code wiki / _hdl_build / nx_param_census.nx
`nx_param_census.nx` source

↩ module page · 394 lines · 20664 B
1// nx_param_census.nx -- LOG_SCAN family, X-PRM-002 (operator rule-11: "No Magic Numbers --
2// every threshold/limit/timeout/weight/multiplier belongs in svc-config or a database table,
3// not buried in code").  EXTENDS the live params registry X-PRM-001 (knowledge/registry/params.tsv).
4//
5// AUTHOR=ORGAN.  Scans TWO REAL surfaces listed in param_surfaces.tsv (growable DATA, no recompile)
6// and COMPUTES coverage/DEBT from file reads, NEVER asserted:
7//   HALF A  CONF-KEY COVERAGE -- for each `C <conf>` row, extract every `key=value` key and check
8//           re_has against the real params.tsv bytes.  A conf key with NO params row = an ABSENT
9//           coverage gap ("every conf key has a row" made measurable).
10//   HALF B  SOURCE MAGIC-NUMBER DEBT -- for each `S <organ.nx>` row, scan for named numeric source
11//           constants `const NAME: i64 = <digit>`; any NAME not already in params.tsv -> AUTO-FILE a
12//           rule-11 DEBT row (the hidden tunable becomes visible work).  ABI/syscall consts
13//           (SYS_/AT_/O_/SOCK/AF_/CLONE/DT_/SO_/SOL_/SIG) are FIXED-BY-SPEC, excluded so DEBT is signal.
14//
15// Outputs: knowledge/registry/param_census.tsv (full PRESENT/ABSENT/DEBT report, organ-authored
16// header) + new DEBT rows APPENDED (additive, never truncate -- rule-13) to params.tsv after a .bak,
17// + a PRMCENSUS verdict line to stdout AND appended to knowledge/status/param_census.log (the
18// evidence nx_reconcile grades; the organ does NOT flip its own row).
19//
20// SELF-VALIDATING (no false-green, sibling of nx_competitive_census pos/neg + nx_hwmap derived-neg):
21// BEFORE touching the real registry it runs baked controls on /tmp planted fixtures --
22//   ctrl_pos_confkey  = a KNOWN registered conf-key (diff_seed) MUST be found in the registry read.
23//   ctrl_pos_debtrow  = the KNOWN existing DEBT row (an_load_max_rows) MUST be present (won't re-file).
24//   ctrl_neg_plantmagic = a /tmp fixture with `const ZZ_PLANTED_MAGIC: i64 = 31337` MUST scan to 1
25//                         unregistered DEBT candidate (detector is not blind).
26//   ctrl_neg_cleanzero  = a /tmp fixture with no named numeric const MUST scan to 0 (no false-positive).
27// Any control wrong -> RED, return 1, and the real params.tsv mutation is SKIPPED.
28// Argv override of the surfaces list routes outputs to a /tmp tamper lane (self-tamper, no oracle).
29// license_tier: ORIGINAL
30import "nx_research_extract.nx"
31import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
32const PC_MAGIC_2000000: i64 = 2000000
33const PC_MAGIC_8192: i64 = 8192
34const PC_MAGIC_80000: i64 = 80000
35const PC_MAGIC_1000000: i64 = 1000000
36
37const PC_REF: *u8 = "knowledge/registry/param_surfaces.tsv"
38const PC_REG: *u8 = "knowledge/registry/params.tsv"
39const PC_OUT: *u8 = "knowledge/registry/param_census.tsv"
40const PC_LOG: *u8 = "knowledge/status/param_census.log"
41const PC_BAK: *u8 = "knowledge/registry/params.tsv.bak.preParamCensus"
42const PC_FX_DIRTY: *u8 = "/tmp/_prm_fx_dirty.nx"
43const PC_FX_CLEAN: *u8 = "/tmp/_prm_fx_clean.nx"
44
45func pc_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
46// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
47// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
48// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
49// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
50func pc_wn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 }
51
52// read whole file into buf (cap-bounded); return length, -1 if open fails.
