv_contract_copy(contract_runtime, 96, a, ro) }
                          else {
                              if ob >= 0 { pv_contract_copy(contract_observed, 96, a, ob) }
                              else {
                                  if ma >= 0 { contract_max_age = pv_atoi(((a as i64) + ma) as *u8) }
                                  else {
                                      if eo >= 0 { expoff = (a as i64) + eo }
                                      else {
                                          if mo >= 0 { minbytes = pv_atoi(((a as i64) + mo) as *u8) }
                                          else {
                                              if nx_https_connect_override_set(a) != 1 { hw("RED bad connect-override (want a.b.c.d:port)\n" as *u8); sys_exit(PV_EXIT_USAGE); return PV_EXIT_USAGE }
                                              hw("vantage=EXPLICIT connect-override " as *u8); hw(a); hw(" (SNI/Host stay the URL host)\n" as *u8)
                                              ov_given = 1
                                              vo = pv_vcat(vant, 0, "pinned:" as *u8)
                                              vo = pv_vcat(vant, vo, a)
                                          }
                                      }
                                  }
                              }
                          }
                      }
                  }
              }
          }
      }
      ai = ai + 1
  }
681
  // ---- VANTAGE RESOLUTION (recovered + hardened 2026-07-25; seq1008 recovery, seq990 hardening) ----
  // The whole point: this organ must NEVER be able to grade one server while the reader believes it
  // graded another. So the vantage is now stated on EVERY run -- there is no silent path.
  let pv_h: *u8 = sys_mmap(PV_URL_CAP)
  pv_h[0] = 0 as u8
  var pv_isours: i64 = 0
  var pv_regunread: i64 = 0
  var pv_pinned: i64 = ov_given
  if pv_host(url, pv_h, PV_URL_CAP) == 1 {
      let pv_ep: *u8 = sys_mmap(PV_EP_CAP)
      let d: i64 = pv_dom_lookup(pv_h, pv_ep, PV_EP_CAP)
      if d == 1 { pv_isours = 1 }
      if ov_given == 0 {
          if d == 1 {
              if nx_https_connect_override_set(pv_ep) != 1 {
                  hw("VERDICT=UNMEASURED (our-domain " as *u8); hw(pv_h)
                  hw(" but its registry endpoint " as *u8); hw(pv_ep)
                  hw(" is malformed -- refusing to grade an unknown server)\n" as *u8)
                  sys_exit(PV_EXIT_UNMEASURED); return PV_EXIT_UNMEASURED
              }
              hw("auto connect-override (our-domain " as *u8); hw(pv_h)
              hw(" -> " as *u8); hw(pv_ep); hw("; SNI/Host stay the URL host)\n" as *u8)
              pv_pinned = 1
              vo = pv_vcat(vant, 0, "pinned:" as *u8)
              vo = pv_vcat(vant, vo, pv_ep)
          }
          if d == (0 - 1) {
              hw("WARNING registry " as *u8); hw(PV_DOMCONF)
              hw(" unreadable -- cannot tell if this host is ours; proceeding via DNS (fail-safe)\n" as *u8)
              pv_regunread = 1
          }
      }
  }
  if pv_pinned == 1 { hw("vantage=PINNED (deterministic sovereign edge)\n" as *u8) }
  else {
      hw("vantage=DNS (no override)" as *u8)
      vo = pv_vcat(vant, 0, "dns:" as *u8)
      vo = pv_vcat(vant, vo, pv_h)
      if pv_regunread == 1 { vo = pv_vcat(vant, vo, ",registry-unreadable-from-cwd" as *u8) }
      if pv_isours == 1 {
          // Cannot happen once the registry is readable, but if it ever does, the reader is told
          // LOUDLY rather than handed a confident RED from whatever answered port 443.
          hw("  <== WARNING: this IS one of our domains and it is NOT pinned. A 404/RED here may be\n" as *u8)
          hw("     the co-squatting server on :443, not our edge. TREAT AS UNMEASURED." as *u8)
      }
      hw("\n" as *u8)
  }
729
  let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, PV_CERTDATA_CAP)
  if r <= 0 {
      // the eye has no trust store -> it cannot fetch anything -> it has NO EVIDENCE about the page.
