nx_seat.nx source

1// nx_seat.nx -- THE AGENT-SEAT token-engine organ (seat-system S0+S3, 2026-07-20). 2// MISSION (operator): move Claude's token lift INTO the ecosystem. Measured 12-session baseline: 3// cache_read 920.8M tok vs output 6.1M -- fat tool results re-read every turn dominate cost. 4// So: boot = ONE call, HARD-CAPPED <=4096B digest (vs ~40K-token memory-file boot); the substrate 5// is digested SERVER-SIDE and only the decision surface reaches a seat's context window. 6// nx_seat boot <ws> [journal] [debtprefix] [frontierprefix] [meterlog] -> capped JSON digest 7// nx_seat meter <seat> <sessions> <out_tok> <cread_tok> <ccreate_tok> <note> [logpath] 8// -> ONE O_APPEND TSV row to knowledge/status/token_efficiency.log (conflict-free, S3) 9// nx_seat meterlog [n] [logpath] -> last n metering rows (tail-window, declared) 10// nx_seat shift [days] [meterlog] [ws.jrnl] -> ENGINE-SHIFT SCOREBOARD (F831): claude-vs-local 11// seat-class aggregates + DONE-closures in window -> tokens-per-closed-rung, capped JSON 12// nx_seat reap [actor] [note] [claims.jrnl] [ws.jrnl] -> F214 ORPHAN REAP: forks the nx_claims 13// organ's reap verb (releases ONLY provably-EXPIRED claims, age>ttl by the claim's OWN 14// ttl -- the wrapper NEVER decides expiry itself) then appends one ORPHAN-REAPED audit 15// frame per reaped ws to the ws journal (who/when/why); idempotent, additive-only 16// nx_seat resume_map <transcripts_dir> <temp_root|-> <win_start_epoch|latest> [win_end] [frames.jrnl|-] 17// -> DM2 CRASH-RESUME MAP (/compare/devmgmt): per-seat lane/last-action/IN-FLIGHT/resume-point 18// evidence from transcript JSONL tails + scratchpads + task-child outputs; full population, 19// partition printed AND summed; in-flight wrong only toward flagging. The last arg is the DM1 20// frames journal -- the convention DIR (knowledge/status/chbeat) or one chbeat_<YYYYMMDD>.jrnl -- 21// which joins ESTATE-side frames to each seat by session id (actlog col1) and reports 22// SKIP / PARTIAL (covered window stated) / COVERS. SSOT: buildroot copy of this file. 23// nx_seat selftest [tmpbase] -> gv-lib gate T1..T6 incl SCALE tooth (300-frame journal 24// -> output still <=4096B; fixture gates prove correctness NEVER scale -- ark v1 lesson) 25// SCALE-LAW: every read is tail-windowed with the true size DECLARED in output (journal_bytes vs 26// window_bytes); output budget declared as budget_bytes. AUTHORITY: nx_ws_cycle next remains the 27// scoped debt gate; boot is the recon DIGEST and says so in its output (no drift, no dup gate). 28// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 29import "nx_sovjson_lib.nx" 30import "nx_store_seed_lib.nx" 31import "nx_seg_store.nx" 32import "nx_gate_verdict.nx" 33import "nx_tool_run.nx" 34import "nx_syscalls.nx" 35// CLAIM-AWARE SELECTION (2026-08-22): cl_state / cl_res_span_lit / cl_read come from here. 36// IMPORTED, NEVER REIMPLEMENTED -- the selector and the claims tool must not be able to disagree 37// about who holds what, and the only way to guarantee that is for there to be exactly ONE predicate. 38import "nx_claims.nx" 39import "nx_costest_lib.nx" // EC56: the ONE grammar of the costcal ledger's event rows (ces_events_window, ces_cal_parse) 40import "nx_rungclose_lib.nx" // EC57 c: the ONE wire of the close-first worklist (rgc_work_pick, rgc_work_fresh, rgc_state_name) 41import "nx_gauge_lib.nx" // CE9: the ONE gauge-stamp writer (ga_stamp_write); gauge_pass renders what this writes 42const ST_GAUGE_STAMP: *u8 = "knowledge/status/seat_gauge.stamp" // CE9: the heartbeat the codeeffectiveness.gauge row reads 43const ST_LEDGER: *u8 = "knowledge/status/costcal.ledger" // EC56: the boards' land and retract events, written by the costcal beat 44const ST_FRAME_SLACK: i64 = 64 // EC62: a frame's fixed parts -- the timestamp digits, four tabs, the newline and the terminator 45const ST_WIPSTATUS: *u8 = "knowledge/status/wip.status" // EC57: the costcal beat's ONE canonical started-not-landed line 46const ST_WORKLIST: *u8 = "knowledge/status/rungclose.worklist" // EC57 c: the fleet census's close-first worklist (nx_rungclose census all) 47const ST_CLOSESTATUS: *u8 = "knowledge/status/rungclose.status" // EC57: the fleet census's ONE canonical state line 48const ST_CF_DAY_S: i64 = 86400 // EC57 c: a close-first row's idle time is quoted in whole days 49const ST_CF_FIX_ROWS: i64 = 4 // T23: the planted worklist holds three rows; one spare 50const ST_CF_FIX_NAME_B: i64 = 16 // T23: more than the longest planted domain plus rung name (fxdom and S1) 51const ST_STAMP_SUFFIX: *u8 = ".gauge.stamp" // EC56: a run over non-default evidence stamps BESIDE its own meter log, never the production heartbeat 52const ST_GAUGE_AXES: i64 = 2 // CE9: the meter log and the ws journal; a window that read only one is BLIND, never zero 53const ST_MAGIC_172800: i64 = 172800 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 54const ST_MAGIC_7200000: i64 = 7200000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 55// BOUNDED EXEC (seq1442). nx_seat forks helper organs (nx_debt, nx_frontier_board, ...) to build the 56// boot digest. tr_run_capture has no deadline, so ONE wedged helper hangs `nx_seat boot` -- the FIRST 57// call of every session -- with no way through. A digest missing one field is recoverable; a session 58// that cannot start is not. 30s: these are local store reads that normally return in well under a 59// second, so this can only ever catch a genuine hang. 60const ST_FORK_TIMEOUT_MS: i64 = 30000 61const ST_MAGIC_4096: i64 = 4096 62const ST_MAGIC_86400: i64 = 86400 63const ST_MAGIC_4092: i64 = 4092 64const ST_MAGIC_8192: i64 = 8192 65const ST_MAGIC_8188: i64 = 8188 66const ST_MAGIC_3600: i64 = 3600 67const ST_MAGIC_1024: i64 = 1024 68const ST_MAGIC_9000: i64 = 9000 69const ST_MAGIC_90000: i64 = 90000 70const ST_MAGIC_100000: i64 = 100000 // selftest: a row this far back falls in the PREVIOUS 1-day shift window 71const ST_FIX_CUR_CREAD: i64 = 2000 // selftest ratchet fixture: the current window's cache-read tokens (not a ratchet input) 72const ST_FIX_PREV_OUT_HIGH: i64 = 4000 // selftest ratchet fixture: previous-window out tokens high enough that the current window reads GREEN 73const ST_MAGIC_65536: i64 = 65536 74// 8MiB: the ws journal is 1.37MB and GROWING. Sized to match the sibling's K_JRNL_BUF in 75// nx_ws_kickoff_sync so the reaper and the surface that reports on it cannot disagree about coverage. 76const ST_JRNL_BUF: i64 = 8388608 77 78const ST_CAP: i64 = 1048576 79// The drift census is append-only; st_read seeks to size-cap, so a small cap reads the TAIL -- 80// which is the only part that matters here. 4096 comfortably holds the last row of a ~180-byte line. 81const ST_DRIFTLOG: *u8 = "knowledge/status/artifactdrift.log" 82const ST_DRIFTCAP: i64 = 4096 83const ST_OUTCAP: i64 = 4096 84const ST_OUTBUF: i64 = 8192 85const ST_SEEK_SET: i64 = 0 86const ST_SEEK_END: i64 = 2 87const ST_TAB: i64 = 9 88const ST_NL: i64 = 10 89const ST_STDERR: i64 = 2 90const ST_SPAN: i64 = 16 91const ST_EXIT_USAGE: i64 = 2 92const ST_ACTIVE_MAX: i64 = 8 93const ST_FRONT_MAX: i64 = 5 94const ST_ROW_ESC: i64 = 240 95const ST_NOTE_ESC: i64 = 160 96const ST_WS_ESC: i64 = 40 97const ST_TITLE_ESC: i64 = 60 98const ST_STALE_SEC: i64 = 7200 99const ST_MODE_RW: i64 = 0x1a4 100const ST_ST_FRAMES: i64 = 300 101 102// ---- CLAIM-AWARE TOP-DEBT SELECTION (2026-08-22). Derivation beside each; nothing tunable-by-guess. 103const ST_CLAIMS_JRNL: *u8 = "knowledge/status/claims.jrnl" // the canonical plane checkin/checkout/reap ALREADY write; named once here so the four sites cannot drift 104const ST_CLAIMRES_PFX: *u8 = "debt-" // claim resource = this + the row's OWN id column, so selector and claimer derive the same name with no shared literal to drift 105const ST_CLAIMRES_B: i64 = 64 // len("debt-")=5 + widest i64 decimal=20 + NUL=1 = 26; 64 is the next power of two above that (also covers the frontier prefix below) 106const ST_CLAIMRES_FPFX: *u8 = "frontier-" // ready's rows are frontier F-ids, so they claim under their OWN namespace and can never collide with a debt-<id> 107 108// ---- DM2 crash-resume map (st_resume_map) constants. Derivation beside each; nothing tunable-by-guess. 109const ST_RM_DIRBUF: i64 = 1048576 // getdents64 batch buffer -- LOOPED to completion, so this is throughput not coverage (census-organ figure) 110const ST_RM_PATHCAP: i64 = 4096 // PATH_MAX, the kernel's own bound 111const ST_RM_NAMECAP: i64 = 256 // NAME_MAX+1, the kernel's own bound 112const ST_RM_STATBUF: i64 = 256 // struct stat is 144B on x86_64; ccz_mtime precedent allocates 256 113const ST_RM_STAT_MTIME_IDX: i64 = 11 // st_mtim.tv_sec at byte 88 = i64[11] (x86_64 ABI, ccz_mtime precedent) 114const ST_RM_STAT_SIZE_IDX: i64 = 6 // st_size at byte 48 = i64[6] (x86_64 ABI) 115const ST_RM_DENT_TYPE_OFF: i64 = 18 // linux_dirent64 d_type (kernel ABI) 116const ST_RM_DT_DIR: i64 = 4 // DT_DIR (kernel ABI) 117const ST_RM_TYPEMAX: i64 = 64 // per-file distinct entry-type census slots; overflow ANNOUNCES types_floor=1 (counts become a FLOOR, never silent) 118const ST_RM_TYPENAME: i64 = 32 // stored type-name cap; longest observed harness type is 21B (file-history-snapshot) 119const ST_RM_SLOT: i64 = 512 // one condensed-evidence string slot: ST_ROW_ESC=240 max + NUL + margin 120const ST_RM_TSCAP: i64 = 40 // ISO-8601 timestamp verbatim copy; observed wire form is 24B 121const ST_RM_DANGROW: i64 = 192 // one formatted in-flight row: "id="+ST_RM_IDCAP+" tool="+ST_RM_TOOLCAP+NUL < 192 122const ST_RM_IDCAP: i64 = 48 // tool_use id copy cap; observed toolu_ ids are 30B 123const ST_RM_TOOLCAP: i64 = 64 // tool-name copy cap; longest registered tool name observed ~40B 124const ST_RM_LINE: i64 = 65536 // report line build buffer; content bounded by the cond caps above 125const ST_RM_HASHMUL: i64 = 131 // polynomial rolling-hash base for tool-id pairing (prime > byte alphabet) 126const ST_RM_I64B: i64 = 8 // sizeof(i64) 127const ST_RM_QUOTE: i64 = 34 128const ST_RM_BSLASH: i64 = 92 129const ST_RM_LBRACE: i64 = 123 130const ST_RM_RBRACE: i64 = 125 131const ST_RM_LBRACK: i64 = 91 132const ST_RM_RBRACK: i64 = 93 133const ST_RM_COLON: i64 = 58 134const ST_RM_SPACE: i64 = 32 135const ST_RM_DOT: i64 = 46 136const ST_RM_SLASH: i64 = 47 137// st_rm_scan result slots -- ONE array so caller and callee cannot disagree on order 138const ST_RM_R_OK: i64 = 0 139const ST_RM_R_BYTES: i64 = 1 140const ST_RM_R_LINES: i64 = 2 141const ST_RM_R_MALFORMED: i64 = 3 142const ST_RM_R_TAILMAL: i64 = 4 143const ST_RM_R_TAILUNTERM: i64 = 5 144const ST_RM_R_USES: i64 = 6 145const ST_RM_R_RESULTS: i64 = 7 146const ST_RM_R_DANGLING: i64 = 8 147const ST_RM_R_LASTKIND: i64 = 9 148const ST_RM_R_TYPES: i64 = 10 149const ST_RM_R_TYPEFLOOR: i64 = 11 150const ST_RM_R_NULFINAL: i64 = 12 151const ST_RM_R_SIDECHAIN: i64 = 13 152const ST_RM_R_ORPHANRES: i64 = 14 153const ST_RM_R_HASTEXT: i64 = 15 154const ST_RM_R_DANGBUF: i64 = 16 155const ST_RM_R_TAILMALLEN: i64 = 17 156const ST_RM_R_SLOTS: i64 = 24 157// condensed-evidence string slots inside the strs buffer (slot k at strs + k*ST_RM_SLOT) 158const ST_RM_S_TITLE: i64 = 0 159const ST_RM_S_PROMPT: i64 = 1 160const ST_RM_S_TEXT: i64 = 2 161const ST_RM_S_TOOL: i64 = 3 162const ST_RM_S_INPUT: i64 = 4 163const ST_RM_S_TS: i64 = 5 164const ST_RM_S_LPROMPT: i64 = 6 165const ST_RM_S_N: i64 = 7 166// last-entry kind classes (unrecognised types stay K_UNKNOWN -- their OWN bucket, never folded) 167const ST_RM_K_UNKNOWN: i64 = 0 168const ST_RM_K_ASSIST: i64 = 1 169const ST_RM_K_AWAIT: i64 = 2 170const ST_RM_K_META: i64 = 3 171const ST_RM_K_QUEUE: i64 = 4 172// DM1 frames-journal leg (contract published 2026-08-20): NAS knowledge/status/chbeat/chbeat_<YYYYMMDD>.jrnl 173// (laptop twin nishi-ops/chbeat/journal/), frames in the EXISTING actlog shape 174// <ts>\t<ws>\t<tool>\t<verb>\t<outcome>\t<note> -- col1 IS the session id, which is what makes a per-seat 175// join possible from the ESTATE rather than only from laptop-local transcripts. Undated frames live in 176// chbeat_tszero.jrnl and are counted in their OWN bucket, never folded into the ts coverage. 177const ST_RM_J_SKIP: i64 = 0 // no journal declared / unreadable / empty -> abstain, never acquit 178const ST_RM_J_PARTIAL: i64 = 1 // frames exist but do NOT span the requested window (backfill mid-drain) 179const ST_RM_J_COVERS: i64 = 2 // derived coverage spans the whole requested window 180const ST_RM_JCOL_TS: i64 = 0 181const ST_RM_JCOL_WS: i64 = 1 182const ST_RM_JCOL_TOOL: i64 = 2 183// journal global result slots (one array so producer and consumer cannot disagree on order) 184const ST_RM_JG_FRAMES: i64 = 0 185const ST_RM_JG_MINTS: i64 = 1 186const ST_RM_JG_MAXTS: i64 = 2 187const ST_RM_JG_INWIN: i64 = 3 188const ST_RM_JG_TSZERO: i64 = 4 189const ST_RM_JG_FILES: i64 = 5 190const ST_RM_JG_BYTES: i64 = 6 191const ST_RM_JG_MALFORMED: i64 = 7 192const ST_RM_JG_SLOTS: i64 = 12 193// per-seat journal agreement states -- DIFFER is EVIDENCE, never a verdict on either source 194const ST_RM_JSEATMAX: i64 = 256 // distinct in-window session ids collectable in estate-only mode; overflow ANNOUNCES seats_floor=1 195const ST_RM_SIDLEN: i64 = 36 // canonical session-uuid length (8-4-4-4-12 + 4 dashes), the id's own format 196const ST_RM_A_UNCOVERED: i64 = 0 197const ST_RM_A_AGREE: i64 = 1 198const ST_RM_A_DIFFER: i64 = 2 199// seat state buckets 200const ST_RM_ST_CRASHED: i64 = 0 201const ST_RM_ST_COMPLETED: i64 = 1 202const ST_RM_ST_IDLE: i64 = 2 203const ST_RM_ST_UNKNOWN: i64 = 3 204 205// helpers below DELEGATE to the shared nx_sovjson_lib (sj_*) -- one canonical copy, dup logic eaten (TS04) 206func st_puts(s: *u8) -> i64 { return sj_puts(s) } 207func st_werr(s: *u8) -> i64 { return sj_werr(s) } 208func st_vlen(s: *u8) -> i64 { return sj_vlen(s) } 209func st_cat(d: *u8, o: i64, s: *u8) -> i64 { return sj_cat(d, o, s) } 210func st_catn(d: *u8, o: i64, v: i64) -> i64 { return sj_catn(d, o, v) } 211func st_cat_esc(d: *u8, o: i64, q: *u8, s: i64, e: i64, maxn: i64) -> i64 { return sj_cat_esc(d, o, q, s, e, maxn) } 212func st_atoi_z(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v } 213func st_atoi_span(q: *u8, s: i64, e: i64) -> i64 { return sj_atoi_span(q, s, e) } 214func st_le(q: *u8, i: i64, n: i64) -> i64 { return sj_le(q, i, n) } 215func st_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 { return sj_col(q, ls, le, c, out) } 216 217// Find the `_cap=<token>` inside a shift_verbs HINT column; fills cs[0]=off cs[1]=len. 0 = no cap declared. 218// WHY THIS EARNS ITS BYTES (seq1235, id 1785338488): that row MEASURED 44pct of all tool calls as raw shell and 219// named the cause as DISCOVERY, not capability -- nx_mgmt returns capability-denied unless the ADMIN cap rides 220// as _cap, which reads like the tool is unavailable, so seats fall back to ssh and never revisit. The conf has 221// ALREADY carried `_cap=admin.cap` in its hint column all along; the digest simply never emitted that column, 222// because the emitter reads col 0 and col 1 and stops. 223// u00e2u02dcu2026A HINT THAT EXISTS IN THE FILE AND NOT IN THE DIGEST IS A HINT NOBODY HAS. 224// Confirmed live 2026-07-31 on the session that fixed it: I read this exact digest at boot, saw the verb WITHOUT 225// the cap, called nx_mgmt, got capability-denied, and hand-hunted ~/.nishi/admin.cap -- the precise failure the 226// row predicted, on the session that closed it. Emits ONLY the token, never the whole hint, so the digest's 227// 512B tail reserve still holds. 228func st_cap_of(buf: *u8, off: i64, len: i64, cs: *i64) -> i64 { 229 let pat: *u8 = "_cap=" as *u8 230 let lim: i64 = off + len 231 var i: i64 = off 232 while i + 5 <= lim { 233 var k: i64 = 0 234 var ok: i64 = 1 235 while k < 5 { if buf[i+k] != pat[k] { ok = 0; k = 5 } else { k = k + 1 } } 236 if ok == 1 { 237 var e: i64 = i + 5 238 var go: i64 = 1 239 while go == 1 { 240 if e >= lim { go = 0 } else { 241 let c2: i64 = buf[e] as i64 242 if c2 == 59 { go = 0 } else { if c2 == 32 { go = 0 } else { e = e + 1 } } 243 } 244 } 245 cs[0] = i + 5 246 cs[1] = e - (i + 5) 247 return 1 248 } 249 i = i + 1 250 } 251 return 0 252} 253func st_lit_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { return sj_lit_eq(q, s, e, lit) } 254func st_span_eq(q: *u8, s1: i64, e1: i64, s2: i64, e2: i64) -> i64 { 255 if e1 - s1 != e2 - s2 { return 0 } 256 var i: i64 = 0 257 while s1 + i < e1 { if q[s1+i] != q[s2+i] { return 0 } i = i + 1 } 258 return 1 259} 260func st_contains(q: *u8, n: i64, lit: *u8) -> i64 { return sj_span_has(q, 0, n, lit) } 261// SCALE-LAW tail-window read: newest bytes win; partial first line dropped; true size declared. 