53func pc_read_file(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var tot: i64 = 0
  var r: i64 = 1
  while r > 0 {
      let dst: *u8 = ((buf as i64) + tot) as *u8
      r = sys_read(fd, dst, cap - tot)
      if r > 0 { tot = tot + r }
  }
  sys_close(fd)
  return tot
65}
66
67// scan buf[start..n) for the first byte == delim (or n); return that index.
68func pc_scan_to(buf: *u8, n: i64, start: i64, delim: i64) -> i64 {
  var i: i64 = start
  var s: i64 = 1
  while s == 1 { if i >= n { s = 0 } else { if buf[i] == (delim as u8) { s = 0 } else { i = i + 1 } } }
  return i
73}
74
75// append NUL-terminated s into dst at off; return new offset (no NUL written).
76func pc_app(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i }
77
78// append the slice src[a..b) into dst at off; return new offset.
79func pc_app_slice(dst: *u8, off: i64, src: *u8, a: i64, b: i64) -> i64 {
  var o: i64 = off; var i: i64 = a
  while i < b { dst[o] = src[i]; o = o + 1; i = i + 1 }
  return o
83}
84
85// write a fixture file (truncating) with the given NUL-terminated content; return 0/-1.
86func pc_write_fixture(path: *u8, content: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, 420)
  if fd < 0 { return 0 - 1 }
  var n: i64 = 0; while content[n] != (0 as u8) { n = n + 1 }
  sys_write(fd, content, n)
  sys_close(fd)
  return 0
93}
94
95// is a NAME (a copy of src[a..b)) an ABI/syscall const we must NOT file as DEBT?  Prefix match.
96func pc_is_abi(src: *u8, a: i64, b: i64) -> i64 {
  let L: i64 = b - a
  // SYS_
  if L >= 4 { if src[a]==(83 as u8) { if src[a+1]==(89 as u8) { if src[a+2]==(83 as u8) { if src[a+3]==(95 as u8) { return 1 } } } } }
  // AT_
  if L >= 3 { if src[a]==(65 as u8) { if src[a+1]==(84 as u8) { if src[a+2]==(95 as u8) { return 1 } } } }
  // O_
  if L >= 2 { if src[a]==(79 as u8) { if src[a+1]==(95 as u8) { return 1 } } }
  // SOCK
  if L >= 4 { if src[a]==(83 as u8) { if src[a+1]==(79 as u8) { if src[a+2]==(67 as u8) { if src[a+3]==(75 as u8) { return 1 } } } } }
  // AF_
  if L >= 3 { if src[a]==(65 as u8) { if src[a+1]==(70 as u8) { if src[a+2]==(95 as u8) { return 1 } } } }
  // CLONE
  if L >= 5 { if src[a]==(67 as u8) { if src[a+1]==(76 as u8) { if src[a+2]==(79 as u8) { if src[a+3]==(78 as u8) { if src[a+4]==(69 as u8) { return 1 } } } } } }
  // DT_
  if L >= 3 { if src[a]==(68 as u8) { if src[a+1]==(84 as u8) { if src[a+2]==(95 as u8) { return 1 } } } }
  // SO_  (also covers SOL_ via SO prefix? no: must distinguish; SO_ then SOL_)
  if L >= 3 { if src[a]==(83 as u8) { if src[a+1]==(79 as u8) { if src[a+2]==(95 as u8) { return 1 } } } }
  // SOL_
  if L >= 4 { if src[a]==(83 as u8) { if src[a+1]==(79 as u8) { if src[a+2]==(76 as u8) { if src[a+3]==(95 as u8) { return 1 } } } } }
  // SIG
  if L >= 3 { if src[a]==(83 as u8) { if src[a+1]==(73 as u8) { if src[a+2]==(71 as u8) { return 1 } } } }
  return 0
119}
120
121func pc_is_alnum_us(c: i64) -> i64 {
  if c == 95 { return 1 }
  if c >= 48 { if c <= 57 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 97 { if c <= 122 { return 1 } }
  return 0
127}
128
129// emit one DEBT row (8-col, matching params.tsv schema) into dst at off; return new off.