      // This was already exit 3; it now says so in the fleet's own word, on the last line.
      hw("cannot load trust store (run from repo root)\n" as *u8)
      hw("VERDICT=UNOBSERVABLE vantage=" as *u8); hw(vant); hw(" reason=no-trust-store\n" as *u8)
      sys_exit(PV_EXIT_UNOBSERVABLE); return PV_EXIT_UNOBSERVABLE
  }
  let store: *TrustStore = r as *TrustStore
739
  let page: *u8 = sys_mmap(PV_CAP)
  let st: *i64 = sys_mmap(8) as *i64
  st[0] = PV_NO_STATUS
  let n: i64 = nx_https_fetch_follow(url, store, page, PV_CAP, 6, st)
  hw("page status=" as *u8); pn(st[0]); hw(" bytes=" as *u8); pn(n)
  if n < 0 { hw(" fetch-stage=" as *u8); hw(pv_stage_name(n)) }
  hw("\n" as *u8)
  // THE THIRD STATE. No status AND a negative length = no server ever answered. That is a
  // fact about the VANTAGE (closed port, black-holed host, DNS landing on the wrong edge, a CWD
  // that lost the registry), not about the page. It must not be spelled RED.
  if pv_unobservable(n, st[0]) == 1 {
      hw("VERDICT=UNOBSERVABLE vantage=" as *u8); hw(vant)
      hw(" reason=no-connection(" as *u8); hw(pv_stage_name(n)); hw(")\n" as *u8)
      sys_exit(PV_EXIT_UNOBSERVABLE); return PV_EXIT_UNOBSERVABLE
  }
  if st[0] != 200 { hw("VERDICT=RED (page not 200)\n" as *u8); sys_exit(PV_EXIT_RED); return PV_EXIT_RED }
  if n <= 0 { hw("VERDICT=RED (empty page)\n" as *u8); sys_exit(PV_EXIT_RED); return PV_EXIT_RED }
  if contract_mode == 1 {
      if contract_max_age <= 0 { hw("served-review RED reason=invalid-max-age\n" as *u8); sys_exit(PV_CONTRACT_USAGE); return PV_CONTRACT_USAGE }
      let crc: i64 = pv_contract_verify(url, page, n, contract_artifact, contract_evidence, contract_evidence_sha, contract_interaction, contract_runtime, contract_observed, contract_max_age)
      sys_exit(crc)
      return crc
  }
763
  // CONTENT ASSERTION (debt seq911). A 200 DOES NOT MEAN YOUR PAGE. The edge serves a
  // root fallback for unknown paths, so a failed publish yields 200 with a perfectly
  // valid, fully-decoding page that simply is not yours -- and every asset on it fetches,
  // so the old asset-only verdict said GREEN. Measured 2026-07-25: verifying
  // /research/rt004.html reported status=200 VERDICT=GREEN while the edge was serving the
  // 835-byte site root and the 10201-byte page had landed nowhere. Asset liveness is not
  // page identity; the caller must be able to assert WHICH page it expects.
  if minbytes > 0 {
      if n < minbytes {
          hw("VERDICT=RED (page is " as *u8); pn(n)
          hw(" bytes, below the asserted floor of " as *u8); pn(minbytes)
          hw(" -- a 200 is not your page)\n" as *u8)
          sys_exit(PV_EXIT_RED); return PV_EXIT_RED
      }
      hw("byte-floor OK (" as *u8); pn(n); hw(" >= " as *u8); pn(minbytes); hw(")\n" as *u8)
  }
  if expoff != 0 {
      if pv_has(page, n, expoff as *u8) == 0 {
          hw("VERDICT=RED (expected content ABSENT: " as *u8); hw(expoff as *u8)
          hw(") -- the server returned 200 but this is not the page you published\n" as *u8)
          sys_exit(PV_EXIT_RED); return PV_EXIT_RED
      }
      hw("content-assert OK (expect=" as *u8); hw(expoff as *u8); hw(")\n" as *u8)
  }
788
  let origin: *u8 = sys_mmap(PV_URL_CAP)
  pv_origin(url, origin)
791
  // --- a11y-lite audit (integer, no float): axe-core / Lighthouse-class page checks ---
  hw("-- a11y-lite --\n" as *u8)
  var a11y: i64 = 0
  if pv_has(page, n, "<title" as *u8) == 1 { hw("  title OK\n" as *u8) } else { hw("  A11Y missing <title>\n" as *u8); a11y = a11y + 1 }
  if pv_has(page, n, "lang=" as *u8) == 1 { hw("  lang OK\n" as *u8) } else { hw("  A11Y missing lang= on <html>\n" as *u8); a11y = a11y + 1 }
  if pv_has(page, n, "viewport" as *u8) == 1 { hw("  viewport OK\n" as *u8) } else { hw("  A11Y missing <meta viewport>\n" as *u8); a11y = a11y + 1 }
  // ELEMENT-SCOPED SINCE 2026-08-26, AND THAT IS THE WHOLE POINT. These two lines used to be
  // pv_count(page, n, "<img") and pv_count(page, n, " alt=") -- two whole-page SUBSTRING counts.