262func st_read(path: *u8, buf: *u8, cap: i64, sizep: *i64) -> i64 { 263 sizep[0] = 0 264 let fd: i64 = sys_openat_rd(path) 265 if fd < 0 { return 0 } 266 var size: i64 = sys_lseek(fd, 0, ST_SEEK_END) 267 if size < 0 { size = 0 } 268 sizep[0] = size 269 var off: i64 = 0 270 if size > cap { off = size - cap } 271 sys_lseek(fd, off, ST_SEEK_SET) 272 var n: i64 = 0 273 var go: i64 = 1 274 while go == 1 { let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } } 275 sys_close(fd) 276 if off > 0 { 277 var fnl: i64 = 0 278 var s: i64 = 1 279 while s == 1 { if fnl >= n { s = 0 } else { if buf[fnl] == (ST_NL as u8) { s = 0 } else { fnl = fnl + 1 } } } 280 if fnl < n { 281 var t: i64 = 0 282 let sk: i64 = fnl + 1 283 while sk + t < n { buf[t] = buf[sk + t]; t = t + 1 } 284 n = t 285 } 286 } 287 return n 288} 289// one O_APPEND metering row: ts\tseat\tsessions\tout\tcread\tccreate\tnote\n (tabs/nl in note -> space) 290func st_meter_append(logpath: *u8, seat: *u8, sess: i64, outk: i64, cread: i64, ccre: i64, note: *u8) -> i64 { 291 return st_meter_append_at(logpath, sys_now_realtime_sec(), seat, sess, outk, cread, ccre, note) 292} 293// the same row at a caller-supplied ts (the shift ratchet's fixtures need rows in an EARLIER window) 294func st_meter_append_at(logpath: *u8, ts: i64, seat: *u8, sess: i64, outk: i64, cread: i64, ccre: i64, note: *u8) -> i64 { 295 let ln: *u8 = sys_mmap(ST_MAGIC_4096) 296 var o: i64 = 0 297 o = st_catn(ln, o, ts) 298 ln[o] = ST_TAB as u8 299 o = o + 1 300 var i: i64 = 0 301 while seat[i] != (0 as u8) { var c: i64 = seat[i] as i64; if c < 32 { c = 32 } ln[o] = c as u8; o = o + 1; i = i + 1 } 302 ln[o] = ST_TAB as u8 303 o = o + 1 304 o = st_catn(ln, o, sess) 305 ln[o] = ST_TAB as u8 306 o = o + 1 307 o = st_catn(ln, o, outk) 308 ln[o] = ST_TAB as u8 309 o = o + 1 310 o = st_catn(ln, o, cread) 311 ln[o] = ST_TAB as u8 312 o = o + 1 313 o = st_catn(ln, o, ccre) 314 ln[o] = ST_TAB as u8 315 o = o + 1 316 var j: i64 = 0 317 while note[j] != (0 as u8) { var c2: i64 = note[j] as i64; if c2 < 32 { c2 = 32 } ln[o] = c2 as u8; o = o + 1; j = j + 1 } 318 ln[o] = ST_NL as u8 319 o = o + 1 320 let fd: i64 = sys_openat_append(logpath, ST_MODE_RW) 321 if fd < 0 { return 0 - 1 } 322 sys_write(fd, ln, o) 323 sys_close(fd) 324 return 0 325} 326// journal helpers (same frame grammar as ws_sync: ts\tVERB\tws\tactor\tnote) 327func st_has(q: *u8, n: i64, verb: *u8, ws: *u8) -> i64 { 328 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 329 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 330 var i: i64 = 0 331 while i < n { 332 let le: i64 = st_le(q, i, n) 333 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], verb) == 1 { 334 if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 { return 1 } } 335 } } 336 i = le + 1 337 } 338 return 0 339} 340func st_first_kick(q: *u8, upto: i64, ws_s: i64, ws_e: i64) -> i64 { 341 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 342 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 343 var i: i64 = 0 344 while i < upto { 345 let le: i64 = st_le(q, i, upto) 346 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 { 347 if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 0 } } 348 } } 349 i = le + 1 350 } 351 return 1 352} 353func st_last_ts_lit(q: *u8, n: i64, ws: *u8) -> i64 { 354 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 355 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 356 var last: i64 = 0 - 1 357 var i: i64 = 0 358 while i < n { 359 let le: i64 = st_le(q, i, n) 360 if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 { 361 if st_col(q, i, le, 0, c0) == 1 { last = st_atoi_span(q, c0[0], c0[1]) } 362 } } 363 i = le + 1 364 } 365 return last 366} 367func st_last_ts_span(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 { 368 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 369 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 370 var last: i64 = 0 - 1 371 var i: i64 = 0 372 while i < n { 373 let le: i64 = st_le(q, i, n) 374 if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { 375 if st_col(q, i, le, 0, c0) == 1 { last = st_atoi_span(q, c0[0], c0[1]) } 376 } } 377 i = le + 1 378 } 379 return last 380} 381// ctx-tax flush loop (ws=ctx-tax-function): the LAST CHECKPOINT frame for a ws -- ts returned, 382// note span into fs[0..1] -- so boot can surface in-flight state after a harness compact/clear 383func st_last_brief(q: *u8, n: i64, ws: *u8, fs: *i64) -> i64 { 384 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 385 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 386 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 387 let c4: *i64 = sys_mmap(ST_SPAN) as *i64 388 var last: i64 = 0 - 1 389 fs[0] = 0 - 1 390 fs[1] = 0 - 1 391 var i: i64 = 0 392 while i < n { 393 let le: i64 = st_le(q, i, n) 394 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "CHECKPOINT" as *u8) == 1 { 395 if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 { 396 if st_col(q, i, le, 0, c0) == 1 { if st_col(q, i, le, 4, c4) == 1 { 397 last = st_atoi_span(q, c0[0], c0[1]) 398 fs[0] = c4[0] 399 fs[1] = c4[1] 400 } } 401 } } 402 } } 403 i = le + 1 404 } 405 return last 406} 407// top-severity OPEN debt (schema-aware: legacy 5-col sev@1 / v2 7-col sev@2, status@3 both). 408// fills row span fs[0..1] + sev fs[2]; returns open count. 409// CLAIM-AWARE TOP-DEBT SELECTION (2026-08-22). Its predecessor was a pure max over the open set -- 410// and a pure max is DETERMINISTIC, so every seat that booted was handed the SAME row. That is not a 411// race condition; it is a selector that points the entire fleet at one item BY DESIGN. 412// MEASURED THE DAY THIS SHIPPED: two seats independently selected sev-9 row 1785519657 within 22 413// seconds of each other and both began work on it. The second seat found the collision only because 414// the first happened to write a memory file mid-turn -- by luck, not by any instrument. 415// The claims plane already existed (nx_claims: append-only, TTL, crash-expiry, derived holdership) 416// and THIS ORGAN ALREADY FORKED IT for `reap`, so this was an ADOPTION GAP, not a missing primitive. 417// ONE CLASSIFIER: cl_state is IMPORTED and never reimplemented here, so the selector and the claims 418// tool CANNOT disagree about who holds what. A second holder-predicate would be the duplicate-ruler 419// defect this estate has paid for repeatedly. 420// A ROW HELD BY THIS ACTOR IS STILL OFFERED -- that is CRASH-RESUME, not a collision: a seat that 421// died mid-row gets its own work handed straight back on the next boot. 422// MEASURED AT SHIP TIME: 231 claim resources existed and NONE was a debt row -- claims were held at 423// LANE granularity while this selector hands out ROWS. So against today's plane it returns exactly 424// what the predecessor returned, and diverges only once seats claim rows. Additive by construction. 425// cb[] carries the COVERAGE, because a count published without its coverage is an assertion, not a 426// measurement -- the bar this file already holds itself to for open_debts. 427// cb[0] rows skipped (held by ANOTHER actor) cb[1],cb[2] first blocking holder span 428// cb[3] claims buffer (cb[1],cb[2] index it) cb[4] 1 if the CHOSEN row is held by THIS actor 429// cb[5] open rows whose id column is not a plain integer, so no claim resource can be derived -- 430// ITS OWN BUCKET, never folded into "unclaimed": the bucket an unrecognised case lands in 431// becomes the number somebody plans against. 432func st_topdebt_unclaimed(dp: *u8, bufp: *i64, fs: *i64, cjrn: *u8, actor: *u8, now: i64, cb: *i64) -> i64 { 433 // COMPLETE LOAD, NOT A CAPPED ONE (2026-08-22 -- and this is the CORRECTED comment). CARRIED 434 // VERBATIM from the predecessor this function replaced: it is the reason sts_load_fit is called 435 // here, so deleting it with the old body would have destroyed the reasoning and invited the 436 // exact regression it records. 437 // MEASURED: this digest published "open_debts":855 while the plane holds 2,688 open of 4,138 rows, 438 // verified two independent ways (nx_debt's own DEBTS line, and a raw plane load counted by awk). 439 // The live binary printed "STS-LOAD TRUNCATED ... bytes DROPPED" DIRECTLY ABOVE the number and 440 // nothing acted on it: every seat opened on a backlog understated by roughly 3x. 441 // MY FIRST FIX WAS WRONG AND IS RECORDED HERE RATHER THAN QUIETLY REPLACED. I reached for 442 // sts_load_honest, which reports Q:N coverage -- and q:n was already CORRECT (declared 4138, 443 // loaded 4138, beyond 0). It is silent about the OTHER truncation, the one actually happening: 444 // the 1 MiB ST_CAP buffer filling. That change SILENCED the honest TRUNCATED warning while still 445 // publishing 855 -- strictly WORSE than the defect it replaced. 446 // AN INSTRUMENT THAT REPORTS ONE KIND OF INCOMPLETENESS AND IS SILENT ABOUT ANOTHER WILL BE READ 447 // AS REPORTING BOTH; A FIX THAT REMOVES THE WARNING WITHOUT REMOVING THE LOSS IS A REGRESSION. 448 // sts_load_fit ends it: it sizes the buffer from the plane (8 MiB doubling to 1 GiB) and REFUSES 449 // with a named diagnostic rather than EVER returning a partial board -- the estate's own law that 450 // a cap is not a number to tune but a thing to remove. 451 // fs[3]: 0 = whole board loaded; -1 = the loader REFUSED. Never a silent partial. 452 let lp: *i64 = sys_mmap(ST_SPAN) as *i64 453 let dbuf: *u8 = sts_load_fit(dp, lp) 454 bufp[0] = dbuf as i64 455 if (dbuf as i64) == 0 { fs[0] = 0 - 1; fs[1] = 0 - 1; fs[2] = 0 - 1; fs[3] = 0 - 1; return 0 - 1 } 456 let n: i64 = lp[0] 457 fs[3] = 0 458 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 459 let c3: *i64 = sys_mmap(ST_SPAN) as *i64 460 let cs: *i64 = sys_mmap(ST_SPAN) as *i64 461 fs[0] = 0 - 1 462 fs[1] = 0 - 1 463 fs[2] = 0 - 1 464 // The claims journal is read ONCE, not forked per row: a per-row fork across a 2,688-row board is 465 // the syscalls-per-unit-of-output defect, and the whole plane is one small append-only file. 466 let cq: *u8 = sys_mmap(ST_JRNL_BUF) 467 let cn: i64 = cl_read(cjrn, cq, ST_JRNL_BUF) 468 let cx: *i64 = sys_mmap(ST_SPAN) as *i64 469 cx[0] = cn 470 cx[1] = now 471 cb[0] = 0 472 cb[1] = 0 - 1 473 cb[2] = 0 - 1 474 cb[3] = cq as i64 475 cb[4] = 0 476 cb[5] = 0 477 cb[6] = 0 478 let rbuf: *u8 = sys_mmap(ST_CLAIMRES_B) 479 let rsp: *i64 = sys_mmap(ST_SPAN) as *i64 480 // cl_state writes out[0..3], so this box is FOUR i64 -- ST_SPAN alone (two) would corrupt its neighbour. 481 let hol: *i64 = sys_mmap(ST_SPAN * 2) as *i64 482 var k: i64 = 0 483 var i: i64 = 0 484 while i < n { 485 let le: i64 = st_le(dbuf, i, n) 486 if st_col(dbuf, i, le, 3, c3) == 1 { if st_lit_eq(dbuf, c3[0], c3[1], "open" as *u8) == 1 { 487 k = k + 1 488 var sevcol: i64 = 2 489 var idok: i64 = 0 490 if st_col(dbuf, i, le, 0, c0) == 1 { 491 if c0[1] - c0[0] >= 8 { 492 var alldig: i64 = 1 493 var p: i64 = c0[0] 494 while p < c0[1] { let c: i64 = dbuf[p] as i64; if c < 48 { alldig = 0; p = c0[1] } else { if c > 57 { alldig = 0; p = c0[1] } else { p = p + 1 } } } 495 if alldig == 1 { sevcol = 1; idok = 1 } 496 } 497 } 498 if idok == 0 { cb[5] = cb[5] + 1 } 499 if st_col(dbuf, i, le, sevcol, cs) == 1 { 500 let sev: i64 = st_atoi_span(dbuf, cs[0], cs[1]) 501 if sev > fs[2] { 502 var held: i64 = 0 503 var mine: i64 = 0 504 if idok == 1 { 505 // COVERAGE. Count every row we ACTUALLY holdership-test. Selection only needs the 506 // strictly-increasing running-max frontier, so this is FAR fewer than the open-row 507 // count -- and publishing it is the only thing that stops the skip counter being 508 // read as a whole-plane fact. An adversarial audit measured the gap: boot picked 509 // the first sev-9 at plane index 2045 of 4140, so the nine other open sev-9 rows 510 // and every row after it were never tested. Selection was still correct; the 511 // PUBLISHED NUMBER was not, because its name implied a population it never saw. 512 cb[6] = cb[6] + 1 513 var ro: i64 = st_cat(rbuf, 0, ST_CLAIMRES_PFX) 514 var pp: i64 = c0[0] 515 while pp < c0[1] { rbuf[ro] = dbuf[pp]; ro = ro + 1; pp = pp + 1 } 516 rbuf[ro] = 0 as u8 517 if cl_res_span_lit(cq, cx, rbuf, rsp) == 1 { 518 if cl_state(cq, cx, rsp[0], rsp[1], hol) == 1 { 519 if st_lit_eq(cq, hol[0], hol[1], actor) == 1 { mine = 1 } else { 520 held = 1 521 cb[0] = cb[0] + 1 522 if cb[1] < 0 { cb[1] = hol[0]; cb[2] = hol[1] } 523 } 524 } 525 } 526 } 527 if held == 0 { fs[2] = sev; fs[0] = i; fs[1] = le; cb[4] = mine } 528 } 529 } 530 } } 531 i = le + 1 532 } 533 return k 534} 535// status CHAR (i64) of the frontier row whose col0 == id span [ids,ide) in fbuf; 0 if not found. 536// Same-buffer span compare (ids/ide and the scanned col0 both index fbuf). 537func st_frontier_status(fbuf: *u8, fn: i64, ids: i64, ide: i64) -> i64 { 538 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 539 let c5: *i64 = sys_mmap(ST_SPAN) as *i64 540 var i: i64 = 0 541 while i < fn { 542 let le: i64 = st_le(fbuf, i, fn) 543 if st_col(fbuf, i, le, 0, c0) == 1 { 544 if st_span_eq(fbuf, c0[0], c0[1], ids, ide) == 1 { 545 if st_col(fbuf, i, le, 5, c5) == 1 { if c5[1] > c5[0] { return fbuf[c5[0]] as i64 } } 546 return 0 547 } 548 } 549 i = le + 1 550 } 551 return 0 552} 553// count of BLOCKING deps in a deps-column span [ds,de): each internal F-ref whose status != D. 554// "-"/empty => 0 (ready). External (non-F) or unresolvable refs do NOT block (can't gate here). 555// 68='D' 70='F' 45='-' 44=',' 59=';' 32=' ' 556func st_deps_block_count(fbuf: *u8, fn: i64, ds: i64, de: i64) -> i64 { 557 if de <= ds { return 0 } 558 if de - ds == 1 { if fbuf[ds] == (45 as u8) { return 0 } } 559 var block: i64 = 0 560 var p: i64 = ds 561 while p < de { 562 var sk: i64 = 1 563 while sk == 1 { if p >= de { sk = 0 } else { let c: i64 = fbuf[p] as i64; if c == 44 { p = p + 1 } else { if c == 59 { p = p + 1 } else { if c == 32 { p = p + 1 } else { sk = 0 } } } } } 564 if p < de { 565 let ts: i64 = p 566 var s2: i64 = 1 567 while s2 == 1 { if p >= de { s2 = 0 } else { let c2: i64 = fbuf[p] as i64; if c2 == 44 { s2 = 0 } else { if c2 == 59 { s2 = 0 } else { if c2 == 32 { s2 = 0 } else { p = p + 1 } } } } } 568 let te: i64 = p 569 if te > ts { if fbuf[ts] == (70 as u8) { 570 let stt: i64 = st_frontier_status(fbuf, fn, ts, te) 571 if stt != 0 { if stt != 68 { block = block + 1 } } 572 } } 573 } 574 } 575 return block 576} 577// THE READY DIGEST (F832): deps-resolved READY frontier set from the SAME seg-store the 33.7KB 578// nx_frontier_board reads -- a seat picks work in ~1KB, not the full CPM dump. READY = status T 579// with every internal F-dep at status D. Lane filter ("*"/empty = all). Envelope DECLARED 580// (store_bytes/ready_total vs shown/cap). Authority pointers preserved (debt-gate + full CPM). 581// EC57 c CLOSE-FIRST (2026-09-17): the rungs NEAREST to closed, named BEFORE any new work. The list is the fleet census's 582// (nx_rungclose census all); the wire, the order and the freshness rule are the close ruler's own (rgc_work_*), so this 583// digest cannot disagree with the census about what a row means. A missing, undated, future-dated or fossil list is NAMED 584// as such and quotes NO rows, and its total reads -1: could-not-look is never an empty worklist. 585// Emits "close_first":[...] plus its accounting, ending with a comma for the field that follows. 586func st_close_first(out: *u8, o0: i64, lane: *u8, maxn: i64, wl: *u8, now: i64) -> i64 { 587 var o: i64 = o0 588 let lenp: *i64 = sys_mmap(RGC_I64) as *i64 589 lenp[0] = 0 590 let wb: *u8 = sys_read_file(wl, lenp) 591 let wn: i64 = lenp[0] 592 var word: *u8 = "ABSENT" as *u8 593 var asof: i64 = 0 - 1 594 var shown: i64 = 0 595 var matched: i64 = 0 - 1 596 var malformed: i64 = 0 - 1 597 o = st_cat(out, o, "\"close_first\":[" as *u8) 598 if wn > 0 { 599 asof = rgc_work_asof(wb, wn) 600 let fr: i64 = rgc_work_fresh(asof, now) 601 word = "UNDATED" as *u8 602 if fr == RGC_WORK_STALE { word = "FOSSIL" as *u8 } 603 if fr == RGC_WORK_FRESH { 604 word = "FRESH" as *u8 605 let cfn: i64 = (maxn + 1) / 2 606 let picks: *i64 = sys_mmap(cfn * RGC_PICK_STRIDE * RGC_I64) as *i64 607 let acc: *i64 = sys_mmap(RGC_W_SLOTS * RGC_I64) as *i64 608 let off: *i64 = sys_mmap(RGC_I64) as *i64 609 shown = rgc_work_pick(wb, wn, lane, now, cfn, picks, acc) 610 matched = acc[RGC_W_MATCHED] 611 malformed = acc[RGC_W_MALFORMED] 612 var k: i64 = 0 613 while k < shown { 614 let p: i64 = picks[k * RGC_PICK_STRIDE] 615 let e: i64 = picks[k * RGC_PICK_STRIDE + 1] 616 if k > 0 { o = st_cat(out, o, "," as *u8) } 617 o = st_cat(out, o, "{\"dom\":\"" as *u8) 618 let dl: i64 = ces_field(wb, p, e, RGC_WORK_F_DOM, off) 619 o = st_cat_esc(out, o, wb, off[0], off[0] + dl, ST_WS_ESC) 620 o = st_cat(out, o, "\",\"rung\":\"" as *u8) 621 let rl: i64 = ces_field(wb, p, e, RGC_WORK_F_RUNG, off) 622 o = st_cat_esc(out, o, wb, off[0], off[0] + rl, ST_WS_ESC) 623 o = st_cat(out, o, "\",\"state\":\"" as *u8) 624 o = st_cat(out, o, rgc_state_name(rgc_work_line_state(wb, p, e, off))) 625 o = st_cat(out, o, "\",\"needs\":\"" as *u8) 626 let kl: i64 = ces_field(wb, p, e, RGC_WORK_F_WEAK, off) 627 o = st_cat_esc(out, o, wb, off[0], off[0] + kl, ST_WS_ESC) 628 o = st_cat(out, o, "\",\"could_not_look\":" as *u8) 629 let ul: i64 = ces_field(wb, p, e, RGC_WORK_F_UNOBS, off) 630 if ces_parse_int(wb, off[0], ul) == 1 { o = st_cat(out, o, "1" as *u8) } else { o = st_cat(out, o, "0" as *u8) } 631 o = st_cat(out, o, ",\"idle_d\":" as *u8) 632 let ll: i64 = ces_field(wb, p, e, RGC_WORK_F_LAST, off) 633 let lv: i64 = ces_parse_int(wb, off[0], ll) 634 if lv >= 0 { o = st_catn(out, o, (now - lv) / ST_CF_DAY_S) } else { o = st_catn(out, o, 0 - 1) } 635 o = st_cat(out, o, "}" as *u8) 636 k = k + 1 637 } 638 } 639 } 640 o = st_cat(out, o, "],\"close_first_list\":\"" as *u8) 641 o = st_cat(out, o, word) 642 o = st_cat(out, o, "\",\"close_first_asof\":" as *u8) 643 o = st_catn(out, o, asof) 644 o = st_cat(out, o, ",\"close_first_total\":" as *u8) 645 o = st_catn(out, o, matched) 646 o = st_cat(out, o, ",\"close_first_shown\":" as *u8) 647 o = st_catn(out, o, shown) 648 o = st_cat(out, o, ",\"close_first_malformed\":" as *u8) 649 o = st_catn(out, o, malformed) 650 o = st_cat(out, o, ",\"close_first_rule\":\"nearest-to-closed-first;then-touched-this-week;refresh=nx_rungclose-census-all;one-rung=nx_rungclose-check-DOM-RUNG;a-list-that-is-not-FRESH-quotes-no-rows\"," as *u8) 651 return o 652} 653func st_ready_wl(lane: *u8, maxn: i64, fp: *u8, cj: *u8, wl: *u8, out: *u8) -> i64 { 654 let fbuf: *u8 = sys_mmap(ST_CAP) 655 let fn: i64 = sts_load(fp, fbuf, ST_CAP) 656 let now: i64 = sys_now_realtime_sec() 657 let lanelen: i64 = st_vlen(lane) 658 var nofilter: i64 = 0 659 if lanelen == 0 { nofilter = 1 } 660 if lanelen == 1 { if lane[0] == (42 as u8) { nofilter = 1 } } 661 var o: i64 = 0 662 o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"verb\":\"ready\",\"epoch\":" as *u8) 663 o = st_catn(out, o, now) 664 o = st_cat(out, o, ",\"budget_bytes\":" as *u8) 665 o = st_catn(out, o, ST_OUTCAP) 666 o = st_cat(out, o, ",\"store_bytes\":" as *u8) 667 o = st_catn(out, o, fn) 668 o = st_cat(out, o, ",\"lane\":\"" as *u8) 669 o = st_cat_esc(out, o, lane, 0, lanelen, ST_WS_ESC) 670 o = st_cat(out, o, "\"," as *u8) 671 o = st_close_first(out, o, lane, maxn, wl, now) 672 o = st_cat(out, o, "\"ready\":[" as *u8) 673 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 674 let c1: *i64 = sys_mmap(ST_SPAN) as *i64 675 let c5: *i64 = sys_mmap(ST_SPAN) as *i64 676 let c6: *i64 = sys_mmap(ST_SPAN) as *i64 677 let c8: *i64 = sys_mmap(ST_SPAN) as *i64 678 var nready: i64 = 0 679 var nblocked: i64 = 0 680 var ntodo: i64 = 0 681 var shown: i64 = 0 682 let c2w: *i64 = sys_mmap(ST_SPAN) as *i64 683 // RANKW1 (big-rocks sharpening 2026-07-20): the digest must surface the BIGGEST rocks first, 684 // not first-inserted. Pass 1 counts; pass 2 emits in weight bands 9..0 (col 2; store order 685 // within a band; missing/non-numeric w = 0 = last). <=10 in-memory passes, no sort machinery. 