130//   NAME = src[na..nb)   value-digits = src[va..vb)   organ = basename copy in onm (NUL-term)
131func pc_emit_debt(dst: *u8, off: i64, src: *u8, na: i64, nb: i64, va: i64, vb: i64, onm: *u8, spath: *u8) -> i64 {
  var o: i64 = off
  o = pc_app_slice(dst, o, src, na, nb)
  o = pc_app(dst, o, "\t" as *u8)
  o = pc_app(dst, o, onm)
  o = pc_app(dst, o, "\t" as *u8)
  o = pc_app_slice(dst, o, src, va, vb)
  o = pc_app(dst, o, "\tmagic-int\t" as *u8)
  o = pc_app(dst, o, spath)
  o = pc_app(dst, o, "\tUNMETERED\tDEBT\tX-PRM-002 census: named source const outside config = rule-11 debt; promote to conf or FIX-BY-SPEC\n" as *u8)
  return o
142}
143
144// derive a basename (last path segment) of a NUL-terminated path into out (NUL-term).
145func pc_basename(path: *u8, out: *u8) -> i64 {
  var len: i64 = 0; while path[len] != (0 as u8) { len = len + 1 }
  var s: i64 = 0; var i: i64 = 0
  while i < len { if path[i] == (47 as u8) { s = i + 1 } i = i + 1 }
  var k: i64 = 0
  while s < len { out[k] = path[s]; k = k + 1; s = s + 1 }
  out[k] = 0 as u8
  return k
153}
154
155// HALF-B core: scan src[0..n) for `const NAME: i64 = <digit>`; for each NAME not in REG and not
156// ABI, emit a DEBT row to dbuf (off) and bump found[0].  Returns new dbuf offset.  `filemode`:
157// 1 = real (skip already-registered via re_has against REG); 0 = control (count ALL candidates,
158// no registry skip, no emit) -- used by the planted/clean fixtures.  found[0]=candidates counted.
159func pc_scan_consts(src: *u8, n: i64, reg: *u8, regn: i64, dbuf: *u8, doff: i64, onm: *u8, spath: *u8, filemode: i64, found: *i64) -> i64 {
  var o: i64 = doff
  var p: i64 = 0
  while p < n {
      // match the literal "const " (6 bytes) at p.
      var hit: i64 = 0
      if p + 6 <= n {
          if src[p]==(99 as u8) { if src[p+1]==(111 as u8) { if src[p+2]==(110 as u8) { if src[p+3]==(115 as u8) { if src[p+4]==(116 as u8) { if src[p+5]==(32 as u8) { hit = 1 } } } } } }
      }
      if hit == 0 { p = p + 1 }
      else {
          let na: i64 = p + 6
          // NAME = alnum/underscore run.
          var nb: i64 = na
          var run: i64 = 1
          while run == 1 { if nb >= n { run = 0 } else { if pc_is_alnum_us(src[nb] as i64) == 1 { nb = nb + 1 } else { run = 0 } } }
          // expect ": i64 = " then a digit.  Verify the exact byte pattern.
          var ok: i64 = 0
          var va: i64 = 0; var vb: i64 = 0
          if nb + 8 <= n {
              if src[nb]==(58 as u8) { if src[nb+1]==(32 as u8) { if src[nb+2]==(105 as u8) { if src[nb+3]==(54 as u8) { if src[nb+4]==(52 as u8) { if src[nb+5]==(32 as u8) { if src[nb+6]==(61 as u8) { if src[nb+7]==(32 as u8) {
                  // src[nb+8] must be a digit or '-' then digit.
                  var d: i64 = nb + 8
                  if d < n { if src[d]==(45 as u8) { d = d + 1 } }
                  if d < n { if src[d] >= (48 as u8) { if src[d] <= (57 as u8) { ok = 1; va = nb + 8 } } }
              } } } } } } } }
          }
          if ok == 1 {
              // value-end fix: vb walked past with sentinel; recompute true end.
              vb = va; if src[vb]==(45 as u8) { vb = vb + 1 }
              var vrun: i64 = 1
              while vrun == 1 { if vb >= n { vrun = 0 } else { if src[vb] >= (48 as u8) { if src[vb] <= (57 as u8) { vb = vb + 1 } else { vrun = 0 } } else { vrun = 0 } } }
              let abi: i64 = pc_is_abi(src, na, nb)
              if abi == 0 {
                  if filemode == 0 {
                      found[0] = found[0] + 1
                  } else {
                      // build a NUL-terminated NAME copy for re_has.
