`nx_ppp_probe.nx` source

↩ module page · 901 lines · 51178 B
1// nx_ppp_probe.nx -- PERSON / PRODUCT / PLACE probe: ONE ruler, run on OUR live surface AND on each rival's
2// live surface, so a /compare page can say how to build a better site than the competitor from a measurement
3// instead of an opinion (operator 2026-08-24: "we need to know the person, product, and place ... competing on
4// person via privacy and superior cx, product as a superior product ... place ... ease of navigation and
5// ability to accomplish the desired task").
6//
7// WHAT IT MEASURES, from the bytes a first visitor receives (HTML body over the sovereign TLS stack + the
8// HTTP response headers) -- the same envelope for every subject, which is what makes the head-to-head fair:
9//   PERSON  (privacy + CX)  third-party asset hosts, third-party SCRIPT hosts, known tracker markers (tag
10//           manager, analytics, pixel, session-replay, ad networks, fingerprinting), consent-banner markers,
11//           cookie-less analytics markers, Set-Cookie count, Permissions-Policy, the 5 security headers
12//           (composes nx_uiq_wire_lib uw_audit -- one ruler for headers, never a second copy).
13//   PRODUCT (design quality + longevity)  the design-hygiene score of nx_ui_audit (forked, /12), computed
14//           WCAG contrast over the page's real color tokens (composes nx_uiq_color uiq_audit_buf in-process),
15//           the static Core-Web-Vitals predictor of nx_uiq_perf (forked: render-blocking css/js, unsized
16//           media), script tags, inline-JS share of the page, noscript, dark-mode + reduced-motion media
17//           queries, canonical link, doctype, page weight.
18//   PLACE   (findability + task)  nav / main / footer landmarks, skip link, on-site search, breadcrumb,
19//           exactly-one h1, aria-current, link count and internal-link count, lang, viewport, title.
20// SCORE: each axis is a permil computed by the DECLARED rules in pp_score_* below -- every rule is a count
21// against a published bar (WCAG 2.2 landmarks and skip links, NN/g search + breadcrumb, web.dev CWV
22// predictors, OWASP secure headers, the Markup Blacklight tracker classes) so it can be argued with, and the
23// raw counts are printed beside the score so nobody has to trust the arithmetic.
24// THIRD STATE: a sub-measure the probe could not observe (a fork that returned nothing, headers not captured)
25// is printed as -1 and named in "unobserved" -- it scores ZERO for that rule and the page says so, never a
26// silent acquittal (abstain-never-acquit).
27// HONEST ENVELOPE: static HTML + headers, no render, no script execution. A client-rendered app is graded on
28// what it ships to a no-JS first visitor -- which is the progressive-enhancement bar itself, stated on the
29// page. Registrable domain = last two labels (wrong for co.uk-class suffixes; declared).
30//   nx_ppp_probe url <url> [connect-host:port]   -> one JSON object on stdout
31//   nx_ppp_probe domain <dom>                    -> reads knowledge/compare/<dom>.ppp rows
32//                                                   surface|<col>|<label>|<url>|<connect or ->
33//                                                   probes each, writes knowledge/compare/<dom>.pppstate
34//   nx_ppp_probe --kat                           -> fixture self-test (bite-proven both directions)
35// exit: 0 ok | 1 kat failed | 2 usage | 4 fetch failed (url verb)
36// license_tier: ORIGINAL   No hw writes (Rule 26).
37import "nx_syscalls.nx"
38import "nx_tool_run.nx"
39import "nx_https_fetch_follow.nx"
40import "nx_trust_store_load_from_certdata.nx"
41import "nx_https_url_connect.nx"
42import "nx_uiq_color.nx"
43import "nx_uiq_wire_lib.nx"
44
45const PP_BODY_CAP: i64 = 4194304        // one page body reserve (largest rival measured: 792 KB); brim announces
46const PP_CERT_CAP: i64 = 4194304        // Mozilla certdata reserve, as nx_ui_audit sizes it
47const PP_FORK_CAP: i64 = 262144         // a forked ruler's stdout, unknowable in advance
48const PP_HDR_CAP: i64 = 2097152         // nx_https_get prints headers AND body; headers are read from the head
49const PP_HOSTS_MAX: i64 = 128           // distinct hosts tracked per page; brim announces
50const PP_HOST_W: i64 = 128              // one host slot
51const PP_OUT_CAP: i64 = 32768           // one surface's JSON
52const PP_MIN_BYTES: i64 = 1024          // under this a body is a redirect stub or a co-squat 404, not a page
53const PP_FORK_MS: i64 = 60000           // a forked ruler that has not answered in a minute is UNOBSERVED
54const PP_MAX_SURFACES: i64 = 16
55const PP_ROW_CAP: i64 = 2048
56const PP_STATE_CAP: i64 = 524288
57const PP_NAME_CAP: i64 = 512
58const PP_TMP_BODY: *u8 = "/tmp/nx_ppp_body.html"
59const PP_LINE_CAP: i64 = 4096
60// widest attr=value pattern pp_has_attr assembles (attr + 3 punctuation bytes + value + NUL)
61const PP_ATTRPAT_CAP: i64 = 256
62// scratch for one decimal integer rendered by pp_catn (i64 max is 19 digits + sign + NUL)
63const PP_NUMBUF_CAP: i64 = 32
64
65func pp_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
66func pp_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
67func pp_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } d[p] = 0 as u8; return p }
68func pp_catn(d: *u8, o: i64, v: i64) -> i64 {
  var p: i64 = o
  var m: i64 = v
  if m < 0 { d[p] = 45 as u8; p = p + 1; m = 0 - m }
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { d[p] = t[k - 1 - i]; p = p + 1; i = i + 1 }
  d[p] = 0 as u8
  return p
80}
81func pp_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] == b[i] { if a[i] == (0 as u8) { return 1 } i = i + 1 } return 0 }
82func pp_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
83// count non-overlapping occurrences of pat in buf[0..n)
84func pp_count(buf: *u8, n: i64, pat: *u8) -> i64 {
  let pl: i64 = pp_len(pat)
  if pl == 0 { return 0 }
  var c: i64 = 0
  var i: i64 = 0
  while i + pl <= n {
      var k: i64 = 0
      var m: i64 = 1
      while k < pl { if buf[i + k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
      if m == 1 { c = c + 1; i = i + pl } else { i = i + 1 }
  }
  return c
96}
97func pp_has(buf: *u8, n: i64, pat: *u8) -> i64 { if pp_count(buf, n, pat) > 0 { return 1 } return 0 }
98// Quote-agnostic attribute match: attr="val" | attr='val' | attr=val.
99// WHY THIS EXISTS: the three-form check was already hand-written for rel=canonical and for href=/,
100// and NOT for name=viewport, role=main, role=search or type=search. MEASURED 2026-08-25: the live
101// /games page emits <meta name='viewport' ...> in SINGLE quotes, so this probe scored viewport=0 on
102// a page that is CORRECT -- a false negative inside a PUBLISHED competitive score, worth 50 permil
103// of PLACE. A fix applied in one place and not its siblings is half a fix; this is the one matcher,
104// so the next attribute added cannot inherit the same gap.
105// LIMIT, DECLARED: the bare form is a prefix match, so attr=val also matches attr=valxyz. That
106// over-match is inherited from the incumbent's own bare fallback and is not widened here.