686 var i: i64 = 0 687 while i < fn { 688 let le: i64 = st_le(fbuf, i, fn) 689 if st_col(fbuf, i, le, 5, c5) == 1 { if st_lit_eq(fbuf, c5[0], c5[1], "T" as *u8) == 1 { 690 var lanematch: i64 = nofilter 691 if lanematch == 0 { if st_col(fbuf, i, le, 8, c8) == 1 { if st_lit_eq(fbuf, c8[0], c8[1], lane) == 1 { lanematch = 1 } } } 692 if lanematch == 1 { 693 ntodo = ntodo + 1 694 var blk: i64 = 0 695 if st_col(fbuf, i, le, 6, c6) == 1 { blk = st_deps_block_count(fbuf, fn, c6[0], c6[1]) } 696 if blk > 0 { nblocked = nblocked + 1 } else { nready = nready + 1 } 697 } 698 } } 699 i = le + 1 700 } 701 // CLAIM ANNOTATION FOR ready (2026-08-22), the OTHER selector. Unlike top_debt this returns a LIST, 702 // so a held row is ANNOTATED, never skipped -- skipping would hide work that is merely in progress, 703 // and the list is what lets a seat pick a free row while SEEING who has the rest. The collision is 704 // then closed at claim time, where nx_claims answers CONTENDED. Same imported cl_state; one ruler. 705 // No actor is in scope here, so the field is honestly "who holds it", not "someone else holds it". 706 let cq: *u8 = sys_mmap(ST_JRNL_BUF) 707 let cn: i64 = cl_read(cj, cq, ST_JRNL_BUF) 708 let cx: *i64 = sys_mmap(ST_SPAN) as *i64 709 cx[0] = cn 710 cx[1] = now 711 let rbuf2: *u8 = sys_mmap(ST_CLAIMRES_B) 712 let rsp2: *i64 = sys_mmap(ST_SPAN) as *i64 713 let hol2: *i64 = sys_mmap(ST_SPAN * 2) as *i64 714 var nheld: i64 = 0 715 var band: i64 = 9 716 while band >= 0 { 717 var j: i64 = 0 718 while j < fn { 719 let le2: i64 = st_le(fbuf, j, fn) 720 if shown < maxn { if st_col(fbuf, j, le2, 5, c5) == 1 { if st_lit_eq(fbuf, c5[0], c5[1], "T" as *u8) == 1 { 721 var lm2: i64 = nofilter 722 if lm2 == 0 { if st_col(fbuf, j, le2, 8, c8) == 1 { if st_lit_eq(fbuf, c8[0], c8[1], lane) == 1 { lm2 = 1 } } } 723 if lm2 == 1 { 724 var wv: i64 = 0 725 if st_col(fbuf, j, le2, 2, c2w) == 1 { wv = st_atoi_span(fbuf, c2w[0], c2w[1]) } 726 if wv > 9 { wv = 9 } 727 if wv < 0 { wv = 0 } 728 if wv == band { 729 var blk2: i64 = 0 730 if st_col(fbuf, j, le2, 6, c6) == 1 { blk2 = st_deps_block_count(fbuf, fn, c6[0], c6[1]) } 731 if blk2 == 0 { 732 if st_col(fbuf, j, le2, 0, c0) == 1 { if st_col(fbuf, j, le2, 1, c1) == 1 { 733 if shown > 0 { o = st_cat(out, o, "," as *u8) } 734 o = st_cat(out, o, "{\"id\":\"" as *u8) 735 o = st_cat_esc(out, o, fbuf, c0[0], c0[1], ST_WS_ESC) 736 o = st_cat(out, o, "\",\"w\":" as *u8) 737 o = st_catn(out, o, wv) 738 o = st_cat(out, o, ",\"t\":\"" as *u8) 739 o = st_cat_esc(out, o, fbuf, c1[0], c1[1], ST_TITLE_ESC) 740 o = st_cat(out, o, "\",\"lane\":\"" as *u8) 741 if st_col(fbuf, j, le2, 8, c8) == 1 { o = st_cat_esc(out, o, fbuf, c8[0], c8[1], ST_WS_ESC) } 742 o = st_cat(out, o, "\",\"held\":\"" as *u8) 743 var ro2: i64 = st_cat(rbuf2, 0, ST_CLAIMRES_FPFX) 744 var pz: i64 = c0[0] 745 while pz < c0[1] { rbuf2[ro2] = fbuf[pz]; ro2 = ro2 + 1; pz = pz + 1 } 746 rbuf2[ro2] = 0 as u8 747 if cl_res_span_lit(cq, cx, rbuf2, rsp2) == 1 { 748 if cl_state(cq, cx, rsp2[0], rsp2[1], hol2) == 1 { 749 o = st_cat_esc(out, o, cq, hol2[0], hol2[1], ST_WS_ESC) 750 nheld = nheld + 1 751 } 752 } 753 o = st_cat(out, o, "\"}" as *u8) 754 shown = shown + 1 755 } } 756 } 757 } 758 } 759 } } } 760 j = le2 + 1 761 } 762 band = band - 1 763 } 764 o = st_cat(out, o, "],\"ready_total\":" as *u8) 765 o = st_catn(out, o, nready) 766 o = st_cat(out, o, ",\"shown\":" as *u8) 767 o = st_catn(out, o, shown) 768 // COVERAGE, not decoration: shown_held>0 says the fleet is BUSY on these rows, which is a different 769 // situation from a short ready list and demands a different action. 770 o = st_cat(out, o, ",\"shown_held\":" as *u8) 771 o = st_catn(out, o, nheld) 772 o = st_cat(out, o, ",\"blocked_total\":" as *u8) 773 o = st_catn(out, o, nblocked) 774 o = st_cat(out, o, ",\"todo_total\":" as *u8) 775 o = st_catn(out, o, ntodo) 776 o = st_cat(out, o, ",\"env\":\"frontier-store-digest;ready=T-with-all-F-deps-D;order=w-desc;cap-" as *u8) 777 o = st_catn(out, o, maxn) 778 o = st_cat(out, o, "\",\"authority\":\"debt-gate=nx_ws_cycle-next;full-CPM=nx_frontier_board\"}" as *u8) 779 out[o] = ST_NL as u8 780 o = o + 1 781 return o 782} 783// st_ready keeps its 4-arg shape for every existing caller and DELEGATES. The point is that the claims 784// journal becomes INJECTABLE: a gate must be able to aim this at a FIXTURE instead of the production 785// claims plane, and a checker that can only be pointed at production is a checker nobody can run twice. 786// st_ready_cj keeps its 5-arg shape and delegates the same way: the WORKLIST is injectable too (st_ready_wl), so a tooth 787// aims the close-first read at a planted list and never at the production census. 788func st_ready_cj(lane: *u8, maxn: i64, fp: *u8, cj: *u8, out: *u8) -> i64 { 789 return st_ready_wl(lane, maxn, fp, cj, ST_WORKLIST, out) 790} 791func st_ready(lane: *u8, maxn: i64, fp: *u8, out: *u8) -> i64 { 792 return st_ready_cj(lane, maxn, fp, ST_CLAIMS_JRNL, out) 793} 794func st_has_span_done(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 { 795 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 796 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 797 var i: i64 = 0 798 while i < n { 799 let le: i64 = st_le(q, i, n) 800 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "DONE" as *u8) == 1 { 801 if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 1 } } 802 } } 803 i = le + 1 804 } 805 return 0 806} 807// THE ENGINE-SHIFT SCOREBOARD (F831 half 2): seat-class aggregates from the SAME evidence log 808// meter writes + DONE closures from the SAME journal boot reads. The plan's gauge: engine-shift 809// = claude out-per-done FALLING while local zero-API closure rows RISE. class = seat prefix 810// "claude" vs everything-else=local; both reads tail-windowed + declared (scale-law). 811func st_starts(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { 812 var i: i64 = 0 813 while lit[i] != (0 as u8) { 814 if s + i >= e { return 0 } 815 if q[s+i] != lit[i] { return 0 } 816 i = i + 1 817 } 818 return 1 819} 820// EC57 (2026-09-17): a DONE frame STANDS unless a LATER frame for the same ws says REOPENED -- a closure is withdrawn by an 821// additive counter-frame, never by deleting history, so the closure count must read the newest word, not the first. 822// r1 and r2 are the caller's scratch cells (one allocation per window, not one per frame). 823func st_done_stands(q: *u8, n: i64, from: i64, ws_s: i64, ws_e: i64, r1: *i64, r2: *i64) -> i64 { 824 var i: i64 = from 825 while i < n { 826 let le: i64 = st_le(q, i, n) 827 if st_col(q, i, le, 1, r1) == 1 { if st_lit_eq(q, r1[0], r1[1], "REOPENED" as *u8) == 1 { 828 if st_col(q, i, le, 2, r2) == 1 { if st_span_eq(q, r2[0], r2[1], ws_s, ws_e) == 1 { return 0 } } 829 } } 830 i = le + 1 831 } 832 return 1 833} 834// ONE window [lo, hi) over the meter log and the ws journal. acc: 0 crows 1 csess 2 coutv 3 ccread 4 cccre 835// 5 lrows 6 lsess 7 lout 8 done. The ratchet (ES18) calls this twice -- current window and the one before it -- 836// so there is exactly ONE reader of both files and the two windows cannot disagree on a row's class. 837func st_shift_acc(mb: *u8, mn: i64, q: *u8, n: i64, lo: i64, hi: i64, acc: *i64) -> i64 { 838 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 839 let c1: *i64 = sys_mmap(ST_SPAN) as *i64 840 let c2: *i64 = sys_mmap(ST_SPAN) as *i64 841 let c3: *i64 = sys_mmap(ST_SPAN) as *i64 842 let c4: *i64 = sys_mmap(ST_SPAN) as *i64 843 let c5: *i64 = sys_mmap(ST_SPAN) as *i64 844 var k: i64 = 0 845 while k < 9 { acc[k] = 0; k = k + 1 } 846 var i: i64 = 0 847 while i < mn { 848 let le: i64 = st_le(mb, i, mn) 849 if st_col(mb, i, le, 0, c0) == 1 { 850 let ts: i64 = st_atoi_span(mb, c0[0], c0[1]) 851 if ts >= lo { if ts < hi { if st_col(mb, i, le, 1, c1) == 1 { 852 var sess: i64 = 0 853 var outv: i64 = 0 854 var crd: i64 = 0 855 var ccr: i64 = 0 856 if st_col(mb, i, le, 2, c2) == 1 { sess = st_atoi_span(mb, c2[0], c2[1]) } 857 if st_col(mb, i, le, 3, c3) == 1 { outv = st_atoi_span(mb, c3[0], c3[1]) } 858 if st_col(mb, i, le, 4, c4) == 1 { crd = st_atoi_span(mb, c4[0], c4[1]) } 859 if st_col(mb, i, le, 5, c5) == 1 { ccr = st_atoi_span(mb, c5[0], c5[1]) } 860 if st_starts(mb, c1[0], c1[1], "claude" as *u8) == 1 { 861 acc[0] = acc[0] + 1 862 acc[1] = acc[1] + sess 863 acc[2] = acc[2] + outv 864 acc[3] = acc[3] + crd 865 acc[4] = acc[4] + ccr 866 } else { 867 acc[5] = acc[5] + 1 868 acc[6] = acc[6] + sess 869 acc[7] = acc[7] + outv 870 } 871 } } } 872 } 873 i = le + 1 874 } 875 let d0: *i64 = sys_mmap(ST_SPAN) as *i64 876 let d1: *i64 = sys_mmap(ST_SPAN) as *i64 877 let d2: *i64 = sys_mmap(ST_SPAN) as *i64 878 let d3: *i64 = sys_mmap(ST_SPAN) as *i64 879 let d4: *i64 = sys_mmap(ST_SPAN) as *i64 880 var j: i64 = 0 881 while j < n { 882 let jle: i64 = st_le(q, j, n) 883 if st_col(q, j, jle, 1, d1) == 1 { if st_lit_eq(q, d1[0], d1[1], "DONE" as *u8) == 1 { 884 if st_col(q, j, jle, 0, d0) == 1 { let dts: i64 = st_atoi_span(q, d0[0], d0[1]); if dts >= lo { if dts < hi { 885 // EC57: count the closure only while it STANDS (no later REOPENED frame for the same ws) 886 if st_col(q, j, jle, 2, d2) == 1 { if st_done_stands(q, n, jle + 1, d2[0], d2[1], d3, d4) == 1 { acc[8] = acc[8] + 1 } } 887 } } } 888 } } 889 j = jle + 1 890 } 891 return 0 892} 893// the integer after `key` in a stamp file (`green_or_skip=560`); -1 when the key is absent 894func st_stamp_int(b: *u8, n: i64, key: *u8) -> i64 { 895 let kl: i64 = st_vlen(key) 896 var i: i64 = 0 897 while i + kl <= n { 898 // flag-terminated compares and scans: the cursor is never used as its own exit sentinel 899 var j: i64 = 0 900 var same: i64 = 1 901 var cmp: i64 = 1 902 while cmp == 1 { if j >= kl { cmp = 0 } else { if b[i + j] != key[j] { same = 0; cmp = 0 } else { j = j + 1 } } } 903 if same == 1 { 904 var f: i64 = i + kl 905 var scan: i64 = 1 906 while scan == 1 { if f >= n { scan = 0 } else { let c2: i64 = b[f] as i64; if c2 >= 48 { if c2 <= 57 { f = f + 1 } else { scan = 0 } } else { scan = 0 } } } 907 if f == i + kl { return 0 - 1 } 908 return st_atoi_span(b, i + kl, f) 909 } 910 i = i + 1 911 } 912 return 0 - 1 913} 914// ES18 st_ratchet: THE verdict on tokens per closed rung, a pure function of the two windows so a tooth can drive 915// it directly. RED when the current window's out-per-closed-rung ROSE against the previous window's; GREEN when it 916// did not; UNMEASURED when either window closed nothing (a window with zero closed rungs is never a win or a loss). 917// why[0] receives the reason string. The quality-floor conjunct (a grade drop turning a token fall RED) needs a second 918// roster stamp and is declared UNMEASURED by the caller until one exists -- never dropped. 919func st_ratchet(tpd: i64, ptpd: i64, why: *i64) -> *u8 { 920 why[0] = ("a window with zero closed rungs cannot be a win or a loss" as *u8) as i64 921 if tpd < 0 { return "UNMEASURED" as *u8 } 922 if ptpd < 0 { return "UNMEASURED" as *u8 } 923 if tpd > ptpd { why[0] = ("claude out per closed rung ROSE against the previous window" as *u8) as i64; return "RED" as *u8 } 924 why[0] = ("claude out per closed rung did not rise against the previous window" as *u8) as i64 925 return "GREEN" as *u8 926} 927// EC56 (2026-09-17): the landed-rung verdict, the same three states as st_ratchet with its own reasons -- a LANDED rung 928// (a land row on a board) is not a CLOSED one (EC57), so the two ratchets never share a sentence. 929func st_ratchet_landed(tpl: i64, ptpl: i64, why: *i64) -> *u8 { 930 why[0] = ("a window with zero landed rungs cannot be a win or a loss" as *u8) as i64 931 if tpl < 0 { return "UNMEASURED" as *u8 } 932 if ptpl < 0 { return "UNMEASURED" as *u8 } 933 if tpl > ptpl { why[0] = ("claude out per landed rung ROSE against the previous window" as *u8) as i64; return "RED" as *u8 } 934 why[0] = ("claude out per landed rung did not rise against the previous window" as *u8) as i64 935 return "GREEN" as *u8 936} 937// the stamp path BESIDE a meter log: <log>.gauge.stamp -- a non-default run stamps a path derived from its own arguments 938func st_stamp_beside(ml: *u8) -> *u8 { 939 let p: *u8 = sys_mmap(ST_MAGIC_1024) 940 var o: i64 = st_cat(p, 0, ml) 941 o = st_cat(p, o, ST_STAMP_SUFFIX) 942 p[o] = 0 as u8 943 return p 944} 945func st_shift(days: i64, ml: *u8, jr: *u8, lg: *u8, stamp: *u8, out: *u8) -> i64 { 946 let now: i64 = sys_now_realtime_sec() 947 let win: i64 = days * ST_MAGIC_86400 948 var cutoff: i64 = now - win 949 if days <= 0 { cutoff = 0 } 950 let mb: *u8 = sys_mmap(ST_CAP) 951 let msz: *i64 = sys_mmap(ST_SPAN) as *i64 952 let mn: i64 = st_read(ml, mb, ST_CAP - 4, msz) 953 let q: *u8 = sys_mmap(ST_CAP) 954 let jsz: *i64 = sys_mmap(ST_SPAN) as *i64 955 let n: i64 = st_read(jr, q, ST_CAP - 4, jsz) 956 let acc: *i64 = sys_mmap(128) as *i64 957 let pacc: *i64 = sys_mmap(128) as *i64 958 st_shift_acc(mb, mn, q, n, cutoff, now + 1, acc) 959 // ES18: the window BEFORE this one, same width, so tokens per closed rung can be a delta and not a level 960 var pmeasured: i64 = 0 961 if days > 0 { st_shift_acc(mb, mn, q, n, cutoff - win, cutoff, pacc); pmeasured = 1 } 962 let crows: i64 = acc[0] 963 let csess: i64 = acc[1] 964 let coutv: i64 = acc[2] 965 let ccread: i64 = acc[3] 966 let cccre: i64 = acc[4] 967 let lrows: i64 = acc[5] 968 let lsess: i64 = acc[6] 969 let lout: i64 = acc[7] 970 let done: i64 = acc[8] 971 var tpd: i64 = 0 - 1 972 var cpd: i64 = 0 - 1 973 if done > 0 { tpd = coutv / done } 974 if done > 0 { cpd = ccread / done } 975 var ptpd: i64 = 0 - 1 976 if pmeasured == 1 { if pacc[8] > 0 { ptpd = pacc[2] / pacc[8] } } 977 // EC56: what LANDED, from the boards' own journals (the costcal ledger's event rows), beside what the seat protocol 978 // recorded as DONE. ONE reader (ces_events_window) over both windows, so they cannot disagree on a row's class. 979 let lnp: *i64 = sys_mmap(ST_SPAN) as *i64 980 lnp[0] = 0 981 let lb: *u8 = sys_read_file(lg, lnp) 982 var lsz: i64 = lnp[0] 983 if (lb as i64) == 0 { lsz = 0 } 984 if lsz < 0 { lsz = 0 } 985 let lacc: *i64 = sys_mmap(CES_W_SLOTS * CES_I64) as *i64 986 let placc: *i64 = sys_mmap(CES_W_SLOTS * CES_I64) as *i64 987 ces_events_window(lb, lsz, cutoff, now + 1, lacc) 988 if pmeasured == 1 { ces_events_window(lb, lsz, cutoff - win, cutoff, placc) } 989 let cst: *i64 = sys_mmap(CES_S_SLOTS * CES_I64) as *i64 990 var lasof: i64 = 0 - 1 991 if lsz > 0 { if ces_cal_parse(lb, lsz, cst) == 1 { lasof = cst[CES_S_ASOF] } } 992 let landed: i64 = lacc[CES_W_LANDED_RUNGS] 993 var tpl: i64 = 0 - 1 994 if landed > 0 { tpl = coutv / landed } 995 var ptpl: i64 = 0 - 1 996 if pmeasured == 1 { if placc[CES_W_LANDED_RUNGS] > 0 { ptpl = pacc[2] / placc[CES_W_LANDED_RUNGS] } } 997 let rlwhyp: *i64 = sys_mmap(ST_SPAN) as *i64 998 let ratchet_l: *u8 = st_ratchet_landed(tpl, ptpl, rlwhyp) 999 let rlwhy: *u8 = rlwhyp[0] as *u8 1000 // the ratchet verdict: RED when tokens per closed rung rose against the previous window; UNMEASURED when either 1001 // window closed nothing (a window with zero closed rungs can never read as a win). The grade conjunct needs a 1002 // SECOND roster stamp to compare against and only one is truncate-written today, so it is declared UNMEASURED 1003 // beside the current stamp rather than silently dropped. 1004 let rwhyp: *i64 = sys_mmap(ST_SPAN) as *i64 1005 let ratchet: *u8 = st_ratchet(tpd, ptpd, rwhyp) 1006 let rwhy: *u8 = rwhyp[0] as *u8 1007 // CE9 LAST MILE: the gauge heartbeat written NAS-side from the rows this verb already read. The laptop meter 1008 // pushes the rows; this derives the figure; gauge_pass renders the stamp. gauge = claude out per closed rung; 1009 // axes = meter log + ws journal; cadence = the window itself, so a stamp older than two windows reads STALE. 