code wiki / _hdl_build / nx_rebuild_drain.nx
`nx_rebuild_drain.nx` source

↩ module page · 1307 lines · 79056 B
1// nx_rebuild_drain.nx -- THE ACTING HALF of dependency-aware staleness (debt 1785447998).
2//
3// nx_rebuild_plan DIAGNOSES: 662 of 696 deployed organs run binaries predating their own dependencies,
4// 638 of them traceable to just two shared runtimes carrying real behavioural root-fixes (SIGPIPE in
5// nx_syscalls.nx, the ss_get O(whole-store) fix in nx_seg_store.nx). But a census nobody is OBLIGED to
6// read is the same shape of defect as a fix nobody is OBLIGED to rebuild against -- both are capability
7// that exists and does not reach the place it matters. This organ is the obligation.
8//
9// ★★★WHY AN ORGAN AND NOT THE SHELL SCRIPT IT REPLACES: a shell batch is something a human remembers to
10// run. An organ can be SUPERVISED -- put on a beat, it turns "someone should rebuild the dependents"
11// into a property of the system. That is the whole difference between a workaround and a fix.
12//
13// GUARDS, every one of them learned by being bitten today:
14//   • _cli/STUB TRAP: a fresh build far SMALLER than the deployed elf means the same-basename .nx is a
15//     smoke stub and the real tool came from another source. nx_https_get rebuilds 443KB vs 633KB
16//     deployed -- installing that BREAKS a working tool. REFUSED, never installed.
17//   • ETXTBSY: cp over a RUNNING elf fails; the daemon holds that inode. Install is write-to-.new then
18//     RENAME, which swaps the directory entry and leaves the live inode alone.
19//   • BUILD FAILURE IS NOT INSTALLABLE: a non-zero build rc or a missing artifact skips the target.
20//   • BOUNDED + SERIAL: today's saturation incident (load 63, mgmt+tools+sshd dead) came from wide
21//     fan-out. This drains a batch at a time, one build at a time, and stops. Idempotent: re-running
22//     simply picks up whatever is still stale, so a partial drain is always safe to resume.
23//   • IDENTICAL-BYTES IS A NO-OP: if the fresh build matches what is deployed, nothing is written.
24//
25//   nx_rebuild_drain beat [batch] [buildroot] [elfdir]          SELF-CONTAINED for a clock row: regenerates the list, then drains a bounded batch
26//   nx_rebuild_drain classify <listfile> [buildroot] [elfdir]  PARTITION ONLY, spends no compile: buildable vs lib-basename vs no-elf
27//   nx_rebuild_drain <listfile> [batch] [buildroot] [elfdir]
28//     listfile = output of `nx_rebuild_plan list` (one target name per line)
29//   -> per-target rows + summary. Exit 0 always; a drain reports, it does not refuse.
30// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
31import "nx_syscalls.nx"
32import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
33
34const RD_AT_FDCWD: i64 = 0 - 100
35const RD_SYS_NEWFSTATAT: i64 = 262
36const RD_STATBUF: i64 = 256
37const RD_OFF_SIZE: i64 = 48
38const RD_PATHCAP: i64 = 512
39const RD_LISTCAP: i64 = 262144
40// derived: measured 8 serial targets ran clean with zero saturation; 8 is the proven-safe default and is
41// overridable per invocation rather than baked in.
42const RD_DEFAULT_BATCH: i64 = 8
43// the stub-trap ratio: a fresh build under HALF the deployed size is a wrong-source signal, not a
44// shrink. Same discriminator nx_stale_check documents.
45const RD_STUB_NUM: i64 = 2
46// ⚠NO BUILD TIMEOUT IS ENFORCED HERE. A wedged nx_sov_build_run will block this drain indefinitely.
47// Stating it rather than declaring an unused RD_BUILD_TIMEOUT_S const -- a threshold nothing reads is
48// a guard that exists only in the reader's imagination, which is worse than an honestly absent one.
49// Mitigated for now by BOUNDED batches: a hang stalls one batch, never an unattended sweep.
50const RD_COPYBUF: i64 = 1048576
51
52func rd_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
53// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
54// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
55// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
56// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
57func rd_n(v: i64) -> i64 { nxi_out(v); return 0 }
58func rd_len(a: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { i = i + 1 } return i }
59func rd_cpy(dst: *u8, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[i] = src[i]; i = i + 1 } dst[i] = 0 as u8; return i }
60func rd_cat(dst: *u8, o: i64, src: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while src[i] != (0 as u8) { dst[p] = src[i]; p = p + 1; i = i + 1 } dst[p] = 0 as u8; return p }
61
62// ALIAS RESOLUTION (2026-08-15). Some deployed artifacts carry a basename that is NOT their build
63// target -- nx_opaque_login.elf is byte-identical to the nx_opaque_login_daemon build. Without this the
64// row resolves to a LIBRARY, never links, and blocks the queue forever.
65// ★DATA, NOT CODE: the mapping lives in a conf so a new case is a row, not a rebuild of this organ.
66// ⚠ONLY `proven` ROWS RESOLVE. An `unresolved` row keeps its recorded evidence and is NOT built under a
67// guessed target -- installing a different program under a live service's name is worse than the stale
68// binary it would replace. ★WRONG IN THE DIRECTION OF DOING NOTHING.
69const RD_ALIAS_CONF: *u8 = "knowledge/registry/elf_source_alias.conf"
70const RD_TAB_C: i64 = 9
71const RD_HASH_C: i64 = 35
72// Writes the resolved build target for `name` into out; returns 1 if a PROVEN alias applied, else 0
73// (and out is left holding `name` unchanged).
74func rd_alias(name: *u8, out: *u8) -> i64 {
  rd_cpy(out, name)
  let lenp: *i64 = sys_mmap(8)
  let b: *u8 = sys_read_file(RD_ALIAS_CONF, lenp)
  let n: i64 = lenp[0]
  sys_munmap(lenp as *u8, 8)
  if n <= 0 { return 0 }
  var applied: i64 = 0
  var i: i64 = 0
  while i < n {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= n { sc = 0 } else { if b[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      if le > i {
          if (b[i] as i64) != RD_HASH_C {
              let e1: i64 = rd_find_byte(b, i, le, RD_TAB_C)
              if e1 >= 0 {
                  let nlen: i64 = e1 - i
                  var k: i64 = 0
                  var same: i64 = 1
                  var cmp: i64 = 1
                  while cmp == 1 {
                      if k >= nlen { cmp = 0 } else {
                          if name[k] != b[i+k] { same = 0; cmp = 0 } else { k = k + 1 }
                      }
                  }
                  if same == 1 { if name[nlen] == (0 as u8) {
                      let f2s: i64 = e1 + 1
                      let t2: i64 = rd_find_byte(b, f2s, le, RD_TAB_C)
                      if t2 >= 0 {
                          // ★WIDENED 2026-08-17 to accept `equivalent` as well as `proven`, and the scope is
                          // ONE ROW: of the three equivalent aliases, two are DECLARED DAEMONS that the
                          // portmap guard defers regardless, so only nx_project -> nx_project_gate becomes
                          // buildable. Its evidence is the STRICT oracle (nx_contentdiff runs_scanned=470
                          // lost_from_live=0 verdict=GREEN 3/3), and four independent guards still stand
                          // between this and the serving root: the daemon deferral, the content-loss
                          // threshold, the .prev rollback, and the install ledger.
                          // ⚠`unresolved` is STILL refused. A guessed alias installs a different program
                          // under a deployed name, which is worse than the stale binary it replaces.
                          var okstat: i64 = 0
                          if rd_starts_at(b, t2 + 1, le, "proven" as *u8) == 1 { okstat = 1 }
                          if rd_starts_at(b, t2 + 1, le, "equivalent" as *u8) == 1 { okstat = 1 }
                          if okstat == 1 {
                              var w: i64 = 0
                              while f2s + w < t2 { out[w] = b[f2s + w]; w = w + 1 }
                              out[w] = 0 as u8
                              applied = 1
                          }
                      }
                  } }
              }
          }
      }
      i = le + 1
  }
  sys_munmap(b, n)
  return applied
131}
132
133// ★★★★★★THE CALLABLE HOME FOR "WHERE IS THIS BYTE". I wrote the cursor-clobber exit THREE TIMES in
134// one session -- mb_loop_allocs, rd_has_main, and rd_alias -- each time AFTER banking the law that
135// forbids it. A rule I have to remember is a rule I will skip; the only thing that stops it is a
136// function that cannot express the defect. Returns the index of `c` in [s,e), or -1. The scan cursor
137// and the ANSWER are separate variables, so the exit can never destroy the position.
138func rd_find_byte(b: *u8, s: i64, e: i64, c: i64) -> i64 {
  var i: i64 = s
  var at: i64 = 0 - 1
  var scanning: i64 = 1
  while scanning == 1 {
      if i >= e { scanning = 0 } else {
          if (b[i] as i64) == c { at = i; scanning = 0 } else { i = i + 1 }
      }
  }
  return at
148}
149
150func rd_starts_at(b: *u8, s: i64, e: i64, pre: *u8) -> i64 {
  var k: i64 = 0
  while pre[k] != (0 as u8) {
      if s + k >= e { return 0 }
      if b[s+k] != pre[k] { return 0 }
      k = k + 1
  }
  return 1
158}
159
160func rd_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  var r: i64 = 2
  while r == 2 {
      if a[i] != b[i] { r = 0 } else {
          if a[i] == (0 as u8) { r = 1 } else { i = i + 1 }
      }
  }
  return r
169}
170
171func rd_size(path: *u8) -> i64 {
  let sb: *u8 = sys_mmap(RD_STATBUF)
  if __syscall(RD_SYS_NEWFSTATAT, RD_AT_FDCWD, path as i64, sb as i64, 0, 0, 0) != 0 { return 0 - 1 }
  let sp: *i64 = ((sb as i64) + RD_OFF_SIZE) as *i64
  return sp[0]
176}
177
178// name must be [A-Za-z0-9_] -- this string is handed to execve, so anything else is refused outright
179// rather than sanitised. A target name is not user prose; if it does not look like one, it is not one.