107func pp_has_attr(buf: *u8, n: i64, attr: *u8, val: *u8) -> i64 {
  let b: *u8 = sys_mmap(PP_ATTRPAT_CAP)
  var p: i64 = pp_cat(b, 0, attr)
  p = pp_cat(b, p, "=\"" as *u8); p = pp_cat(b, p, val); p = pp_cat(b, p, "\"" as *u8)
  if pp_has(buf, n, b) == 1 { return 1 }
  p = pp_cat(b, 0, attr)
  p = pp_cat(b, p, "='" as *u8); p = pp_cat(b, p, val); p = pp_cat(b, p, "'" as *u8)
  if pp_has(buf, n, b) == 1 { return 1 }
  p = pp_cat(b, 0, attr)
  p = pp_cat(b, p, "=" as *u8); p = pp_cat(b, p, val)
  if pp_has(buf, n, b) == 1 { return 1 }
  return 0
119}
120// first index of pat in buf[from..n) or -1
121func pp_find(buf: *u8, n: i64, from: i64, pat: *u8) -> i64 {
  let pl: i64 = pp_len(pat)
  if pl == 0 { return 0 - 1 }
  var i: i64 = from
  while i + pl <= n {
      var k: i64 = 0
      var m: i64 = 1
      while k < pl { if buf[i + k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
      if m == 1 { return i }
      i = i + 1
  }
  return 0 - 1
133}
134// parse the integer that follows key in buf (a JSON "key":N), -1 when absent
135func pp_json_int(buf: *u8, n: i64, key: *u8) -> i64 {
  let at: i64 = pp_find(buf, n, 0, key)
  if at < 0 { return 0 - 1 }
  var i: i64 = at + pp_len(key)
  while i < n { if buf[i] == (32 as u8) { i = i + 1 } else { break } }
  var neg: i64 = 0
  if i < n { if buf[i] == (45 as u8) { neg = 1; i = i + 1 } }
  var v: i64 = 0
  var got: i64 = 0
  while i < n {
      let c: i64 = buf[i] as i64
      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); got = 1; i = i + 1 } else { break } } else { break }
  }
  if got == 0 { return 0 - 1 }
  if neg == 1 { return 0 - v }
  return v
151}
152func pp_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
153// resolve a promoted elf the way the estate installs it (flat at the serving root; ../ when run from buildroot)
154func pp_elf(name: *u8, out: *u8) -> i64 {
  var o: i64 = pp_cat(out, 0, name); o = pp_cat(out, o, ".elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  o = pp_cat(out, 0, "../" as *u8); o = pp_cat(out, o, name); o = pp_cat(out, o, ".elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  o = pp_cat(out, 0, "_offc/" as *u8); o = pp_cat(out, o, name); o = pp_cat(out, o, ".elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  o = pp_cat(out, 0, "/volume1/homes/elderwesto/nishihost/" as *u8); o = pp_cat(out, o, name); o = pp_cat(out, o, ".elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  // the estate registers some CLIs under a _cli2 basename (nx_https_get -> nx_https_get_cli2.elf); a plain
  // <name>.elf may not exist. Fall back so pp_fork resolves the ACTUAL installed binary rather than reporting
  // a reachable subject UNOBSERVED (the header axis went dark on every surface until this line existed).
  o = pp_cat(out, 0, name); o = pp_cat(out, o, "_cli2.elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  o = pp_cat(out, 0, "/volume1/homes/elderwesto/nishihost/" as *u8); o = pp_cat(out, o, name); o = pp_cat(out, o, "_cli2.elf" as *u8)
  if pp_exists(out) == 1 { return 1 }
  return 0
171}
172func pp_write_atomic(path: *u8, buf: *u8, n: i64) -> i64 {
  let tmp: *u8 = sys_mmap(PP_NAME_CAP + 8)
  var o: i64 = pp_cat(tmp, 0, path); o = pp_cat(tmp, o, ".tmp" as *u8)
  let fd: i64 = sys_openat_wr(tmp, 420)
  if fd < 0 { return 0 - 1 }
  var off: i64 = 0
  while off < n { let r: i64 = sys_write(fd, ((buf as i64) + off) as *u8, n - off); if r <= 0 { sys_close(fd); return 0 - 2 } off = off + r }
  sys_close(fd)
  if sys_renameat(tmp, path) != 0 { return 0 - 3 }
  return 0
182}
183// lowercase copy of buf[0..n) into dst (dst has room for n+1)
184func pp_lower(src: *u8, n: i64, dst: *u8) -> i64 {
  var i: i64 = 0
  while i < n { dst[i] = pp_lc(src[i] as i64) as u8; i = i + 1 }
  dst[n] = 0 as u8
  return n
189}
190// page host from a url: after :// up to / or : ; registrable domain = last two labels (declared imprecision)
191func pp_host_of(url: *u8, host: *u8, reg: *u8) -> i64 {
  var i: i64 = 0
  let n: i64 = pp_len(url)
  let at: i64 = pp_find(url, n, 0, "://" as *u8)
  if at >= 0 { i = at + 3 }
  var o: i64 = 0
  while i < n {
      let c: i64 = url[i] as i64
      if c == 47 { break }
      if c == 58 { break }
      if c == 63 { break }
      if o < PP_HOST_W - 1 { host[o] = pp_lc(c) as u8; o = o + 1 }
      i = i + 1
  }
  host[o] = 0 as u8
  // registrable = from the second-last dot
  var dots: i64 = 0
  var k: i64 = o - 1
  var start: i64 = 0
  while k >= 0 {
      if host[k] == (46 as u8) { dots = dots + 1; if dots == 2 { start = k + 1; k = 0 - 1 } }
      k = k - 1
  }
  var r: i64 = 0
  var j: i64 = start
  while j < o { reg[r] = host[j]; r = r + 1; j = j + 1 }
  reg[r] = 0 as u8
  return o
219}
220// does host (NUL-term) end with "." + reg, or equal reg?
