nx_registry_txn.nx source

1// nx_registry_txn.nx -- the RACE-FREE registry-write COORDINATOR (operator 2026-06-14: "fix this race 2// callout from the hardware rung up to be S-class exceed"). 3// 4// THE RACE: nx_reconcile / nx_mark_migrate / nx_express_lane all do read-modify-write on 5// assignment_queue.tsv / row_markers.tsv with NO lock. Atomic-rename saves them from a TORN file 6// (corruption) but NOT from a LOST UPDATE: if two run concurrently both read the same base, both 7// rewrite, the second clobbers the first. (Confirmed: el_apply_mark renames, reconcile/mark_migrate 8// truncate-write; none lock.) 9// 10// HARDWARE RUNG: the lock primitive flock was silently broken -- rv64 syscall 32 had NO entry in the 11// rv64->x86_64 map (nx_x86_64_ctx.nx) so it fell through to x86_64 32 = dup2 (a no-op "lock"). FIXED 12// (32->73). And flock is anyway dead on /mnt/c drvfs. So the drvfs-safe mutual-exclusion primitive is 13// an O_CREAT|O_EXCL lockfile (kernel guarantees ONE creator wins, no TOCTOU) + atomic renameat. 14// 15// S-CLASS EXCEED over the incumbent ad_acquire_lock (which HARD-FAILS on contention with NO staleness 16// recovery): this coordinator SPIN-SERIALIZES contenders AND self-heals a stale lock left by a crashed 17// holder (the lockfile stamps its acquire-epoch; a lock older than RT_STALE_SEC is stolen) -- so it is 18// serializable + crash-safe + drvfs-portable, exceeding flock (drvfs-dead), atomic-rename-alone (loses 19// updates), and ad_acquire_lock (deadlocks on a crashed holder). 20// 21// SELF-GATE (no-args): fork 2 writers, each does N lock-guarded increments of a counter file. GUARDED -> 22// final == 2N (no lost update). UNGUARDED control -> final < 2N (the race is real, the lock necessary). 23// GREEN iff guarded==2N AND unguarded<2N. license_tier: ORIGINAL 24// 25// LOCK PRIMITIVE EXTRACTED 2026-06-14: rt_lock/rt_unlock (+ rt_now/rt_unlink/rt_readint/ 26// rt_writeint_fd and the RT_OEXCL/RT_MODE/RT_STALE_SEC consts) now live in the shared mainless 27// lib nx_registry_lock.nx so the queue writers + daemons can share ONE serializable lock (DRY, 28// rule 15). This organ now imports the lib ONLY (NOT nx_syscalls directly -- the lib pulls it in 29// transitively; the nx_assign_core<-nx_dep_audit convention that dodges the double-import rc=6). 30// This file stays the GATE that proves the lib (RTXN-GATE = fork-2-writers losslessness). 31import "nx_registry_lock.nx" 32 33const RT_COUNTER: *u8 = "knowledge/status/_rtxn_counter" 34const RT_LOCK: *u8 = "knowledge/status/_rtxn_counter.lock" 35const RT_TMP0: *u8 = "knowledge/status/_rtxn.tmp0" 36const RT_TMP1: *u8 = "knowledge/status/_rtxn.tmp1" 37const RT_ITERS: i64 = 40 38 39func rt_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 40func rt_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48 as u8;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 41 42// rt_now / rt_unlink / rt_writeint_fd / rt_readint are now provided by nx_registry_lock.nx (lib split). 