180func rd_safe(name: *u8) -> i64 {
  var i: i64 = 0
  while name[i] != (0 as u8) {
      let c: i64 = name[i] as i64
      var ok: i64 = 0
      if c >= 48 { if c <= 57 { ok = 1 } }
      if c >= 65 { if c <= 90 { ok = 1 } }
      if c >= 97 { if c <= 122 { ok = 1 } }
      if c == 95 { ok = 1 }
      if ok == 0 { return 0 }
      i = i + 1
      if i >= 64 { return 0 }
  }
  if i == 0 { return 0 }
  return 1
195}
196
197// byte-identical? 1 = same, 0 = differ/unreadable
198func rd_same(a: *u8, b: *u8) -> i64 {
  let sa: i64 = rd_size(a)
  let sb2: i64 = rd_size(b)
  if sa < 0 { return 0 }
  if sa != sb2 { return 0 }
  let fa: i64 = sys_openat_rd(a)
  if fa < 0 { return 0 }
  let fb: i64 = sys_openat_rd(b)
  if fb < 0 { sys_close(fa); return 0 }
  let ba: *u8 = sys_mmap(RD_COPYBUF)
  let bb: *u8 = sys_mmap(RD_COPYBUF)
  var same: i64 = 1
  var go: i64 = 1
  while go == 1 {
      let ra: i64 = sys_read(fa, ba, RD_COPYBUF)
      let rb: i64 = sys_read(fb, bb, RD_COPYBUF)
      if ra != rb { same = 0; go = 0 } else {
          if ra <= 0 { go = 0 } else {
              var k: i64 = 0
              while k < ra { if ba[k] != bb[k] { same = 0; k = ra; go = 0 } else { k = k + 1 } }
          }
      }
  }
  sys_close(fa)
  sys_close(fb)
  return same
224}
225
226// copy src -> dst (truncating). 1 ok, 0 fail.
227func rd_copy(src: *u8, dst: *u8) -> i64 {
  let fs: i64 = sys_openat_rd(src)
  if fs < 0 { return 0 }
  let fd: i64 = sys_openat_wr(dst, 493)
  if fd < 0 { sys_close(fs); return 0 }
  let buf: *u8 = sys_mmap(RD_COPYBUF)
  var ok: i64 = 1
  var go: i64 = 1
  while go == 1 {
      let r: i64 = sys_read(fs, buf, RD_COPYBUF)
      if r < 0 { ok = 0; go = 0 } else {
          if r == 0 { go = 0 } else {
              let wn: i64 = sys_write(fd, buf, r)
              if wn != r { ok = 0; go = 0 }
          }
      }
  }
  sys_fsync(fd)
  sys_close(fd)
  sys_close(fs)
  return ok
248}
249
250// ---- CONTENT CONTAINMENT (root fix 2026-07-30, ws=sev-eater) ---------------------------------
251// THE SIZE RATIO ABOVE CANNOT SEE THE DIFFERENCE BETWEEN THE TWO THINGS IT MUST SEPARATE.
252// MEASURED TODAY, both directions, which is why this exists:
253//   * A BETTER TOOLCHAIN SHRINKS A BINARY WITHOUT LOSING ANYTHING. Rebuilding nx_fin_serve /
254//     nx_mp_serve / nx_torrent_mkinfo produced 12-22pc SMALLER elfs whose printable-string sets were
255//     IDENTICAL to the deployed ones (only_in_deployed=0 AND only_in_fresh=0). seq1464 restored 11712
256//     bytes of optimiser passes, so EVERY organ built by an older compiler now looks suspicious to a
257//     size ruler. Judged by size alone the whole 700-organ queue is unreachable.
258//   * REAL SOURCE LOSS ALSO SHRINKS A BINARY -- and by LESS. A supervised drain of 40 found 9 organs
259//     whose fresh build was missing runs the deployed binary had (nx_warden -48, nx_conductor -46,
260//     nx_https_get -12, +6 more). Every one of them PASSED the 50pc stub ratio; refused_stub_source
261//     was 0. The ratio would have installed all nine.
262// So size correlates with the thing we fear and does not measure it. CONTENT does: a run of printable
263// bytes in the deployed binary is something that binary can emit, and if the fresh build cannot emit
264// it, capability was lost. An optimiser cannot trip this -- it changes instruction encoding, not the
265// strings the program can print.
266// LAW: A GUARD MUST MEASURE THE PROPERTY YOU CARE ABOUT (capability retained), NOT A PROXY THAT
267// CORRELATES WITH IT (size). Same shape as nx_srcguard v2's symbol-set containment for SOURCE.
268// THE MEASUREMENT ITSELF IS NOT MADE HERE. This organ carried its own printable-run differ until
269// 2026-08-16; see the rd_lost_runs tombstone below for why a second one was a defect rather than an
270// optimisation. The reasoning above is retained because it is WHY the guard exists at all -- it is the
271// case for measuring content instead of size, and that case is unchanged by which organ does the counting.
272
273// ⛔rd_slurp DELETED 2026-08-16 -- a hand-rolled CAPPED whole-file reader that sat beside the estate's
274// proven cap-free `sys_read_file`, which sizes its buffer from the file (lseek END) and cannot
275// short-read. Its own source records DEBT-EATEN 2026-07-15 for precisely this class: "the old fixed cap
276// SILENTLY TRUNCATED bigger files ... the worst failure class". I reproduced that eaten debt here as
277// three guessed ceilings (65536 alias conf / 65536 live-service table / 8388608 elf compare), one of
278// them feeding a SAFETY GUARD that fails OPEN on truncation and one feeding the content-loss verdict
279// that can corrupt in BOTH directions.
280// ★★★★★★A DUPLICATE RULER WEARING A CONSTANT IS STILL A DUPLICATE RULER, AND ITS CONSTANT IS THE PART
281// THAT ROTS. Compose the proven reader; never re-implement it.
282
283
284// ⛔rd_lost_runs DELETED 2026-08-16, with its private rd_runs / rd_h_ins / rd_h_has hash set and the six
285// constants that tuned it (RD_RUNMIN RD_HSLOTS RD_HMASK RD_HBYTES RD_FNVP RD_LENMIX RD_PROBE_CAP).
286// It was a SECOND printable-run differ living beside nx_contentdiff, and the two disagreed on a SAFETY
287// verdict: 267 vs 334 on identical inputs, because this one's RD_RUNMIN was 8 and the incumbent's minlen
288// is 6. The count now comes from rd_cdiff_lost, which forks the incumbent and parses its report, so the
289// drain and /api/promote decide on the SAME number and the calibrated 10-run floor finally means what it
290// was calibrated to mean. ★★★★★★DELETING THE DUPLICATE IS THE FIX; RETUNING 8 TO 6 WOULD HAVE LEFT TWO
291// RULERS THAT AGREE TODAY AND DRIFT TOMORROW.
292
293// run the sovereign builder for <target> under buildroot; returns its exit code, or -1 on spawn failure.
294// REBUILD LIKE FOR LIKE (2026-08-19): does the DEPLOYED elf carry a .debug_line section? If it does,
295// the drain must rebuild with --debug, or the content ruler reads the disappearance of the debug NAME
296// TABLE as capability loss and the row is refused forever. MEASURED on the two rows that sat at the
297// head of every regenerated list: nx_conductor "lost 52 runs" / nx_warden "lost 55" -- every single
298// lost run was a FUNCTION NAME (sys_socket, sys_recvfrom, w_is_build_artifact...) from .debug_line/
299// .debug_info of an 08-15 dbgflag-era debug build; rebuilt with --debug the loss collapses to the
300// names of functions the compiler's whole-program DCE genuinely removed (dead code, not capability).
301// The probe is the section-name STRING in the elf bytes -- the same channel the section header table
302// uses, present exactly when nxasm emitted the section, and absent from a stripped build. Fail-open:
303// an unreadable elf probes 0 and the row builds exactly as before.
304const RD_DEBUG_MARK: *u8 = ".debug_line"
305func rd_live_has_debug(dep: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(dep, lenp)
  if (b as i64) == 0 { return 0 }
  let n: i64 = lenp[0]
  var m: i64 = 0
  while RD_DEBUG_MARK[m] != (0 as u8) { m = m + 1 }
  var i: i64 = 0
  var hit: i64 = 0
  while i + m <= n {
      var k: i64 = 0
      var ok: i64 = 1
      while k < m { if b[i+k] != RD_DEBUG_MARK[k] { ok = 0; k = m } else { k = k + 1 } }
      if ok == 1 { hit = 1; i = n }
      i = i + 1
  }
  if n > 0 { sys_munmap(b, n + 16) }
  sys_munmap(lenp as *u8, 16)
  return hit
324}
325func rd_build(broot: *u8, target: *u8, want_debug: i64) -> i64 {
  let pid: i64 = sys_fork()
  if pid < 0 { return 0 - 1 }
  if pid == 0 {
      sys_chdir(broot)
      let devnull: i64 = sys_openat_wr("/dev/null" as *u8, 420)
      if devnull >= 0 { sys_dup3(devnull, 1, 0); sys_dup3(devnull, 2, 0) }
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = "./_offc/nx_sov_build_run.elf" as i64
      av[1] = target as i64
      av[2] = "--build-only" as i64
      var na: i64 = 3
      if want_debug == 1 { av[na] = "--debug" as i64; na = na + 1 }
      av[na] = 0
      let ev: *i64 = sys_mmap(16) as *i64
      ev[0] = 0
      sys_execve("./_offc/nx_sov_build_run.elf" as *u8, av, ev)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return wait_exit_code(st[0])
347}
348
349// ★★★★★★THE BEAT VERB IS THE WHOLE POINT OF THIS ORGAN, AND IT WAS THE ONE THING MISSING. This
350// file's own header says it: "an organ can be SUPERVISED -- put on a beat, it turns 'someone should
351// rebuild the dependents' into a property of the system. That is the whole difference between a
352// workaround and a fix." It shipped without one, so it stayed a tool somebody had to remember to run --
353// which is the same adoption defect it exists to cure, one level up.
354// A clock row forks ONE command, but the pipeline is plan-list THEN drain, and the drain's own note says
355// the list must be regenerated first because installing changes who is stale. So the loop closes HERE,
356// inside the incumbent, rather than in a new beat organ that would be a second thing to keep correct.
357// ★EXTEND THE INCUMBENT, NEVER ADD A SECOND RULER.
358// ⚠BOUNDED BY CONSTRUCTION: the batch is an argument with a small default, the drain is serial, every
359// install is content-loss-refused and rollback-snapshotted, and identical bytes are a no-op. The header
360// records why that matters -- "today's saturation incident (load 63, mgmt+tools+sshd dead) came from
361// wide fan-out."
362// Deliberately SMALL. A beat is unattended, so its blast radius per firing is the thing that must be
363// bounded, not its throughput -- 1,849 rows drain over many quiet firings rather than one wide one.
364// ★★★★★★THE BATCH IS A SAFETY CEILING, NOT THE OPERATING POINT. A guessed count is a defect
365// generator in both directions -- too small is a trickle (at 4/day, 1,834 rows is ~458 days), too large
366// saturates the host. The real limit is HEADROOM, and the estate already measures it: nx_build_admit
367// reads /proc live and nx_sov_build_run turns a denial into SBR_ADMIT_REFUSED(6). So the drain runs
368// until the BOX says stop, and this number only bounds the worst case for one unattended firing.