221func pp_same_site(host: *u8, reg: *u8) -> i64 {
  let hl: i64 = pp_len(host)
  let rl: i64 = pp_len(reg)
  if rl == 0 { return 0 }
  if hl == rl { if pp_streq(host, reg) == 1 { return 1 } return 0 }
  if hl < rl + 1 { return 0 }
  if host[hl - rl - 1] != (46 as u8) { return 0 }
  var i: i64 = 0
  while i < rl { if host[hl - rl + i] != reg[i] { return 0 } i = i + 1 }
  return 1
231}
232// tag containing position p starts with "<script"? (scan back to the opening '<')
233func pp_in_script_tag(lb: *u8, p: i64) -> i64 {
  var k: i64 = p
  while k > 0 {
      let c: i64 = lb[k] as i64
      if c == 60 { break }
      if c == 62 { return 0 }
      k = k - 1
  }
  if lb[k] != (60 as u8) { return 0 }
  if pp_find(lb, k + 8, k, "<script" as *u8) == k { return 1 }
  return 0
244}
245// distinct src= hosts. out[0]=distinct third-party hosts out[1]=distinct third-party SCRIPT hosts out[2]=all distinct hosts
246// out[3]=1 when the host table brimmed (a floor, not a total)
247func pp_hosts(lb: *u8, n: i64, reg: *u8, out: *i64, names: *u8) -> i64 {
  let tab: *u8 = sys_mmap(PP_HOSTS_MAX * PP_HOST_W)
  let kind: *i64 = sys_mmap(PP_HOSTS_MAX * 8) as *i64   // 1 = seen in a script tag
  var cnt: i64 = 0
  var brim: i64 = 0
  var p: i64 = 0
  let h: *u8 = sys_mmap(PP_HOST_W)
  while p < n {
      let at: i64 = pp_find(lb, n, p, "src=" as *u8)
      if at < 0 { break }
      var i: i64 = at + 4
      if i < n { if lb[i] == (34 as u8) { i = i + 1 } else { if lb[i] == (39 as u8) { i = i + 1 } } }
      var ok: i64 = 0
      if pp_find(lb, n, i, "https://" as *u8) == i { i = i + 8; ok = 1 } else {
          if pp_find(lb, n, i, "http://" as *u8) == i { i = i + 7; ok = 1 } else {
              if i + 1 < n { if lb[i] == (47 as u8) { if lb[i + 1] == (47 as u8) { i = i + 2; ok = 1 } } } } }
      if ok == 1 {
          var o: i64 = 0
          while i < n {
              let c: i64 = lb[i] as i64
              if c == 47 { break }
              if c == 34 { break }
              if c == 39 { break }
              if c == 58 { break }
              if c == 63 { break }
              if c == 32 { break }
              if c == 62 { break }
              if o < PP_HOST_W - 1 { h[o] = c as u8; o = o + 1 }
              i = i + 1
          }
          h[o] = 0 as u8
          if o > 0 {
              var found: i64 = 0 - 1
              var t: i64 = 0
              while t < cnt { if pp_streq(((tab as i64) + t * PP_HOST_W) as *u8, h) == 1 { found = t; t = cnt } else { t = t + 1 } }
              let insc: i64 = pp_in_script_tag(lb, at)
              if found < 0 {
                  if cnt < PP_HOSTS_MAX {
                      pp_cat(((tab as i64) + cnt * PP_HOST_W) as *u8, 0, h)
                      kind[cnt] = insc
                      cnt = cnt + 1
                  } else { brim = 1 }
              } else { if insc == 1 { kind[found] = 1 } }
          }
      }
      p = at + 4
  }
  var tp: i64 = 0
  var tps: i64 = 0
  var no: i64 = 0
  var t2: i64 = 0
  while t2 < cnt {
      let hh: *u8 = ((tab as i64) + t2 * PP_HOST_W) as *u8
      if pp_same_site(hh, reg) == 0 {
          tp = tp + 1
          if kind[t2] == 1 { tps = tps + 1 }
          if no < 400 { if no > 0 { no = pp_cat(names, no, " " as *u8) } no = pp_cat(names, no, hh) }
      }
      t2 = t2 + 1
  }
  out[0] = tp; out[1] = tps; out[2] = cnt; out[3] = brim
  return tp
309}
310// tracker marker classes (the Markup Blacklight classes plus the ad-network and replay vendors); returns hits
311func pp_trackers(lb: *u8, n: i64, names: *u8) -> i64 {
  let pats: *i64 = sys_mmap(32 * 8) as *i64
  pats[0] = "googletagmanager.com" as i64
  pats[1] = "google-analytics.com" as i64
  pats[2] = "gtag(" as i64
  pats[3] = "fbevents.js" as i64
  pats[4] = "connect.facebook.net" as i64
  pats[5] = "hotjar" as i64
  pats[6] = "fullstory" as i64
  pats[7] = "clarity.ms" as i64
  pats[8] = "doubleclick.net" as i64
  pats[9] = "adsbygoogle" as i64
  pats[10] = "segment.com" as i64
  pats[11] = "mixpanel" as i64
  pats[12] = "amplitude.com" as i64
  pats[13] = "heapanalytics" as i64
  pats[14] = "sentry" as i64
  pats[15] = "intercom" as i64
  pats[16] = "hubspot" as i64
  pats[17] = "taboola" as i64
  pats[18] = "outbrain" as i64
  pats[19] = "criteo" as i64
  pats[20] = "fingerprint" as i64
  pats[21] = "logrocket" as i64
  pats[22] = "datadoghq" as i64
  pats[23] = "posthog" as i64
  let np: i64 = 24
  var hits: i64 = 0
  var no: i64 = 0
  var i: i64 = 0
  while i < np {
      if pp_has(lb, n, pats[i] as *u8) == 1 {
          hits = hits + 1
          if no < 400 { if no > 0 { no = pp_cat(names, no, " " as *u8) } no = pp_cat(names, no, pats[i] as *u8) }
      }
      i = i + 1
  }
  return hits
349}
350func pp_consent(lb: *u8, n: i64) -> i64 {
  var c: i64 = 0
  if pp_has(lb, n, "cookieconsent" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "onetrust" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "cookiebot" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "consentmanager" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "cookie-banner" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "cookie banner" as *u8) == 1 { c = c + 1 }
  return c
359}
360func pp_cookieless(lb: *u8, n: i64) -> i64 {
  var c: i64 = 0
  if pp_has(lb, n, "plausible.io" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "usefathom" as *u8) == 1 { c = c + 1 }
  if pp_has(lb, n, "umami" as *u8) == 1 { c = c + 1 }
  return c
366}
367// inline JS bytes: sum of bytes between <script ...> and </script>
368func pp_inline_js(lb: *u8, n: i64) -> i64 {
  var total: i64 = 0
  var p: i64 = 0
  while p < n {
      let s: i64 = pp_find(lb, n, p, "<script" as *u8)
      if s < 0 { break }
      var e: i64 = s
      while e < n { if lb[e] == (62 as u8) { break } e = e + 1 }
      let close: i64 = pp_find(lb, n, e, "</script" as *u8)
      if close < 0 { break }
      if close > e + 1 { total = total + (close - e - 1) }
      p = close + 8
  }
  return total
382}
383// declared scoring rules -- every rule is a count against a published bar; printed beside the raw counts.