  // A SUBSTRING COUNTER CANNOT SEE ATTRIBUTE SCOPE. Measured 2026-08-26 it read img=15 with-alt=15,
  // a clean bill of health, for /compare/koikatsu, whose first figure served
  //   <img src='...' alt='The card's own portrait -- the oracle we match against' loading='lazy'>
  // The caption's raw apostrophe ends alt at the two words -The card-, turns the rest of the sentence
  // into attribute names and swallows loading='lazy'. Every byte the old rule looked for was present,
  // so it counted a DESTROYED alt as a good one and the page validated GREEN for as long as the row
  // had existed.
  // ia_scan walks each img tag with the quoting rules a browser uses, and it is the SAME lib the
  // compare generator now emits through -- the writer and the reader share one definition and cannot
  // drift into two answers. It also skips comment, script and style bodies, so an img quoted inside
  // inline JavaScript is no longer counted as an element; that makes the COVERAGE-GAP comparison
  // below sharper too, because nimg is now a count of real elements rather than of a 4-byte pattern.
  let iasl: *i64 = sys_mmap(IA_SCAN_SLOTS * IA_SLOT_BYTES) as *i64
  ia_scan(page, n, iasl)
  let nimg: i64 = iasl[IA_S_IMGS]
  let nalt: i64 = iasl[IA_S_ALT_OK]
  hw("  img=" as *u8); pn(nimg); hw(" with-alt=" as *u8); pn(nalt); hw("\n" as *u8)
  if nalt < nimg { hw("  A11Y " as *u8); pn(nimg - nalt); hw(" image(s) missing alt\n" as *u8); a11y = a11y + 1 }
  // ITS OWN AXIS, not folded into missing-alt: the alt is PRESENT here and merely truncated, so the
  // remedy is the emitter's escaping and not a missing attribute. One counter for two causes is how a
  // worklist stops pointing at the repair.
  if iasl[IA_S_QUOTEBREAK] > 0 {
      hw("  A11Y " as *u8); pn(iasl[IA_S_QUOTEBREAK])
      hw(" img tag(s) whose own data escaped its attribute -- an unescaped quote ends the value early, so the alt a browser reads is a TRUNCATED prefix of the intended one\n" as *u8)
      a11y = a11y + 1
  }
  if iasl[IA_S_MALFORMED] > 0 {
      hw("  A11Y " as *u8); pn(iasl[IA_S_MALFORMED])
      hw(" img tag(s) whose tag or attribute value never closed\n" as *u8)
      a11y = a11y + 1
  }
  let nh1: i64 = pv_count(page, n, "<h1" as *u8)
  if nh1 == 1 { hw("  single-h1 OK\n" as *u8) } else { hw("  A11Y h1-count=" as *u8); pn(nh1); hw(" (want exactly 1)\n" as *u8); a11y = a11y + 1 }
  let hsk: i64 = pv_hskip(page, n)
  if hsk == 0 { hw("  heading-order OK\n" as *u8) } else { hw("  A11Y " as *u8); pn(hsk); hw(" heading-level skip(s)\n" as *u8); a11y = a11y + 1 }
  if pv_has(page, n, "<main" as *u8) == 1 { hw("  landmark <main> OK\n" as *u8) } else { hw("  A11Y no <main> landmark\n" as *u8); a11y = a11y + 1 }
  hw("  a11y-issues=" as *u8); pn(a11y); hw("\n" as *u8)
837
  // extract src="..." / href="..." refs (img/script/link surface)
  let abuf: *u8 = sys_mmap(PV_CAP)
  let prout: *i64 = sys_mmap(PV_PROUT_SLOTS * PV_WORD_BYTES) as *i64
  var broken: i64 = 0
  var checked: i64 = 0
  var skipped: i64 = 0
  var lawred: i64 = 0
  var declared: i64 = 0   // assets the page DECLARES its script will fetch (meta name=nishi-<kind> content=...; pr_declared_hit, 2026-09-05)
  // bare src= occurrences REJECTED as not-inside-a-tag (inline script, almost always). Printed on
  // the summary line so the new filter's effect on real pages is measurable rather than assumed.