369// ★COMPOSE THE INCUMBENT'S MEASUREMENT INSTEAD OF INVENTING A SECOND ONE: reading /proc here would be a
370// duplicate ruler that drifts from the admitter the builds actually obey.
371// ★★★★★★A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, AND `lost_runs=2` IS A COUNT. A refusal that
372// says only HOW MANY capabilities the fresh build drops leaves the reader with no way to decide whether
373// the loss is a real regression or a deliberate reword -- so the row is re-attempted and re-refused on
374// every firing, forever. That is the head-of-line block again, one level down.
375// The estate already has the differ that NAMES them (nx_contentdiff prints `LOST: <run>`), so this forks
376// it ON REFUSAL ONLY rather than teaching rd_lost_runs to print. ★COMPOSE THE RULER, NEVER RE-IMPLEMENT
377// IT -- and the fork cost is paid only on the rare refusal, never on the common path.
378// ⚠Output goes to a DURABLE log, not stdout: this organ emits a JSON row stream, and interleaving the
379// differ's prose would corrupt it for every consumer. The JSON keeps the count; the log keeps the names.
380const RD_INSTALLLOG: *u8 = "knowledge/status/rebuild_installs.log"
381// ⛔THE LEDGER OF WHAT THIS ORGAN ACTUALLY SWAPPED. The trend journal records `installed=3` and NOT
382// WHICH -- so after the beat ran unattended, "did it replace a declared daemon?" was UNANSWERABLE, and I
383// hit exactly that wall auditing my own runs. ★★★★★★A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, AND
384// FOR AN ORGAN THAT MUTATES THE SERVING ROOT THE WORKLIST IS THE AUDIT TRAIL. An unattended installer
385// whose actions cannot be enumerated afterwards is asking to be trusted rather than checked.
386// Append-only; the rollback path rides on the row so a reversal needs no archaeology.
387func rd_install_log(organ: *u8, was: i64, now: i64, prevn: *u8) -> i64 {
  let fd: i64 = sys_openat_append(RD_INSTALLLOG, MODE_0644)
  if fd < 0 {
      rd_w("{\"organ\":\"nx_rebuild_drain\",\"install_ledger\":\"UNWRITABLE\"}\n" as *u8)
      return 0 - 1
  }
  let b: *u8 = sys_mmap(RD_PATHCAP)
  var o: i64 = 0
  o = rd_catn(b, o, sys_now_realtime_sec())
  o = rd_cat(b, o, "\t" as *u8); o = rd_cat(b, o, organ)
  o = rd_cat(b, o, "\twas=" as *u8); o = rd_catn(b, o, was)
  o = rd_cat(b, o, "\tnow=" as *u8); o = rd_catn(b, o, now)
  o = rd_cat(b, o, "\trollback=" as *u8); o = rd_cat(b, o, prevn)
  b[o] = 10 as u8
  o = o + 1
  sys_write(fd, b, o)
  sys_close(fd)
  sys_munmap(b, RD_PATHCAP)
  return 0
406}
407const RD_FAILLOG: *u8 = "knowledge/status/rebuild_buildfail.log"
408// ⛔THE OTHER PERMANENTLY-STUCK CLASS, AND IT BURNS A BUILD SLOT EVERY FIRING. MEASURED on the live beat
409// series: `failed=2` on EVERY scheduled firing since 1786932213 -- the SAME two organs re-attempted and
410// re-failing, consuming half a batch of 4 for ever. That is the head-of-line block already fixed for LIB
411// rows, in a new costume: a row that cannot compile is retried by an unattended beat until someone
412// notices, and `failed=2` is a COUNT WITH NO WORKLIST so nobody can.
413// ★★★★★A COUNTER TELLS YOU A CLASS EXISTS; ONLY A LEDGER TELLS YOU IT IS THE SAME ROW EVERY TIME.
414// ⚠DELIBERATELY NOT AN AUTO-SKIP: a BUILDFAIL can be TRANSIENT (a sibling mid-edit, headroom, a lease),
415// so refusing the row for ever would be wrong in the destructive direction. Recording it makes the
416// repeat offender VISIBLE and adjudicable; suppressing it would hide a defect that may have healed.
417func rd_fail_log(organ: *u8, tgt: *u8, rc: i64) -> i64 {
  let fd: i64 = sys_openat_append(RD_FAILLOG, MODE_0644)
  if fd < 0 { rd_w("{\"organ\":\"nx_rebuild_drain\",\"buildfail_ledger\":\"UNWRITABLE\"}\n" as *u8); return 0 - 1 }
  let b: *u8 = sys_mmap(RD_PATHCAP)
  var o: i64 = 0
  o = rd_catn(b, o, sys_now_realtime_sec())
  o = rd_cat(b, o, "\t" as *u8); o = rd_cat(b, o, organ)
  o = rd_cat(b, o, "\tbuilt_target=" as *u8); o = rd_cat(b, o, tgt)
  o = rd_cat(b, o, "\trc=" as *u8); o = rd_catn(b, o, rc)
  b[o] = 10 as u8
  o = o + 1
  sys_write(fd, b, o)
  sys_close(fd)
  sys_munmap(b, RD_PATHCAP)
  return 0
432}
433const RD_LOSSLOG: *u8 = "knowledge/status/rebuild_contentloss.log"
434const RD_CDIFF_ELF: *u8 = "./_offc/nx_contentdiff.elf"
435const RD_CDIFF_TMPA: *u8 = "/tmp/nx_rd_cdiff_"
436const RD_CDIFF_TMPB: *u8 = ".txt"
437const RD_STATLINE: *u8 = "runs_scanned="
438const RD_LOSTFIELD: *u8 = "lost_from_live="
439// ⛔THE ONE CONTENT RULER. This organ used to CARRY ITS OWN printable-run differ (rd_runs + an FNV hash
440// set) whose shortest counted run was RD_RUNMIN=8, while nx_contentdiff -- the ruler /api/promote's guard
441// shares arithmetic with -- uses minlen=6. MEASURED 2026-08-16 on nx_clean_serve_daemon, identical inputs
442// (deployed 1255501 B, fresh 715779 B): mine said 267 lost, the incumbent said 334 of 592 scanned. FOUR
443// of the six runs it NAMED as lost were shorter than 8 (`default` `delete` `typeof` `finally`) and were
444// structurally invisible to mine. ★★★★★★I ADOPTED PROMOTE'S CALIBRATED FLOOR (10 runs / 49 permil) AND
445// APPLIED IT TO A DIFFERENT MEASURE WITH A DIFFERENT DENOMINATOR -- A THRESHOLD CALIBRATED ON ONE RULER
446// IS MEANINGLESS ON ANOTHER, and the drift is toward UNDER-reporting loss, i.e. toward installing a
447// regression. The comment directly below already forbade exactly this and I built it anyway.
448// Returns lost_from_live, or -1 when the report cannot be read or parsed -- and an unverifiable compare
449// is refused by the caller, because a guard that cannot answer must never wave through.
450func rd_cdiff_lost(organ: *u8, dep: *u8, fresh: *u8, logit: i64) -> i64 {
  // ⚠Per-organ temp path: a single shared scratch file would make two concurrent drains read each
  // other's report. Concurrency on the SAME organ is already excluded by the per-target lease.
  let tp: *u8 = sys_mmap(RD_PATHCAP)
  var tc: i64 = rd_cpy(tp, RD_CDIFF_TMPA)
  tc = rd_cat(tp, tc, organ)
  tc = rd_cat(tp, tc, RD_CDIFF_TMPB)
  sys_unlinkat(tp)
  let of: i64 = sys_openat_wr(tp, MODE_0644)
  if of < 0 { sys_munmap(tp, RD_PATHCAP); return 0 - 1 }
  let pid: i64 = sys_fork()
  if pid < 0 { sys_close(of); sys_munmap(tp, RD_PATHCAP); return 0 - 1 }
  if pid == 0 {
      sys_dup3(of, 1, 0)
      sys_dup3(of, 2, 0)
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = RD_CDIFF_ELF as i64
      av[1] = dep as i64
      av[2] = fresh as i64
      av[3] = 0
      let ev: *i64 = sys_mmap(16) as *i64
      ev[0] = 0
      sys_execve(RD_CDIFF_ELF, av, ev)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  sys_close(of)
  sys_munmap(st as *u8, 16)
  let lenp: *i64 = sys_mmap(8)
  let b: *u8 = sys_read_file(tp, lenp)
  let n: i64 = lenp[0]
  sys_munmap(lenp as *u8, 8)
  sys_munmap(tp, RD_PATHCAP)
  if n <= 0 { return 0 - 1 }
  if logit == 1 {
      let fd: i64 = sys_openat_append(RD_LOSSLOG, MODE_0644)
      if fd >= 0 {
          let hb: *u8 = sys_mmap(RD_PATHCAP)
          var o: i64 = rd_cpy(hb, "\n=== " as *u8)
          o = rd_cat(hb, o, organ)
          o = rd_cat(hb, o, "  epoch=" as *u8)
          o = rd_catn(hb, o, sys_now_realtime_sec())
          o = rd_cat(hb, o, "  (capabilities the DEPLOYED binary has and the FRESH build does not)\n" as *u8)
          sys_write(fd, hb, o)
          sys_write(fd, b, n)
          sys_munmap(hb, RD_PATHCAP)
          sys_close(fd)
      }
  }
  // ★ANCHOR BY POSITION, NEVER BY TEXT. `lost_from_live=` is itself a printable run inside any binary
  // that embeds nx_contentdiff's strings, so it can appear on a `LOST:` line -- an unanchored search
  // would read the DATA as the ANSWER. Only the stats line STARTS with `runs_scanned=`.