1010 // A window that closed nothing writes NO stamp (tpd -1 is UNMEASURED, not a value): the old stamp then ages 1011 // into STALE, which is the axis-blind alarm, never a fresh zero. 1012 var gknown: i64 = 0 1013 if mn > 0 { gknown = gknown + 1 } 1014 if n > 0 { gknown = gknown + 1 } 1015 var gcad: i64 = win 1016 if gcad <= 0 { gcad = ST_MAGIC_86400 } 1017 var gw: i64 = 0 - 1 1018 // EC56: the gauge is claude out per CLOSED rung when the seat protocol recorded closures, else per LANDED rung from 1019 // the boards' journals; the basis travels in the JSON. A window with neither writes NO stamp, and the stamp path is 1020 // the CALLER'S: only a default-evidence run may write the production heartbeat (a selftest once could forge it). 1021 var gval: i64 = tpd 1022 var gbasis: *u8 = "done" as *u8 1023 if gval < 0 { 1024 gval = tpl 1025 gbasis = "landed" as *u8 1026 gknown = 0 1027 if mn > 0 { gknown = gknown + 1 } 1028 if lsz > 0 { gknown = gknown + 1 } 1029 } 1030 if gval < 0 { gbasis = "none" as *u8 } 1031 if gval >= 0 { gw = ga_stamp_write(stamp, now, gval, gknown, ST_GAUGE_AXES, gcad) } 1032 let sb: *u8 = sys_mmap(ST_MAGIC_4096) 1033 let ssz: *i64 = sys_mmap(ST_SPAN) as *i64 1034 let sn: i64 = st_read("knowledge/status/gateroster.stamp" as *u8, sb, ST_MAGIC_4096 - 4, ssz) 1035 var qobs: i64 = 0 1036 var qgreen: i64 = 0 - 1 1037 var qred: i64 = 0 - 1 1038 if sn > 0 { qobs = 1; qgreen = st_stamp_int(sb, sn, "green_or_skip=" as *u8); qred = st_stamp_int(sb, sn, "red_absent_timeout=" as *u8) } 1039 var o: i64 = 0 1040 o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"verb\":\"shift\",\"epoch\":" as *u8) 1041 o = st_catn(out, o, now) 1042 o = st_cat(out, o, ",\"budget_bytes\":" as *u8) 1043 o = st_catn(out, o, ST_OUTCAP) 1044 o = st_cat(out, o, ",\"days\":" as *u8) 1045 o = st_catn(out, o, days) 1046 o = st_cat(out, o, ",\"log_bytes\":" as *u8) 1047 o = st_catn(out, o, msz[0]) 1048 o = st_cat(out, o, ",\"log_window\":" as *u8) 1049 o = st_catn(out, o, mn) 1050 o = st_cat(out, o, ",\"jr_bytes\":" as *u8) 1051 o = st_catn(out, o, jsz[0]) 1052 o = st_cat(out, o, ",\"jr_window\":" as *u8) 1053 o = st_catn(out, o, n) 1054 o = st_cat(out, o, ",\"claude\":{\"rows\":" as *u8) 1055 o = st_catn(out, o, crows) 1056 o = st_cat(out, o, ",\"sessions\":" as *u8) 1057 o = st_catn(out, o, csess) 1058 o = st_cat(out, o, ",\"out\":" as *u8) 1059 o = st_catn(out, o, coutv) 1060 o = st_cat(out, o, ",\"cread\":" as *u8) 1061 o = st_catn(out, o, ccread) 1062 o = st_cat(out, o, ",\"ccreate\":" as *u8) 1063 o = st_catn(out, o, cccre) 1064 o = st_cat(out, o, "},\"local\":{\"rows\":" as *u8) 1065 o = st_catn(out, o, lrows) 1066 o = st_cat(out, o, ",\"sessions\":" as *u8) 1067 o = st_catn(out, o, lsess) 1068 o = st_cat(out, o, ",\"out\":" as *u8) 1069 o = st_catn(out, o, lout) 1070 o = st_cat(out, o, "},\"done_ws\":" as *u8) 1071 o = st_catn(out, o, done) 1072 o = st_cat(out, o, ",\"claude_out_per_done\":" as *u8) 1073 o = st_catn(out, o, tpd) 1074 o = st_cat(out, o, ",\"claude_cread_per_done\":" as *u8) 1075 o = st_catn(out, o, cpd) 1076 o = st_cat(out, o, ",\"gauge_stamp_wrote\":" as *u8) 1077 o = st_catn(out, o, gw) 1078 o = st_cat(out, o, ",\"gauge_basis\":\"" as *u8) 1079 o = st_cat(out, o, gbasis) 1080 o = st_cat(out, o, "\",\"gauge_stamp\":\"" as *u8) 1081 o = st_cat(out, o, stamp) 1082 o = st_cat(out, o, "\",\"landed\":{\"src\":\"" as *u8) 1083 o = st_cat(out, o, lg) 1084 o = st_cat(out, o, "\",\"ledger_bytes\":" as *u8) 1085 o = st_catn(out, o, lsz) 1086 o = st_cat(out, o, ",\"asof\":" as *u8) 1087 o = st_catn(out, o, lasof) 1088 o = st_cat(out, o, ",\"events\":" as *u8) 1089 o = st_catn(out, o, lacc[CES_W_LAND_EVENTS]) 1090 o = st_cat(out, o, ",\"rungs\":" as *u8) 1091 o = st_catn(out, o, landed) 1092 o = st_cat(out, o, ",\"relanded\":" as *u8) 1093 o = st_catn(out, o, lacc[CES_W_RELANDED]) 1094 o = st_cat(out, o, ",\"retracts\":" as *u8) 1095 o = st_catn(out, o, lacc[CES_W_RETRACTS]) 1096 o = st_cat(out, o, ",\"deciu\":" as *u8) 1097 o = st_catn(out, o, lacc[CES_W_LANDED_DECIU]) 1098 o = st_cat(out, o, ",\"ledger_land_events\":" as *u8) 1099 o = st_catn(out, o, lacc[CES_W_EVENTS_TOTAL]) 1100 o = st_cat(out, o, "},\"claude_out_per_landed\":" as *u8) 1101 o = st_catn(out, o, tpl) 1102 o = st_cat(out, o, ",\"prev_landed\":{\"rungs\":" as *u8) 1103 o = st_catn(out, o, placc[CES_W_LANDED_RUNGS]) 1104 o = st_cat(out, o, ",\"retracts\":" as *u8) 1105 o = st_catn(out, o, placc[CES_W_RETRACTS]) 1106 o = st_cat(out, o, ",\"claude_out_per_landed\":" as *u8) 1107 o = st_catn(out, o, ptpl) 1108 o = st_cat(out, o, "},\"ratchet_landed\":\"" as *u8) 1109 o = st_cat(out, o, ratchet_l) 1110 o = st_cat(out, o, "\",\"ratchet_landed_why\":\"" as *u8) 1111 o = st_cat(out, o, rlwhy) 1112 o = st_cat(out, o, "\"" as *u8) 1113 o = st_cat(out, o, ",\"prev\":{\"days\":" as *u8) 1114 o = st_catn(out, o, days) 1115 o = st_cat(out, o, ",\"measured\":" as *u8) 1116 o = st_catn(out, o, pmeasured) 1117 o = st_cat(out, o, ",\"claude_rows\":" as *u8) 1118 o = st_catn(out, o, pacc[0]) 1119 o = st_cat(out, o, ",\"claude_out\":" as *u8) 1120 o = st_catn(out, o, pacc[2]) 1121 o = st_cat(out, o, ",\"done_ws\":" as *u8) 1122 o = st_catn(out, o, pacc[8]) 1123 o = st_cat(out, o, ",\"claude_out_per_done\":" as *u8) 1124 o = st_catn(out, o, ptpd) 1125 o = st_cat(out, o, "},\"ratchet\":\"" as *u8) 1126 o = st_cat(out, o, ratchet) 1127 o = st_cat(out, o, "\",\"ratchet_why\":\"" as *u8) 1128 o = st_cat(out, o, rwhy) 1129 o = st_cat(out, o, "\",\"quality\":{\"src\":\"knowledge/status/gateroster.stamp\",\"observed\":" as *u8) 1130 o = st_catn(out, o, qobs) 1131 o = st_cat(out, o, ",\"green_or_skip\":" as *u8) 1132 o = st_catn(out, o, qgreen) 1133 o = st_cat(out, o, ",\"red_absent_timeout\":" as *u8) 1134 o = st_catn(out, o, qred) 1135 o = st_cat(out, o, ",\"grade_delta\":\"UNMEASURED-single-stamp\"}" as *u8) 1136 o = st_cat(out, o, ",\"env\":\"tail-1MiB-both-declared;class=seat-prefix-claude-else-local;done=DONE-frames-in-window;landed=distinct-domain-and-rung-land-events-in-window-from-the-costcal-ledger;ratchet=cur-vs-prev-window-out-per-done;ratchet_landed=the-same-over-landed-rungs;out-hard-" as *u8) 1137 o = st_catn(out, o, ST_OUTCAP) 1138 o = st_cat(out, o, "\",\"authority\":\"evidence=token_efficiency.log+ws_sync.jrnl+costcal.ledger;goal=out-per-done-and-out-per-landed-falling-local-rows-rising\"}" as *u8) 1139 out[o] = ST_NL as u8 1140 o = o + 1 1141 return o 1142} 1143// THE BOOT DIGEST: one hard-capped JSON. Returns emitted length (<= ST_OUTCAP by construction). 1144// ---- UNFINISHED WORK, PUT WHERE THE SEAT CANNOT MISS IT (2026-08-22) -------------------------- 1145// THE DIAGNOSIS WAS ALREADY WRITTEN IN THIS ESTATE AND NOBODY ACTED ON IT: "the cost lands on a 1146// census nobody reads instead of on the seat that created it." nx_artifactdrift has run on a daily 1147// beat for weeks and appends behind/ahead/own_undeclared to knowledge/status/artifactdrift.log -- 1148// a file no seat opens. Meanwhile THIS digest, which every session opens with, carried debts, 1149// frontier rows and ws counts and NOT ONE FIELD about work left half-finished. 1150// *A CENSUS OUTSIDE THE PATH IS A COMMENT. THE ONLY DURABLE FIX FOR WORK THAT KEEPS BEING LEFT 1151// PARTIAL IS TO PUT THE PARTIAL COUNT IN THE FIRST 1.5 KB EVERY SEAT READS -- not in a log, not in 1152// a checkout the seat may never run (see the note at st_do_checkout: a voluntary close CANNOT be 1153// enforced, and a killed seat never runs it). This field needs no voluntary act by anyone. 1154// behind = built and NOT promoted -- somebody compiled it and walked away 1155// ahead = the SERVED binary carries code the source cannot rebuild (promoting DESTROYS it) 1156// own_undeclared = artifacts this estate owns that no registry declares 1157// PASSES THE CENSUS'S OWN LINE THROUGH VERBATIM rather than re-parsing it into fields: a hand-copied 1158// restatement of another organ's verdict drifts from it silently, which is the defect this session 1159// spent the day removing elsewhere. The producer's format IS the contract. 1160// ABSENT is reported as ABSENT, never as a comfortable zero -- an unrun census is UNMEASURED. 1161// ONE scanner for every census line the digest carries (EC57, 2026-09-17: st_drift's scan, extracted the day st_wip 1162// needed the same): the LAST line of a status file passed through VERBATIM as ,"<key>":"<line>" -- or the NAMED absence. 1163func st_passthrough(out: *u8, o0: i64, key: *u8, path: *u8, absent: *u8) -> i64 { 1164 var o: i64 = o0 1165 o = st_cat(out, o, ",\"" as *u8) 1166 o = st_cat(out, o, key) 1167 o = st_cat(out, o, "\":\"" as *u8) 1168 let buf: *u8 = sys_mmap(ST_DRIFTCAP) 1169 let szp: *i64 = sys_mmap(ST_SPAN) as *i64 1170 let n: i64 = st_read(path, buf, ST_DRIFTCAP, szp) 1171 var linelen: i64 = 0 1172 if n > 0 { 1173 var e: i64 = n 1174 var run: i64 = 1 1175 while run == 1 { if e > 0 { if buf[e - 1] == (10 as u8) { e = e - 1 } else { run = 0 } } else { run = 0 } } 1176 var s: i64 = e 1177 run = 1 1178 while run == 1 { if s > 0 { if buf[s - 1] != (10 as u8) { s = s - 1 } else { run = 0 } } else { run = 0 } } 1179 linelen = e - s 1180 o = st_cat_esc(out, o, buf, s, e, ST_ROW_ESC) 1181 } else { 1182 o = st_cat(out, o, absent) 1183 } 1184 o = st_cat(out, o, "\"" as *u8) 1185 // a line longer than the digest's row budget is NAMED as cut: a declared truncation, never a silent one 1186 if linelen > ST_ROW_ESC { 1187 o = st_cat(out, o, ",\"" as *u8) 1188 o = st_cat(out, o, key) 1189 o = st_cat(out, o, "_cut\":\"the line is " as *u8) 1190 o = st_catn(out, o, linelen) 1191 o = st_cat(out, o, " bytes and the digest quotes the first " as *u8) 1192 o = st_catn(out, o, ST_ROW_ESC) 1193 o = st_cat(out, o, "; nx_fs tail the status file for the whole line\"" as *u8) 1194 } 1195 return o 1196} 1197// EC57: the fleet's close census, verbatim from nx_rungclose census all -- how many rungs stand at each state word, how 1198// many are started and not closed, how many could not be looked at. ABSENT is named, never read as nothing open. 1199func st_closecensus(out: *u8, o0: i64) -> i64 { 1200 return st_passthrough(out, o0, "close_census" as *u8, ST_CLOSESTATUS, "ABSENT -- nx_rungclose census all has not written a fleet line; how much is started and not closed is UNMEASURED, not zero" as *u8) 1201} 1202func st_drift(out: *u8, o0: i64) -> i64 { 1203 return st_passthrough(out, o0, "unfinished_census" as *u8, ST_DRIFTLOG, "ABSENT -- the drift census has not run; unfinished work is UNMEASURED, not zero" as *u8) 1204} 1205// EC57 WIP (2026-09-17): the rungs the boards' journals show STARTED and never landed, in the digest every session opens 1206// with -- count, active and stale, the oldest, and the three most recently touched BY NAME. Written by the costcal beat. 1207func st_wip(out: *u8, o0: i64) -> i64 { 1208 return st_passthrough(out, o0, "wip_census" as *u8, ST_WIPSTATUS, "ABSENT -- the costcal beat has not written a WIP line; started-not-landed work is UNMEASURED, not zero" as *u8) 1209} 1210func st_boot_cj(ws: *u8, jr: *u8, dp: *u8, fp: *u8, ml: *u8, cj: *u8, out: *u8) -> i64 { 1211 let q: *u8 = sys_mmap(ST_CAP) 1212 let jsz: *i64 = sys_mmap(ST_SPAN) as *i64 1213 let n: i64 = st_read(jr, q, ST_CAP - 4, jsz) 1214 let now: i64 = sys_now_realtime_sec() 1215 var o: i64 = 0 1216 o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"epoch\":" as *u8) 1217 o = st_catn(out, o, now) 1218 o = st_cat(out, o, ",\"budget_bytes\":" as *u8) 1219 o = st_catn(out, o, ST_OUTCAP) 1220 o = st_cat(out, o, ",\"journal_bytes\":" as *u8) 1221 o = st_catn(out, o, jsz[0]) 1222 o = st_cat(out, o, ",\"window_bytes\":" as *u8) 1223 o = st_catn(out, o, n) 1224 o = st_cat(out, o, ",\"ws\":\"" as *u8) 1225 o = st_cat_esc(out, o, ws, 0, st_vlen(ws), ST_WS_ESC) 1226 o = st_cat(out, o, "\",\"phase\":\"" as *u8) 1227 let lt: i64 = st_last_ts_lit(q, n, ws) 1228 if st_has(q, n, "DONE" as *u8, ws) == 1 { o = st_cat(out, o, "DONE" as *u8) } else { 1229 if lt >= 0 { o = st_cat(out, o, "INFLIGHT" as *u8) } else { o = st_cat(out, o, "UNKNOWN" as *u8) } 1230 } 1231 o = st_cat(out, o, "\",\"age_s\":" as *u8) 1232 if lt >= 0 { o = st_catn(out, o, now - lt) } else { o = st_catn(out, o, 0 - 1) } 1233 // ctx-tax flush loop: surface the last CHECKPOINT so post-compact re-entry keeps state 1234 let bfs: *i64 = sys_mmap(ST_SPAN) as *i64 1235 let bts: i64 = st_last_brief(q, n, ws, bfs) 1236 o = st_cat(out, o, ",\"brief_age_s\":" as *u8) 1237 if bts >= 0 { o = st_catn(out, o, now - bts) } else { o = st_catn(out, o, 0 - 1) } 1238 o = st_cat(out, o, ",\"last_brief\":\"" as *u8) 1239 if bfs[0] >= 0 { o = st_cat_esc(out, o, q, bfs[0], bfs[1], ST_NOTE_ESC) } 1240 o = st_cat(out, o, "\"" as *u8) 1241 // EC62: a checkpoint longer than the digest's note budget is NAMED as truncated, beside the one call that returns all of it 1242 var blen: i64 = 0 1243 if bfs[0] >= 0 { blen = bfs[1] - bfs[0] } 1244 o = st_cat(out, o, ",\"last_brief_bytes\":" as *u8) 1245 o = st_catn(out, o, blen) 1246 if blen > ST_NOTE_ESC { o = st_cat(out, o, ",\"last_brief_more\":\"nx_seat lastbrief <ws> returns the whole checkpoint\"" as *u8) } 1247 // debts: open count + THE top-severity row (eat-most-important-first pointer) 1248 // st_topdebt now SIZES ITS OWN BUFFER from the plane (sts_load_fit) and hands it back here, so 1249 // the top-debt row span fs[0..1] indexes the buffer that was actually loaded. The old fixed 1250 // ST_CAP mmap is gone: it was the truncation. 1251 let bp: *i64 = sys_mmap(ST_SPAN) as *i64 1252 let fs: *i64 = sys_mmap(ST_SPAN * 3) as *i64 1253 fs[3] = 0 1254 // ws IS the actor: a row THIS workspace already holds is offered back to it (crash-resume), 1255 // while a row another seat holds is passed over and COUNTED in cb[0] rather than silently dropped. 1256 let cb: *i64 = sys_mmap(ST_SPAN * 4) as *i64 // 7 slots cb[0..6]: ST_SPAN is 16B = 2 i64, so *3 held only 6 1257 let k: i64 = st_topdebt_unclaimed(dp, bp, fs, cj, ws, now, cb) 1258 let dbuf: *u8 = bp[0] as *u8 1259 o = st_cat(out, o, ",\"open_debts\":" as *u8) 1260 o = st_catn(out, o, k) 1261 // COVERAGE OF THE COUNT ABOVE. A seat that opens on a truncated board plans against a backlog 1262 // smaller than the real one, and nothing in the digest said so -- it published 855 of 2,688. 1263 // 1 = sts_load_fit returned the WHOLE board, so open_debts is exact. 1264 // 0 = the loader REFUSED (it never returns a partial board), so open_debts is NOT a number to 1265 // plan against and the refusal is on stderr with the plane named. 1266 // *A COUNT PUBLISHED WITHOUT ITS COVERAGE IS AN ASSERTION, NOT A MEASUREMENT. 1267 var lok: i64 = 1 1268 if fs[3] != 0 { lok = 0 } 1269 o = st_cat(out, o, ",\"debts_load_ok\":" as *u8) 1270 o = st_catn(out, o, lok) 1271 // UNFINISHED WORK, verbatim from the census that already measures it (see st_drift). 1272 o = st_drift(out, o) 1273 // EC57: the started-not-landed rungs, verbatim from the costcal beat's one canonical line (see st_wip) 1274 o = st_wip(out, o) 1275 // EC57: the fleet's close census, one line: every rung's state word counted, started-not-closed, could-not-look 1276 o = st_closecensus(out, o) 1277 o = st_cat(out, o, ",\"top_sev\":" as *u8) 1278 o = st_catn(out, o, fs[2]) 1279 o = st_cat(out, o, ",\"top_debt\":\"" as *u8) 1280 if fs[0] >= 0 { o = st_cat_esc(out, o, dbuf, fs[0], fs[1], ST_ROW_ESC) } 1281 o = st_cat(out, o, "\"" as *u8) 1282 // WHY THIS ROW AND NOT A HIGHER ONE. Without these a seat cannot tell "nothing above this is 1283 // open" from "everything above this is already being worked" -- two states that demand OPPOSITE 1284 // actions. held_by_others>0 means the fleet is BUSY, not that the backlog is short. 1285 // NAMED FOR WHAT IT MEASURES, NOT FOR WHAT A READER WOULD LIKE IT TO MEAN. These fields shipped 1286 // hours earlier as top_debt_held_by_others / top_debt_first_holder, and an ADVERSARIAL AUDIT OF MY 1287 // OWN WORK correctly refuted both names. Holdership is tested only on the strictly-increasing 1288 // running-max frontier, so a 0 meant "no held row beat the running max at its scan position" and 1289 // NEVER "nobody holds a debt row" -- measured: the winner sat at plane index 2045 of 4140, leaving 1290 // nine other open sev-9 rows and ~2,094 later rows untested. SELECTION was correct throughout (the 1291 // highest-severity unheld row always wins); the PUBLISHED NUMBER was the dishonest part. 1292 // Renamed while nothing consumed them yet -- rule 19 makes this the last safe moment. 1293 // skipped_held = rows PASSED OVER before the winner, which is exactly what cb[0] counts 1294 // holdership_tested = the DENOMINATOR: how many rows were actually claim-tested 1295 // blocked_by = the FIRST holder that blocked us, not "the holder of the top row" 1296 // A COUNT PUBLISHED WITHOUT ITS COVERAGE IS AN ASSERTION, NOT A MEASUREMENT. 