                      let nm: *u8 = sys_mmap(256)
                      var ci: i64 = na; var ck: i64 = 0
                      while ci < nb { nm[ck] = src[ci]; ck = ck + 1; ci = ci + 1 }
                      nm[ck] = 0 as u8
                      let reg_has: i64 = re_has(reg, regn, nm)
                      if reg_has == 0 {
                          o = pc_emit_debt(dbuf, o, src, na, nb, va, vb, onm, spath)
                          found[0] = found[0] + 1
                      }
                  }
              }
              p = vb
          } else { p = na }
      }
  }
  return o
213}
214
215func main(argc: i64, argv: *i64) -> i64 {
  var ref: *u8 = PC_REF
  var outp: *u8 = PC_OUT
  var logp: *u8 = PC_LOG
  var regp: *u8 = PC_REG
  var bakp: *u8 = PC_BAK
  var tamper: i64 = 0
  if argc >= 2 { ref = argv[1] as *u8; outp = "/tmp/_prm_census_tamper.tsv" as *u8; logp = "/tmp/_prm_census_tamper.log" as *u8; bakp = "/tmp/_prm_params_tamper.bak" as *u8; tamper = 1 }
223
  // ---- load the registry (the param-key universe) from REAL bytes ----
  let reg: *u8 = sys_mmap(PC_MAGIC_2000000)
  let regn: i64 = pc_read_file(regp, reg, PC_MAGIC_2000000)
  if regn <= 0 { pc_w(1, "PRMCENSUS verdict=RED reason=registry-unreadable\n" as *u8); return 1 }
228
  // ---- BAKED SELF-TEST CONTROLS (run BEFORE any real mutation) ----
  // pos controls: known registered keys must be present in the real registry read.
  let ctrl_pos_confkey: i64 = re_has(reg, regn, "diff_seed" as *u8)
  let ctrl_pos_debtrow: i64 = re_has(reg, regn, "an_load_max_rows" as *u8)
  // neg controls: planted fixtures scanned by the SAME const detector.
  pc_write_fixture(PC_FX_DIRTY, "// planted\nconst ZZ_PLANTED_MAGIC: i64 = 31337\n" as *u8)
  pc_write_fixture(PC_FX_CLEAN, "// clean\nfunc f() -> i64 { return 0 }\n" as *u8)
  let fxd: *u8 = sys_mmap(PC_MAGIC_8192)
  let fxc: *u8 = sys_mmap(PC_MAGIC_8192)
  let fxdn: i64 = pc_read_file(PC_FX_DIRTY, fxd, PC_MAGIC_8192)
  let fxcn: i64 = pc_read_file(PC_FX_CLEAN, fxc, PC_MAGIC_8192)
  let dbuf_ctl: *u8 = sys_mmap(PC_MAGIC_8192)
  let cnt: *i64 = sys_mmap(16) as *i64
  cnt[0] = 0
  pc_scan_consts(fxd, fxdn, reg, regn, dbuf_ctl, 0, "_fx" as *u8, "/tmp/_prm_fx_dirty.nx" as *u8, 0, cnt)
  let ctrl_neg_plantmagic: i64 = cnt[0]
  cnt[0] = 0
  pc_scan_consts(fxc, fxcn, reg, regn, dbuf_ctl, 0, "_fx" as *u8, "/tmp/_prm_fx_clean.nx" as *u8, 0, cnt)
  let ctrl_neg_cleanzero: i64 = cnt[0]
248
  // ---- load + parse the surface list (DATA-driven; growable) ----
  let rb: *u8 = sys_mmap(PC_MAGIC_80000)
  let rbn: i64 = pc_read_file(ref, rb, PC_MAGIC_80000)
  if rbn <= 0 { pc_w(1, "PRMCENSUS verdict=RED reason=surfaces-unreadable\n" as *u8); return 1 }
253
  // output census buffer + DEBT accumulation buffer
  let ob: *u8 = sys_mmap(PC_MAGIC_2000000)
  var o: i64 = 0
  o = pc_app(ob, o, "# AUTHORED BY nx_param_census (X-PRM-002) -- conf-key coverage + source magic-number DEBT.\n" as *u8)
  o = pc_app(ob, o, "# status COMPUTED via re_has against the REAL params.tsv bytes + const-scan of the REAL .nx source, NOT asserted.\n" as *u8)
  o = pc_app(ob, o, "# columns: status\tkey-or-const\tsurface\tdetail\n" as *u8)
260
  let dbuf: *u8 = sys_mmap(PC_MAGIC_1000000)
  var doff: i64 = 0
  let onm: *u8 = sys_mmap(256)
  let srcb: *u8 = sys_mmap(PC_MAGIC_2000000)
  let lineKey: *u8 = sys_mmap(512)
266
  var conf_keys: i64 = 0
  var conf_present: i64 = 0
  var consts_scanned: i64 = 0
  var debt_filed: i64 = 0
  let dcnt: *i64 = sys_mmap(16) as *i64
272
  var p: i64 = 0
  while p < rbn {
      if rb[p] == (35 as u8) { let e: i64 = pc_scan_to(rb, rbn, p, 10); p = e + 1 }
      else { if rb[p] == (10 as u8) { p = p + 1 }
      else {
          // kind = rb[p] (C or S); after kind a TAB, then path to EOL.