43func rt_setint(path: *u8, v: i64) -> i64 { 44 let fd: i64 = sys_openat_wr(path, RT_MODE) 45 if fd < 0 { return 0 - 1 } 46 rt_writeint_fd(fd, v) 47 sys_close(fd) 48 return 0 49} 50 51// rt_lock / rt_unlock (the O_EXCL+stale-steal primitive) are now provided by nx_registry_lock.nx. 52 53// one increment of the counter. guarded=1 -> under the coordinator lock (serializable, lossless). 54func rt_inc(counter: *u8, lockpath: *u8, tmp: *u8, guarded: i64) -> i64 { 55 var fd: i64 = 0 - 1 56 if guarded == 1 { fd = rt_lock(lockpath); if fd < 0 { return 0 - 1 } } 57 let v: i64 = rt_readint(counter) 58 let nv: i64 = v + 1 59 let wf: i64 = sys_openat_wr(tmp, RT_MODE) 60 if wf >= 0 { rt_writeint_fd(wf, nv); sys_close(wf); sys_renameat(tmp, counter) } 61 if guarded == 1 { rt_unlock(lockpath, fd) } 62 return 0 63} 64func rt_loop(counter: *u8, lockpath: *u8, tmp: *u8, guarded: i64, iters: i64) -> i64 { 65 var i: i64 = 0 66 while i < iters { rt_inc(counter, lockpath, tmp, guarded); i = i + 1 } 67 return 0 68} 69 70// reset, fork 2 writers, wait, return the final counter value. 71func rt_run(guarded: i64, iters: i64) -> i64 { 72 rt_setint(RT_COUNTER, 0) 73 rt_unlink(RT_LOCK) 74 let pid0: i64 = sys_fork() 75 if pid0 == 0 { rt_loop(RT_COUNTER, RT_LOCK, RT_TMP0, guarded, iters); sys_exit(0) } 76 let pid1: i64 = sys_fork() 77 if pid1 == 0 { rt_loop(RT_COUNTER, RT_LOCK, RT_TMP1, guarded, iters); sys_exit(0) } 78 let st: *i64 = sys_mmap(16) as *i64 79 sys_wait4(pid0, st, 0) 80 sys_wait4(pid1, st, 0) 81 return rt_readint(RT_COUNTER) 82} 83 84func rt_gate(fd: i64, pos: i64, neg: i64, expect: i64, ok: i64, epoch: i64) -> i64 { 85 rt_w(fd, "RTXN-GATE authored=organ primitive=O_EXCL-lockfile+atomic-rename+age-staleness(drvfs-safe) guarded_count=" as *u8); rt_wn(fd, pos) 86 rt_w(fd, " expect=" as *u8); rt_wn(fd, expect) 87 rt_w(fd, " unguarded_count=" as *u8); rt_wn(fd, neg) 88 rt_w(fd, " lost_without_lock=" as *u8); rt_wn(fd, expect - neg) 89 rt_w(fd, " epoch=" as *u8); rt_wn(fd, epoch) 90 if ok == 1 { rt_w(fd, " no_lost_update=YES verdict=GREEN\n" as *u8) } else { rt_w(fd, " verdict=RED\n" as *u8) } 91 return 0 92} 93 94func main() -> i64 { 95 let expect: i64 = 2 * RT_ITERS 96 let pos: i64 = rt_run(1, RT_ITERS) // guarded -> must be lossless (== 2N) 97 var neg: i64 = rt_run(0, RT_ITERS) // unguarded control -> must lose >=1 (< 2N) 98 var rtry: i64 = 0 99 while rtry < 5 { 100 if neg >= expect { let n2: i64 = rt_run(0, RT_ITERS); if n2 < neg { neg = n2 } } 101 rtry = rtry + 1 102 } 103 rt_unlink(RT_COUNTER); rt_unlink(RT_LOCK); rt_unlink(RT_TMP0); rt_unlink(RT_TMP1) 104 105 var ok: i64 = 1 106 if pos != expect { ok = 0 } // the coordinator MUST be lossless 107 if neg >= expect { ok = 0 } // the unguarded control MUST lose -- proves the race real + the lock necessary 108 let epoch: i64 = rt_now() 109 rt_gate(1, pos, neg, expect, ok, epoch) 110 let lf: i64 = sys_openat_append("knowledge/status/registry_txn.log" as *u8, RT_MODE) 111 if lf >= 0 { rt_gate(lf, pos, neg, expect, ok, epoch); sys_close(lf) } 112 if ok == 1 { sys_exit(0); return 0 } 113 sys_exit(1); return 1 114}