1297 o = st_cat(out, o, ",\"top_debt_skipped_held\":" as *u8) 1298 o = st_catn(out, o, cb[0]) 1299 o = st_cat(out, o, ",\"top_debt_holdership_tested\":" as *u8) 1300 o = st_catn(out, o, cb[6]) 1301 o = st_cat(out, o, ",\"top_debt_resume_is_mine\":" as *u8) 1302 o = st_catn(out, o, cb[4]) 1303 o = st_cat(out, o, ",\"top_debt_unclaimable_ids\":" as *u8) 1304 o = st_catn(out, o, cb[5]) 1305 o = st_cat(out, o, ",\"top_debt_blocked_by\":\"" as *u8) 1306 if cb[1] >= 0 { o = st_cat_esc(out, o, cb[3] as *u8, cb[1], cb[2], ST_WS_ESC) } 1307 o = st_cat(out, o, "\",\"active\":[" as *u8) 1308 // board digest: ACTIVE ws (fresh within window) capped, DONE/STALE counted only 1309 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 1310 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 1311 var nact: i64 = 0 1312 var ndone: i64 = 0 1313 var nstale: i64 = 0 1314 var i: i64 = 0 1315 while i < n { 1316 let le: i64 = st_le(q, i, n) 1317 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 { 1318 if st_col(q, i, le, 2, cw) == 1 { if st_first_kick(q, i, cw[0], cw[1]) == 1 { 1319 if st_has_span_done(q, n, cw[0], cw[1]) == 1 { ndone = ndone + 1 } else { 1320 var wlt: i64 = st_last_ts_span(q, n, cw[0], cw[1]) 1321 // debt 1786054445: a reap frame is TERMINAL, never activity. Zeroing the recency 1322 // drops a reaped-and-not-revived lane out of ACTIVE into the STALE count, which is 1323 // the honest bucket -- it is neither working nor DONE -- and it must never be the 1324 // first thing offered to a booting seat. 1325 // USES st_ws_closed -- the SAME predicate the reaper uses -- for precisely the 1326 // reason that function's own header gives: two readers of one journal must not 1327 // carry two definitions of closed. I wrote a private twin of it here first and 1328 // the compiler rejected the duplicate, which was the correct answer. 1329 if st_ws_closed(q, n, cw[0], cw[1]) == 1 { wlt = 0 } 1330 if now - wlt <= ST_STALE_SEC { 1331 if nact < ST_ACTIVE_MAX { 1332 if nact > 0 { o = st_cat(out, o, "," as *u8) } 1333 o = st_cat(out, o, "{\"ws\":\"" as *u8) 1334 o = st_cat_esc(out, o, q, cw[0], cw[1], ST_WS_ESC) 1335 o = st_cat(out, o, "\",\"age_s\":" as *u8) 1336 o = st_catn(out, o, now - wlt) 1337 o = st_cat(out, o, "}" as *u8) 1338 } 1339 nact = nact + 1 1340 } else { nstale = nstale + 1 } 1341 } 1342 } } 1343 } } 1344 i = le + 1 1345 } 1346 o = st_cat(out, o, "],\"active_total\":" as *u8) 1347 o = st_catn(out, o, nact) 1348 o = st_cat(out, o, ",\"done_ws\":" as *u8) 1349 o = st_catn(out, o, ndone) 1350 o = st_cat(out, o, ",\"stale_ws\":" as *u8) 1351 o = st_catn(out, o, nstale) 1352 // frontier: first N TODO rows (id + capped title) + totals 1353 let fbuf: *u8 = sys_mmap(ST_CAP) 1354 let fn: i64 = sts_load(fp, fbuf, ST_CAP) 1355 let f0: *i64 = sys_mmap(ST_SPAN) as *i64 1356 let f1: *i64 = sys_mmap(ST_SPAN) as *i64 1357 let f5: *i64 = sys_mmap(ST_SPAN) as *i64 1358 o = st_cat(out, o, ",\"frontier_todo\":[" as *u8) 1359 var nf: i64 = 0 1360 var tf: i64 = 0 1361 var fi: i64 = 0 1362 while fi < fn { 1363 let fle: i64 = st_le(fbuf, fi, fn) 1364 if st_col(fbuf, fi, fle, 5, f5) == 1 { if st_lit_eq(fbuf, f5[0], f5[1], "T" as *u8) == 1 { 1365 tf = tf + 1 1366 if nf < ST_FRONT_MAX { 1367 if st_col(fbuf, fi, fle, 0, f0) == 1 { if st_col(fbuf, fi, fle, 1, f1) == 1 { 1368 if nf > 0 { o = st_cat(out, o, "," as *u8) } 1369 o = st_cat(out, o, "{\"id\":\"" as *u8) 1370 o = st_cat_esc(out, o, fbuf, f0[0], f0[1], ST_WS_ESC) 1371 o = st_cat(out, o, "\",\"t\":\"" as *u8) 1372 o = st_cat_esc(out, o, fbuf, f1[0], f1[1], ST_TITLE_ESC) 1373 o = st_cat(out, o, "\"}" as *u8) 1374 nf = nf + 1 1375 } } 1376 } 1377 } } 1378 fi = fle + 1 1379 } 1380 o = st_cat(out, o, "],\"frontier_todo_total\":" as *u8) 1381 o = st_catn(out, o, tf) 1382 // metering pointer: last row of the token-efficiency evidence log 1383 let mbuf: *u8 = sys_mmap(ST_CAP) 1384 let msz: *i64 = sys_mmap(ST_SPAN) as *i64 1385 let mn: i64 = st_read(ml, mbuf, ST_MAGIC_4096, msz) 1386 o = st_cat(out, o, ",\"meter_last\":\"" as *u8) 1387 if mn > 0 { 1388 var ls: i64 = 0 1389 var mi: i64 = 0 1390 while mi < mn { let mle: i64 = st_le(mbuf, mi, mn); if mle < mn { ls = mi } else { if mle > mi { ls = mi } } mi = mle + 1 } 1391 let lse: i64 = st_le(mbuf, ls, mn) 1392 o = st_cat_esc(out, o, mbuf, ls, lse, ST_NOTE_ESC) 1393 } 1394 o = st_cat(out, o, "\"" as *u8) // 2026-07-29: the shift_verbs insertion dropped meter_last's CLOSING quote -- the whole boot digest was INVALID JSON (a human reader skims past it; every machine consumer -- makers, cheap-model seats, scripts -- dies on JSON.parse, which is precisely who the digest is for) 1395 // SHIFT-VERBS: the sovereign path for each work class a session would 1396 // otherwise rediscover by shelling out (discovery-is-the-bottleneck, 1397 // knowledge/status/self_sufficiency_map_20260729.md). Data-driven per 1398 // rule 11: knowledge/shift_verbs.conf rows task<TAB>verb<TAB>hint -- 1399 // extend the conf, never rebuild the seat. Additive field (rule 19); 1400 // conf absent => empty list, the FIELD is always present (honest zero). 1401 // Row emission is BUDGET-DERIVED, not a taste top-N (bounds law 07-29): 1402 // rows emit while output stays under ST_OUTCAP minus ST_SV_RESERVE bytes. 1403 let svb: *u8 = sys_mmap(ST_CAP) 1404 let svz: *i64 = sys_mmap(ST_SPAN) as *i64 1405 let svn: i64 = st_read("knowledge/shift_verbs.conf" as *u8, svb, ST_MAGIC_4096, svz) 1406 o = st_cat(out, o, ",\"shift_verbs\":[" as *u8) 1407 var nsv: i64 = 0 1408 if svn > 0 { 1409 let s0: *i64 = sys_mmap(ST_SPAN) as *i64 1410 let s1: *i64 = sys_mmap(ST_SPAN) as *i64 1411 // Allocated ONCE outside the row loop on purpose: a sys_mmap per row is an allocator in a loop, which 1412 // this ecosystem has already paid for twice (the unfreed-mmap class). Both are pure out-params. 1413 let s2: *i64 = sys_mmap(ST_SPAN) as *i64 1414 let cs: *i64 = sys_mmap(ST_SPAN) as *i64 1415 var si: i64 = 0 1416 while si < svn { 1417 let sle: i64 = st_le(svb, si, svn) 1418 if sle > si + 2 { if svb[si] != (35 as u8) { 1419 // ST_SV_RESERVE units=BYTES: measured digest tail after this 1420 // field (env+authority strings ~230B) + one max row (task 1421 // ST_WS_ESC + verb ST_TITLE_ESC + json wrappers ~200B) + NL, 1422 // rounded up = 512. When this bound bites the fix is a wider 1423 // ST_OUTCAP envelope or a leaner tail -- never a smaller list. 1424 if o < ST_OUTCAP - 512 { 1425 if st_col(svb, si, sle, 0, s0) == 1 { if st_col(svb, si, sle, 1, s1) == 1 { 1426 if nsv > 0 { o = st_cat(out, o, "," as *u8) } 1427 o = st_cat(out, o, "{\"t\":\"" as *u8) 1428 o = st_cat_esc(out, o, svb, s0[0], s0[1], ST_WS_ESC) 1429 o = st_cat(out, o, "\",\"v\":\"" as *u8) 1430 o = st_cat_esc(out, o, svb, s1[0], s1[1], ST_TITLE_ESC) 1431 // Carry the cap token when the hint declares one. Additive field (rule 19): consumers 1432 // that ignore it are unaffected, and a row with no _cap= emits exactly what it did 1433 // before, so a conf without caps produces a byte-identical digest. 1434 if st_col(svb, si, sle, 2, s2) == 1 { 1435 if st_cap_of(svb, s2[0], s2[1], cs) == 1 { 1436 o = st_cat(out, o, "\",\"cap\":\"" as *u8) 1437 // Direct byte copy, not st_cat_esc: the first cut emitted "cap":"" and the 1438 // escaper is the only unknown in that path. A cap token is [a-z0-9._-] by 1439 // construction (it names a file in ~/.nishi), so there is nothing to escape and 1440 // nothing to be gained by routing it through a helper whose contract I would be 1441 // guessing at. Bounded by cs[1], which st_cap_of derived from the slice itself. 1442 var cq: i64 = 0 1443 while cq < cs[1] { out[o] = svb[cs[0] + cq]; o = o + 1; cq = cq + 1 } 1444 } 1445 } 1446 o = st_cat(out, o, "\"}" as *u8) 1447 nsv = nsv + 1 1448 } } 1449 } 1450 } } 1451 si = sle + 1 1452 } 1453 } 1454 o = st_cat(out, o, "],\"shift_src\":\"knowledge/shift_verbs.conf;rows-budget-derived-512B-reserve\"" as *u8) 1455 o = st_cat(out, o, ",\"env\":\"jr-tail-1MiB-declared;debt-plane-1MiB;frontier-first-" as *u8) 1456 o = st_catn(out, o, ST_FRONT_MAX) 1457 o = st_cat(out, o, ";out-hard-" as *u8) 1458 o = st_catn(out, o, ST_OUTCAP) 1459 o = st_cat(out, o, "\",\"authority\":\"nx_ws_cycle-next-is-the-scoped-gate;this-is-the-recon-digest\"}" as *u8) 1460 out[o] = ST_NL as u8 1461 o = o + 1 1462 return o 1463} 1464// st_boot keeps its 6-arg shape for every existing caller and DELEGATES, so the claims journal is 1465// INJECTABLE. This is not symmetry for its own sake: T6c proves st_topdebt_unclaimed's LOGIC, and 1466// nothing proved that BOOT WIRES IT CORRECTLY -- the call site, not the definition, is where a fix 1467// silently fails to be reached. A gate that can only be aimed at the production claims plane cannot 1468// test that wiring without writing production, so it would never have been written at all. 1469func st_boot(ws: *u8, jr: *u8, dp: *u8, fp: *u8, ml: *u8, out: *u8) -> i64 { 1470 return st_boot_cj(ws, jr, dp, fp, ml, ST_CLAIMS_JRNL, out) 1471} 1472// append one journal frame (selftest fixture writer; same grammar as ws_sync) 1473func st_frame(jr: *u8, ts: i64, verb: *u8, ws: *u8, actor: *u8, note: *u8) -> i64 { 1474 // EC62: the line buffer is SIZED FROM ITS INPUTS -- a fixed 4096 let a long checkpoint note run off the end of the mapping 1475 let ln: *u8 = sys_mmap(st_vlen(verb) + st_vlen(ws) + st_vlen(actor) + st_vlen(note) + ST_FRAME_SLACK) 1476 var o: i64 = 0 1477 o = st_catn(ln, o, ts) 1478 ln[o] = ST_TAB as u8 1479 o = o + 1 1480 o = st_cat(ln, o, verb) 1481 ln[o] = ST_TAB as u8 1482 o = o + 1 1483 o = st_cat(ln, o, ws) 1484 ln[o] = ST_TAB as u8 1485 o = o + 1 1486 o = st_cat(ln, o, actor) 1487 ln[o] = ST_TAB as u8 1488 o = o + 1 1489 o = st_cat(ln, o, note) 1490 ln[o] = ST_NL as u8 1491 o = o + 1 1492 let fd: i64 = sys_openat_append(jr, ST_MODE_RW) 1493 if fd < 0 { return 0 - 1 } 1494 sys_write(fd, ln, o) 1495 sys_close(fd) 1496 return 0 1497} 1498// claims-grammar fixture frame (ts\tVERB\tres\tactor\tttl\tnote) -- selftest injects OLD ts 1499// to synthesize a provably-EXPIRED claim in a SCRATCH journal (never the prod store) 1500func st_cframe(cjr: *u8, ts: i64, verb: *u8, res: *u8, actor: *u8, ttl: i64, note: *u8) -> i64 { 1501 let ln: *u8 = sys_mmap(ST_MAGIC_4096) 1502 var o: i64 = 0 1503 o = st_catn(ln, 0, ts) 1504 ln[o] = ST_TAB as u8 1505 o = o + 1 1506 o = st_cat(ln, o, verb) 1507 ln[o] = ST_TAB as u8 1508 o = o + 1 1509 o = st_cat(ln, o, res) 1510 ln[o] = ST_TAB as u8 1511 o = o + 1 1512 o = st_cat(ln, o, actor) 1513 ln[o] = ST_TAB as u8 1514 o = o + 1 1515 o = st_catn(ln, o, ttl) 1516 ln[o] = ST_TAB as u8 1517 o = o + 1 1518 o = st_cat(ln, o, note) 1519 ln[o] = ST_NL as u8 1520 o = o + 1 1521 let fd: i64 = sys_openat_append(cjr, ST_MODE_RW) 1522 if fd < 0 { return 0 - 1 } 1523 sys_write(fd, ln, o) 1524 sys_close(fd) 1525 return 0 1526} 1527// CTX-TAX FLUSH VERB (the warden's ecosystem-side function): ONE CHECKPOINT frame captures the 1528// in-flight state so the operator can /compact or /clear LOSSLESSLY; re-entry = boot, whose 1KB 1529// digest now carries last_brief. Journal-append only -- additive, conflict-free, rule-19. 1530// EC62: the WHOLE last CHECKPOINT of a ws (the digest carries only its first ST_NOTE_ESC bytes). A header line, then the 1531// note verbatim. cap bounds the copy, and a note that does not fit is NAMED truncated, never silently cut. 1532func st_lastbrief_into(ws: *u8, jr: *u8, out: *u8, cap: i64) -> i64 { 1533 let q: *u8 = sys_mmap(ST_CAP) 1534 let qs: *i64 = sys_mmap(ST_SPAN) as *i64 1535 let n: i64 = st_read(jr, q, ST_CAP - 4, qs) 1536 let fs: *i64 = sys_mmap(ST_SPAN) as *i64 1537 let ts: i64 = st_last_brief(q, n, ws, fs) 1538 var o: i64 = st_cat(out, 0, "LASTBRIEF ws=" as *u8) 1539 o = st_cat(out, o, ws) 1540 var have: i64 = 1 1541 if ts < 0 { have = 0 } 1542 if fs[0] < 0 { have = 0 } 1543 if have == 0 { 1544 o = st_cat(out, o, " NONE\n" as *u8) 1545 return o 1546 } 1547 let blen: i64 = fs[1] - fs[0] 1548 o = st_cat(out, o, " age_s=" as *u8) 1549 o = st_catn(out, o, sys_now_realtime_sec() - ts) 1550 o = st_cat(out, o, " bytes=" as *u8) 1551 o = st_catn(out, o, blen) 1552 var take: i64 = blen 1553 if o + take + ST_FRAME_SLACK > cap { take = cap - o - ST_FRAME_SLACK } 1554 if take < 0 { take = 0 } 1555 if take < blen { 1556 o = st_cat(out, o, " TRUNCATED-TO=" as *u8) 1557 o = st_catn(out, o, take) 1558 } 1559 out[o] = ST_NL as u8 1560 o = o + 1 1561 var k: i64 = 0 1562 while k < take { out[o] = q[fs[0] + k]; o = o + 1; k = k + 1 } 1563 out[o] = ST_NL as u8 1564 o = o + 1 1565 return o 1566} 1567func st_do_brief(ws: *u8, actor: *u8, note: *u8, wj: *u8, out: *u8) -> i64 { 1568 let rc: i64 = st_frame(wj, sys_now_realtime_sec(), "CHECKPOINT" as *u8, ws, actor, note) 1569 var o: i64 = 0 1570 if rc != 0 { 1571 o = st_cat(out, 0, "BRIEF-FAIL journal unwritable jr=" as *u8) 1572 o = st_cat_esc(out, o, wj, 0, st_vlen(wj), 200) 1573 out[o] = ST_NL as u8 1574 o = o + 1 1575 sys_write(1, out, o) 1576 return 1 1577 } 1578 o = st_cat(out, 0, "BRIEF ws=" as *u8) 1579 o = st_cat(out, o, ws) 1580 o = st_cat(out, o, " checkpoint=1 flush-safe=1 reboot=nx_seat-boot note=" as *u8) 1581 o = st_cat_esc(out, o, note, 0, st_vlen(note), 160) 1582 out[o] = ST_NL as u8 1583 o = o + 1 1584 sys_write(1, out, o) 1585 return 0 1586} 1587// S1 ONE-CALL PROTOCOL (composes the sibling nx_claims organ by FORK -- its derived-holdership 1588// parser stays THE one copy, no dup): checkin = claim(fail-closed CONTENDED) then KICKOFF frame; 1589// checkout = DONE frame then release. A seat's whole session protocol = two calls. 1590func st_claims_run(verb: *u8, cj: *u8, ws: *u8, actor: *u8, ttl: i64, note: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 { 1591 let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8 1592 let av: *i64 = sys_mmap(16 * 8) as *i64 1593 let tb: *u8 = sys_mmap(28) 1594 av[0] = elf as i64 1595 av[1] = verb as i64 1596 av[2] = cj as i64 1597 av[3] = ws as i64 1598 av[4] = actor as i64 1599 var n: i64 = 5 1600 if ttl >= 0 { 1601 let te: i64 = st_catn(tb, 0, ttl) 1602 tb[te] = 0 as u8 1603 av[5] = tb as i64 1604 n = 6 1605 } 1606 av[n] = note as i64 1607 av[n+1] = 0 1608 return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS) 1609} 1610// PURE clamp decision, split out from st_do_checkin so the rule can be gated WITHOUT forking a real 1611// claim against the live plane. A tooth that has to mutate production to run is a tooth nobody runs. 1612func st_clamp_ttl(ttl: i64, ceil: i64) -> i64 { 1613 if ceil <= 0 { return ttl } 1614 if ttl > ceil { return ceil } 1615 return ttl 1616} 1617// ---------- TTL CEILING: EVERY CLAIM MUST BE MORTAL ---------- 1618// You cannot enforce a voluntary checkout. A seat that is killed never runs its checkout, which is why 1619// the reaper exists -- but the reaper can only release a claim PAST ITS OWN DECLARED TTL, so a seat 1620// that declares a long enough TTL opts out of the entire mechanism. MEASURED on the live claims plane 1621// 2026-08-06: `d001-anchor-r3` and `browser-parity-daily-driver` were both HELD with ttl_sec=7200000 = 1622// 83 DAYS, at ages of 14 days, against a fleet whose largest LEGITIMATE declared ttl is 21600 (6h). 1623// Those two were structurally unreapable and would have starved their resources into October. 1624// CLAMP, DO NOT REFUSE -- deliberate. Refusing an over-long checkin leaves the seat with no claim at 1625// all, and it will then work as an UNCLAIMED ws row, which is the population with no ttl to expire and 1626// therefore the hardest of all to close. Refusing would trade a reapable problem for an unreapable one. 1627// FAIL-SAFE: an absent/zero ceiling clamps NOTHING and behaviour is exactly as before -- silence must 1628// never change what a claim means. The clamp is reported IN-BAND so it is never a silent rewrite of 1629// what the caller asked for. 1630func st_do_checkin(ws: *u8, actor: *u8, ttl: i64, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 { 1631 let cout: *u8 = sys_mmap(ST_MAGIC_4096) 1632 let colen: *i64 = sys_mmap(ST_SPAN) as *i64 1633 // st_reap_ttl is a generic "read the integer on line 1" head-reader; reused rather than cloned. 1634 let ceil: i64 = st_reap_ttl("knowledge/status/ws_ttl_ceiling.conf" as *u8) 1635 let eff: i64 = st_clamp_ttl(ttl, ceil) 1636 var clamped: i64 = 0 1637 if eff != ttl { clamped = 1 } 1638 let rc: i64 = st_claims_run("claim" as *u8, cj, ws, actor, eff, note, cout, ST_MAGIC_4092, colen) 1639 var o: i64 = 0 1640 if rc != 0 { 1641 o = st_cat(out, o, "CHECKIN-REFUSED rc=" as *u8) 1642 o = st_catn(out, o, rc) 1643 o = st_cat(out, o, " claim=" as *u8) 1644 o = st_cat_esc(out, o, cout, 0, colen[0], 300) 1645 out[o] = ST_NL as u8 1646 o = o + 1 1647 sys_write(1, out, o) 1648 return rc 1649 } 1650 st_frame(wj, sys_now_realtime_sec(), "KICKOFF" as *u8, ws, actor, note) 1651 o = st_cat(out, o, "CHECKIN ws=" as *u8) 1652 o = st_cat(out, o, ws) 1653 o = st_cat(out, o, " claim=HELD kickoff=1" as *u8) 1654 if clamped == 1 { 1655 o = st_cat(out, o, " ttl-CLAMPED-from=" as *u8) 1656 o = st_catn(out, o, ttl) 1657 o = st_cat(out, o, "s-to=" as *u8) 1658 o = st_catn(out, o, eff) 1659 o = st_cat(out, o, "s" as *u8) 1660 } 1661 o = st_cat(out, o, " note=" as *u8) 1662 o = st_cat_esc(out, o, note, 0, st_vlen(note), 160) 1663 out[o] = ST_NL as u8 1664 o = o + 1 1665 sys_write(1, out, o) 1666 return 0 1667} 1668// ---------- seq543/seq552 checkout honesty ---------- 1669// ROOT CAUSE: the de-facto seat protocol is `checkout <ws> <actor> done <note>` while the v2 1670// grammar was `checkout <ws> <actor> <note> [claims.jrnl]` -- the RESULT NOTE was consumed as 1671// the CLAIMS JOURNAL PATH, so release forked at a phantom journal -> ABSENT -> NOT-HOLDER(3) 1672// while the real claim in knowledge/status/claims.jrnl stayed HELD. A journal arg must LOOK 1673// like a journal (contains '/' or ends ".jrnl"); interpretation is data-shape-driven. 