384// person: max 1000
385func pp_score_person(tp_hosts: i64, tp_script: i64, trackers: i64, consent: i64, setcookie: i64, sec: i64, permpol: i64) -> i64 {
  var s: i64 = 0
  if tp_script == 0 { s = s + 250 } else { if tp_script <= 2 { s = s + 100 } }
  if tp_hosts == 0 { s = s + 150 } else { if tp_hosts <= 3 { s = s + 75 } }
  if trackers == 0 { s = s + 250 } else { if trackers == 1 { s = s + 100 } }
  if consent == 0 { s = s + 50 }
  if setcookie == 0 { s = s + 100 } else { if setcookie == 1 { s = s + 50 } }
  if sec >= 5 { s = s + 150 } else { if sec >= 3 { s = s + 75 } }
  if permpol == 1 { s = s + 50 }
  return s
395}
396// product: max 1000
397func pp_score_product(design: i64, cfails: i64, ctokens: i64, bcss: i64, bjs: i64, unsized: i64, scripts: i64, jsperm: i64, noscript: i64, dark: i64, motion: i64, canonical: i64, doctype: i64) -> i64 {
  var s: i64 = 0
  if design >= 0 { s = s + (design * 300) / 12 }
  if ctokens > 0 { if cfails == 0 { s = s + 150 } } else { s = s + 50 }
  let blocking: i64 = bcss + bjs
  if bcss >= 0 { if blocking == 0 { s = s + 150 } else { if blocking <= 2 { s = s + 75 } } }
  if unsized == 0 { s = s + 100 }
  if scripts == 0 { s = s + 100 } else { if scripts <= 4 { s = s + 50 } else { if jsperm < 300 { s = s + 25 } } }
  if noscript == 1 { s = s + 25 }
  if dark == 1 { s = s + 50 }
  if motion == 1 { s = s + 25 }
  if canonical == 1 { s = s + 25 }
  if doctype == 1 { s = s + 25 }
  return s
411}
412// place: max 1000
413func pp_score_place(nav: i64, main: i64, footer: i64, skip: i64, search: i64, crumb: i64, h1: i64, links: i64, internal: i64, lang: i64, viewport: i64, title: i64, current: i64) -> i64 {
  var s: i64 = 0
  if nav == 1 { s = s + 150 }
  if main == 1 { s = s + 100 }
  if footer == 1 { s = s + 50 }
  if skip == 1 { s = s + 100 }
  if search == 1 { s = s + 150 }
  if crumb == 1 { s = s + 100 }
  if h1 == 1 { s = s + 100 }
  if internal >= 10 { s = s + 100 } else { if internal >= 3 { s = s + 50 } }
  if lang == 1 { s = s + 50 }
  if viewport == 1 { s = s + 50 }
  if title == 1 { s = s + 25 }
  if current == 1 { s = s + 25 }
  return s
428}
429// build the '#' bearing skip pattern at runtime (the lexer trap forbids the byte in a literal)
430func pp_pat_skip(out: *u8) -> i64 {
  var o: i64 = pp_cat(out, 0, "href=\"" as *u8)
  out[o] = 35 as u8; o = o + 1
  o = pp_cat(out, o, "main" as *u8)
  return o
435}
436func pp_pat_skip2(out: *u8) -> i64 {
  var o: i64 = pp_cat(out, 0, "href=\"" as *u8)
  out[o] = 35 as u8; o = o + 1
  o = pp_cat(out, o, "content" as *u8)
  return o
441}
442// ---- the measurement over a body already in hand: body (raw) + hdr capture (raw, may be empty) ----
443// m[] slots (i64): 0 tp_hosts 1 tp_script 2 trackers 3 consent 4 cookieless 5 setcookie 6 sec 7 permpol
444//   10 design 11 cfails 12 ctokens 13 bcss 14 bjs 15 unsized 16 scripts 17 jsperm 18 noscript 19 dark 20 motion 21 canonical 22 doctype 23 bytes
445//   30 nav 31 main 32 footer 33 skip 34 search 35 crumb 36 h1 37 links 38 internal 39 lang 40 viewport 41 title 42 current
446//   50 person 51 product 52 place 53 hosts_total 54 hosts_brim 55 status
447func pp_measure(body: *u8, n: i64, hdr: *u8, hn: i64, url: *u8, design: i64, bcss: i64, bjs: i64, unsized: i64, m: *i64, tnames: *u8, hnames: *u8) -> i64 {
  let lb: *u8 = sys_mmap(n + 16)
  pp_lower(body, n, lb)
  let host: *u8 = sys_mmap(PP_HOST_W)
  let reg: *u8 = sys_mmap(PP_HOST_W)
  pp_host_of(url, host, reg)
  let ho: *i64 = sys_mmap(8 * 8) as *i64
  pp_hosts(lb, n, reg, ho, hnames)
  m[0] = ho[0]; m[1] = ho[1]; m[53] = ho[2]; m[54] = ho[3]
  m[2] = pp_trackers(lb, n, tnames)
  m[3] = pp_consent(lb, n)
  m[4] = pp_cookieless(lb, n)
  if hn > 0 {
      let lh: *u8 = sys_mmap(hn + 16)
      pp_lower(hdr, hn, lh)
      // headers end at the first blank line; count only inside that block
      var he: i64 = pp_find(lh, hn, 0, "\r\n\r\n" as *u8)
      if he < 0 { he = pp_find(lh, hn, 0, "\n\n" as *u8) }
      if he < 0 { he = hn }
      m[5] = pp_count(lh, he, "set-cookie:" as *u8)
      m[7] = pp_has(lh, he, "permissions-policy:" as *u8)
      let uo: *i64 = sys_mmap(16 * 8) as *i64
      uw_audit(hdr, hn, uo)
      m[6] = uo[7]
      m[55] = uo[0]
  } else { m[5] = 0 - 1; m[6] = 0 - 1; m[7] = 0 - 1; m[55] = 0 - 1 }
  m[10] = design
  m[12] = 0
  let tcap: i64 = 96
  let toff: *i64 = sys_mmap(tcap * 8) as *i64
  let tlen: *i64 = sys_mmap(tcap * 8) as *i64
  let trgb: *i64 = sys_mmap(tcap * 24) as *i64
  m[12] = uiq_scan_tokens(body, n, toff, tlen, trgb, tcap)
  m[11] = uiq_audit_buf(body, n, 0)
  m[13] = bcss; m[14] = bjs; m[15] = unsized
  m[16] = pp_count(lb, n, "<script" as *u8)
  let js: i64 = pp_inline_js(lb, n)
  if n > 0 { m[17] = (js * 1000) / n } else { m[17] = 0 }
  m[18] = pp_has(lb, n, "<noscript" as *u8)
  m[19] = pp_has(lb, n, "prefers-color-scheme" as *u8)
  m[20] = pp_has(lb, n, "prefers-reduced-motion" as *u8)
  m[21] = pp_has_attr(lb, n, "rel" as *u8, "canonical" as *u8)
  m[22] = pp_has(lb, n, "doctype html" as *u8)
  m[23] = n
  m[30] = pp_has(lb, n, "<nav" as *u8)
  m[31] = pp_has(lb, n, "<main" as *u8)
  if m[31] == 0 { m[31] = pp_has_attr(lb, n, "role" as *u8, "main" as *u8) }
  m[32] = pp_has(lb, n, "<footer" as *u8)
  let sk: *u8 = sys_mmap(64)
  pp_pat_skip(sk)
  var skip: i64 = pp_has(lb, n, sk)
  if skip == 0 { pp_pat_skip2(sk); skip = pp_has(lb, n, sk) }
  if skip == 0 { skip = pp_has(lb, n, "skip to content" as *u8) }
  if skip == 0 { skip = pp_has(lb, n, "skip-link" as *u8) }
  m[33] = skip
  var search: i64 = pp_has_attr(lb, n, "role" as *u8, "search" as *u8)
  if search == 0 { search = pp_has_attr(lb, n, "type" as *u8, "search" as *u8) }
  m[34] = search
  var crumb: i64 = pp_has(lb, n, "breadcrumb" as *u8)
  m[35] = crumb
  m[36] = pp_count(lb, n, "<h1" as *u8)
  m[37] = pp_count(lb, n, "<a " as *u8)
  m[38] = pp_count(lb, n, "href=\"/" as *u8) + pp_count(lb, n, "href='/" as *u8)
  m[39] = pp_has(lb, n, " lang=" as *u8)
  m[40] = pp_has_attr(lb, n, "name" as *u8, "viewport" as *u8)
  m[41] = pp_has(lb, n, "<title" as *u8)
  m[42] = pp_has(lb, n, "aria-current" as *u8)
  var h1one: i64 = 0
  if m[36] == 1 { h1one = 1 }
  var sec: i64 = m[6]
  if sec < 0 { sec = 0 }
  var sc: i64 = m[5]
  if sc < 0 { sc = 1 }   // unobserved cookies: no credit for "none"
  var pp: i64 = m[7]
  if pp < 0 { pp = 0 }
  m[50] = pp_score_person(m[0], m[1], m[2], m[3], sc, sec, pp)
  m[51] = pp_score_product(m[10], m[11], m[12], m[13], m[14], m[15], m[16], m[17], m[18], m[19], m[20], m[21], m[22])
  m[52] = pp_score_place(m[30], m[31], m[32], m[33], m[34], m[35], h1one, m[37], m[38], m[39], m[40], m[41], m[42])
  return 0
526}
527func pp_kv(d: *u8, o: i64, k: *u8, v: i64) -> i64 {
  var p: i64 = pp_cat(d, o, "\"" as *u8); p = pp_cat(d, p, k); p = pp_cat(d, p, "\":" as *u8); p = pp_catn(d, p, v); return p
529}
530func pp_ks(d: *u8, o: i64, k: *u8, v: *u8) -> i64 {
  var p: i64 = pp_cat(d, o, "\"" as *u8); p = pp_cat(d, p, k); p = pp_cat(d, p, "\":\"" as *u8)
  var i: i64 = 0
  while v[i] != (0 as u8) { let c: i64 = v[i] as i64; if c == 34 { d[p] = 39 as u8 } else { if c == 92 { d[p] = 47 as u8 } else { if c < 32 { d[p] = 32 as u8 } else { d[p] = c as u8 } } } p = p + 1; i = i + 1 }