  var flen: i64 = 0
  while RD_LOSTFIELD[flen] != (0 as u8) { flen = flen + 1 }
  var out: i64 = 0 - 1
  var i: i64 = 0
  var walking: i64 = 1
  while walking == 1 {
      if i >= n { walking = 0 } else {
          var le: i64 = i
          var sc: i64 = 1
          while sc == 1 { if le >= n { sc = 0 } else { if b[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
          if rd_starts_at(b, i, le, RD_STATLINE) == 1 {
              var k: i64 = i
              var fnd: i64 = 0 - 1
              var scan: i64 = 1
              while scan == 1 {
                  if k >= le { scan = 0 } else {
                      if rd_starts_at(b, k, le, RD_LOSTFIELD) == 1 { fnd = k; scan = 0 } else { k = k + 1 }
                  }
              }
              if fnd >= 0 {
                  var p: i64 = fnd + flen
                  var v: i64 = 0
                  var any: i64 = 0
                  var dig: i64 = 1
                  while dig == 1 {
                      if p >= le { dig = 0 } else {
                          let c: i64 = b[p] as i64
                          if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; p = p + 1 } else { dig = 0 } } else { dig = 0 }
                      }
                  }
                  if any == 1 { out = v }
              }
              walking = 0
          } else { i = le + 1 }
      }
  }
  sys_munmap(b, n)
  return out
541}
542func rd_name_losses(organ: *u8, dep: *u8, fresh: *u8) -> i64 {
  let fd: i64 = sys_openat_append(RD_LOSSLOG, MODE_0644)
  if fd < 0 { return 0 - 1 }
  let hb: *u8 = sys_mmap(RD_PATHCAP)
  var o: i64 = rd_cpy(hb, "\n=== " as *u8)
  o = rd_cat(hb, o, organ)
  o = rd_cat(hb, o, "  epoch=" as *u8)
  o = rd_catn(hb, o, sys_now_realtime_sec())
  o = rd_cat(hb, o, "  (capabilities the DEPLOYED binary has and the FRESH build does not)\n" as *u8)
  sys_write(fd, hb, o)
  sys_munmap(hb, RD_PATHCAP)
  let pid: i64 = sys_fork()
  if pid < 0 { sys_close(fd); return 0 - 1 }
  if pid == 0 {
      sys_dup3(fd, 1, 0)
      sys_dup3(fd, 2, 0)
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = RD_CDIFF_ELF as i64
      av[1] = dep as i64
      av[2] = fresh as i64
      av[3] = 0
      let ev: *i64 = sys_mmap(16) as *i64
      ev[0] = 0
      sys_execve(RD_CDIFF_ELF, av, ev)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  sys_close(fd)
  return wait_exit_code(st[0])
572}
573// ★★★★★★A GUARD THAT MEASURES ONLY LOSS WILL BLOCK EVERY UPGRADE THAT RENAMES ANYTHING. MEASURED
574// 2026-08-15 on nx_archive_daemon: the fresh build LOSES 2 runs (an old `User-Agent: NishiReader/2.0` +
575// its Accept twin, replaced by the Chrome header set nx_polite_browser now emits) and GAINS 139 --
576// including ARENA-OVERRUN, ring_sizes and the fail-loud ENOMEM messages, i.e. the arena safety work the
577// deployed binary predates. Refusing that install keeps the OLDER, LESS SAFE binary in production, and
578// re-refuses it on every firing forever.
579// ★A ONE-DIRECTION DIFF CANNOT TELL A REGRESSION FROM A REWORD -- the gain is half the evidence and the
580// guard was reading neither.
581// THE THRESHOLD IS NOT INVENTED HERE. /api/promote's calibrated guard already permits 1-2 absent runs:
582// ordinary edits measure 8-38 permil, and EVERY real regression cleared 49+ permil / 10+ runs. This
583// adopts that measured floor in the unit available (run count), so the drain DECIDES LIKE PROMOTE
584// DECIDES -- ★TWO GUARDS FOR ONE INVARIANT WITH DIFFERENT THRESHOLDS IS THE DUPLICATE-RULER DEFECT.
585// ⚠A loss below the floor is never silent: it is still NAMED in the loss log and reported in the row.
586// ★★★★★★A DRAIN THAT CANNOT TELL A LIVE SERVICE FROM A ONE-SHOT WILL EVENTUALLY DEPLOY ONE WITHOUT
587// A HEALTH CHECK. Every install so far landed on a NON-running binary -- verified against the live table,
588// not assumed -- but that was the luck of the queue order, not a property of this organ. The backlog
589// holds nx_opaque_login, nx_gallery_serve and nx_mgmt_api among its 1,828 rows, and this organ's guards
590// are all STATIC (content, size, rollback): none of them asks "does it still serve after the swap?".
591// The estate already states the rule -- /api/promote REFUSES daemons with "A DAEMON must use the
592// health-checked /api/deploy (validate -> promote -> http-health -> auto-rollback), not /api/promote --
593// that is the correct path, not a workaround." This organ was bypassing that lane entirely.
594// ★READ THE LIVE TABLE, NEVER HARDCODE A SERVICE LIST: the supervisor writes mgmt_snap.json every poll,
595// so the set is DATA that stays current on its own. A baked-in list would rot into a guard that waves
596// through whatever was added after it was written.
597// ⚠Refusing is the SAFE direction: a deferred upgrade leaves the estate exactly as it is, while an
598// unchecked daemon swap can take a service down and only the NEXT restart would reveal it (the rename
599// leaves the running inode alone, so the damage is silent until then -- the worst shape a failure can
600// have).
601const RD_SNAP: *u8 = "mgmt_snap.json"
602// ⛔NO CAP HERE, AND THE REASON IS THE GUARD'S OWN SAFETY. This read used a hand-picked 65536 ceiling.
603// mgmt_snap.json measures 662 B today -- 99x headroom, which is exactly why the defect was invisible --
604// but a capped read TRUNCATES IN SILENCE, and a truncated live-service table reads as `not live` for
605// every service past the cut. The guard would then wave an unchecked daemon swap through, and the rename
606// leaves the running inode alone so nothing would surface until the next restart.
607// ★★★★★★A SAFETY GUARD WHOSE INPUT CAN TRUNCATE SILENTLY FAILS OPEN, AND ITS HEADROOM TODAY IS NOT A
608// PROPERTY OF TOMORROW'S DATA. sys_read_file sizes from the file and cannot short-read.
609func rd_is_live_service(name: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(8)
  let b: *u8 = sys_read_file(RD_SNAP, lenp)
  let n: i64 = lenp[0]
  sys_munmap(lenp as *u8, 8)
  if n <= 0 {
      // ★A GUARD THAT CANNOT MEASURE MUST REFUSE, NEVER WAVE THROUGH. No snapshot means we cannot tell
      // whether this target is live, and installing on that basis is exactly the gamble to avoid.
      return 0 - 1
  }
  let pat: *u8 = sys_mmap(RD_PATHCAP)
  var p: i64 = rd_cpy(pat, "SVC " as *u8)
  p = rd_cat(pat, p, name)
  p = rd_cat(pat, p, ".elf " as *u8)
  var found: i64 = 0
  var i: i64 = 0
  while i < n {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= n { sc = 0 } else { if b[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      if rd_starts_at(b, i, le, pat) == 1 { found = 1; i = n } else { i = le + 1 }
  }
  sys_munmap(pat, RD_PATHCAP)
  sys_munmap(b, n)
  return found
634}
635const RD_PORTMAP: *u8 = "knowledge/status/portmap.conf"
636// ⛔A DAEMON THAT HAPPENS TO BE DOWN IS STILL A DAEMON. rd_is_live_service reads mgmt_snap, which lists
637// only what is RUNNING -- so a declared service that is currently stopped sails past it and gets its
638// binary swapped by a rename, bypassing the health-checked /api/deploy lane. ★★★★★A GUARD KEYED ON
639// CURRENT STATE MISSES EVERY SUBJECT THAT IS BETWEEN STATES, AND `stopped` IS EXACTLY WHEN A BAD BINARY
640// LANDS UNNOTICED: nothing fails until the next start. portmap.conf is the CANONICAL port registry and
641// its own header states the rule -- "A listener absent here is UNDECLARED." Owning a port IS the
642// declaration. 1 = declared owner, 0 = not, -1 = unreadable (caller refuses, never waves through).
643func rd_owns_port(name: *u8) -> i64 {
  let lenp: *i64 = sys_mmap(8)
  let b: *u8 = sys_read_file(RD_PORTMAP, lenp)
  let n: i64 = lenp[0]
  sys_munmap(lenp as *u8, 8)
  if n <= 0 { return 0 - 1 }
  let pat: *u8 = sys_mmap(RD_PATHCAP)
  var p: i64 = rd_cpy(pat, name)
  p = rd_cat(pat, p, ".elf" as *u8)
  var found: i64 = 0
  var i: i64 = 0
  var walking: i64 = 1
  while walking == 1 {
      if i >= n { walking = 0 } else {
          var le: i64 = i
          var sc: i64 = 1
          while sc == 1 { if le >= n { sc = 0 } else { if b[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
          if le > i { if b[i] != (35 as u8) {
              let t: i64 = rd_find_byte(b, i, le, RD_TAB_C)
              if t >= 0 { if rd_starts_at(b, t + 1, le, pat) == 1 {
                  // ★rd_starts_at IS A PREFIX TEST, so the field must also END here or `nx_foo.elf`
                  // matches a row owning `nx_foo.elf.bak`. A PREFIX TEST STANDING IN FOR AN EXACT ONE.
                  if t + 1 + p >= le { found = 1; walking = 0 }
              } }
          } }
          if walking == 1 { i = le + 1 }
      }
  }
  sys_munmap(pat, RD_PATHCAP)
  sys_munmap(b, n)
  return found
674}
675const RD_LOSS_REGRESSION_RUNS: i64 = 10
676const RD_ADMIT_REFUSED: i64 = 6
677// BUILD SLOTS PER FIRING -- not rows per firing; rows we decline to build cost no slot (see the
678// work-done-not-work-offered note in the drain loop). ★A CONSTANT MUST CARRY THE ARITHMETIC THAT CHOSE
679// IT, OR THE NEXT READER CAN ONLY GUESS WHETHER RAISING IT IS SAFE. MEASURED 2026-08-16 from this
680// organ's own elapsed_s column: fixed cost per firing ~9 s (plan regeneration + lib skips), marginal
681// cost ~10 s per build, so 4 slots = ~48 s. Against the 1800 s period adopted from the estate's
682// established queue-drain beat (ddqbeat, nx_dedup_migrate queue 2) that is a 2.7% duty cycle.
683// ⚠The REAL governor is not this number: nx_sov_build_run's admission controller refuses per-build
684// when the box lacks headroom and the drain STOPS on SBR_ADMIT_REFUSED, so a loaded box drains slower
685// by measurement rather than by anything guessed here. Raise this only with a fresh elapsed_s reading.
686const RD_BEAT_BATCH: i64 = 4
687// The durable series. Append-only, TAB-separated, one line per run of the `beat` VERB -- which is NOT
688// the same as one line per SCHEDULED firing, and conflating the two is what made this series unreadable:
689// read `src=scheduled` rows for cadence and backlog trend, `src=manual` rows for operator-driven drains.