1674func st_jpathish(s: *u8) -> i64 { 1675 var i: i64 = 0 1676 var slash: i64 = 0 1677 while s[i] != (0 as u8) { if s[i] == (47 as u8) { slash = 1 } i = i + 1 } 1678 if slash == 1 { return 1 } 1679 if i < 5 { return 0 } 1680 if s[i-5] != (46 as u8) { return 0 } 1681 if s[i-4] != (106 as u8) { return 0 } 1682 if s[i-3] != (114 as u8) { return 0 } 1683 if s[i-2] != (110 as u8) { return 0 } 1684 if s[i-1] != (108 as u8) { return 0 } 1685 return 1 1686} 1687// checkout arg interpretation (T16): a5 jpathish -> classic `<note> [claims]` form (oi=5, note 1688// untouched); else a4 was a status token -> note = "a4 a5" merged, journals shift (oi=6) 1689func st_co_argshift(a4: *u8, a5: *u8, nout: *i64) -> i64 { 1690 nout[0] = a4 as i64 1691 if st_jpathish(a5) == 1 { return 5 } 1692 let mb: *u8 = sys_mmap(ST_MAGIC_4096) 1693 var mo: i64 = st_cat(mb, 0, a4) 1694 mo = st_cat(mb, mo, " " as *u8) 1695 mo = st_cat(mb, mo, a5) 1696 mb[mo] = 0 as u8 1697 nout[0] = mb as i64 1698 return 6 1699} 1700// single-resource state probe through the sibling organ (holdership derivation stays THE one copy) 1701func st_claims_state(cj: *u8, ws: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 { 1702 let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8 1703 let vb: *u8 = "state" as *u8 1704 let av: *i64 = sys_mmap(8 * 8) as *i64 1705 av[0] = elf as i64 1706 av[1] = vb as i64 1707 av[2] = cj as i64 1708 av[3] = ws as i64 1709 av[4] = 0 1710 return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS) 1711} 1712// CHECKOUT rewrite (rule-3, not a patch cascade). DONE frame ALWAYS lands first (kept). 1713// (1) an unreadable claims journal cannot hold a claim -- forking release at it can only lie 1714// NOT-HOLDER while the real claim stays held; refuse LOUD rc=2, never fork (fail-safe). 1715// (2) release rc=3 is CLASSIFIED via the sibling's state probe: FREE/ABSENT -> benign 1716// ALREADY-FREE (rc=0, honest note; covers ttl-lapse-then-reap); HELD/EXPIRED by ANOTHER 1717// actor -> FOREIGN-HELD stays rc=3 LOUD (nx_claims refuses foreign release; no force path 1718// exists here); probe unavailable/unparsable -> NOT-HOLDER-UNCLASSIFIED stays rc=3 1719// (never guess benign). Output prefix + fields are ADDITIVE (rule 19). 1720func st_do_checkout(ws: *u8, actor: *u8, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 { 1721 st_frame(wj, sys_now_realtime_sec(), "DONE" as *u8, ws, actor, note) 1722 let jfd: i64 = sys_openat_rd(cj) 1723 if jfd < 0 { 1724 var ob: i64 = 0 1725 ob = st_cat(out, 0, "CHECKOUT ws=" as *u8) 1726 ob = st_cat(out, ob, ws) 1727 ob = st_cat(out, ob, " done=1 release-rc=2 release=BAD-CLAIMS-JOURNAL cj=" as *u8) 1728 ob = st_cat_esc(out, ob, cj, 0, st_vlen(cj), 200) 1729 out[ob] = ST_NL as u8 1730 ob = ob + 1 1731 sys_write(1, out, ob) 1732 return 2 1733 } 1734 sys_close(jfd) 1735 let cout: *u8 = sys_mmap(ST_MAGIC_4096) 1736 let colen: *i64 = sys_mmap(ST_SPAN) as *i64 1737 let rc: i64 = st_claims_run("release" as *u8, cj, ws, actor, 0 - 1, note, cout, ST_MAGIC_4092, colen) 1738 var frc: i64 = rc 1739 var cls: i64 = 0 1740 let sbuf: *u8 = sys_mmap(ST_MAGIC_4096) 1741 let slen: *i64 = sys_mmap(ST_SPAN) as *i64 1742 let hsp: *i64 = sys_mmap(ST_SPAN) as *i64 1743 if rc == 3 { 1744 cls = 3 1745 let src: i64 = st_claims_state(cj, ws, sbuf, ST_MAGIC_4092, slen) 1746 if src == 0 { 1747 let sn: i64 = slen[0] 1748 let sle: i64 = st_le(sbuf, 0, sn) 1749 let ssp2: *i64 = sys_mmap(ST_SPAN) as *i64 1750 if st_tagval(sbuf, 0, sle, " state=" as *u8, ssp2) == 1 { 1751 var isfree: i64 = 0 1752 if st_lit_eq(sbuf, ssp2[0], ssp2[1], "FREE" as *u8) == 1 { isfree = 1 } 1753 if st_lit_eq(sbuf, ssp2[0], ssp2[1], "ABSENT" as *u8) == 1 { isfree = 1 } 1754 if isfree == 1 { cls = 1; frc = 0 } 1755 if isfree == 0 { if st_tagval(sbuf, 0, sle, " holder=" as *u8, hsp) == 1 { cls = 2 } } 1756 } 1757 } 1758 } 1759 var o: i64 = 0 1760 o = st_cat(out, 0, "CHECKOUT ws=" as *u8) 1761 o = st_cat(out, o, ws) 1762 o = st_cat(out, o, " done=1 release-rc=" as *u8) 1763 o = st_catn(out, o, frc) 1764 if cls == 1 { o = st_cat(out, o, " release=ALREADY-FREE" as *u8) } 1765 if cls == 2 { 1766 o = st_cat(out, o, " release=FOREIGN-HELD holder=" as *u8) 1767 o = st_cat_esc(out, o, sbuf, hsp[0], hsp[1], 120) 1768 } 1769 if cls == 3 { o = st_cat(out, o, " release=NOT-HOLDER-UNCLASSIFIED" as *u8) } 1770 o = st_cat(out, o, " fork-rc=" as *u8) 1771 o = st_catn(out, o, rc) 1772 o = st_cat(out, o, " " as *u8) 1773 o = st_cat_esc(out, o, cout, 0, colen[0], 200) 1774 out[o] = ST_NL as u8 1775 o = o + 1 1776 sys_write(1, out, o) 1777 return frc 1778} 1779// ---------- F214 ORPHAN REAP (seat layer) ---------- 1780// forks the sibling nx_claims organ's reap verb (its derived-EXPIRED judgment stays THE one 1781// copy -- this wrapper NEVER decides expiry itself), then appends one ORPHAN-REAPED audit 1782// frame per reaped ws to the ws journal via the SAME append discipline checkin uses. 1783func st_tagval(q: *u8, ls: i64, le: i64, tag: *u8, out: *i64) -> i64 { 1784 let tl: i64 = st_vlen(tag) 1785 var i: i64 = ls 1786 while i + tl <= le { 1787 var k: i64 = 0 1788 var ok: i64 = 1 1789 while k < tl { if q[i+k] != tag[k] { ok = 0; k = tl } else { k = k + 1 } } 1790 if ok == 1 { 1791 let vs: i64 = i + tl 1792 var ve: i64 = vs 1793 var s: i64 = 1 1794 while s == 1 { if ve >= le { s = 0 } else { if q[ve] == (32 as u8) { s = 0 } else { ve = ve + 1 } } } 1795 out[0] = vs 1796 out[1] = ve 1797 return 1 1798 } 1799 i = i + 1 1800 } 1801 return 0 1802} 1803func st_reap_run(cj: *u8, actor: *u8, note: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 { 1804 let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8 1805 let vb: *u8 = "reap" as *u8 1806 let av: *i64 = sys_mmap(8 * 8) as *i64 1807 av[0] = elf as i64 1808 av[1] = vb as i64 1809 av[2] = cj as i64 1810 av[3] = actor as i64 1811 av[4] = note as i64 1812 av[5] = 0 1813 return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS) 1814} 1815// ---------- WS-NATIVE ORPHAN REAP (the UNCLAIMED half) ---------- 1816// The claims-side reap above can only ever reach a ws that HELD A CLAIM. MEASURED on the live board 1817// 2026-08-06: 12 rows read IN-FLIGHT and NINE OF THEM had no claim at all -- opened with a bare 1818// `nx_ws_sync kickoff`, so no ttl ever existed for them and no amount of claim-expiry sweeping could 1819// ever close them. Those nine had been silent 17-20 DAYS while the resume surface still reported them 1820// as work in progress. This pass closes exactly that population, from the ws journal's own evidence. 1821func st_reap_ttl(cfg: *u8) -> i64 { 1822 // HEAD read, deliberately NOT st_read. st_read is a TAIL reader (scale-law -- correct for journals, 1823 // whose newest evidence is at the end). A CONFIG's value is on LINE 1, so a tail read drops exactly 1824 // the byte you came for the moment the file grows past the window. MEASURED 2026-08-06: this config 1825 // is 1267B against a 1020B window, so `172800` on line 1 was skipped, the parse returned 0, and for 1826 // a REAPER 0 means DISABLED -- writing documentation into the config silently switched the sweep 1827 // off, and the only symptom was a number in an envelope nobody would have questioned. 1828 // A TAIL READER POINTED AT A HEAD-ANCHORED FILE FAILS SILENTLY AND IN THE SAFE-LOOKING DIRECTION. 1829 // (Re-applied after a concurrent restore reverted it; tooth T15d holds it down now.) 1830 let b: *u8 = sys_mmap(ST_MAGIC_1024) 1831 let fd: i64 = sys_openat_rd(cfg) 1832 if fd < 0 { return 0 } 1833 let n: i64 = sys_read(fd, b, ST_MAGIC_1024 - 4) 1834 sys_close(fd) 1835 if n <= 0 { return 0 } 1836 var v: i64 = 0 1837 var i: i64 = 0 1838 var go: i64 = 1 1839 while i < n { 1840 if go == 1 { 1841 let c: i64 = b[i] as i64 1842 if c == 10 { go = 0 } 1843 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } 1844 } 1845 i = i + 1 1846 } 1847 return v 1848} 1849// RESTORED 2026-08-06 AFTER A TWO-WRITER CONVERGENCE RACE DELETED IT (debt 1786054445). Two seats 1850// independently wrote this predicate in the same hour. Each then read the other's copy, judged it 1851// canonical, and deleted its own -- so BOTH copies disappeared and the build broke on an undefined 1852// name that two people had just finished agreeing was the right one. 1853// ***MUTUAL DEFERENCE IS NOT COORDINATION.*** "I will use theirs" is only safe if exactly one author 1854// says it; when both do, the shared definition is destroyed by the very politeness meant to preserve 1855// it. The convergence was correct and the outcome was still a broken build, which is why this note 1856// exists instead of a third rewrite. If you are about to delete a duplicate in favour of a sibling's, 1857// VERIFY THEIRS IS STILL THERE IN THE SAME EDIT -- a grep from ten minutes ago is not evidence. 1858// This is the surviving definition and it is deliberately the SUPERSET: it counts CHECKPOINT (written 1859// by `nx_seat brief`) as proof of life alongside BEAT/KICKOFF, which the other copy omitted. 1860func st_last_ts_verb_span(q: *u8, n: i64, verb: *u8, ws_s: i64, ws_e: i64) -> i64 { 1861 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 1862 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 1863 let c0: *i64 = sys_mmap(ST_SPAN) as *i64 1864 var last: i64 = 0 - 1 1865 var i: i64 = 0 1866 while i < n { 1867 let le: i64 = st_le(q, i, n) 1868 if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { 1869 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], verb) == 1 { 1870 if st_col(q, i, le, 0, c0) == 1 { last = st_atoi_span(q, c0[0], c0[1]) } 1871 } } 1872 } } 1873 i = le + 1 1874 } 1875 return last 1876} 1877// 1 iff this ws is REAPED-AND-NOT-REVIVED: a reap frame exists and no LATER frame of a working verb 1878// follows it. Revival is deliberate, not a loophole -- a seat that beats (or briefs) after a reap is 1879// working again, which is exactly what nx_ws_kickoff_sync's T11 asserts. 1880func st_reaped_span(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 { 1881 let rt: i64 = st_last_ts_verb_span(q, n, "ORPHAN-REAPED" as *u8, ws_s, ws_e) 1882 if rt < 0 { return 0 } 1883 if st_last_ts_verb_span(q, n, "BEAT" as *u8, ws_s, ws_e) > rt { return 0 } 1884 if st_last_ts_verb_span(q, n, "KICKOFF" as *u8, ws_s, ws_e) > rt { return 0 } 1885 if st_last_ts_verb_span(q, n, "CHECKPOINT" as *u8, ws_s, ws_e) > rt { return 0 } 1886 return 1 1887} 1888// COMPOSES the sibling's st_reaped_span (landed above the same hour) instead of carrying a second 1889// copy. They had already mirrored ks_closed AND caught a verb I missed: CHECKPOINT, which 1890// `nx_seat brief` writes and which is every bit as much proof of life as a BEAT. My duplicate is 1891// DELETED rather than kept -- TWO READERS OF ONE JOURNAL MUST NOT CARRY TWO DEFINITIONS OF CURRENT, 1892// and that applies to two AUTHORS of one organ just as much as to two organs. 1893func st_ws_closed(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 { 1894 if st_has_span_done(q, n, ws_s, ws_e) == 1 { return 1 } 1895 return st_reaped_span(q, n, ws_s, ws_e) 1896} 1897// ttl<=0 REAPS NOTHING. The direction is deliberate and is the opposite of nx_favela_decay's: for a 1898// mitigation-expiry organ the safe default is "assume expired", but for a REAPER a missing config 1899// that reaped every row would erase the entire board in one unattended run. Silence must cost a 1900// stale row, never a mass close. Iterates a SNAPSHOT taken before the first append, so frames written 1901// during the pass cannot feed back into it. 1902func st_ws_sweep(wj: *u8, actor: *u8, note: *u8, ttl: i64, now: i64, cov: *i64) -> i64 { 1903 cov[0] = 0 1904 cov[1] = 0 1905 if ttl <= 0 { return 0 } 1906 // 8MB window, NOT ST_CAP (1MB). st_read is a TAIL reader, so a 1MB window over the live 1.37MB 1907 // journal silently drops the OLDEST 27pc -- and for a REAPER that is exactly inverted: the oldest 1908 // rows are precisely the dead ones it exists to close. MEASURED 2026-08-06: the first live sweep 1909 // reaped 10 and left ~11 lanes idle since Jul-20 completely untouched, because their KICKOFF frames 1910 // sat before the window. A TAIL-WINDOWED REAPER IS BLIND TO THE DEADEST LANES -- the same 1911 // bounded-read class found in nx_cron_watch and nx_ws_kickoff_sync on this same day, making four. 1912 // Coverage is DECLARED through cov[] so a partial sweep can never be read as a complete one. 1913 let q: *u8 = sys_mmap(ST_JRNL_BUF) 1914 let sz: *i64 = sys_mmap(ST_SPAN) as *i64 1915 let n: i64 = st_read(wj, q, ST_JRNL_BUF - 8, sz) 1916 cov[0] = sz[0] 1917 cov[1] = n 1918 if n <= 0 { return 0 } 1919 let cv: *i64 = sys_mmap(ST_SPAN) as *i64 1920 let cw: *i64 = sys_mmap(ST_SPAN) as *i64 1921 let wsb: *u8 = sys_mmap(512) 1922 let nb: *u8 = sys_mmap(ST_MAGIC_1024) 1923 var frames: i64 = 0 1924 var i: i64 = 0 1925 while i < n { 1926 let le: i64 = st_le(q, i, n) 1927 if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 { 1928 if st_col(q, i, le, 2, cw) == 1 { if st_first_kick(q, i, cw[0], cw[1]) == 1 { 1929 if st_ws_closed(q, n, cw[0], cw[1]) == 0 { 1930 let lt: i64 = st_last_ts_span(q, n, cw[0], cw[1]) 1931 let age: i64 = now - lt 1932 if lt > 0 { if age > ttl { if cw[1] - cw[0] < 500 { 1933 var a: i64 = 0 1934 while cw[0] + a < cw[1] { wsb[a] = q[cw[0] + a]; a = a + 1 } 1935 wsb[a] = 0 as u8 1936 var o: i64 = 0 1937 o = st_cat(nb, 0, "orphan-reap unclaimed-ws why=idle age=" as *u8) 1938 o = st_catn(nb, o, age) 1939 o = st_cat(nb, o, "s ttl=" as *u8) 1940 o = st_catn(nb, o, ttl) 1941 o = st_cat(nb, o, "s " as *u8) 1942 o = st_cat(nb, o, note) 1943 nb[o] = 0 as u8 1944 st_frame(wj, now, "ORPHAN-REAPED" as *u8, wsb, actor, nb) 1945 frames = frames + 1 1946 } } } 1947 } 1948 } } 1949 } } 1950 i = le + 1 1951 } 1952 return frames 1953} 1954func st_do_reap(actor: *u8, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 { 1955 let cout: *u8 = sys_mmap(ST_MAGIC_65536) 1956 let colen: *i64 = sys_mmap(ST_SPAN) as *i64 1957 let rc: i64 = st_reap_run(cj, actor, note, cout, ST_MAGIC_65536 - 4, colen) 1958 let cn: i64 = colen[0] 1959 let rv: *i64 = sys_mmap(ST_SPAN) as *i64 1960 let hv: *i64 = sys_mmap(ST_SPAN) as *i64 1961 let wsb: *u8 = sys_mmap(512) 1962 let nb: *u8 = sys_mmap(ST_MAGIC_1024) 1963 var frames: i64 = 0 1964 var i: i64 = 0 1965 while i < cn { 1966 let le: i64 = st_le(cout, i, cn) 1967 if st_tagval(cout, i, le, "REAPED resource=" as *u8, rv) == 1 { 1968 if st_tagval(cout, i, le, " holder=" as *u8, hv) == 1 { 1969 if rv[1] - rv[0] < 500 { 1970 let rvs: i64 = rv[0] 1971 let rve: i64 = rv[1] 1972 var a: i64 = 0 1973 while rvs + a < rve { wsb[a] = cout[rvs + a]; a = a + 1 } 1974 wsb[a] = 0 as u8 1975 var o: i64 = 0 1976 o = st_cat(nb, 0, "orphan-reap holder=" as *u8) 1977 let hvs: i64 = hv[0] 1978 let hve: i64 = hv[1] 1979 var b: i64 = 0 1980 while hvs + b < hve { if b < 200 { nb[o] = cout[hvs + b]; o = o + 1 } b = b + 1 } 1981 o = st_cat(nb, o, " why=ttl-expired " as *u8) 1982 o = st_cat(nb, o, note) 1983 nb[o] = 0 as u8 1984 st_frame(wj, sys_now_realtime_sec(), "ORPHAN-REAPED" as *u8, wsb, actor, nb) 1985 frames = frames + 1 1986 } 1987 } 1988 } 1989 i = le + 1 1990 } 1991 // SECOND PASS: the unclaimed half. Runs after the claims pass so a ws that had a claim is already 1992 // closed by the stronger (ttl-declared-by-the-seat-itself) evidence and is skipped here. 1993 let wsttl: i64 = st_reap_ttl("knowledge/status/ws_reap_ttl.conf" as *u8) 1994 let wscov: *i64 = sys_mmap(ST_SPAN) as *i64 1995 let idle: i64 = st_ws_sweep(wj, actor, note, wsttl, sys_now_realtime_sec(), wscov) 1996 var o2: i64 = 0 1997 o2 = st_cat(out, 0, "REAP claims-rc=" as *u8) 1998 o2 = st_catn(out, o2, rc) 1999 o2 = st_cat(out, o2, " ws-frames=" as *u8) 2000 o2 = st_catn(out, o2, frames) 2001 // envelope declared in-band: the ttl actually used, so a 0 (config absent => swept nothing) can 2002 // never be mistaken for "swept and found nothing idle". 2003 o2 = st_cat(out, o2, " ws-idle-frames=" as *u8) 2004 o2 = st_catn(out, o2, idle) 2005 o2 = st_cat(out, o2, " ws-idle-ttl=" as *u8) 2006 o2 = st_catn(out, o2, wsttl) 2007 // COVERAGE DECLARED. A sweep that saw 76pc of the journal and a sweep that saw all of it produce 2008 // the same `ws-idle-frames=N` and are not the same claim. Without these two numbers a partial 2009 // sweep reads exactly like a complete one that found nothing more to do. 2010 o2 = st_cat(out, o2, " ws-file-bytes=" as *u8) 2011 o2 = st_catn(out, o2, wscov[0]) 2012 o2 = st_cat(out, o2, " ws-scanned=" as *u8) 2013 o2 = st_catn(out, o2, wscov[1]) 2014 o2 = st_cat(out, o2, " claims-said: " as *u8) 2015 o2 = st_cat_esc(out, o2, cout, 0, cn, 600) 2016 out[o2] = ST_NL as u8 2017 o2 = o2 + 1 2018 sys_write(1, out, o2) 2019 return rc 2020} 2021// ==================== DM2 CRASH-RESUME MAP (/compare/devmgmt rung DM2: st_resume_map) ==================== 2022// One call after a crash: the per-seat lane / last-action / in-flight / resume-point map mined from the 2023// session record itself (transcript JSONL + scratchpad + task-child outputs), ground-truthed against the 2024// hand-mined 2026-08-19 double-crash map. EVIDENCE NOT AUTHORITY (devmgmt.plan risk row): the map never 2025// relaunches a seat; the coordinator judges. IN-FLIGHT IS WRONG ONLY TOWARD FLAGGING: a tool_use whose id 2026// has no tool_result anywhere in the file flags, an unparseable or unterminated FINAL line flags; nothing 2027// is ever silently cleared. The transcript wire format is vendor-declared version-unstable, so every 2028// line's depth-1 "type" lands in a per-file census (unknown names counted by name, never misfiled, never 2029// a crash) and a line without a parseable depth-1 type is MALFORMED evidence, not a skip. 2030func st_rm_slot(strs: *u8, k: i64) -> *u8 { return ((strs as i64) + k * ST_RM_SLOT) as *u8 } 2031 2032func st_rm_emit(lb: *u8, o: i64) -> i64 { 2033 lb[o] = ST_NL as u8 2034 sys_write(1, lb, o + 1) 2035 return 0 2036} 2037 2038// first index of lit in q[s..e), or -1 (sj_span_has answers only yes/no; the map needs the position) 2039func st_rm_find(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { 2040 let fn_l: i64 = st_vlen(lit) 2041 if fn_l == 0 { return 0 - 1 } 2042 var fn_i: i64 = s 2043 while fn_i + fn_l <= e { 2044 var fn_j: i64 = 0 2045 var fn_ok: i64 = 1 2046 while fn_j < fn_l { if q[fn_i + fn_j] != lit[fn_j] { fn_ok = 0; fn_j = fn_l } else { fn_j = fn_j + 1 } } 2047 if fn_ok == 1 { return fn_i } 2048 fn_i = fn_i + 1 2049 } 2050 return 0 - 1 2051} 2052 2053// index of the closing quote of a JSON string whose first content byte is s (escape-aware); le if unterminated 2054func st_rm_str_end(q: *u8, s: i64, le: i64) -> i64 { 2055 var se_i: i64 = s 2056 var se_go: i64 = 1 2057 while se_go == 1 { 2058 if se_i >= le { se_go = 0 } else { 2059 let se_c: i64 = q[se_i] as i64 2060 if se_c == ST_RM_BSLASH { se_i = se_i + 2 } else { 2061 if se_c == ST_RM_QUOTE { se_go = 0 } else { se_i = se_i + 1 } 2062 } 2063 } 2064 } 2065 if se_i > le { return le } 2066 return se_i 2067} 2068 2069// DEPTH-1 string-valued key extractor over one JSONL line. A first-occurrence scan is WRONG here: 2070// message.type ("message") serializes BEFORE the top-level type on assistant lines, so the extractor 2071// tracks brace+bracket depth, skips strings whole, and matches keys only at depth 1. Returns 1 with 2072// sp[0..1] = value span, 0 when the key is absent or its value is not a string. 