  d[p] = 0 as u8
  p = pp_cat(d, p, "\"" as *u8)
  return p
537}
538func pp_emit_json(out: *u8, col: *u8, label: *u8, url: *u8, m: *i64, tnames: *u8, hnames: *u8, unobs: *u8) -> i64 {
  var p: i64 = pp_cat(out, 0, "{" as *u8)
  p = pp_ks(out, p, "organ" as *u8, "nx_ppp_probe" as *u8); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "col" as *u8, col); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "label" as *u8, label); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "url" as *u8, url); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "asof" as *u8, sys_now_realtime_sec()); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "status" as *u8, m[55]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "bytes" as *u8, m[23]); p = pp_cat(out, p, "," as *u8)
  p = pp_cat(out, p, "\"person\":{" as *u8)
  p = pp_kv(out, p, "score_permil" as *u8, m[50]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "third_party_hosts" as *u8, m[0]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "third_party_script_hosts" as *u8, m[1]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "hosts_total" as *u8, m[53]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "hosts_brim" as *u8, m[54]); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "third_party_names" as *u8, hnames); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "tracker_hits" as *u8, m[2]); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "tracker_names" as *u8, tnames); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "consent_markers" as *u8, m[3]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "cookieless_analytics" as *u8, m[4]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "set_cookie" as *u8, m[5]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "sec_headers" as *u8, m[6]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "permissions_policy" as *u8, m[7]); p = pp_cat(out, p, "}," as *u8)
  p = pp_cat(out, p, "\"product\":{" as *u8)
  p = pp_kv(out, p, "score_permil" as *u8, m[51]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "design_hygiene" as *u8, m[10]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "design_max" as *u8, 12); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "contrast_fails" as *u8, m[11]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "contrast_tokens" as *u8, m[12]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "blocking_css" as *u8, m[13]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "blocking_js" as *u8, m[14]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "unsized_media" as *u8, m[15]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "script_tags" as *u8, m[16]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "inline_js_permil" as *u8, m[17]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "noscript" as *u8, m[18]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "dark_mode" as *u8, m[19]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "reduced_motion" as *u8, m[20]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "canonical" as *u8, m[21]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "doctype" as *u8, m[22]); p = pp_cat(out, p, "}," as *u8)
  p = pp_cat(out, p, "\"place\":{" as *u8)
  p = pp_kv(out, p, "score_permil" as *u8, m[52]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "nav" as *u8, m[30]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "main" as *u8, m[31]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "footer" as *u8, m[32]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "skip_link" as *u8, m[33]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "site_search" as *u8, m[34]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "breadcrumb" as *u8, m[35]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "h1_count" as *u8, m[36]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "links" as *u8, m[37]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "internal_links" as *u8, m[38]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "lang" as *u8, m[39]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "viewport" as *u8, m[40]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "title" as *u8, m[41]); p = pp_cat(out, p, "," as *u8)
  p = pp_kv(out, p, "aria_current" as *u8, m[42]); p = pp_cat(out, p, "}," as *u8)
  p = pp_ks(out, p, "unobserved" as *u8, unobs); p = pp_cat(out, p, "," as *u8)
  p = pp_ks(out, p, "envelope" as *u8, "static HTML + response headers over the sovereign TLS stack; no render, no script execution; a client-rendered app is graded on what a no-JS first visitor receives; -1 = unobserved (scores zero for that rule, never acquitted); registrable domain = last two labels" as *u8)
  p = pp_cat(out, p, "}" as *u8)
  return p
596}
597// fork a promoted ruler with argv and capture stdout; returns bytes captured (0 = unobserved)
598func pp_fork(name: *u8, a1: *u8, a2: *u8, out: *u8, cap: i64) -> i64 {
  let elf: *u8 = sys_mmap(PP_NAME_CAP)
  if pp_elf(name, elf) == 0 { return 0 }
  let av: *i64 = sys_mmap(8 * 8) as *i64
  av[0] = elf as i64
  av[1] = a1 as i64
  var an: i64 = 2
  if (a2 as i64) != 0 { av[2] = a2 as i64; an = 3 }
  av[an] = 0
  let ol: *i64 = sys_mmap(16) as *i64
  tr_run_capture_to(elf, av, out, cap, ol, PP_FORK_MS)
  return ol[0]
610}
611// probe one url end to end -> JSON in out; returns json length, or a negative code
612func pp_probe_url(url: *u8, connect: *u8, col: *u8, label: *u8, store: *TrustStore, out: *u8) -> i64 {
  if (connect as i64) != 0 { nx_https_connect_override_set(connect) }
  let unobs: *u8 = sys_mmap(512)
  var uo: i64 = 0
  // PRIMARY FETCH via the sovereign GET CLI: it leads with the Chrome-JA3 hello, which completes the
  // handshake at Cloudflare-fronted rivals (civitai/HF/syosetu) that RST the minimal in-process hello,
  // and it prints the status line + headers + DECODED body in one stream -- so ONE fetch yields BOTH the
  // header axis (privacy/security) and the body axis. A fork empty under load is not an unreachable
  // subject: one bounded retry (nx_ui_audit's paid lesson). resp holds the raw CLI stream (diagnostics,
  // then the HTTP response); httppos anchors the parse past the diagnostic prefix.
  let resp: *u8 = sys_mmap(PP_HDR_CAP + 16)
  var rn: i64 = pp_fork("nx_https_get_cli2" as *u8, url, connect, resp, PP_HDR_CAP)
  if rn < 16 { rn = pp_fork("nx_https_get_cli2" as *u8, url, connect, resp, PP_HDR_CAP) }
  let body: *u8 = sys_mmap(PP_BODY_CAP + 16)
  var n: i64 = 0
  var hdr: *u8 = resp
  var hn: i64 = 0
  var httppos: i64 = 0 - 1
  if rn >= 16 { httppos = pp_find(resp, rn, 0, "HTTP/" as *u8) }
  if httppos >= 0 {
      let sep: i64 = pp_find(resp, rn, httppos, "\r\n\r\n" as *u8)
      if sep >= 0 {
          hdr = (resp as i64 + httppos) as *u8
          hn = sep + 4 - httppos
          let bstart: i64 = sep + 4
          var bl: i64 = rn - bstart
          if bl < 0 { bl = 0 }
          if bl > PP_BODY_CAP { bl = PP_BODY_CAP }
          var c: i64 = 0
          while c < bl { body[c] = resp[bstart + c]; c = c + 1 }
          n = bl
      }
  }
  // FALLBACK: the low-level GET does not follow redirects, so a redirecting front door yields only a stub.