690// The schedule itself is NEVER inferable from this file; the clocksched- plane is its only authority. nx_sizeguard already exists
691// to watch a status journal's growth and its sibling calibration is knowledge/status/procchurn.jrnl at
692// 1048576 B / 20000 lines -- REUSE THAT BUDGET rather than inventing one when this is wired to a guard.
693const RD_TREND: *u8 = "knowledge/status/rebuild_drain.jrnl"
694func rd_trend(backlog: i64, attempted: i64, installed: i64, notprog: i64, failed: i64, src: *u8, elapsed: i64, ddaemon: i64, dlive: i64, current: i64, hstop: i64) -> i64 {
  let fd: i64 = sys_openat_append(RD_TREND, MODE_0644)
  if fd < 0 {
      // ★AN UNWRITABLE TREND MUST ANNOUNCE, NOT VANISH: a silently missing row reads later as "the
      // beat did not fire", which is the exact confusion this series exists to remove.
      rd_w("{\"organ\":\"nx_rebuild_drain\",\"trend\":\"UNWRITABLE\",\"path\":\"" as *u8)
      rd_w(RD_TREND); rd_w("\"}\n" as *u8)
      return 0 - 1
  }
  let b: *u8 = sys_mmap(RD_PATHCAP)
  var o: i64 = 0
  o = rd_catn(b, o, sys_now_realtime_sec())
  o = rd_cat(b, o, "\tbacklog=" as *u8); o = rd_catn(b, o, backlog)
  o = rd_cat(b, o, "\tattempted=" as *u8); o = rd_catn(b, o, attempted)
  o = rd_cat(b, o, "\tinstalled=" as *u8); o = rd_catn(b, o, installed)
  o = rd_cat(b, o, "\tnot_a_program=" as *u8); o = rd_catn(b, o, notprog)
  o = rd_cat(b, o, "\tfailed=" as *u8); o = rd_catn(b, o, failed)
  o = rd_cat(b, o, "\tsrc=" as *u8); o = rd_cat(b, o, src)
  // ★★★★★A BEAT THAT DOES NOT REPORT ITS OWN DURATION CANNOT BE SCHEDULED FROM EVIDENCE -- the period is
  // then chosen by taste, and the only feedback is a queue that visibly never drains. With elapsed in
  // the series the duty cycle (elapsed/period) is arithmetic any later reader can redo.
  o = rd_cat(b, o, "\telapsed_s=" as *u8); o = rd_catn(b, o, elapsed)
  // REASON TRAVELS WITH THE COUNT (2026-08-29): these buckets were COMPUTED on every beat and then
  // thrown away by this row, so `backlog=2301 installed=0` read for 15 hours as a broken drain when
  // it is mostly DAEMONS this organ CORRECTLY defers to the health-checked /api/deploy lane, plus a
  // program tail starved by build admission on a loaded box. Additive columns, appended LAST.
  o = rd_cat(b, o, "\tdeferred_daemon=" as *u8); o = rd_catn(b, o, ddaemon)
  o = rd_cat(b, o, "\tdeferred_live=" as *u8); o = rd_catn(b, o, dlive)
  o = rd_cat(b, o, "\talready_current=" as *u8); o = rd_catn(b, o, current)
  o = rd_cat(b, o, "\theadroom_stopped=" as *u8); o = rd_catn(b, o, hstop)
  b[o] = 10 as u8
  o = o + 1
  sys_write(fd, b, o)
  sys_close(fd)
  sys_munmap(b, RD_PATHCAP)
  return 0
730}
731// decimal append into dst at o, returns new offset (MSB-first, no allocation)
732func rd_catn(dst: *u8, o: i64, v: i64) -> i64 {
  var m: i64 = v
  if m < 0 { dst[o] = 45 as u8; return rd_catn(dst, o + 1, 0 - m) }
  if m == 0 { dst[o] = 48 as u8; return o + 1 }
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var p: i64 = o
  while k > 0 { k = k - 1; dst[p] = t[k]; p = p + 1 }
  sys_munmap(t, 32)
  return p
743}
744const RD_PLAN_ELF: *u8 = "./_offc/nx_rebuild_plan.elf"
745const RD_BEAT_LIST: *u8 = "/tmp/nx_rebuild_beat.list"
746func rd_plan_list(elfdir: *u8, srcroot: *u8, outpath: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid < 0 { return 0 - 1 }
  if pid == 0 {
      let ofd: i64 = sys_openat_wr(outpath, MODE_0644)
      if ofd < 0 { sys_exit(126) }
      sys_dup3(ofd, 1, 0)
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = RD_PLAN_ELF as i64
      av[1] = "list" as i64
      av[2] = elfdir as i64
      av[3] = srcroot as i64
      av[4] = 0
      let ev: *i64 = sys_mmap(16) as *i64
      ev[0] = 0
      sys_execve(RD_PLAN_ELF, av, ev)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return wait_exit_code(st[0])
767}
768
769// 1 iff <broot>/runtime/**/<name>.nx declares a main(). A source without one is a LIBRARY and can never
770// link standalone -- `nxasm_x86: UNDEFINED label: main` is the toolchain saying "not a program", not
771// "broken code". Checked BEFORE spending a compile, because the compile is the expensive part and its
772// failure is indistinguishable from a real one once you only have an rc.
773// ⚠Both source roots are probed in the builder's own order (_hdl_build first, then runtime), so this
774// reports on the file that actually compiles rather than the first one that happens to exist.
775const RD_MAINDECL: *u8 = "func main("
776// ⚠⚠READS THE WHOLE SOURCE, NOT A HEAD WINDOW. In this corpus main() is conventionally the LAST
777// function in the file, so a head-capped read would have found it in almost nothing and reported every
778// program as NOT-A-PROGRAM -- vacuous by construction, and it would have silently emptied the drain's
779// work queue while looking like a clean classification. ★A HEAD READ CANNOT ANSWER A QUESTION ABOUT THE
780// TAIL. rd_slurp is the organ's existing whole-file reader; composing it keeps one reader, not two.
781func rd_has_main(broot: *u8, name: *u8) -> i64 {
  let p: *u8 = sys_mmap(RD_PATHCAP)
  let lenp: *i64 = sys_mmap(8)
  var c: i64 = rd_cpy(p, broot)
  c = rd_cat(p, c, "/runtime/_hdl_build/" as *u8)
  c = rd_cat(p, c, name)
  c = rd_cat(p, c, ".nx" as *u8)
  var buf: *u8 = sys_read_file(p, lenp)
  var n: i64 = lenp[0]
  if n <= 0 {
      c = rd_cpy(p, broot)
      c = rd_cat(p, c, "/runtime/" as *u8)
      c = rd_cat(p, c, name)
      c = rd_cat(p, c, ".nx" as *u8)
      buf = sys_read_file(p, lenp)
      n = lenp[0]
  }
  var found: i64 = 0
  if n > 0 {
      var i: i64 = 0
      while i < n {
          // ⚠⚠EXIT BY FLAG, NEVER BY CLOBBERING THE CURSOR. The first cut of this wrote `k = 9` to
          // break out -- but the needle is 10 bytes, so RD_MAINDECL[9] is '(' and NOT the terminator:
          // on a mismatch it reset k to 9 and span forever at 100% CPU. ★★★★★★A LOOP THAT BREAKS BY
          // CLOBBERING ITS OWN CURSOR IS THE DEFECT THIS ESTATE HAS ALREADY PAID FOR FOUR TIMES IN A
          // DAY, AND I WROTE IT AGAIN -- the fix is a separate flag, which cannot be off-by-one.
          var k: i64 = 0
          var ok: i64 = 1
          var scanning: i64 = 1
          while scanning == 1 {
              if RD_MAINDECL[k] == (0 as u8) { scanning = 0 } else {
                  if i + k >= n { ok = 0; scanning = 0 } else {
                      if buf[i+k] != RD_MAINDECL[k] { ok = 0; scanning = 0 } else { k = k + 1 }
                  }
              }
          }
          if ok == 1 { found = 1; i = n } else { i = i + 1 }
      }
  }
  if n > 0 { sys_munmap(buf, n) }
  sys_munmap(lenp as *u8, 8)
  sys_munmap(p, RD_PATHCAP)
  return found
824}
825
826// ★★★★★★DEDUPE TO SUBJECTS, THEN SPLIT BY REMEDY, BEFORE PUBLISHING ANY BACKLOG NUMBER. `1,852
827// stale organs` is a MIXED POPULATION, not a work queue: some rows are libraries whose basename happens
828// to match a deployed elf and can NEVER be built, some have no deployed elf at all, and only the
829// remainder is work. Reporting the total as a backlog sends the next reader on a campaign that cannot
830// finish. This verb answers the partition WITHOUT SPENDING A SINGLE COMPILE -- the classification is a
831// file read per row, and the compile is the expensive part -- so the honest number is cheap to have and
832// there is no excuse for quoting the mixed one.
833// ⚠Walks the WHOLE list, never a batch: a partition measured over a prefix is a sample wearing a
834// population's name.
835func rd_classify(listp: *u8, broot: *u8, elfdir: *u8) -> i64 {
  let lb: *u8 = sys_mmap(RD_LISTCAP)
  let lfd: i64 = sys_openat_rd(listp)
  if lfd < 0 { rd_w("{\"organ\":\"nx_rebuild_drain\",\"refused\":\"listfile unreadable\"}\n" as *u8); return 2 }
  let ln: i64 = sys_read(lfd, lb, RD_LISTCAP - 1)
  sys_close(lfd)
  if ln <= 0 { rd_w("{\"organ\":\"nx_rebuild_drain\",\"refused\":\"list EMPTY\"}\n" as *u8); return 2 }
  lb[ln] = 0 as u8
  let name: *u8 = sys_mmap(RD_PATHCAP)
  let dep: *u8 = sys_mmap(RD_PATHCAP)
  var rows: i64 = 0
  var notprog: i64 = 0
  var noelf: i64 = 0
  var daemonrow: i64 = 0
  var unsafe_name: i64 = 0
  var buildable: i64 = 0
  var i: i64 = 0
  while i < ln {
      var le: i64 = i
      var sc: i64 = 1
      while sc == 1 { if le >= ln { sc = 0 } else { if lb[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
      if le > i {
          var o: i64 = 0
          var k: i64 = i
          while k < le { if o < RD_PATHCAP - 1 { name[o] = lb[k]; o = o + 1 } k = k + 1 }
          name[o] = 0 as u8
          rows = rows + 1
          if rd_safe(name) == 0 { unsafe_name = unsafe_name + 1 } else {
              var c: i64 = rd_cpy(dep, elfdir)
              c = rd_cat(dep, c, "/" as *u8)
              c = rd_cat(dep, c, name)
              c = rd_cat(dep, c, ".elf" as *u8)
              if rd_size(dep) < 0 { noelf = noelf + 1 } else {
                  let tgt: *u8 = sys_mmap(RD_PATHCAP)
                  let aliased: i64 = rd_alias(name, tgt)
                  // ★★★★★SPLIT BY REMEDY BEFORE PUBLISHING A BACKLOG NUMBER. A DECLARED DAEMON belongs to the
                  // health-checked /api/deploy lane and can NEVER be drained by this one, so counting it
                  // as `buildable` makes the work queue permanently unreachable -- a backlog that cannot
                  // reach zero reads as failure when it is actually correct. Checked FIRST because it is
                  // the most specific fact: nx_project_serve is BOTH a declared daemon and a lib basename,
                  // and `daemon` is the one that names its remedy.