  var barerej: i64 = 0
  // bare src= occurrences REJECTED as INSIDE script/style RAW TEXT (pv_in_rawtext above). Counted
  // and printed SEPARATELY from barerej, because two rejection REASONS with opposite remedies must
  // never share one counter -- a reader who cannot tell them apart cannot audit either.
  var rawrej: i64 = 0
  var i: i64 = 0
  while i < n - 8 {
      var hit: i64 = 0
      // BOTH QUOTE STYLES (2026-08-18). This scanner recognised only src=" -- so a generator emitting
      // src='...' (the whole compare gallery, 15 relative images that 404'd in every browser) was
      // INVISIBLE to it: not checked, not skipped, not law-red -- and the verdict still said "every
      // referenced asset fetches". A REF THE EXTRACTOR CANNOT SEE IS A REF THE VERDICT SILENTLY
      // ACQUITS. The closing delimiter is whichever quote opened the attribute.
      var bare: i64 = 0
      var qch: i64 = 34
      // IN-TAG GUARD ON EVERY ATTRIBUTE BRANCH (2026-08-25). pv_in_tag was added for the BARE branch
      // and not its siblings -- the same half-a-fix shape one level down. MEASURED: the first fleet
      // sweep reported 245 broken refs of which 216 were /code/ pages, and those pages carry NO <pre>
      // at all (count=0) -- each line is a <span class='l'>, and the hits are the literal text src=
      // inside RENDERED STRING LITERALS, e.g. gf_puts(" verdict=LIB src=" as *u8). Those sit in TEXT
      // BETWEEN tags, so the nearest preceding bracket is '>' and pv_in_tag already rejects them.
      // A real <img src="..."> has '<' as its nearest preceding bracket and is unaffected.
      // ONE VOCABULARY OWNER (nx_pageref_lib, shared with nx_pageref_gate). This was two hand-written
      // branches that knew only src=. The table now also carries data-glb=, the attribute nx_asset_page
      // emits for every mesh panel on an /exceed page and the one this extractor had never heard of --
      // so four mesh refs per page were acquitted without ever being fetched (measured on the live
      // /exceed/vrm/seed-san: checked=2 against four data-glb canvases). Behaviour on src= is unchanged
      // BY CONSTRUCTION: the skip is still the attribute length plus its quote, and the closing
      // delimiter is still whichever quote opened the attribute.
      if pr_attr_hit(page, n, i, prout) >= 0 { if pv_in_tag(page, i) == 1 { hit = prout[0]; qch = prout[1] } }
      // DECLARED ASSETS (2026-09-05): a meta row named nishi-<kind> with a content path promises a script-fetched
      // artifact (rigview declares its 1.7 MB rig this way and used to be acquitted on one advert PNG); followed like a src
      if hit == 0 { if pr_declared_hit(page, n, i, prout) >= 0 { if pv_in_tag(page, i) == 1 { hit = prout[0]; qch = prout[1]; declared = declared + 1 } } }
      // BARE (UNQUOTED) src= -- legal HTML, and our own sites/nishifamily/world/foundation.html emits
      // <img src=nx_worldpipe.png ...>. Checked ONLY after both quoted forms miss, and only when the
      // next byte is not a quote / space / '>', so an empty or quoted value can never land here.