2073func st_rm_top(q: *u8, ls: i64, le: i64, key: *u8, sp: *i64) -> i64 { 2074 var tp_i: i64 = ls 2075 var tp_bd: i64 = 0 2076 var tp_kd: i64 = 0 2077 while tp_i < le { 2078 let tp_c: i64 = q[tp_i] as i64 2079 if tp_c == ST_RM_QUOTE { 2080 let tp_ss: i64 = tp_i + 1 2081 let tp_se: i64 = st_rm_str_end(q, tp_ss, le) 2082 var tp_p: i64 = tp_se + 1 2083 var tp_sk: i64 = 1 2084 while tp_sk == 1 { if tp_p >= le { tp_sk = 0 } else { if (q[tp_p] as i64) == ST_RM_SPACE { tp_p = tp_p + 1 } else { tp_sk = 0 } } } 2085 var tp_key: i64 = 0 2086 if tp_p < le { if (q[tp_p] as i64) == ST_RM_COLON { tp_key = 1 } } 2087 if tp_key == 1 { 2088 var tp_hit: i64 = 0 2089 if tp_bd == 1 { if tp_kd == 0 { if st_lit_eq(q, tp_ss, tp_se, key) == 1 { tp_hit = 1 } } } 2090 if tp_hit == 1 { 2091 var tp_v: i64 = tp_p + 1 2092 var tp_s2: i64 = 1 2093 while tp_s2 == 1 { if tp_v >= le { tp_s2 = 0 } else { if (q[tp_v] as i64) == ST_RM_SPACE { tp_v = tp_v + 1 } else { tp_s2 = 0 } } } 2094 if tp_v < le { if (q[tp_v] as i64) == ST_RM_QUOTE { 2095 let tp_vs: i64 = tp_v + 1 2096 sp[0] = tp_vs 2097 sp[1] = st_rm_str_end(q, tp_vs, le) 2098 return 1 2099 } } 2100 return 0 2101 } 2102 tp_i = tp_p + 1 2103 } else { tp_i = tp_se + 1 } 2104 } else { 2105 if tp_c == ST_RM_LBRACE { tp_bd = tp_bd + 1 } 2106 if tp_c == ST_RM_RBRACE { tp_bd = tp_bd - 1 } 2107 if tp_c == ST_RM_LBRACK { tp_kd = tp_kd + 1 } 2108 if tp_c == ST_RM_RBRACK { tp_kd = tp_kd - 1 } 2109 tp_i = tp_i + 1 2110 } 2111 } 2112 return 0 2113} 2114 2115// condense span into dst (NUL-terminated) under the incumbent's row-escape budget ST_ROW_ESC 2116func st_rm_cond(dst: *u8, q: *u8, s: i64, e: i64) -> i64 { 2117 var cd_o: i64 = st_cat_esc(dst, 0, q, s, e, ST_ROW_ESC) 2118 dst[cd_o] = 0 as u8 2119 return cd_o 2120} 2121 2122func st_rm_hash(q: *u8, s: i64, e: i64) -> i64 { 2123 var hs_v: i64 = 0 2124 var hs_i: i64 = s 2125 while hs_i < e { hs_v = hs_v * ST_RM_HASHMUL + (q[hs_i] as i64); hs_i = hs_i + 1 } 2126 return hs_v 2127} 2128 2129// per-file entry-type census: count by NAME so an unknown type is COUNTED, never misfiled into a known 2130// bucket. Table overflow sets types_floor (announced) -- a full table is a FLOOR, never a silent drop. 2131func st_rm_census(tn: *u8, tc: *i64, ntypes: *i64, q: *u8, s: i64, e: i64, res: *i64) -> i64 { 2132 var cn_l: i64 = e - s 2133 if cn_l >= ST_RM_TYPENAME { cn_l = ST_RM_TYPENAME - 1 } 2134 var cn_i: i64 = 0 2135 while cn_i < ntypes[0] { 2136 let cn_row: *u8 = ((tn as i64) + cn_i * ST_RM_TYPENAME) as *u8 2137 if st_lit_eq(q, s, s + cn_l, cn_row) == 1 { tc[cn_i] = tc[cn_i] + 1; return cn_i } 2138 cn_i = cn_i + 1 2139 } 2140 if ntypes[0] >= ST_RM_TYPEMAX { res[ST_RM_R_TYPEFLOOR] = 1; return 0 - 1 } 2141 let cn_nr: *u8 = ((tn as i64) + ntypes[0] * ST_RM_TYPENAME) as *u8 2142 var cn_j: i64 = 0 2143 while cn_j < cn_l { cn_nr[cn_j] = q[s + cn_j]; cn_j = cn_j + 1 } 2144 cn_nr[cn_l] = 0 as u8 2145 tc[ntypes[0]] = 1 2146 ntypes[0] = ntypes[0] + 1 2147 return ntypes[0] - 1 2148} 2149 2150// entry-kind classes measured from the 2026-08-19/20 record (10-file schema probe); unknown stays UNKNOWN 2151func st_rm_kind(q: *u8, s: i64, e: i64) -> i64 { 2152 if st_lit_eq(q, s, e, "assistant" as *u8) == 1 { return ST_RM_K_ASSIST } 2153 if st_lit_eq(q, s, e, "user" as *u8) == 1 { return ST_RM_K_AWAIT } 2154 if st_lit_eq(q, s, e, "attachment" as *u8) == 1 { return ST_RM_K_AWAIT } 2155 if st_lit_eq(q, s, e, "queue-operation" as *u8) == 1 { return ST_RM_K_QUEUE } 2156 if st_lit_eq(q, s, e, "system" as *u8) == 1 { return ST_RM_K_META } 2157 if st_lit_eq(q, s, e, "summary" as *u8) == 1 { return ST_RM_K_META } 2158 if st_lit_eq(q, s, e, "ai-title" as *u8) == 1 { return ST_RM_K_META } 2159 if st_lit_eq(q, s, e, "last-prompt" as *u8) == 1 { return ST_RM_K_META } 2160 if st_lit_eq(q, s, e, "mode" as *u8) == 1 { return ST_RM_K_META } 2161 if st_lit_eq(q, s, e, "permission-mode" as *u8) == 1 { return ST_RM_K_META } 2162 if st_lit_eq(q, s, e, "file-history-snapshot" as *u8) == 1 { return ST_RM_K_META } 2163 if st_lit_eq(q, s, e, "atis-latch" as *u8) == 1 { return ST_RM_K_META } 2164 return ST_RM_K_UNKNOWN 2165} 2166 2167func st_rm_ends(name: *u8, ext: *u8) -> i64 { 2168 let ed_nl: i64 = st_vlen(name) 2169 let ed_el: i64 = st_vlen(ext) 2170 if ed_el > ed_nl { return 0 } 2171 var ed_i: i64 = 0 2172 while ed_i < ed_el { if name[ed_nl - ed_el + ed_i] != ext[ed_i] { return 0 } ed_i = ed_i + 1 } 2173 return 1 2174} 2175 2176func st_rm_join(dst: *u8, dir: *u8, name: *u8) -> i64 { 2177 var jn_o: i64 = st_cat(dst, 0, dir) 2178 dst[jn_o] = ST_RM_SLASH as u8 2179 jn_o = jn_o + 1 2180 jn_o = st_cat(dst, jn_o, name) 2181 dst[jn_o] = 0 as u8 2182 return jn_o 2183} 2184 2185func st_rm_statml(path: *u8, mtp: *i64, szp: *i64) -> i64 { 2186 let sm_sb: *u8 = sys_mmap(ST_RM_STATBUF) 2187 if sys_fstatat(path, sm_sb) < 0 { return 0 } 2188 let sm_w: *i64 = sm_sb as *i64 2189 mtp[0] = sm_w[ST_RM_STAT_MTIME_IDX] 2190 szp[0] = sm_w[ST_RM_STAT_SIZE_IDX] 2191 return 1 2192} 2193 2194// enumerate regular entries of dir. ext filters by suffix ("-" keeps everything; filtered-out entries go 2195// to the nonj census so they are COUNTED, never silently dropped). cap==0 counts only. getdents64 is 2196// LOOPED to completion -- one call is a prefix, never a listing. ONE enumerator serves transcripts, 2197// scratchpads, task children and journal days: a second copy would be the duplicate-ruler defect. 2198// Returns kept count, -1 when the dir is unreadable; grew[0] rises when the dir outgrew cap between 2199// passes (announced, never silent). 2200func st_rm_enum(dir: *u8, ext: *u8, names: *u8, mt: *i64, szs: *i64, cap: i64, nonj: *i64, statfail: *i64, grew: *i64) -> i64 { 2201 let ev_fd: i64 = sys_openat_rd(dir) 2202 if ev_fd < 0 { return 0 - 1 } 2203 let ev_db: *u8 = sys_mmap(ST_RM_DIRBUF) 2204 let ev_path: *u8 = sys_mmap(ST_RM_PATHCAP) 2205 let ev_m1: *i64 = sys_mmap(ST_SPAN) as *i64 2206 let ev_s1: *i64 = sys_mmap(ST_SPAN) as *i64 2207 var ev_cnt: i64 = 0 2208 var ev_run: i64 = 1 2209 while ev_run == 1 { 2210 let ev_n: i64 = sys_getdents64(ev_fd, ev_db, ST_RM_DIRBUF) 2211 if ev_n <= 0 { ev_run = 0 } else { 2212 var ev_off: i64 = 0 2213 while ev_off < ev_n { 2214 let ev_rec: *u8 = ((ev_db as i64) + ev_off) as *u8 2215 let ev_rl: i64 = dirent_reclen(ev_rec) 2216 if ev_rl <= 0 { ev_off = ev_n } else { 2217 let ev_nm: *u8 = dirent_name(ev_rec) 2218 var ev_skip: i64 = 0 2219 if (ev_rec[ST_RM_DENT_TYPE_OFF] as i64) == ST_RM_DT_DIR { ev_skip = 1 } 2220 if ev_nm[0] == (ST_RM_DOT as u8) { if ev_nm[1] == (0 as u8) { ev_skip = 1 } } 2221 if ev_nm[0] == (ST_RM_DOT as u8) { if ev_nm[1] == (ST_RM_DOT as u8) { if ev_nm[2] == (0 as u8) { ev_skip = 1 } } } 2222 if ev_skip == 0 { if st_lit_eq(ext, 0, st_vlen(ext), "-" as *u8) == 0 { if st_rm_ends(ev_nm, ext) == 0 { nonj[0] = nonj[0] + 1; ev_skip = 1 } } } 2223 if ev_skip == 0 { 2224 if cap == 0 { ev_cnt = ev_cnt + 1 } else { 2225 if ev_cnt >= cap { grew[0] = grew[0] + 1 } else { 2226 st_rm_join(ev_path, dir, ev_nm) 2227 if st_rm_statml(ev_path, ev_m1, ev_s1) == 0 { statfail[0] = statfail[0] + 1 } else { 2228 let ev_sl: *u8 = ((names as i64) + ev_cnt * ST_RM_NAMECAP) as *u8 2229 var ev_k: i64 = 0 2230 var ev_g2: i64 = 1 2231 while ev_g2 == 1 { if ev_k >= ST_RM_NAMECAP - 1 { ev_g2 = 0 } else { if ev_nm[ev_k] == (0 as u8) { ev_g2 = 0 } else { ev_sl[ev_k] = ev_nm[ev_k]; ev_k = ev_k + 1 } } } 2232 ev_sl[ev_k] = 0 as u8 2233 mt[ev_cnt] = ev_m1[0] 2234 szs[ev_cnt] = ev_s1[0] 2235 ev_cnt = ev_cnt + 1 2236 } 2237 } 2238 } 2239 } 2240 ev_off = ev_off + ev_rl 2241 } 2242 } 2243 } 2244 } 2245 sys_close(ev_fd) 2246 return ev_cnt 2247} 2248 2249// FULL-POPULATION tool-call pairing over the whole file (never a tail window): a tool_use id with no 2250// tool_result anywhere is IN-FLIGHT. The two literals cannot collide: in "tool_use_id" the "id" is 2251// preceded by '_' not '"', so the use anchor matches only declarations. Orphan results (result without 2252// use) are counted as evidence that a malformed line may be hiding the use -- printed, never dropped. 2253func st_rm_pair(q: *u8, n: i64, res: *i64) -> i64 { 2254 let pr_lu: *u8 = "\"id\":\"toolu_" as *u8 2255 let pr_ku: i64 = st_vlen("\"id\":\"" as *u8) 2256 let pr_lr: *u8 = "_use_id\":\"toolu_" as *u8 2257 let pr_kr: i64 = st_vlen("_use_id\":\"" as *u8) 2258 var pr_uc: i64 = 0 2259 var pr_p: i64 = 0 2260 var pr_g: i64 = 1 2261 while pr_g == 1 { let pr_m: i64 = st_rm_find(q, pr_p, n, pr_lu); if pr_m < 0 { pr_g = 0 } else { pr_uc = pr_uc + 1; pr_p = pr_m + pr_ku } } 2262 var pr_rc: i64 = 0 2263 pr_p = 0 2264 pr_g = 1 2265 while pr_g == 1 { let pr_m2: i64 = st_rm_find(q, pr_p, n, pr_lr); if pr_m2 < 0 { pr_g = 0 } else { pr_rc = pr_rc + 1; pr_p = pr_m2 + pr_kr } } 2266 res[ST_RM_R_USES] = pr_uc 2267 res[ST_RM_R_RESULTS] = pr_rc 2268 let pr_uo: *i64 = sys_mmap((pr_uc + 1) * ST_RM_I64B) as *i64 2269 let pr_ue: *i64 = sys_mmap((pr_uc + 1) * ST_RM_I64B) as *i64 2270 let pr_uh: *i64 = sys_mmap((pr_uc + 1) * ST_RM_I64B) as *i64 2271 let pr_ro: *i64 = sys_mmap((pr_rc + 1) * ST_RM_I64B) as *i64 2272 let pr_re: *i64 = sys_mmap((pr_rc + 1) * ST_RM_I64B) as *i64 2273 let pr_rh: *i64 = sys_mmap((pr_rc + 1) * ST_RM_I64B) as *i64 2274 var pr_i: i64 = 0 2275 pr_p = 0 2276 pr_g = 1 2277 while pr_g == 1 { 2278 let pr_m3: i64 = st_rm_find(q, pr_p, n, pr_lu) 2279 if pr_m3 < 0 { pr_g = 0 } else { 2280 if pr_i < pr_uc { 2281 let pr_vs: i64 = pr_m3 + pr_ku 2282 let pr_ve: i64 = st_rm_str_end(q, pr_vs, n) 2283 pr_uo[pr_i] = pr_vs 2284 pr_ue[pr_i] = pr_ve 2285 pr_uh[pr_i] = st_rm_hash(q, pr_vs, pr_ve) 2286 pr_i = pr_i + 1 2287 } 2288 pr_p = pr_m3 + pr_ku 2289 } 2290 } 2291 var pr_j: i64 = 0 2292 pr_p = 0 2293 pr_g = 1 2294 while pr_g == 1 { 2295 let pr_m4: i64 = st_rm_find(q, pr_p, n, pr_lr) 2296 if pr_m4 < 0 { pr_g = 0 } else { 2297 if pr_j < pr_rc { 2298 let pr_ws: i64 = pr_m4 + pr_kr 2299 let pr_we: i64 = st_rm_str_end(q, pr_ws, n) 2300 pr_ro[pr_j] = pr_ws 2301 pr_re[pr_j] = pr_we 2302 pr_rh[pr_j] = st_rm_hash(q, pr_ws, pr_we) 2303 pr_j = pr_j + 1 2304 } 2305 pr_p = pr_m4 + pr_kr 2306 } 2307 } 2308 let pr_dang: *u8 = sys_mmap((pr_uc + 1) * ST_RM_DANGROW) 2309 res[ST_RM_R_DANGBUF] = pr_dang as i64 2310 var pr_dn: i64 = 0 2311 var pr_u2: i64 = 0 2312 while pr_u2 < pr_i { 2313 var pr_found: i64 = 0 2314 var pr_r2: i64 = 0 2315 while pr_r2 < pr_j { 2316 if pr_rh[pr_r2] == pr_uh[pr_u2] { 2317 if st_span_eq(q, pr_uo[pr_u2], pr_ue[pr_u2], pr_ro[pr_r2], pr_re[pr_r2]) == 1 { pr_found = 1; pr_r2 = pr_j } 2318 } 2319 if pr_r2 < pr_j { pr_r2 = pr_r2 + 1 } 2320 } 2321 if pr_found == 0 { 2322 let pr_row: *u8 = ((pr_dang as i64) + pr_dn * ST_RM_DANGROW) as *u8 2323 var pr_o: i64 = st_cat(pr_row, 0, "id=" as *u8) 2324 var pr_il: i64 = pr_ue[pr_u2] - pr_uo[pr_u2] 2325 if pr_il > ST_RM_IDCAP { pr_il = ST_RM_IDCAP } 2326 var pr_c2: i64 = 0 2327 while pr_c2 < pr_il { pr_row[pr_o] = q[pr_uo[pr_u2] + pr_c2]; pr_o = pr_o + 1; pr_c2 = pr_c2 + 1 } 2328 pr_o = st_cat(pr_row, pr_o, " tool=" as *u8) 2329 let pr_le: i64 = st_le(q, pr_uo[pr_u2], n) 2330 let pr_nm: i64 = st_rm_find(q, pr_ue[pr_u2], pr_le, "\"name\":\"" as *u8) 2331 if pr_nm >= 0 { 2332 let pr_ns: i64 = pr_nm + st_vlen("\"name\":\"" as *u8) 2333 let pr_ne: i64 = st_rm_str_end(q, pr_ns, pr_le) 2334 var pr_nl: i64 = pr_ne - pr_ns 2335 if pr_nl > ST_RM_TOOLCAP { pr_nl = ST_RM_TOOLCAP } 2336 var pr_c3: i64 = 0 2337 while pr_c3 < pr_nl { pr_row[pr_o] = q[pr_ns + pr_c3]; pr_o = pr_o + 1; pr_c3 = pr_c3 + 1 } 2338 } else { pr_o = st_cat(pr_row, pr_o, "UNKNOWN" as *u8) } 2339 pr_row[pr_o] = 0 as u8 2340 pr_dn = pr_dn + 1 2341 } 2342 pr_u2 = pr_u2 + 1 2343 } 2344 res[ST_RM_R_DANGLING] = pr_dn 2345 var pr_or: i64 = 0 2346 var pr_r3: i64 = 0 2347 while pr_r3 < pr_j { 2348 var pr_f2: i64 = 0 2349 var pr_u3: i64 = 0 2350 while pr_u3 < pr_i { 2351 if pr_uh[pr_u3] == pr_rh[pr_r3] { 2352 if st_span_eq(q, pr_uo[pr_u3], pr_ue[pr_u3], pr_ro[pr_r3], pr_re[pr_r3]) == 1 { pr_f2 = 1; pr_u3 = pr_i } 2353 } 2354 if pr_u3 < pr_i { pr_u3 = pr_u3 + 1 } 2355 } 2356 if pr_f2 == 0 { pr_or = pr_or + 1 } 2357 pr_r3 = pr_r3 + 1 2358 } 2359 res[ST_RM_R_ORPHANRES] = pr_or 2360 return pr_dn 2361} 2362 2363// scan ONE record file (transcript or task-child output): whole file, never a sample. Fills res slots, 2364// condensed-evidence strings and the type census. Returns 1 readable, 0 not (OK=0 -> UNKNOWN upstream). 2365func st_rm_scan(path: *u8, res: *i64, strs: *u8, tn: *u8, tc: *i64) -> i64 { 2366 var sc_z: i64 = 0 2367 while sc_z < ST_RM_R_SLOTS { res[sc_z] = 0; sc_z = sc_z + 1 } 2368 var sc_y: i64 = 0 2369 while sc_y < ST_RM_S_N { let sc_sl: *u8 = st_rm_slot(strs, sc_y); sc_sl[0] = 0 as u8; sc_y = sc_y + 1 } 2370 let sc_fl: *i64 = sys_mmap(ST_SPAN) as *i64 2371 let q: *u8 = sys_map_file(path, sc_fl) 2372 if (q as i64) == 0 { return 0 } 2373 let sc_n: i64 = sc_fl[0] 2374 res[ST_RM_R_BYTES] = sc_n 2375 if sc_n <= 0 { return 0 } 2376 res[ST_RM_R_OK] = 1 2377 if q[sc_n - 1] != (ST_NL as u8) { res[ST_RM_R_TAILUNTERM] = 1 } 2378 let sc_hle: i64 = st_le(q, 0, sc_n) 2379 if st_rm_find(q, 0, sc_hle, "\"isSidechain\":true" as *u8) >= 0 { res[ST_RM_R_SIDECHAIN] = 1 } 2380 let sc_sp: *i64 = sys_mmap(ST_SPAN) as *i64 2381 let sc_nt: *i64 = sys_mmap(ST_SPAN) as *i64 2382 sc_nt[0] = 0 2383 var sc_lastkind: i64 = 0 2384 var sc_i: i64 = 0 2385 while sc_i < sc_n { 2386 let sc_le: i64 = st_le(q, sc_i, sc_n) 2387 res[ST_RM_R_LINES] = res[ST_RM_R_LINES] + 1 2388 if st_rm_top(q, sc_i, sc_le, "type" as *u8, sc_sp) == 1 { 2389 let sc_t1: i64 = sc_sp[0] 2390 let sc_t2: i64 = sc_sp[1] 2391 st_rm_census(tn, tc, sc_nt, q, sc_t1, sc_t2, res) 2392 let sc_k: i64 = st_rm_kind(q, sc_t1, sc_t2) 2393 sc_lastkind = sc_k 2394 if st_rm_top(q, sc_i, sc_le, "timestamp" as *u8, sc_sp) == 1 { 2395 var sc_tl: i64 = sc_sp[1] - sc_sp[0] 2396 if sc_tl >= ST_RM_TSCAP { sc_tl = ST_RM_TSCAP - 1 } 2397 let sc_td: *u8 = st_rm_slot(strs, ST_RM_S_TS) 2398 var sc_w: i64 = 0 2399 while sc_w < sc_tl { sc_td[sc_w] = q[sc_sp[0] + sc_w]; sc_w = sc_w + 1 } 2400 sc_td[sc_tl] = 0 as u8 2401 } 2402 if sc_k == ST_RM_K_ASSIST { 2403 var sc_tp: i64 = sc_i 2404 var sc_tg: i64 = 1 2405 while sc_tg == 1 { 2406 let sc_m: i64 = st_rm_find(q, sc_tp, sc_le, "\"id\":\"toolu_" as *u8) 2407 if sc_m < 0 { sc_tg = 0 } else { 2408 let sc_vs: i64 = sc_m + st_vlen("\"id\":\"" as *u8) 2409 let sc_ve: i64 = st_rm_str_end(q, sc_vs, sc_le) 2410 let sc_tdn: *u8 = st_rm_slot(strs, ST_RM_S_TOOL) 2411 let sc_nm: i64 = st_rm_find(q, sc_ve, sc_le, "\"name\":\"" as *u8) 2412 if sc_nm >= 0 { 2413 let sc_ns: i64 = sc_nm + st_vlen("\"name\":\"" as *u8) 2414 let sc_ne: i64 = st_rm_str_end(q, sc_ns, sc_le) 2415 st_rm_cond(sc_tdn, q, sc_ns, sc_ne) 2416 let sc_ip: i64 = st_rm_find(q, sc_ne, sc_le, "\"input\":" as *u8) 2417 if sc_ip >= 0 { st_rm_cond(st_rm_slot(strs, ST_RM_S_INPUT), q, sc_ip + st_vlen("\"input\":" as *u8), sc_le) } 2418 } else { st_rm_cond(sc_tdn, q, sc_vs, sc_ve) } 2419 sc_tp = sc_ve 2420 } 2421 } 2422 let sc_tx: i64 = st_rm_find(q, sc_i, sc_le, "{\"type\":\"text\",\"text\":\"" as *u8) 2423 if sc_tx >= 0 { 2424 let sc_xs: i64 = sc_tx + st_vlen("{\"type\":\"text\",\"text\":\"" as *u8) 2425 let sc_xe: i64 = st_rm_str_end(q, sc_xs, sc_le) 2426 st_rm_cond(st_rm_slot(strs, ST_RM_S_TEXT), q, sc_xs, sc_xe) 2427 res[ST_RM_R_HASTEXT] = 1 2428 } 2429 } 2430 if sc_k == ST_RM_K_AWAIT { 2431 let sc_pd: *u8 = st_rm_slot(strs, ST_RM_S_PROMPT) 2432 if sc_pd[0] == (0 as u8) { 2433 let sc_cp: i64 = st_rm_find(q, sc_i, sc_le, "\"content\":\"" as *u8) 2434 if sc_cp >= 0 { 2435 let sc_cs: i64 = sc_cp + st_vlen("\"content\":\"" as *u8) 2436 st_rm_cond(sc_pd, q, sc_cs, st_rm_str_end(q, sc_cs, sc_le)) 2437 } 2438 } 2439 } 2440 if st_lit_eq(q, sc_t1, sc_t2, "ai-title" as *u8) == 1 { 2441 if st_rm_top(q, sc_i, sc_le, "aiTitle" as *u8, sc_sp) == 1 { st_rm_cond(st_rm_slot(strs, ST_RM_S_TITLE), q, sc_sp[0], sc_sp[1]) } 2442 } 2443 if st_lit_eq(q, sc_t1, sc_t2, "last-prompt" as *u8) == 1 { 2444 if st_rm_top(q, sc_i, sc_le, "lastPrompt" as *u8, sc_sp) == 1 { st_rm_cond(st_rm_slot(strs, ST_RM_S_LPROMPT), q, sc_sp[0], sc_sp[1]) } 2445 } 2446 } else { 2447 res[ST_RM_R_MALFORMED] = res[ST_RM_R_MALFORMED] + 1 2448 if sc_le >= sc_n - 1 { 2449 res[ST_RM_R_TAILMAL] = 1 2450 res[ST_RM_R_TAILMALLEN] = sc_le - sc_i 2451 var sc_nz: i64 = sc_i 2452 var sc_ng: i64 = 1 2453 while sc_ng == 1 { if sc_nz >= sc_le { sc_ng = 0 } else { if q[sc_nz] == (0 as u8) { res[ST_RM_R_NULFINAL] = 1; sc_ng = 0 } else { sc_nz = sc_nz + 1 } } } 2454 } 2455 } 2456 sc_i = sc_le + 1 2457 } 2458 res[ST_RM_R_LASTKIND] = sc_lastkind 2459 res[ST_RM_R_TYPES] = sc_nt[0] 2460 st_rm_pair(q, sc_n, res) 2461 sys_free_file(q, sc_n) 2462 return 1 2463} 2464 2465// seat state from evidence only. Crash evidence (dangling use, malformed or unterminated tail) wins; 2466// a clean tail whose last turn ENDED in assistant text is COMPLETED; a clean tail awaiting the model 2467// (user/tool_result/attachment/queue last) is IDLE; anything else is UNKNOWN -- its own bucket. 