                  if rd_owns_port(name) == 1 {
                      daemonrow = daemonrow + 1
                      rd_w("DECLARED-DAEMON " as *u8); rd_w(name); rd_w(" -- /api/deploy lane, not this one\n" as *u8)
                  } else {
                  if rd_has_main(broot, tgt) == 0 {
                      notprog = notprog + 1
                      rd_w("LIB-BASENAME " as *u8); rd_w(name); rd_w("\n" as *u8)
                  } else {
                      buildable = buildable + 1
                      if aliased == 1 { rd_w("ALIASED " as *u8); rd_w(name); rd_w(" -> " as *u8); rd_w(tgt); rd_w("\n" as *u8) }
                  }
                  }
                  sys_munmap(tgt, RD_PATHCAP)
              }
          }
      }
      i = le + 1
  }
  rd_w("{\"organ\":\"nx_rebuild_drain\",\"verb\":\"classify\",\"rows\":" as *u8); rd_n(rows)
  rd_w(",\"buildable\":" as *u8); rd_n(buildable)
  rd_w(",\"lib_basename_never_buildable\":" as *u8); rd_n(notprog)
  rd_w(",\"no_deployed_elf\":" as *u8); rd_n(noelf)
  rd_w(",\"declared_daemon_other_lane\":" as *u8); rd_n(daemonrow)
  rd_w(",\"unsafe_name\":" as *u8); rd_n(unsafe_name)
  let sum: i64 = buildable + notprog + noelf + unsafe_name + daemonrow
  rd_w(",\"partition_sum\":" as *u8); rd_n(sum)
  if sum == rows { rd_w(",\"reconciles\":1" as *u8) } else { rd_w(",\"reconciles\":0" as *u8) }
  rd_w(",\"note\":\"buildable is the ONLY row count that is a work queue; the rest need adjudication, not compiles\"}\n" as *u8)
  return 0
905}
906
907func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { rd_w("usage: nx_rebuild_drain <listfile> [batch] [buildroot] [elfdir]\n       nx_rebuild_drain classify <listfile> [buildroot] [elfdir]\n" as *u8); sys_exit(2); return 2 }
  // beat sets these and falls through into the ONE drain body below -- a second copy of the drain
  // loop would be a second thing to keep correct, and the two would silently disagree the first time
  // either changed.
  var is_beat: i64 = 0
  let t_start: i64 = sys_now_realtime_sec()
  var beat_list: *u8 = "" as *u8
  var beat_batch: i64 = 0
  // ★★★★★★A GUARD THAT KEYS ON THE VERB CANNOT SEE WHO TYPED IT. `is_beat` was meant to keep hand-runs
  // out of the durable series, and it could not: invoking the `beat` verb by hand mints rows that are
  // byte-identical to the scheduler's. I then read three of my OWN rows as evidence of a 5-minute
  // cadence and published a 6-day drain estimate for a job that fires DAILY. Only the CLOCK ROW passes
  // `scheduled`, so an operator can never mint a scheduled row by accident.
  var beat_src: *u8 = "manual" as *u8
  var beat_broot: *u8 = "buildroot" as *u8
  var beat_elfdir: *u8 = "." as *u8
  if rd_streq(argv[1] as *u8, "beat" as *u8) == 1 {
      var bb: i64 = RD_BEAT_BATCH
      var bbr: *u8 = "buildroot" as *u8
      var bed: *u8 = "." as *u8
      if argc >= 3 {
          let bs: *u8 = argv[2] as *u8
          var v: i64 = 0
          var q: i64 = 0
          while bs[q] != (0 as u8) { let c: i64 = bs[q] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } q = q + 1 }
          if v > 0 { bb = v }
      }
      if argc >= 4 { bbr = argv[3] as *u8 }
      if argc >= 5 { bed = argv[4] as *u8 }
      // ★A FLAG THAT ACCEPTS ANY SPELLING CANNOT REPORT A TYPO -- exact token or refuse, so a clock row
      // with a mistyped marker fails LOUDLY instead of silently logging every scheduled firing as manual.
      var bsrc: *u8 = "manual" as *u8
      if argc >= 6 {
          if rd_streq(argv[5] as *u8, "scheduled" as *u8) == 1 { bsrc = "scheduled" as *u8 } else {
              rd_w("{\"organ\":\"nx_rebuild_drain\",\"verb\":\"beat\",\"refused\":\"unrecognised source marker -- the only accepted token is `scheduled`, and only the clock row passes it\"}\n" as *u8)
              sys_exit(2)
              return 2
          }
      }
      // ★REGENERATE FIRST. Installing changes who is stale, so a beat that reuses yesterday's list
      // re-attempts work already done and misses work newly created.
      let prc: i64 = rd_plan_list(bed, "buildroot/runtime" as *u8, RD_BEAT_LIST)
      if prc != 0 {
          rd_w("{\"organ\":\"nx_rebuild_drain\",\"verb\":\"beat\",\"refused\":\"plan list failed\",\"rc\":" as *u8)
          rd_n(prc); rd_w("}\n" as *u8)
          sys_exit(0)
          return 0
      }
      rd_w("{\"organ\":\"nx_rebuild_drain\",\"verb\":\"beat\",\"list\":\"" as *u8)
      rd_w(RD_BEAT_LIST); rd_w("\",\"batch\":" as *u8); rd_n(bb); rd_w(",\"src\":\"" as *u8); rd_w(bsrc); rd_w("\"}\n" as *u8)
      beat_list = RD_BEAT_LIST
      beat_batch = bb
      beat_src = bsrc
      beat_broot = bbr
      beat_elfdir = bed
      is_beat = 1
  }
  if rd_streq(argv[1] as *u8, "classify" as *u8) == 1 {
      if argc < 3 { rd_w("usage: nx_rebuild_drain classify <listfile> [buildroot] [elfdir]\n" as *u8); sys_exit(2); return 2 }
      var cb: *u8 = "buildroot" as *u8
      var ce: *u8 = "." as *u8
      if argc >= 4 { cb = argv[3] as *u8 }
      if argc >= 5 { ce = argv[4] as *u8 }
      let rcc: i64 = rd_classify(argv[2] as *u8, cb, ce)
      sys_exit(rcc)
      return rcc
  }
  var listp: *u8 = argv[1] as *u8
  var batch: i64 = RD_DEFAULT_BATCH
  var broot: *u8 = "buildroot" as *u8
  var elfdir: *u8 = "." as *u8
  if argc >= 3 {
      let bs: *u8 = argv[2] as *u8
      var v: i64 = 0
      var i: i64 = 0
      while bs[i] != (0 as u8) { let c: i64 = bs[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 }
      if v > 0 { batch = v }
  }
  if argc >= 4 { broot = argv[3] as *u8 }
  if argc >= 5 { elfdir = argv[4] as *u8 }
  if is_beat == 1 { listp = beat_list; batch = beat_batch; broot = beat_broot; elfdir = beat_elfdir }
989
  let lb: *u8 = sys_mmap(RD_LISTCAP)
  let lfd: i64 = sys_openat_rd(listp)
  if lfd < 0 { rd_w("{\"organ\":\"nx_rebuild_drain\",\"refused\":\"listfile unreadable\"}\n" as *u8); sys_exit(2); return 2 }
  let ln: i64 = sys_read(lfd, lb, RD_LISTCAP - 1)
  sys_close(lfd)
  if ln <= 0 { rd_w("{\"organ\":\"nx_rebuild_drain\",\"drained\":0,\"note\":\"list EMPTY -- nothing stale, or the plan was never run\"}\n" as *u8); return 0 }
  lb[ln] = 0 as u8
997
  let name: *u8 = sys_mmap(RD_PATHCAP)
  let fresh: *u8 = sys_mmap(RD_PATHCAP)
  let dep: *u8 = sys_mmap(RD_PATHCAP)
  let tmpn: *u8 = sys_mmap(RD_PATHCAP)
  let prevn: *u8 = sys_mmap(RD_PATHCAP)
  var installed: i64 = 0
  var notprog: i64 = 0
  // ★★★★★★COUNTED BEFORE THE BATCH BOUND, NOT INSIDE IT. The first cut incremented this in the drain
  // loop -- which stops after `batch` rows -- so the trend recorded `backlog=2` for a 1,852-row queue:
  // A COUNTER INSIDE A BOUNDED LOOP MEASURES THE BOUND, NOT THE POPULATION. Worse, the line carried a
  // comment asserting it counted every row, so the wrong number arrived CERTIFIED.
  // ★A COMMENT THAT STATES AN INTENT THE CODE DOES NOT IMPLEMENT IS WORSE THAN NO COMMENT.
  var total_rows: i64 = 0
  var stopped_headroom: i64 = 0
  var livedefer: i64 = 0
  var tr_i: i64 = 0
  while tr_i < ln {
      var tr_e: i64 = tr_i
      var tr_s: i64 = 1
      while tr_s == 1 { if tr_e >= ln { tr_s = 0 } else { if lb[tr_e] == (10 as u8) { tr_s = 0 } else { tr_e = tr_e + 1 } } }
      if tr_e > tr_i { total_rows = total_rows + 1 }
      tr_i = tr_e + 1
  }
  var nochange: i64 = 0
  var refused: i64 = 0
  var refusedc: i64 = 0
  var failed: i64 = 0
  // ★SPLIT OUT OF `failed` 2026-08-17: no-deployed-elf spends NO build slot, a BUILDFAIL spends one, and
  // the partition identity needs only the former. `failed` is KEPT as the union so the existing summary
  // field does not change meaning for any consumer (rule 19: add, never repurpose).
  var skipped_no_elf: i64 = 0
  var portdefer: i64 = 0
  // `done` = build slots SPENT (the batch bound). `examined` = rows the loop looked at, which is
  // larger whenever a row is declined without a compile. ★PUBLISH BOTH OR THE PARTITION CANNOT BE
  // CHECKED: examined == done + not_a_program + deferred_live_service + no-deployed-elf, and a
  // residual there is a row class nobody named.
  var done: i64 = 0
  var examined: i64 = 0
1036
  rd_w("{\"organ\":\"nx_rebuild_drain\",\"rows\":[" as *u8)
  var first: i64 = 1
  var i: i64 = 0
  while i < ln {
      if done >= batch { i = ln } else {
          var le: i64 = i
          var sc: i64 = 1
          while sc == 1 { if le >= ln { sc = 0 } else { if lb[le] == (10 as u8) { sc = 0 } else { le = le + 1 } } }
          if le > i {
              var o: i64 = 0
              var k: i64 = i
              while k < le { if o < RD_PATHCAP - 1 { name[o] = lb[k]; o = o + 1 } k = k + 1 }
              name[o] = 0 as u8
              if rd_safe(name) == 1 {
                  // ★★★★★★A LIMIT MUST COUNT WORK DONE, NOT WORK OFFERED. This counter used to advance HERE,
                  // before the outcome was known, so a row we DECLINE to build spent a build slot.