      // The terminator is whitespace or '>', handled in the extraction below.
      if hit == 0 { if i + 4 < n { if sw_starts(page, i, "src=" as *u8) == 1 {
          let c0: i64 = page[i+4] as i64
          if c0 != PV_ATTR_DQ { if c0 != PV_ATTR_SQ { if c0 != PV_ATTR_SP { if c0 != PV_ATTR_GT {
              // INSIDE AN OPEN TAG OR IT IS NOT AN ATTRIBUTE (2026-08-25, see pv_in_tag above).
              // Counted, not silently dropped: a filter whose rejections are invisible cannot be
              // audited, and this one is new enough to deserve being watched on real pages.
              if pv_in_tag(page, i) == 1 {
                  // IN A TAG AND NOT IN RAW TEXT. Both conjuncts are required and each is counted
                  // under its own name, so a future reader can see WHICH rule fired on real pages.
                  if pv_in_rawtext(page, i) == PV_RAW_NONE { hit = 4; bare = 1 } else { rawrej = rawrej + 1 }
              } else { barerej = barerej + 1 }
          } } } }
      } } }
      if hit == 0 { if sw_starts(page, i, "href='" as *u8) == 1 {
          var b1: i64 = i
          var found1: i64 = 0
          var back1: i64 = 0
          while back1 < 80 {
              if b1 <= 0 { back1 = 80 } else {
                  if page[b1] == (60 as u8) {
                      if sw_starts(page, b1, "<link" as *u8) == 1 { found1 = 1 }
                      back1 = 80
                  } else { b1 = b1 - 1; back1 = back1 + 1 }
              }
          }
          if found1 == 1 { hit = 6; qch = 39 }
      } }
      if hit == 0 { if sw_starts(page, i, "href=\"" as *u8) == 1 {
          // href only counts for <link ...> stylesheet-ish tags: look back for '<link' within 80 bytes
          var b: i64 = i
          var found: i64 = 0
          var back: i64 = 0
          while back < 80 {
              if b <= 0 { back = 80 } else {
                  if page[b] == (60 as u8) {
                      if sw_starts(page, b, "<link" as *u8) == 1 { found = 1 }
                      back = 80
                  } else { b = b - 1; back = back + 1 }
              }
          }
          if found == 1 { hit = 6 }
      } }
      if hit > 0 {
          let rs: i64 = i + hit
          var re: i64 = rs
          if bare == 0 {
              while page[re] != (qch as u8) { re = re + 1 }
          } else {
              // Unquoted value ends at the first whitespace or '>'. Bounded by n so a malformed tag
              // cannot run the scan off the end of the buffer.
              var stop: i64 = 0
              while stop == 0 {
                  if re >= n { stop = 1 } else {
                      let ce: i64 = page[re] as i64
                      if ce == PV_ATTR_SP { stop = 1 } else {
                      if ce == PV_ATTR_GT { stop = 1 } else {
                      if ce == PV_ATTR_TAB { stop = 1 } else {
                      if ce == PV_ATTR_LF { stop = 1 } else {
                      if ce == PV_ATTR_CR { stop = 1 } else { re = re + 1 } } } } }
                  }
              }
          }
          let rlen: i64 = re - rs
          if rlen > 0 { if rlen < PV_REF_MAX { if checked + skipped + lawred < PV_MAXREF {
              let ref: *u8 = sys_mmap(PV_URL_CAP)
              var k: i64 = 0
              while k < rlen { ref[k] = page[rs+k]; k = k + 1 }
              ref[rlen] = 0 as u8
              if sw_starts(ref, 0, "data:" as *u8) == 1 { skipped = skipped + 1 } else {
              if sw_starts(ref, 0, "http" as *u8) == 1 {
                  if sw_starts(ref, 0, origin) == 1 { checked = checked + 1; broken = broken + pv_check_asset(store, ref, abuf) } else { hw("  skip foreign " as *u8); hw(ref); hw("\n" as *u8); skipped = skipped + 1 }
              } else {
              if ref[0] == (47 as u8) {
                  pv_normpath(ref)