          let kind: i64 = rb[p] as i64
          let t1: i64 = pc_scan_to(rb, rbn, p, 9)        // end of kind token
          let pa: i64 = t1 + 1
          let pe: i64 = pc_scan_to(rb, rbn, pa, 10)      // end of path (newline)
          // NUL-terminate the path in place (safe: we overwrite the newline).
          rb[pe] = 0 as u8
          let spath: *u8 = ((rb as i64) + pa) as *u8
286
          if kind == 67 {   // 'C' -- conf-key coverage
              let cn: i64 = pc_read_file(spath, srcb, PC_MAGIC_2000000)
              if cn > 0 {
                  var lp: i64 = 0
                  while lp < cn {
                      if srcb[lp] == (35 as u8) { let le: i64 = pc_scan_to(srcb, cn, lp, 10); lp = le + 1 }
                      else { if srcb[lp] == (10 as u8) { lp = lp + 1 }
                      else {
                          let le: i64 = pc_scan_to(srcb, cn, lp, 10)
                          // find '=' within this line BEFORE any whitespace (key=value form only).
                          var eq: i64 = -1
                          var ws: i64 = 0
                          var j: i64 = lp
                          while j < le { if srcb[j] == (61 as u8) { if eq < 0 { if ws == 0 { eq = j } } } if srcb[j] == (32 as u8) { ws = 1 } if srcb[j] == (9 as u8) { ws = 1 } j = j + 1 }
                          if eq > lp {
                              // key = srcb[lp..eq)
                              var ki: i64 = lp; var kk: i64 = 0
                              while ki < eq { lineKey[kk] = srcb[ki]; kk = kk + 1; ki = ki + 1 }
                              lineKey[kk] = 0 as u8
                              conf_keys = conf_keys + 1
                              let has: i64 = re_has(reg, regn, lineKey)
                              if has == 1 { o = pc_app(ob, o, "PRESENT\t" as *u8); conf_present = conf_present + 1 }
                              else { o = pc_app(ob, o, "ABSENT\t" as *u8) }
                              o = pc_app(ob, o, lineKey)
                              o = pc_app(ob, o, "\t" as *u8); o = pc_app(ob, o, spath)
                              o = pc_app(ob, o, "\tconf-key (rule-11 satisfied: belongs in params.tsv)\n" as *u8)
                          }
                          lp = le + 1
                      } }
                  }
              }
          }
          if kind == 83 {   // 'S' -- source magic-number DEBT
              let sn: i64 = pc_read_file(spath, srcb, PC_MAGIC_2000000)
              if sn > 0 {
                  pc_basename(spath, onm)
                  dcnt[0] = 0
                  doff = pc_scan_consts(srcb, sn, reg, regn, dbuf, doff, onm, spath, 1, dcnt)
                  debt_filed = debt_filed + dcnt[0]
                  // INFO census row per S surface (consts seen recorded in dbuf; report count).