  // The in-process ladder DOES follow redirects; take it whenever it delivers a fuller body (headers are
  // then UNOBSERVED, honestly declared). Only reached when the CLI body is short -- our own surfaces land
  // here only if the CLI failed outright. It writes into body, so it is used only when it beats the CLI.
  if n < PP_MIN_BYTES {
      let st: *i64 = sys_mmap(16) as *i64
      var n2: i64 = nx_https_fetch_follow(url, store, body, PP_BODY_CAP, 5, st)
      if n2 <= 0 { n2 = nx_https_fetch_follow(url, store, body, PP_BODY_CAP, 5, st) }
      if n2 > n { n = n2; hn = 0 }
  }
  if n <= 0 { return 0 - 4 }
  if n < PP_MIN_BYTES { return 0 - 5 }
  if n >= PP_BODY_CAP { uo = pp_cat(unobs, uo, "body-brim " as *u8) }
  if hn == 0 { uo = pp_cat(unobs, uo, "headers " as *u8) }
  // design hygiene: nx_ui_audit fetches the url itself and prints "score":N
  let dbuf: *u8 = sys_mmap(PP_FORK_CAP)
  var design: i64 = 0 - 1
  let dn: i64 = pp_fork("nx_ui_audit" as *u8, url, connect, dbuf, PP_FORK_CAP)
  if dn > 0 { design = pp_json_int(dbuf, dn, "\"score\":" as *u8) }
  if design < 0 { uo = pp_cat(unobs, uo, "design-hygiene " as *u8) }
  // static CWV predictor over the saved body
  var bcss: i64 = 0 - 1
  var bjs: i64 = 0 - 1
  var unsized: i64 = 0 - 1
  if pp_write_atomic(PP_TMP_BODY, body, n) == 0 {
      let pbuf: *u8 = sys_mmap(PP_FORK_CAP)
      let pn: i64 = pp_fork("nx_uiq_perf" as *u8, PP_TMP_BODY, 0 as *u8, pbuf, PP_FORK_CAP)
      if pn > 0 {
          bcss = pp_json_int(pbuf, pn, "\"blocking_css\":" as *u8)
          bjs = pp_json_int(pbuf, pn, "\"blocking_js\":" as *u8)
          unsized = pp_json_int(pbuf, pn, "\"unsized_media\":" as *u8)
      }
  }
  if bcss < 0 { uo = pp_cat(unobs, uo, "cwv-predictor " as *u8) }
  let m: *i64 = sys_mmap(64 * 8) as *i64
  var z: i64 = 0
  while z < 64 { m[z] = 0; z = z + 1 }
  let tnames: *u8 = sys_mmap(512)
  let hnames: *u8 = sys_mmap(512)
  tnames[0] = 0 as u8; hnames[0] = 0 as u8
  pp_measure(body, n, hdr, hn, url, design, bcss, bjs, unsized, m, tnames, hnames)
  if m[54] == 1 { uo = pp_cat(unobs, uo, "host-table-brim " as *u8) }
  sys_free_file(body, PP_BODY_CAP + 16)
  return pp_emit_json(out, col, label, url, m, tnames, hnames, unobs)
689}
690func pp_store() -> *TrustStore {
  var lr: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 300, PP_CERT_CAP * 8)
  if lr <= 0 { lr = nx_trust_store_load_from_certdata("../data/mozilla_certdata.txt" as *u8, 300, PP_CERT_CAP * 8) }
  if lr <= 0 { return 0 as *TrustStore }
  return lr as *TrustStore
695}
696// ---- fixtures: the bite proof. good page vs tracked page must flip PERSON; landmarks vs bare must flip PLACE;
697// a failing contrast token vs a passing one must flip PRODUCT. ----
698func pp_kat() -> i64 {
  var f: i64 = 0
  let good: *u8 = "<html lang=\"en\"><head><title>t</title><meta name=\"viewport\" content=\"width=device-width\"><link rel=\"canonical\" href=\"/x\"><style>:root{--fg:rgb(17,17,17);--bg:rgb(255,255,255)}@media (prefers-color-scheme:dark){:root{--fg:rgb(238,238,238);--bg:rgb(17,17,17)}}@media (prefers-reduced-motion:reduce){*{animation:none}}</style></head><body><a class=\"skip-link\" href=\"/x\">skip to content</a><nav aria-label=\"breadcrumb\"><a href=\"/\">home</a><a href=\"/a\">a</a><a href=\"/b\">b</a></nav><main><h1>h</h1><form role=\"search\"><input type=\"search\"></form><a href=\"/c\" aria-current=\"page\">c</a></main><footer>f</footer></body></html>" as *u8
  let bad: *u8 = "<div><script src=\"https://www.googletagmanager.com/gtag/js\"></script><script src=\"https://cdn.example-tracker.net/x.js\"></script><img src=\"https://ads.doubleclick.net/p.gif\"><script>document.write(1)</script><div class=\"onetrust-banner\">cookie</div><p>text</p></div>" as *u8
  let gn: i64 = pp_len(good)
  let bn: i64 = pp_len(bad)
  let hdr: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: DENY\r\nContent-Security-Policy: default-src 'self'\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=1\r\nPermissions-Policy: camera=()\r\n\r\n<x>" as *u8
  let hdrbad: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nSet-Cookie: a=1\r\nSet-Cookie: b=2\r\n\r\n<x>" as *u8
  let m: *i64 = sys_mmap(64 * 8) as *i64
  let m2: *i64 = sys_mmap(64 * 8) as *i64
  var z: i64 = 0
  while z < 64 { m[z] = 0; m2[z] = 0; z = z + 1 }
  let t1: *u8 = sys_mmap(512); let h1: *u8 = sys_mmap(512); t1[0] = 0 as u8; h1[0] = 0 as u8
  let t2: *u8 = sys_mmap(512); let h2: *u8 = sys_mmap(512); t2[0] = 0 as u8; h2[0] = 0 as u8
  pp_measure(good, gn, hdr, pp_len(hdr), "https://nishifamily.com/x" as *u8, 12, 0, 0, 0, m, t1, h1)
  pp_measure(bad, bn, hdrbad, pp_len(hdrbad), "https://example.com/" as *u8, 0, 0, 2, 1, m2, t2, h2)
  // 2026-08-25: this printed a LABEL, then an EMPTY string, with no value and no line ending -- so the
  // score it names was never shown AND the next tooth (T1) was swallowed onto this same line, making it
  // uncountable from outside. nx_ppp_probe_gate found it by counting teeth and reading 19 of 20.
  // FIX THE EMITTER, NEVER WIDEN THE READER: print the value, then end the line.