                  let full: *u8 = sys_mmap(PV_FULLURL_CAP)
                  var o: i64 = 0
                  while origin[o] != (0 as u8) { full[o] = origin[o]; o = o + 1 }
                  var q: i64 = 0
                  while ref[q] != (0 as u8) { full[o+q] = ref[q]; q = q + 1 }
                  full[o+q] = 0 as u8
                  checked = checked + 1
                  broken = broken + pv_check_asset(store, full, abuf)
              } else {
                  // RELATIVE ref = RED BY LAW on our slash-stripping edge (the /render3d broken-image class)
                  hw("  asset " as *u8); hw(ref); hw("  BROKEN-BY-LAW (relative ref; the edge 301-strips trailing slashes so browsers resolve this against the PARENT -- use absolute /path)\n" as *u8)
                  lawred = lawred + 1
                  broken = broken + 1
              } } }
          } } }
          i = re
      } else { i = i + 1 }
  }
977
  hw("checked=" as *u8); pn(checked)
  hw(" skipped=" as *u8); pn(skipped)
  hw(" law-violations=" as *u8); pn(lawred)
  hw(" bare-src-rejected-not-in-tag=" as *u8); pn(barerej)
  hw(" bare-src-rejected-in-rawtext=" as *u8); pn(rawrej)
  hw(" declared-assets=" as *u8); pn(declared)
  hw(" unobservable=" as *u8); pn(PV_UNOBS)
  hw(" verified-by-head=" as *u8); pn(PV_HEADVER)
  hw(" broken=" as *u8); pn(broken); hw("\n" as *u8)
  // COVERAGE IS TWO QUESTIONS: per-asset (above) and whole-page. A verdict that says "every asset"
  // must be able to say it saw every asset: refs beyond PV_MAXREF were never examined, and a page
  // whose <img> count exceeds what the extractor resolved has refs the scanner could not read. Both
  // are announced and turn the whole-page claim into UNPROVEN rather than a silent acquittal.
  let seen: i64 = checked + skipped + lawred
  if seen >= PV_MAXREF { hw("COVERAGE-CAP: ref cap PV_MAXREF=" as *u8); pn(PV_MAXREF); hw(" reached -- refs beyond it were NOT examined; whole-page claim UNPROVEN\n" as *u8) }
  if nimg > seen { hw("COVERAGE-GAP: img tags=" as *u8); pn(nimg); hw(" but refs resolved=" as *u8); pn(seen); hw(" -- some src attributes were not readable by the extractor; whole-page claim UNPROVEN\n" as *u8) }
  // AN ASSET THAT COULD NOT BE READ ABSTAINS; IT NEVER ACQUITS. Ordered ahead of both GREEN-PARTIAL
  // arms deliberately: an unread asset is a stronger claim against the page than a capped ref count,
  // and letting a partial-green outrank it would be the acquittal this whole ladder exists to refuse.
  // Nothing that reads GREEN today can land here -- a negative read was already counted as broken and
  // published the page as RED -- so this can only move a verdict toward honesty, never away from it.
  if broken == 0 { if PV_UNOBS > 0 { hw("VERDICT=UNOBSERVABLE unreadable-assets=" as *u8); pn(PV_UNOBS); hw(" (nothing that was read came back broken, but at least one asset could not be READ, so the whole-page claim is UNPROVEN)\n" as *u8); sys_exit(PV_EXIT_UNOBSERVABLE); return PV_EXIT_UNOBSERVABLE } }
  if broken == 0 { if seen >= PV_MAXREF { hw("VERDICT=GREEN-PARTIAL (examined assets fetch AND decode; coverage capped, see above)\n" as *u8); sys_exit(PV_EXIT_GREEN); return PV_EXIT_GREEN } }
  if broken == 0 { if nimg > seen { hw("VERDICT=GREEN-PARTIAL (examined assets fetch AND decode; " as *u8); pn(nimg - seen); hw(" img ref(s) unread, see above)\n" as *u8); sys_exit(PV_EXIT_GREEN); return PV_EXIT_GREEN } }
  if broken == 0 { hw("VERDICT=GREEN (examined static/declarative assets passed HTTP checks; browser rendering and runtime-only dependencies unverified)\n" as *u8); sys_exit(PV_EXIT_GREEN); return PV_EXIT_GREEN }
  hw("VERDICT=RED broken=" as *u8); pn(broken); hw("\n" as *u8)
  sys_exit(broken)
  return broken
1006}
nx_page_verify.nx source

`nx_page_verify.nx` source