                  // MEASURED 2026-08-16: three permanently-unbuildable lib sources sit at the head of
                  // every regenerated list, so a batch of 4 performed ONE build per firing and the
                  // other three slots re-derived the same three refusals for ever. The comment forty
                  // lines below already named this head-of-line block and cited the banked remedy --
                  // the diagnosis was written and the arithmetic was never changed to match it.
                  // ★A DIAGNOSIS IN A COMMENT IS NOT A FIX; THE QUEUE OBEYS THE COUNTER, NOT THE PROSE.
                  examined = examined + 1
                  var c: i64 = rd_cpy(dep, elfdir)
                  c = rd_cat(dep, c, "/" as *u8)
                  c = rd_cat(dep, c, name)
                  c = rd_cat(dep, c, ".elf" as *u8)
                  let ds: i64 = rd_size(dep)
                  var f: i64 = rd_cpy(fresh, broot)
                  f = rd_cat(fresh, f, "/_build/" as *u8)
                  f = rd_cat(fresh, f, name)
                  f = rd_cat(fresh, f, ".sov.elf" as *u8)
                  if first == 0 { rd_w("," as *u8) }
                  first = 0
                  rd_w("{\"organ\":\"" as *u8); rd_w(name); rd_w("\",\"result\":\"" as *u8)
                  // ★★★★★★"IT DOES NOT COMPILE" AND "IT IS NOT A PROGRAM" ARE DIFFERENT FACTS WITH
                  // OPPOSITE REMEDIES. MEASURED 2026-08-15: the first two rows of the backlog reported
                  // BUILDFAIL rc=4, and the real error is `nxasm_x86: UNDEFINED label: main` --
                  // nx_gen_gateway.nx is a LIBRARY (its runnable twin is nx_gen_gateway_daemon.nx, which
                  // has its own built elf). A lib can NEVER link standalone, so this row fails on every
                  // run, never stops being stale, and sits at the head of every regenerated list.
                  // ★★★★★★A PERMANENTLY-FAILING ROW AT THE HEAD OF AN ALWAYS-RE-SORTED QUEUE IS A
                  // HEAD-OF-LINE BLOCK THAT NEVER CLEARS, and the estate already banked the remedy:
                  // HIDING AN UNBUILDABLE SET INSIDE A BUILD QUEUE GUARANTEES THE QUEUE NEVER FINISHES --
                  // dedupe to SUBJECTS, then SPLIT BY REMEDY, before publishing any backlog number.
                  // Detected the only way that is not a guess: the source either declares main or it does
                  // not. Reported as its own row so the two never share a counter -- a lib here needs
                  // ADJUDICATION (whose elf is that, really?), never a compile fix.
                  let livesvc: i64 = rd_is_live_service(name)
                  if ds < 0 { rd_w("SKIP-NO-DEPLOYED-ELF\"}" as *u8); failed = failed + 1; skipped_no_elf = skipped_no_elf + 1 } else {
                      // ★ONE DECISION, ONE BRANCH -- the brace shape here is UNCHANGED on purpose. A nested
                      // else would mean hand-balancing a 13-deep cascade, and a mis-closed brace in a live
                      // installer is a worse defect than the one being fixed.
                      // ★NAME WHICH REASON: a RUNNING service and a DECLARED-but-stopped one take the same
                      // remedy but are not the same fact, and two skip-causes sharing one counter is how a
                      // population stops being adjudicable.
                      let portown: i64 = rd_owns_port(name)
                      var deferany: i64 = 0
                      if livesvc != 0 { deferany = 1 }
                      if portown != 0 { deferany = 1 }
                      if deferany != 0 {
                          if livesvc < 0 { rd_w("REFUSED-CANNOT-READ-LIVE-TABLE\"}" as *u8) } else {
                          if livesvc != 0 { rd_w("DEFERRED-LIVE-SERVICE-USE-API-DEPLOY\"}" as *u8) } else {
                          if portown < 0 { rd_w("REFUSED-CANNOT-READ-PORTMAP\"}" as *u8) } else { rd_w("DEFERRED-DECLARED-DAEMON-USE-API-DEPLOY\"}" as *u8) } } }
                          if livesvc != 0 { livedefer = livedefer + 1 } else { portdefer = portdefer + 1 }
                      } else {
                      // ⛔RESOLVE THE ALIAS BEFORE THE GATE THAT REJECTS ON IT. The first wiring put this
                      // AFTER rd_has_main, which tests the DEPLOYED BASENAME -- so an aliased row was
                      // rejected as a library before the alias was ever consulted, and the change was a
                      // no-op that still compiled and still passed neutrality.
                      // ★★★★★A LOOKUP PLACED AFTER THE TEST IT EXISTS TO SATISFY CANNOT CHANGE ANY OUTCOME,
                      // AND NOTHING IN THE BUILD OR THE TEST SUITE SAYS SO -- only running the aliased row
                      // and seeing the OLD verdict does. rd_classify already had this order right; the
                      // drain path did not, which is exactly how the two halves drifted.
                      let btgt: *u8 = sys_mmap(RD_PATHCAP)
                      let usedalias: i64 = rd_alias(name, btgt)
                      if rd_has_main(broot, btgt) == 0 {
                          rd_w("NOT-A-PROGRAM-LIB-SOURCE\"}" as *u8)
                          notprog = notprog + 1
                          sys_munmap(btgt, RD_PATHCAP)
                      } else {
                      // The slot is spent HERE -- at the first action that costs the box a compile.
                      // STOPPED-NO-HEADROOM counts too: the box was asked, and asking is the work.
                      done = done + 1
                      // ⛔THE ALIAS WAS RESOLVED FOR THE CLASSIFIER AND NEVER FOR THE BUILDER. rd_alias had
                      // exactly two call sites -- its definition and rd_classify -- so the conf could
                      // REPORT a resolved provenance while the drain still compiled the deployed basename,
                      // which for an aliased row is a LIBRARY that can never link.
                      // ★★★★★★A REGISTRY WIRED INTO THE REPORT BUT NOT INTO THE ACTION IS BUILT+UNWIRED
                      // WEARING THE COSTUME OF A FEATURE: every reader sees the mapping and nothing obeys it.
                      // BUILD the alias target and read ITS artifact; COMPARE against the DEPLOYED basename.
                      // Non-aliased rows are unaffected BY CONSTRUCTION -- rd_alias copies `name` through
                      // unchanged when no proven/equivalent row matches.
                      if usedalias == 1 {
                          var af: i64 = rd_cpy(fresh, broot)
                          af = rd_cat(fresh, af, "/_build/" as *u8)
                          af = rd_cat(fresh, af, btgt)
                          af = rd_cat(fresh, af, ".sov.elf" as *u8)
                      }
                      let rc: i64 = rd_build(broot, btgt, rd_live_has_debug(dep))
                      // ⛔LOG BEFORE THE FREE. The first cut called rd_fail_log(name, btgt, rc) at the JSON
                      // emit site far below -- AFTER this munmap -- a USE-AFTER-FREE that SIGSEGV'd the live
                      // drain on its very first BUILDFAIL. The ledger file was created at 0 bytes, so the
                      // open succeeded and the crash landed writing the freed pointer.
                      // ★★★★★★A LEDGER ADDED TO RECORD FAILURES BECAME THE FAILURE: I extended the LIFETIME of
                      // a borrowed buffer by adding a reader, and nothing in the build or the neutrality
                      // test could see it -- only running the exact row that fails.
                      // ★AN ARGUMENT THAT OUTLIVES ITS OWNER'S munmap IS A DANGLING POINTER NO MATTER HOW
                      // OBVIOUSLY CORRECT THE CALL LOOKS AT THE CALL SITE.
                      let fs: i64 = rd_size(fresh)
                      // ⛔BACKPRESSURE IS NOT A FAILURE, AND AN APPEND-ONLY LEDGER MUST NOT SAY IT IS.
                      // rc == RD_ADMIT_REFUSED is the BOX saying "stop", not the TARGET saying "broken".
                      // The emit logic below already earned that exclusion (see its note); the ledger I
                      // added would have bypassed it and permanently recorded healthy organs as failures --
                      // the exact regression that note exists to prevent, re-entered through a new door.
                      // ★★★★★★A NEW RECORDER MUST INHERIT EVERY EXCLUSION THE EXISTING REPORTER ALREADY
                      // EARNED; ADDING AN OUTPUT IS NOT NEUTRAL JUST BECAUSE IT ONLY WRITES.
                      // ⚠Both calls sit BEFORE the munmap so btgt is still owned -- fs is hoisted above the
                      // free for the same reason, which also lets NO-ARTIFACT record the real built target
                      // instead of the deployed basename.
                      if rc != 0 { if rc != RD_ADMIT_REFUSED { rd_fail_log(name, btgt, rc) } }
                      if rc == 0 { if fs < 0 { rd_fail_log(name, btgt, 0 - 1) } }
                      sys_munmap(btgt, RD_PATHCAP)
                      // ★★★★★★BACKPRESSURE IS NOT A FAILURE. nx_sov_build_run returns SBR_ADMIT_REFUSED(6)
                      // for all three admission denials -- DENY-MEM, QUEUE, CANNOT-MEASURE -- and its
                      // source says why that code is distinct: the NAS branch once returned the raw
                      // 3/4/5 which COLLIDE with COMPILE_FAIL/ASM_FAIL, so "a wait-and-retry signal
                      // decoded as a broken build". My drain counted every rc!=0 as BUILDFAIL and would
                      // have reproduced that regression from the other side -- recording a HEALTHY
                      // target as broken, permanently, in an append-only trend.