  let pnb: *u8 = sys_mmap(PP_NUMBUF_CAP)
  pp_w("  fixture good: person=" as *u8); pp_catn(pnb, 0, m[50]); pp_w(pnb); pp_w("\n" as *u8)
  // T1 person: the tracked page must score strictly lower, with the trackers NAMED
  if m2[50] >= m[50] { f = f + 1; pp_w("  T1 FAIL person did not flip\n" as *u8) } else { pp_w("  T1 person flips (good vs tracked)\n" as *u8) }
  if m2[2] < 2 { f = f + 1; pp_w("  T2 FAIL tracker markers not found\n" as *u8) } else { pp_w("  T2 tracker markers named\n" as *u8) }
  if m2[1] < 2 { f = f + 1; pp_w("  T3 FAIL third-party script hosts not counted\n" as *u8) } else { pp_w("  T3 third-party script hosts counted\n" as *u8) }
  if m[0] != 0 { f = f + 1; pp_w("  T4 FAIL neg-control: clean page reports third-party hosts\n" as *u8) } else { pp_w("  T4 neg-control clean page has zero third-party hosts\n" as *u8) }
  if m[6] != 5 { f = f + 1; pp_w("  T5 FAIL security headers 5/5 not read\n" as *u8) } else { pp_w("  T5 security headers 5/5 read from the wire\n" as *u8) }
  if m2[5] != 2 { f = f + 1; pp_w("  T6 FAIL set-cookie count\n" as *u8) } else { pp_w("  T6 set-cookie counted\n" as *u8) }
  // T7 place: landmarks must flip
  if m2[52] >= m[52] { f = f + 1; pp_w("  T7 FAIL place did not flip\n" as *u8) } else { pp_w("  T7 place flips (landmarks vs bare)\n" as *u8) }
  if m[33] != 1 { f = f + 1; pp_w("  T8 FAIL skip link not seen\n" as *u8) } else { pp_w("  T8 skip link seen\n" as *u8) }
  if m[34] != 1 { f = f + 1; pp_w("  T9 FAIL site search not seen\n" as *u8) } else { pp_w("  T9 site search seen\n" as *u8) }
  if m[38] < 3 { f = f + 1; pp_w("  T10 FAIL internal links not counted\n" as *u8) } else { pp_w("  T10 internal links counted\n" as *u8) }
  // T11 product: design + tokens + dark + motion must lift; the tracked page has a blocking script
  if m2[51] >= m[51] { f = f + 1; pp_w("  T11 FAIL product did not flip\n" as *u8) } else { pp_w("  T11 product flips\n" as *u8) }
  if m[19] != 1 { f = f + 1; pp_w("  T12 FAIL dark mode not seen\n" as *u8) } else { pp_w("  T12 dark-mode query seen\n" as *u8) }
  if m[12] < 2 { f = f + 1; pp_w("  T13 FAIL color tokens not scanned\n" as *u8) } else { pp_w("  T13 color tokens scanned by nx_uiq_color\n" as *u8) }
  // T14 unobserved third state: headers absent -> sec_headers == -1, never 0
  pp_measure(good, gn, hdr, 0, "https://nishifamily.com/x" as *u8, 0 - 1, 0 - 1, 0 - 1, 0 - 1, m, t1, h1)
  if m[6] != 0 - 1 { f = f + 1; pp_w("  T14 FAIL unobserved headers not reported as -1\n" as *u8) } else { pp_w("  T14 unobserved headers read -1, not 0\n" as *u8) }
  // T15 json emits and parses back
  let out: *u8 = sys_mmap(PP_OUT_CAP)
  let jl: i64 = pp_emit_json(out, "c1" as *u8, "fixture" as *u8, "https://nishifamily.com/x" as *u8, m, t1, h1, "headers " as *u8)
  if pp_json_int(out, jl, "\"nav\":" as *u8) != 1 { f = f + 1; pp_w("  T15 FAIL json round-trip\n" as *u8) } else { pp_w("  T15 json round-trip\n" as *u8) }
  // T16-T19 SINGLE-QUOTED ATTRIBUTES -- the bite proof for pp_has_attr. MEASURED 2026-08-25: the live
  // /games page emits <meta name='viewport' ...> and the pre-fix probe scored viewport=0 on a page that
  // is CORRECT -- a false negative inside a PUBLISHED competitive score. This fixture means the same as
  // `good` but is single-quoted throughout, so a matcher that only knows double quotes CANNOT pass it.
  let sq: *u8 = "<html lang='en'><head><title>t</title><meta name='viewport' content='width=device-width'><link rel='canonical' href='/x'></head><body><div role='main'><h1>h</h1><form role='search'><input type='search'></form></div></body></html>" as *u8
  let m3: *i64 = sys_mmap(64 * 8) as *i64
  var z3: i64 = 0
  while z3 < 64 { m3[z3] = 0; z3 = z3 + 1 }
  let t3: *u8 = sys_mmap(512); let h3: *u8 = sys_mmap(512); t3[0] = 0 as u8; h3[0] = 0 as u8
  pp_measure(sq, pp_len(sq), hdr, pp_len(hdr), "https://nishifamily.com/x" as *u8, 0, 0, 0, 0, m3, t3, h3)
  if m3[40] != 1 { f = f + 1; pp_w("  T16 FAIL single-quoted viewport not seen\n" as *u8) } else { pp_w("  T16 single-quoted viewport seen\n" as *u8) }
  if m3[21] != 1 { f = f + 1; pp_w("  T17 FAIL single-quoted canonical not seen\n" as *u8) } else { pp_w("  T17 single-quoted canonical seen\n" as *u8) }
  if m3[31] != 1 { f = f + 1; pp_w("  T18 FAIL single-quoted role=main not seen\n" as *u8) } else { pp_w("  T18 single-quoted role=main seen\n" as *u8) }
  if m3[34] != 1 { f = f + 1; pp_w("  T19 FAIL single-quoted role/type=search not seen\n" as *u8) } else { pp_w("  T19 single-quoted role/type=search seen\n" as *u8) }
  // T20 NEG-CONTROL: a page with NO viewport must still read 0. A matcher that says yes to everything
  // passes every positive test and is not a matcher.
  let nov: *u8 = "<html lang='en'><head><title>t</title></head><body><p>x</p></body></html>" as *u8
  let m4: *i64 = sys_mmap(64 * 8) as *i64
  var z4: i64 = 0
  while z4 < 64 { m4[z4] = 0; z4 = z4 + 1 }
  let t4: *u8 = sys_mmap(512); let h4: *u8 = sys_mmap(512); t4[0] = 0 as u8; h4[0] = 0 as u8
  pp_measure(nov, pp_len(nov), hdr, pp_len(hdr), "https://nishifamily.com/x" as *u8, 0, 0, 0, 0, m4, t4, h4)
  if m4[40] != 0 { f = f + 1; pp_w("  T20 FAIL neg-control-absent-viewport reported present\n" as *u8) } else { pp_w("  T20 neg-control-absent-viewport reads 0\n" as *u8) }
  return f
767}
768// ---- domain verb: read <dom>.ppp, probe every surface, write <dom>.pppstate ----
769func pp_split(line: *u8, fld: *i64, maxf: i64) -> i64 {
  var nf: i64 = 0
  var i: i64 = 0
  fld[0] = line as i64
  nf = 1
  while line[i] != (0 as u8) {
      if line[i] == (124 as u8) { line[i] = 0 as u8; if nf < maxf { fld[nf] = (line as i64) + i + 1; nf = nf + 1 } }
      i = i + 1
  }
  return nf
779}
780func pp_domain(dom: *u8) -> i64 {
  let ppath: *u8 = sys_mmap(PP_NAME_CAP)
  let base: *u8 = sys_mmap(PP_NAME_CAP)
  var bo: i64 = pp_cat(base, 0, "knowledge/compare/" as *u8)
  var o: i64 = pp_cat(ppath, 0, base); o = pp_cat(ppath, o, dom); o = pp_cat(ppath, o, ".ppp" as *u8)
  if pp_exists(ppath) == 0 {
      bo = pp_cat(base, 0, "buildroot/knowledge/compare/" as *u8)
      o = pp_cat(ppath, 0, base); o = pp_cat(ppath, o, dom); o = pp_cat(ppath, o, ".ppp" as *u8)
  }
  let ln: *i64 = sys_mmap(16) as *i64