                  o = pc_app(ob, o, "DEBT-SCAN\t" as *u8); o = pc_app(ob, o, onm)
                  o = pc_app(ob, o, "\t" as *u8); o = pc_app(ob, o, spath)
                  o = pc_app(ob, o, "\tnamed i64 const magic numbers filed=" as *u8)
                  // append dcnt[0] decimal
                  var mv: i64 = dcnt[0]; let tb: *u8 = sys_mmap(28); var tk: i64 = 0
                  if mv == 0 { tb[0] = 48; tk = 1 }
                  while mv > 0 { tb[tk] = (48 + (mv % 10)) as u8; mv = mv / 10; tk = tk + 1 }
                  var ti: i64 = 0
                  while ti < tk { ob[o] = tb[tk-1-ti]; o = o + 1; ti = ti + 1 }
                  o = pc_app(ob, o, "\n" as *u8)
                  consts_scanned = consts_scanned + 1
              }
          }
          p = pe + 1
      } }
  }
343
  // ---- GATE: GREEN iff all controls pass AND conf_keys>0 ----
  var ok: i64 = 1
  if ctrl_pos_confkey != 1 { ok = 0 }
  if ctrl_pos_debtrow != 1 { ok = 0 }
  if ctrl_neg_plantmagic != 1 { ok = 0 }
  if ctrl_neg_cleanzero != 0 { ok = 0 }
  if conf_keys <= 0 { ok = 0 }
351
  var coverage_permil: i64 = 0
  if conf_keys > 0 { coverage_permil = (conf_present * 1000) / conf_keys }
354
  // ---- on GREEN: write census report + APPEND DEBT rows to params.tsv (after .bak) ----
  if ok == 1 {
      let wfd: i64 = sys_openat_wr(outp, 420)
      if wfd >= 0 { sys_write(wfd, ob, o); sys_close(wfd) }
      if tamper == 0 {
          if debt_filed > 0 {
              // .bak the whole registry first (additive-safety; rule-13).
              let bfd: i64 = sys_openat_wr(bakp, 420)
              if bfd >= 0 { sys_write(bfd, reg, regn); sys_close(bfd) }
              // APPEND (never truncate) the DEBT rows.
              let afd: i64 = sys_openat_append(regp, 420)
              if afd >= 0 { sys_write(afd, dbuf, doff); sys_close(afd) }
          }
      }
  }
370
  // ---- emit the PRMCENSUS verdict line (stdout + gate log) ----
  var lf: i64 = 1
  var pass2: i64 = 0
  while pass2 < 2 {
      pc_w(lf, "PRMCENSUS authored=organ source=param_surfaces.tsv registry=params.tsv conf_keys=" as *u8); pc_wn(lf, conf_keys)
      pc_w(lf, " conf_present=" as *u8); pc_wn(lf, conf_present)
      pc_w(lf, " conf_absent=" as *u8); pc_wn(lf, conf_keys - conf_present)
      pc_w(lf, " consts_surfaces=" as *u8); pc_wn(lf, consts_scanned)
      pc_w(lf, " debt_filed=" as *u8); pc_wn(lf, debt_filed)
      pc_w(lf, " coverage_permil=" as *u8); pc_wn(lf, coverage_permil)
      pc_w(lf, " ctrl_pos_confkey=" as *u8); pc_wn(lf, ctrl_pos_confkey)
      pc_w(lf, " ctrl_pos_debtrow=" as *u8); pc_wn(lf, ctrl_pos_debtrow)
      pc_w(lf, " ctrl_neg_plantmagic=" as *u8); pc_wn(lf, ctrl_neg_plantmagic)
      pc_w(lf, " ctrl_neg_cleanzero=" as *u8); pc_wn(lf, ctrl_neg_cleanzero)
      if ok == 1 { pc_w(lf, " verdict=GREEN reason=controls-pass\n" as *u8) }
      else { pc_w(lf, " verdict=RED reason=control-or-empty\n" as *u8) }
      if pass2 == 0 { lf = sys_openat_append(logp, 420); if lf < 0 { pass2 = 2 } }
      pass2 = pass2 + 1
  }
  if lf > 2 { sys_close(lf) }
391
  if ok == 1 { return 0 }
  return 1
394}
nx_param_census.nx source

`nx_param_census.nx` source