                      // ★A WAIT-AND-RETRY SIGNAL RECORDED AS A FAILURE TEACHES THE OPERATOR THAT HEALTHY
                      // TARGETS ARE BROKEN. It STOPS the batch instead: the box is telling us to stop,
                      // and the drain is idempotent so the remainder is simply the next firing's work.
                      if rc == RD_ADMIT_REFUSED {
                          rd_w("STOPPED-NO-HEADROOM\"}" as *u8)
                          // The FLAG is what stops the loop (read at the loop tail). The old `i = ln`
                          // written here was OVERWRITTEN by the tail's `i = le + 1` one screen down, so
                          // "STOPS the batch" was true in prose and false in code: MEASURED 2026-08-18,
                          // a 16-slot round printed STOPPED-NO-HEADROOM at slot 4 and went on to spend
                          // the other 12 -- a loop-exit sentinel written into the cursor and erased, the
                          // estate's own banked gotcha. A stop is a flag; the cursor is not a flag.
                          stopped_headroom = 1
                      } else {
                      if rc != 0 { rd_w("BUILDFAIL\",\"rc\":" as *u8); rd_n(rc); rd_w("}" as *u8); failed = failed + 1 } else {
                          if fs < 0 { rd_w("BUILDFAIL-NO-ARTIFACT\"}" as *u8); failed = failed + 1 } else {
                              // ONE RULER: the count now comes from nx_contentdiff itself, so the drain
                              // decides on the SAME number /api/promote's guard was calibrated against.
                              // THE RULER SPEAKS BEFORE THE SIZE SCREEN (2026-08-18). The stub trap below
                              // ("fresh under HALF the deployed size is a wrong-source signal") used to fire
                              // FIRST and alone, so the content ruler never got to vouch for a small build.
                              // Then nx_cc gained whole-program DCE and every honest rebuild became 24-72%
                              // smaller: MEASURED on the live beat -- 11 of 16 slots per round went to
                              // REFUSED-AMBIGUOUS-STUB-SOURCE for binaries that had lost NOTHING, the drain
                              // tapered from 12 installs a round to 0-2, and the same 11 rows re-occupied
                              // the head of every regenerated list. A stub source (main returns 0) is still
                              // refused: it loses every printable run, so lostr>0 and the trap fires as
                              // before -- but now on EVIDENCE, and an unverifiable ruler (-1) refuses too.
                              // Same shape as the promote guard's SHRINK fix the same day: size alone
                              // escalates only when the ruler could not vouch.
                              let lostr: i64 = rd_cdiff_lost(name, dep, fresh, 0)
                              var stubref: i64 = 0
                              if fs * RD_STUB_NUM < ds { if lostr != 0 { stubref = 1 } }
                              if stubref == 1 {
                                  rd_w("REFUSED-AMBIGUOUS-STUB-SOURCE\",\"lost_runs\":" as *u8); rd_n(lostr)
                                  rd_w(",\"fresh\":" as *u8); rd_n(fs)
                                  rd_w(",\"deployed\":" as *u8); rd_n(ds); rd_w("}" as *u8)
                                  refused = refused + 1
                              } else {
                              // The OTHER half of the evidence: what the fresh build adds. A rename shows
                              // as a small loss beside a large gain; a true regression does not.
                              var gained: i64 = 0
                              if lostr > 0 { gained = rd_cdiff_lost(name, fresh, dep, 0) }
                              var block: i64 = 0
                              if lostr < 0 { block = 1 }
                              if lostr >= RD_LOSS_REGRESSION_RUNS { block = 1 }
                              if block == 0 { if lostr > 0 {
                                  // Below the measured regression floor: PROCEED, but never silently.
                                  rd_cdiff_lost(name, dep, fresh, 1)
                              } }
                              if block == 1 {
                                  // Capability the deployed binary can express and the fresh one cannot.
                                  // -1 means we could not read one of them: refuse that too, because a
                                  // guard that cannot answer must not wave things through.
                                  if lostr < 0 { rd_w("REFUSED-UNVERIFIABLE-CONTENT\",\"fresh\":" as *u8) } else { rd_w("REFUSED-CONTENT-LOSS\",\"lost_runs\":" as *u8) }
                                  if lostr > 0 { rd_n(lostr); rd_w(",\"gained_runs\":" as *u8); rd_n(gained); rd_w(",\"fresh\":" as *u8) }
                                  rd_n(fs); rd_w(",\"deployed\":" as *u8); rd_n(ds)
                                  // Name them, so the refusal is adjudicable instead of merely counted.
                                  if lostr > 0 { rd_cdiff_lost(name, dep, fresh, 1); rd_w(",\"named_in\":\"" as *u8); rd_w(RD_LOSSLOG); rd_w("\"" as *u8) }
                                  rd_w("}" as *u8)
                                  refusedc = refusedc + 1
                              } else {
                                  if rd_same(fresh, dep) == 1 {
                                      rd_w("ALREADY-CURRENT\",\"bytes\":" as *u8); rd_n(fs); rd_w("}" as *u8)
                                      nochange = nochange + 1
                                  } else {
                                      // ★★★KEEP A WAY BACK BEFORE YOU NEED ONE. The first real drain installed 9
                                      // binaries that had SHRUNK 24-42%; the 50% stub ratio passed them and only
                                      // post-hoc probing proved they were sound. They were -- but that was LUCK,
                                      // and luck is not a guard. Rename is atomic and therefore IRREVERSIBLE: the
                                      // previous inode has no name left and cannot be rebuilt, because it came
                                      // from an older toolchain that no longer exists. So snapshot the deployed
                                      // elf to .prev FIRST; if the snapshot cannot be taken, DO NOT INSTALL.
                                      // Rule 26's shape applied to software: reversible BY CONSTRUCTION, never by
                                      // the hope that the new artifact is fine.
                                      var pv: i64 = rd_cpy(prevn, dep)
                                      pv = rd_cat(prevn, pv, ".prev" as *u8)
                                      if rd_copy(dep, prevn) == 0 { rd_w("REFUSED-NO-ROLLBACK-SNAPSHOT\"}" as *u8); failed = failed + 1 } else {
                                      var t: i64 = rd_cpy(tmpn, dep)
                                      t = rd_cat(tmpn, t, ".new" as *u8)
                                      if rd_copy(fresh, tmpn) == 0 { rd_w("COPYFAIL\"}" as *u8); failed = failed + 1 } else {
                                          nx_chmod(tmpn, 493)
                                          if sys_renameat(tmpn, dep) != 0 {
                                              rd_w("RENAMEFAIL\"}" as *u8); failed = failed + 1
                                          } else {
                                              rd_w("INSTALLED\",\"was\":" as *u8); rd_n(ds)
                                              rd_w(",\"now\":" as *u8); rd_n(rd_size(dep))
                                              rd_w(",\"rollback\":\"" as *u8); rd_w(prevn); rd_w("\"}" as *u8)
                                              installed = installed + 1
                                              rd_install_log(name, ds, fs, prevn)
                                          }
                                      }
                                      }
                                  }
                              }
                              }
                          }
                      }
                      }
                      }
                      }
                  }
              }
          }
          if stopped_headroom == 1 { i = ln } else { i = le + 1 }
      }
  }
  rd_w("],\"attempted\":" as *u8); rd_n(done)
  rd_w(",\"installed\":" as *u8); rd_n(installed)
  rd_w(",\"already_current\":" as *u8); rd_n(nochange)
  rd_w(",\"refused_stub_source\":" as *u8); rd_n(refused)
  rd_w(",\"refused_content_loss\":" as *u8); rd_n(refusedc)
  rd_w(",\"not_a_program\":" as *u8); rd_n(notprog)
  rd_w(",\"failed\":" as *u8); rd_n(failed)
  rd_w(",\"skipped_no_deployed_elf\":" as *u8); rd_n(skipped_no_elf)
  rd_w(",\"buildfail\":" as *u8); rd_n(failed - skipped_no_elf)
  rd_w(",\"batch\":" as *u8); rd_n(batch)
  rd_w(",\"examined\":" as *u8); rd_n(examined)
  rd_w(",\"partition_reconciles\":" as *u8)
  // 🔴FIXED 2026-08-17, AND MY OWN CHECK IS WHAT CAUGHT IT. This read `+ failed`, which DOUBLE-COUNTS:
  // a BUILDFAIL row already spent a build slot, so it is inside `done`. It reconciled in every earlier
  // test only because those runs contained no real build failures -- the first run that hit two
  // printed `partition_reconciles:0` and named the defect for me.
  // ★★★★★★`failed` IS A BUCKET NAMED FOR HOW THE READER FAILED, HOLDING TWO FACTS WITH OPPOSITE SLOT
  // ACCOUNTING: SKIP-NO-DEPLOYED-ELF spends NO slot, BUILDFAIL spends one. Only the no-elf class is an
  // addend here. ★A PARTITION CHECK EARNS ITS KEEP THE FIRST TIME THE POPULATION CHANGES SHAPE.
  if examined == done + notprog + livedefer + portdefer + skipped_no_elf { rd_n(1) } else { rd_n(0) }
  rd_w(",\"deferred_live_service\":" as *u8); rd_n(livedefer)
  rd_w(",\"deferred_declared_daemon\":" as *u8); rd_n(portdefer)
  rd_w(",\"stopped_for_headroom\":" as *u8); rd_n(stopped_headroom)
  rd_w(",\"note\":\"IDEMPOTENT: re-run to continue draining -- regenerate the list with `nx_rebuild_plan list` first, since installing changes who is stale. VERIFY BY RE-RUNNING THE CENSUS, not by trusting this summary.\"}\n" as *u8)
  // ★★★★★★A BEAT THAT LEAVES NO TREND IS INDISTINGUISHABLE FROM ONE THAT NEVER FIRED. The summary
  // above goes to a job artifact nobody keeps; unattended firings need a DURABLE series or the only
  // answerable question is "did it run just now", never "is the backlog shrinking".
  // The load-bearing column is `backlog` -- the row count of the list the beat REGENERATED this
  // firing. A LEVEL CANNOT EXPRESS PROGRESS: one row says nothing, two rows say whether the drain is
  // outpacing the staleness that shared runtimes keep creating. Append-only, one line per firing.
  // ⚠Written only for the `beat` VERB -- but the verb is typeable by hand, so the row carries `src=`
  // to say which. This comment previously claimed the two could not mix; they did, on the same day.
  if is_beat == 1 { rd_trend(total_rows, done, installed, notprog, failed, beat_src, sys_now_realtime_sec() - t_start, portdefer, livedefer, nochange, stopped_headroom) }
  return 0
1307}
nx_rebuild_drain.nx source

`nx_rebuild_drain.nx` source