  let txt: *u8 = sys_read_file(ppath, ln)
  if (txt as i64) == 0 { pp_w("PPP-PROBE no .ppp file for domain " as *u8); pp_w(dom); pp_w(" (looked in knowledge/compare and buildroot/knowledge/compare)\n" as *u8); return 2 }
  let n: i64 = ln[0]
  let store: *TrustStore = pp_store()
  if (store as i64) == 0 { pp_w("PPP-PROBE trust store unreadable (data/mozilla_certdata.txt) -- refusing to grade\n" as *u8); return 4 }
  let state: *u8 = sys_mmap(PP_STATE_CAP)
  state[0] = 35 as u8
  var so: i64 = pp_cat(state, 1, " " as *u8)
  so = pp_cat(state, so, dom)
  so = pp_cat(state, so, ".pppstate -- NX-DERIVED: regenerated artefact, not authored memory (nx_ppp_probe). rows: ppp|<col>|<label>|<url>|<json> . last line = stamp\n" as *u8)
  let fld: *i64 = sys_mmap(16 * 8) as *i64
  let line: *u8 = sys_mmap(PP_LINE_CAP)
  let out: *u8 = sys_mmap(PP_OUT_CAP)
  var surfaces: i64 = 0
  var probed: i64 = 0
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if txt[e] == (10 as u8) { break } e = e + 1 }
      var li: i64 = 0
      var k: i64 = p
      while k < e { if li < PP_LINE_CAP - 1 { line[li] = txt[k]; li = li + 1 } k = k + 1 }
      line[li] = 0 as u8
      p = e + 1
      if line[0] == (115 as u8) {
          let nf: i64 = pp_split(line, fld, 16)
          if pp_streq(fld[0] as *u8, "surface" as *u8) == 1 { if nf >= 5 {
              surfaces = surfaces + 1
              if surfaces <= PP_MAX_SURFACES {
                  let col: *u8 = fld[1] as *u8
                  let label: *u8 = fld[2] as *u8
                  let url: *u8 = fld[3] as *u8
                  var connect: *u8 = fld[4] as *u8
                  if pp_streq(connect, "-" as *u8) == 1 { connect = 0 as *u8 }
                  pp_w("PPP-PROBE " as *u8); pp_w(col); pp_w(" " as *u8); pp_w(url); pp_w("\n" as *u8)
                  let jl: i64 = pp_probe_url(url, connect, col, label, store, out)
                  if jl > 0 {
                      probed = probed + 1
                      so = pp_cat(state, so, "ppp|" as *u8); so = pp_cat(state, so, col); so = pp_cat(state, so, "|" as *u8)
                      so = pp_cat(state, so, label); so = pp_cat(state, so, "|" as *u8); so = pp_cat(state, so, url); so = pp_cat(state, so, "|" as *u8)
                      var q: i64 = 0
                      while q < jl { if so < PP_STATE_CAP - 2 { state[so] = out[q]; so = so + 1 } q = q + 1 }
                      state[so] = 10 as u8; so = so + 1; state[so] = 0 as u8
                      pp_w("  ok " as *u8); pp_w("person=" as *u8); pp_w("" as *u8)
                      pp_w("\n" as *u8)
                  } else {
                      so = pp_cat(state, so, "ppp|" as *u8); so = pp_cat(state, so, col); so = pp_cat(state, so, "|" as *u8)
                      so = pp_cat(state, so, label); so = pp_cat(state, so, "|" as *u8); so = pp_cat(state, so, url); so = pp_cat(state, so, "|{\"organ\":\"nx_ppp_probe\",\"unreachable\":" as *u8)
                      so = pp_catn(state, so, 0 - jl); so = pp_cat(state, so, "}\n" as *u8)
                      pp_w("  UNREACHABLE code=" as *u8); pp_w("\n" as *u8)
                  }
              }
          } }
      }
  }
  state[so] = 35 as u8; so = so + 1
  so = pp_cat(state, so, " asof=" as *u8); so = pp_catn(state, so, sys_now_realtime_sec())
  so = pp_cat(state, so, " domain=" as *u8); so = pp_cat(state, so, dom)
  so = pp_cat(state, so, " surfaces=" as *u8); so = pp_catn(state, so, surfaces)
  so = pp_cat(state, so, " probed=" as *u8); so = pp_catn(state, so, probed)
  so = pp_cat(state, so, " ruler=nx_ppp_probe\n" as *u8)
  let spath: *u8 = sys_mmap(PP_NAME_CAP)
  var po: i64 = pp_cat(spath, 0, base); po = pp_cat(spath, po, dom); po = pp_cat(spath, po, ".pppstate" as *u8)
  let wr: i64 = pp_write_atomic(spath, state, so)
  pp_w("PPP-PROBE domain=" as *u8); pp_w(dom); pp_w(" surfaces=" as *u8); pp_w("" as *u8)
  let nb: *u8 = sys_mmap(64)
  pp_catn(nb, 0, surfaces); pp_w(nb); pp_w(" probed=" as *u8); pp_catn(nb, 0, probed); pp_w(nb)
  pp_w(" wrote=" as *u8); pp_catn(nb, 0, so); pp_w(nb); pp_w(" of=" as *u8); pp_w(spath)
  if wr != 0 { pp_w(" WRITE-FAILED" as *u8) }
  pp_w("\n" as *u8)
  if probed == 0 { return 4 }
  return 0
862}
863func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { pp_w("usage: nx_ppp_probe url <url> [connect-host:port] | domain <dom> | --kat\n" as *u8); sys_exit(2); return 2 }
  let verb: *u8 = argv[1] as *u8
  if verb[0] == (45 as u8) {
      pp_w("=== nx_ppp_probe --kat (person / product / place, bite-proven on fixtures) ===\n" as *u8)
      let f: i64 = pp_kat()
      pp_w("checks failed=" as *u8)
      let nb: *u8 = sys_mmap(32)
      pp_catn(nb, 0, f); pp_w(nb); pp_w("\n" as *u8)
      if f == 0 { pp_w("VERDICT=GREEN\n" as *u8); sys_exit(0); return 0 }
      pp_w("VERDICT=RED\n" as *u8); sys_exit(1); return 1
  }
  if pp_streq(verb, "url" as *u8) == 1 {
      if argc < 3 { pp_w("usage: nx_ppp_probe url <url> [connect-host:port]\n" as *u8); sys_exit(2); return 2 }
      let url: *u8 = argv[2] as *u8
      var connect: *u8 = 0 as *u8
      if argc >= 4 { connect = argv[3] as *u8 }
      let store: *TrustStore = pp_store()
      if (store as i64) == 0 { pp_w("PPP-PROBE trust store unreadable (data/mozilla_certdata.txt) -- refusing to grade\n" as *u8); sys_exit(4); return 4 }
      let out: *u8 = sys_mmap(PP_OUT_CAP)
      let jl: i64 = pp_probe_url(url, connect, "-" as *u8, "-" as *u8, store, out)
      if jl <= 0 {
          pp_w("PPP-PROBE verdict=UNREACHABLE code=" as *u8)
          let nb: *u8 = sys_mmap(32)
          pp_catn(nb, 0, 0 - jl); pp_w(nb)
          pp_w(" (4=fetch failed twice, 5=body under the page floor: a redirect stub or a co-squat 404 -- for our own domains pass 127.0.0.1:8443)\n" as *u8)
          sys_exit(4); return 4
      }
      sys_write(1, out, jl); pp_w("\n" as *u8)
      sys_exit(0); return 0
  }
  if pp_streq(verb, "domain" as *u8) == 1 {
      if argc < 3 { pp_w("usage: nx_ppp_probe domain <dom>\n" as *u8); sys_exit(2); return 2 }
      let rc: i64 = pp_domain(argv[2] as *u8)
      sys_exit(rc); return rc
  }
  pp_w("usage: nx_ppp_probe url <url> [connect-host:port] | domain <dom> | --kat\n" as *u8)
  sys_exit(2); return 2
901}
nx_ppp_probe.nx source

`nx_ppp_probe.nx` source