2468func st_rm_state_code(res: *i64) -> i64 { 2469 if res[ST_RM_R_OK] == 0 { return ST_RM_ST_UNKNOWN } 2470 let su_c: i64 = res[ST_RM_R_TAILMAL] + res[ST_RM_R_TAILUNTERM] + res[ST_RM_R_DANGLING] 2471 if su_c > 0 { return ST_RM_ST_CRASHED } 2472 let su_k: i64 = res[ST_RM_R_LASTKIND] 2473 if su_k == ST_RM_K_ASSIST { if res[ST_RM_R_HASTEXT] == 1 { return ST_RM_ST_COMPLETED } return ST_RM_ST_UNKNOWN } 2474 if su_k == ST_RM_K_META { if res[ST_RM_R_HASTEXT] == 1 { return ST_RM_ST_COMPLETED } return ST_RM_ST_UNKNOWN } 2475 if su_k == ST_RM_K_AWAIT { return ST_RM_ST_IDLE } 2476 if su_k == ST_RM_K_QUEUE { return ST_RM_ST_IDLE } 2477 return ST_RM_ST_UNKNOWN 2478} 2479 2480func st_rm_code_lit(c: i64) -> *u8 { 2481 if c == ST_RM_ST_CRASHED { return "CRASHED-MIDACTION" as *u8 } 2482 if c == ST_RM_ST_COMPLETED { return "COMPLETED" as *u8 } 2483 if c == ST_RM_ST_IDLE { return "IDLE" as *u8 } 2484 return "UNKNOWN" as *u8 2485} 2486 2487// scratchpad + task-child evidence for one seat. Children are the FULL population (no caps); each 2488// task child is scanned with the SAME scanner as the parent -- the 2026-08-19 second-crash resume map 2489// was hand-mined from exactly these a*.output JSONL tails. 2490func st_rm_children(troot: *u8, sid: *u8, lb: *u8, res2: *i64, strs2: *u8, tn2: *u8, tc2: *i64) -> i64 { 2491 let ch_dm: *u8 = sys_mmap(ST_RM_NAMECAP) 2492 let ch_di: *i64 = sys_mmap(ST_SPAN) as *i64 2493 let ch_z: *i64 = sys_mmap(ST_SPAN) as *i64 2494 let ch_sf: *i64 = sys_mmap(ST_SPAN) as *i64 2495 let ch_gw: *i64 = sys_mmap(ST_SPAN) as *i64 2496 let ch_dir: *u8 = sys_mmap(ST_RM_PATHCAP) 2497 let ch_path: *u8 = sys_mmap(ST_RM_PATHCAP) 2498 var ch_line: i64 = 0 2499 var ch_o: i64 = st_cat(ch_dir, 0, troot) 2500 ch_dir[ch_o] = ST_RM_SLASH as u8 2501 ch_o = ch_o + 1 2502 ch_o = st_cat(ch_dir, ch_o, sid) 2503 ch_o = st_cat(ch_dir, ch_o, "/scratchpad" as *u8) 2504 ch_dir[ch_o] = 0 as u8 2505 ch_z[0] = 0 2506 ch_sf[0] = 0 2507 ch_gw[0] = 0 2508 let ch_c0: i64 = st_rm_enum(ch_dir, "-" as *u8, ch_dm, ch_di, ch_di, 0, ch_z, ch_sf, ch_gw) 2509 if ch_c0 < 0 { 2510 ch_line = st_cat(lb, 0, " scratchpad path=" as *u8) 2511 ch_line = st_cat(lb, ch_line, ch_dir) 2512 ch_line = st_cat(lb, ch_line, " ABSENT" as *u8) 2513 st_rm_emit(lb, ch_line) 2514 } else { 2515 let ch_nm: *u8 = sys_mmap((ch_c0 + 1) * ST_RM_NAMECAP) 2516 let ch_mt: *i64 = sys_mmap((ch_c0 + 1) * ST_RM_I64B) as *i64 2517 let ch_sz: *i64 = sys_mmap((ch_c0 + 1) * ST_RM_I64B) as *i64 2518 let ch_n2: i64 = st_rm_enum(ch_dir, "-" as *u8, ch_nm, ch_mt, ch_sz, ch_c0, ch_z, ch_sf, ch_gw) 2519 ch_line = st_cat(lb, 0, " scratchpad path=" as *u8) 2520 ch_line = st_cat(lb, ch_line, ch_dir) 2521 ch_line = st_cat(lb, ch_line, " files=" as *u8) 2522 ch_line = st_catn(lb, ch_line, ch_n2) 2523 if ch_gw[0] > 0 { ch_line = st_cat(lb, ch_line, " grew_during_enum=" as *u8); ch_line = st_catn(lb, ch_line, ch_gw[0]) } 2524 st_rm_emit(lb, ch_line) 2525 let ch_us: *i64 = sys_mmap((ch_n2 + 1) * ST_RM_I64B) as *i64 2526 var ch_u1: i64 = 0 2527 while ch_u1 < ch_n2 { ch_us[ch_u1] = 0; ch_u1 = ch_u1 + 1 } 2528 var ch_k2: i64 = 0 2529 var ch_lim: i64 = ST_FRONT_MAX 2530 if ch_n2 < ch_lim { ch_lim = ch_n2 } 2531 while ch_k2 < ch_lim { 2532 var ch_bv: i64 = 0 - 1 2533 var ch_bi: i64 = 0 - 1 2534 var ch_s2: i64 = 0 2535 while ch_s2 < ch_n2 { 2536 if ch_us[ch_s2] == 0 { if ch_mt[ch_s2] > ch_bv { ch_bv = ch_mt[ch_s2]; ch_bi = ch_s2 } } 2537 ch_s2 = ch_s2 + 1 2538 } 2539 if ch_bi >= 0 { 2540 ch_us[ch_bi] = 1 2541 ch_line = st_cat(lb, 0, " scratch_new " as *u8) 2542 ch_line = st_cat(lb, ch_line, ((ch_nm as i64) + ch_bi * ST_RM_NAMECAP) as *u8) 2543 ch_line = st_cat(lb, ch_line, " bytes=" as *u8) 2544 ch_line = st_catn(lb, ch_line, ch_sz[ch_bi]) 2545 ch_line = st_cat(lb, ch_line, " mtime=" as *u8) 2546 ch_line = st_catn(lb, ch_line, ch_mt[ch_bi]) 2547 st_rm_emit(lb, ch_line) 2548 } 2549 ch_k2 = ch_k2 + 1 2550 } 2551 } 2552 ch_o = st_cat(ch_dir, 0, troot) 2553 ch_dir[ch_o] = ST_RM_SLASH as u8 2554 ch_o = ch_o + 1 2555 ch_o = st_cat(ch_dir, ch_o, sid) 2556 ch_o = st_cat(ch_dir, ch_o, "/tasks" as *u8) 2557 ch_dir[ch_o] = 0 as u8 2558 ch_z[0] = 0 2559 ch_sf[0] = 0 2560 ch_gw[0] = 0 2561 let ch_t0: i64 = st_rm_enum(ch_dir, "-" as *u8, ch_dm, ch_di, ch_di, 0, ch_z, ch_sf, ch_gw) 2562 if ch_t0 < 0 { 2563 ch_line = st_cat(lb, 0, " tasks path=" as *u8) 2564 ch_line = st_cat(lb, ch_line, ch_dir) 2565 ch_line = st_cat(lb, ch_line, " ABSENT" as *u8) 2566 st_rm_emit(lb, ch_line) 2567 return 0 2568 } 2569 let ch_tn: *u8 = sys_mmap((ch_t0 + 1) * ST_RM_NAMECAP) 2570 let ch_tm: *i64 = sys_mmap((ch_t0 + 1) * ST_RM_I64B) as *i64 2571 let ch_ts: *i64 = sys_mmap((ch_t0 + 1) * ST_RM_I64B) as *i64 2572 let ch_n3: i64 = st_rm_enum(ch_dir, "-" as *u8, ch_tn, ch_tm, ch_ts, ch_t0, ch_z, ch_sf, ch_gw) 2573 ch_line = st_cat(lb, 0, " tasks path=" as *u8) 2574 ch_line = st_cat(lb, ch_line, ch_dir) 2575 ch_line = st_cat(lb, ch_line, " files=" as *u8) 2576 ch_line = st_catn(lb, ch_line, ch_n3) 2577 if ch_gw[0] > 0 { ch_line = st_cat(lb, ch_line, " grew_during_enum=" as *u8); ch_line = st_catn(lb, ch_line, ch_gw[0]) } 2578 st_rm_emit(lb, ch_line) 2579 let ch_u2: *i64 = sys_mmap((ch_n3 + 1) * ST_RM_I64B) as *i64 2580 var ch_u3: i64 = 0 2581 while ch_u3 < ch_n3 { ch_u2[ch_u3] = 0; ch_u3 = ch_u3 + 1 } 2582 var ch_k3: i64 = 0 2583 while ch_k3 < ch_n3 { 2584 var ch_bv2: i64 = 0 - 1 2585 var ch_bi2: i64 = 0 - 1 2586 var ch_s3: i64 = 0 2587 while ch_s3 < ch_n3 { 2588 if ch_u2[ch_s3] == 0 { if ch_tm[ch_s3] > ch_bv2 { ch_bv2 = ch_tm[ch_s3]; ch_bi2 = ch_s3 } } 2589 ch_s3 = ch_s3 + 1 2590 } 2591 if ch_bi2 >= 0 { 2592 ch_u2[ch_bi2] = 1 2593 let ch_cn: *u8 = ((ch_tn as i64) + ch_bi2 * ST_RM_NAMECAP) as *u8 2594 ch_line = st_cat(lb, 0, " task_child name=" as *u8) 2595 ch_line = st_cat(lb, ch_line, ch_cn) 2596 ch_line = st_cat(lb, ch_line, " bytes=" as *u8) 2597 ch_line = st_catn(lb, ch_line, ch_ts[ch_bi2]) 2598 ch_line = st_cat(lb, ch_line, " mtime=" as *u8) 2599 ch_line = st_catn(lb, ch_line, ch_tm[ch_bi2]) 2600 if ch_ts[ch_bi2] == 0 { ch_line = st_cat(lb, ch_line, " kind=empty" as *u8) } else { 2601 st_rm_join(ch_path, ch_dir, ch_cn) 2602 if st_rm_scan(ch_path, res2, strs2, tn2, tc2) == 0 { ch_line = st_cat(lb, ch_line, " kind=unreadable" as *u8) } else { 2603 var ch_kind: *u8 = "raw" as *u8 2604 if res2[ST_RM_R_LINES] - res2[ST_RM_R_MALFORMED] > 0 { ch_kind = "jsonl" as *u8 } 2605 if res2[ST_RM_R_SIDECHAIN] == 1 { ch_kind = "agent" as *u8 } 2606 ch_line = st_cat(lb, ch_line, " kind=" as *u8) 2607 ch_line = st_cat(lb, ch_line, ch_kind) 2608 if res2[ST_RM_R_LINES] - res2[ST_RM_R_MALFORMED] > 0 { 2609 ch_line = st_cat(lb, ch_line, " state=" as *u8) 2610 ch_line = st_cat(lb, ch_line, st_rm_code_lit(st_rm_state_code(res2))) 2611 ch_line = st_cat(lb, ch_line, " dangling=" as *u8) 2612 ch_line = st_catn(lb, ch_line, res2[ST_RM_R_DANGLING]) 2613 ch_line = st_cat(lb, ch_line, " tail_malformed=" as *u8) 2614 ch_line = st_catn(lb, ch_line, res2[ST_RM_R_TAILMAL]) 2615 ch_line = st_cat(lb, ch_line, " last_ts=" as *u8) 2616 ch_line = st_cat(lb, ch_line, st_rm_slot(strs2, ST_RM_S_TS)) 2617 ch_line = st_cat(lb, ch_line, " lane='" as *u8) 2618 ch_line = st_cat(lb, ch_line, st_rm_slot(strs2, ST_RM_S_PROMPT)) 2619 ch_line = st_cat(lb, ch_line, "' last_text='" as *u8) 2620 ch_line = st_cat(lb, ch_line, st_rm_slot(strs2, ST_RM_S_TEXT)) 2621 ch_line = st_cat(lb, ch_line, "'" as *u8) 2622 var ch_d2: i64 = 0 2623 while ch_d2 < res2[ST_RM_R_DANGLING] { 2624 ch_line = st_cat(lb, ch_line, " INFLIGHT " as *u8) 2625 ch_line = st_cat(lb, ch_line, (res2[ST_RM_R_DANGBUF] + ch_d2 * ST_RM_DANGROW) as *u8) 2626 ch_d2 = ch_d2 + 1 2627 } 2628 } 2629 } 2630 } 2631 st_rm_emit(lb, ch_line) 2632 } 2633 ch_k3 = ch_k3 + 1 2634 } 2635 return 0 2636} 2637 2638// session id = transcript filename minus ".jsonl". ONE derivation, shared by the seat block and the 2639// journal join, so the two can never disagree about what a seat is called. 2640func st_rm_sid(dst: *u8, name: *u8) -> i64 { 2641 let sd_nl: i64 = st_vlen(name) 2642 var sd_sl: i64 = sd_nl - st_vlen(".jsonl" as *u8) 2643 if sd_sl < 0 { sd_sl = 0 } 2644 if st_rm_ends(name, ".jsonl" as *u8) == 0 { sd_sl = sd_nl } 2645 if sd_sl >= ST_RM_NAMECAP { sd_sl = ST_RM_NAMECAP - 1 } 2646 var sd_i: i64 = 0 2647 while sd_i < sd_sl { dst[sd_i] = name[sd_i]; sd_i = sd_i + 1 } 2648 dst[sd_sl] = 0 as u8 2649 return sd_sl 2650} 2651 2652// stream ONE frames journal file, accumulating global coverage and per-seat aggregates. sys_map_file 2653// sizes its buffer from the file and cannot short-read, so there is no cap to reach in silence; only 2654// aggregates are retained, so a 2 GB record costs O(seats) memory, not O(file). 2655func st_rm_jscan(path: *u8, ids: *u8, nseats: i64, jfr: *i64, jlt: *i64, jtool: *u8, jg: *i64, ws: i64, we: i64, tszero: i64) -> i64 { 2656 let js_fl: *i64 = sys_mmap(ST_SPAN) as *i64 2657 let q: *u8 = sys_map_file(path, js_fl) 2658 if (q as i64) == 0 { return 0 } 2659 let js_n: i64 = js_fl[0] 2660 if js_n <= 0 { return 0 } 2661 jg[ST_RM_JG_FILES] = jg[ST_RM_JG_FILES] + 1 2662 jg[ST_RM_JG_BYTES] = jg[ST_RM_JG_BYTES] + js_n 2663 let js_sp: *i64 = sys_mmap(ST_SPAN) as *i64 2664 let js_tp: *i64 = sys_mmap(ST_SPAN) as *i64 2665 var js_i: i64 = 0 2666 while js_i < js_n { 2667 let js_le: i64 = st_le(q, js_i, js_n) 2668 if js_le > js_i { 2669 if st_col(q, js_i, js_le, ST_RM_JCOL_WS, js_sp) == 1 { 2670 // COLUMN 0, not the line: st_atoi_span skips non-digits, so handing it the whole line 2671 // concatenates every digit on it (session-id digits included) into one absurd number. 2672 // Measured 2026-08-20: it produced last_frame_ts=8380766977897469739 and made the 2673 // laptop-vs-NAS agreement check compare a RANDOM frame -- the cross-check found the 2674 // defect in the instrument, which is the point of carrying two independent sources. 2675 var js_ts: i64 = 0 2676 if st_col(q, js_i, js_le, ST_RM_JCOL_TS, js_tp) == 1 { js_ts = st_atoi_span(q, js_tp[0], js_tp[1]) } 2677 jg[ST_RM_JG_FRAMES] = jg[ST_RM_JG_FRAMES] + 1 2678 if tszero == 1 { jg[ST_RM_JG_TSZERO] = jg[ST_RM_JG_TSZERO] + 1 } else { 2679 if js_ts > 0 { 2680 if jg[ST_RM_JG_MINTS] == 0 { jg[ST_RM_JG_MINTS] = js_ts } 2681 if js_ts < jg[ST_RM_JG_MINTS] { jg[ST_RM_JG_MINTS] = js_ts } 2682 if js_ts > jg[ST_RM_JG_MAXTS] { jg[ST_RM_JG_MAXTS] = js_ts } 2683 if js_ts >= ws { if js_ts <= we { jg[ST_RM_JG_INWIN] = jg[ST_RM_JG_INWIN] + 1 } } 2684 } else { jg[ST_RM_JG_TSZERO] = jg[ST_RM_JG_TSZERO] + 1 } 2685 } 2686 var js_k: i64 = 0 2687 while js_k < nseats { 2688 let js_id: *u8 = ((ids as i64) + js_k * ST_RM_NAMECAP) as *u8 2689 if st_lit_eq(q, js_sp[0], js_sp[1], js_id) == 1 { 2690 jfr[js_k] = jfr[js_k] + 1 2691 if js_ts >= jlt[js_k] { 2692 jlt[js_k] = js_ts 2693 let js_dst: *u8 = ((jtool as i64) + js_k * ST_RM_TOOLCAP) as *u8 2694 js_dst[0] = 0 as u8 2695 if st_col(q, js_i, js_le, ST_RM_JCOL_TOOL, js_tp) == 1 { 2696 var js_tl: i64 = js_tp[1] - js_tp[0] 2697 if js_tl >= ST_RM_TOOLCAP { js_tl = ST_RM_TOOLCAP - 1 } 2698 var js_c: i64 = 0 2699 while js_c < js_tl { js_dst[js_c] = q[js_tp[0] + js_c]; js_c = js_c + 1 } 2700 js_dst[js_tl] = 0 as u8 2701 } 2702 } 2703 js_k = nseats 2704 } else { js_k = js_k + 1 } 2705 } 2706 } else { jg[ST_RM_JG_MALFORMED] = jg[ST_RM_JG_MALFORMED] + 1 } 2707 } 2708 js_i = js_le + 1 2709 } 2710 sys_free_file(q, js_n) 2711 return 1 2712} 2713 2714// THE DM1 LEG. Accepts either the convention DIRECTORY (knowledge/status/chbeat, laptop twin 2715// nishi-ops/chbeat/journal) or a single day file. Returns SKIP / PARTIAL / COVERS -- and PARTIAL is the 2716// DEFAULT for anything short of strict coverage, because the backfill is mid-drain and a journal that 2717// does not span the window must never read as complete. 2718func st_rm_jrnl(jrn: *u8, ids: *u8, nseats: i64, jfr: *i64, jlt: *i64, jtool: *u8, jg: *i64, ws: i64, we: i64) -> i64 { 2719 var jr_z: i64 = 0 2720 while jr_z < ST_RM_JG_SLOTS { jg[jr_z] = 0; jr_z = jr_z + 1 } 2721 var jr_k: i64 = 0 2722 while jr_k < nseats { jfr[jr_k] = 0; jlt[jr_k] = 0; let jr_t: *u8 = ((jtool as i64) + jr_k * ST_RM_TOOLCAP) as *u8; jr_t[0] = 0 as u8; jr_k = jr_k + 1 } 2723 let jr_nonj: *i64 = sys_mmap(ST_SPAN) as *i64 2724 let jr_sf: *i64 = sys_mmap(ST_SPAN) as *i64 2725 let jr_gw: *i64 = sys_mmap(ST_SPAN) as *i64 2726 let jr_dm: *u8 = sys_mmap(ST_RM_NAMECAP) 2727 let jr_di: *i64 = sys_mmap(ST_SPAN) as *i64 2728 jr_nonj[0] = 0 2729 jr_sf[0] = 0 2730 jr_gw[0] = 0 2731 let jr_c0: i64 = st_rm_enum(jrn, ".jrnl" as *u8, jr_dm, jr_di, jr_di, 0, jr_nonj, jr_sf, jr_gw) 2732 if jr_c0 > 0 { 2733 let jr_nm: *u8 = sys_mmap((jr_c0 + 1) * ST_RM_NAMECAP) 2734 let jr_mt: *i64 = sys_mmap((jr_c0 + 1) * ST_RM_I64B) as *i64 2735 let jr_sz: *i64 = sys_mmap((jr_c0 + 1) * ST_RM_I64B) as *i64 2736 jr_nonj[0] = 0 2737 let jr_n: i64 = st_rm_enum(jrn, ".jrnl" as *u8, jr_nm, jr_mt, jr_sz, jr_c0, jr_nonj, jr_sf, jr_gw) 2738 let jr_path: *u8 = sys_mmap(ST_RM_PATHCAP) 2739 var jr_i: i64 = 0 2740 while jr_i < jr_n { 2741 let jr_one: *u8 = ((jr_nm as i64) + jr_i * ST_RM_NAMECAP) as *u8 2742 st_rm_join(jr_path, jrn, jr_one) 2743 var jr_tz: i64 = 0 2744 if st_lit_eq(jr_one, 0, st_vlen(jr_one), "chbeat_tszero.jrnl" as *u8) == 1 { jr_tz = 1 } 2745 st_rm_jscan(jr_path, ids, nseats, jfr, jlt, jtool, jg, ws, we, jr_tz) 2746 jr_i = jr_i + 1 2747 } 2748 } else { 2749 // not a directory (or an empty one): try the path as a single day file 2750 var jr_tz2: i64 = 0 2751 if st_rm_ends(jrn, "chbeat_tszero.jrnl" as *u8) == 1 { jr_tz2 = 1 } 2752 st_rm_jscan(jrn, ids, nseats, jfr, jlt, jtool, jg, ws, we, jr_tz2) 2753 } 2754 if jg[ST_RM_JG_FRAMES] <= 0 { return ST_RM_J_SKIP } 2755 if jg[ST_RM_JG_MINTS] > 0 { if jg[ST_RM_JG_MINTS] <= ws { if jg[ST_RM_JG_MAXTS] >= we { return ST_RM_J_COVERS } } } 2756 return ST_RM_J_PARTIAL 2757} 2758 2759// ESTATE-ONLY MODE. Collect the distinct session ids with in-window frames straight from the journal, 2760// so the map can be produced NAS-side where no transcript exists. One file at a time via sys_map_file; 2761// only the id table is retained. Overflow sets floor[0] -- a full table is a FLOOR, announced, never a 2762// silent truncation of the population. 2763func st_rm_jseats_file(path: *u8, ids: *u8, nids: *i64, ws: i64, we: i64, floor: *i64) -> i64 { 2764 let jf_fl: *i64 = sys_mmap(ST_SPAN) as *i64 2765 let q: *u8 = sys_map_file(path, jf_fl) 2766 if (q as i64) == 0 { return 0 } 2767 let jf_n: i64 = jf_fl[0] 2768 if jf_n <= 0 { return 0 } 2769 let jf_sp: *i64 = sys_mmap(ST_SPAN) as *i64 2770 let jf_tp: *i64 = sys_mmap(ST_SPAN) as *i64 2771 var jf_i: i64 = 0 2772 while jf_i < jf_n { 2773 let jf_le: i64 = st_le(q, jf_i, jf_n) 2774 if jf_le > jf_i { 2775 if st_col(q, jf_i, jf_le, ST_RM_JCOL_WS, jf_sp) == 1 { 2776 var jf_ts: i64 = 0 2777 if st_col(q, jf_i, jf_le, ST_RM_JCOL_TS, jf_tp) == 1 { jf_ts = st_atoi_span(q, jf_tp[0], jf_tp[1]) } 2778 var jf_in: i64 = 0 2779 if jf_ts >= ws { if jf_ts <= we { jf_in = 1 } } 2780 if jf_in == 1 { 2781 var jf_seen: i64 = 0 2782 var jf_k: i64 = 0 2783 while jf_k < nids[0] { 2784 if st_lit_eq(q, jf_sp[0], jf_sp[1], ((ids as i64) + jf_k * ST_RM_NAMECAP) as *u8) == 1 { jf_seen = 1; jf_k = nids[0] } else { jf_k = jf_k + 1 } 2785 } 2786 if jf_seen == 0 { 2787 if nids[0] >= ST_RM_JSEATMAX { floor[0] = 1 } else { 2788 var jf_l: i64 = jf_sp[1] - jf_sp[0] 2789 if jf_l >= ST_RM_NAMECAP { jf_l = ST_RM_NAMECAP - 1 } 2790 let jf_dst: *u8 = ((ids as i64) + nids[0] * ST_RM_NAMECAP) as *u8 2791 var jf_c: i64 = 0 2792 while jf_c < jf_l { jf_dst[jf_c] = q[jf_sp[0] + jf_c]; jf_c = jf_c + 1 } 2793 jf_dst[jf_l] = 0 as u8 2794 nids[0] = nids[0] + 1 2795 } 2796 } 2797 } 2798 } 2799 } 2800 jf_i = jf_le + 1 2801 } 2802 sys_free_file(q, jf_n) 2803 return 1 2804} 2805 2806func st_rm_jseats(jrn: *u8, ids: *u8, nids: *i64, ws: i64, we: i64, floor: *i64) -> i64 { 2807 nids[0] = 0 2808 floor[0] = 0 2809 let je_nonj: *i64 = sys_mmap(ST_SPAN) as *i64 2810 let je_sf: *i64 = sys_mmap(ST_SPAN) as *i64 2811 let je_gw: *i64 = sys_mmap(ST_SPAN) as *i64 2812 let je_dm: *u8 = sys_mmap(ST_RM_NAMECAP) 2813 let je_di: *i64 = sys_mmap(ST_SPAN) as *i64 2814 je_nonj[0] = 0 2815 je_sf[0] = 0 2816 je_gw[0] = 0 2817 let je_c0: i64 = st_rm_enum(jrn, ".jrnl" as *u8, je_dm, je_di, je_di, 0, je_nonj, je_sf, je_gw) 2818 if je_c0 > 0 { 2819 let je_nm: *u8 = sys_mmap((je_c0 + 1) * ST_RM_NAMECAP) 2820 let je_mt: *i64 = sys_mmap((je_c0 + 1) * ST_RM_I64B) as *i64 2821 let je_sz: *i64 = sys_mmap((je_c0 + 1) * ST_RM_I64B) as *i64 2822 je_nonj[0] = 0 2823 let je_n: i64 = st_rm_enum(jrn, ".jrnl" as *u8, je_nm, je_mt, je_sz, je_c0, je_nonj, je_sf, je_gw) 2824 let je_path: *u8 = sys_mmap(ST_RM_PATHCAP) 2825 var je_i: i64 = 0 2826 while je_i < je_n { 2827 st_rm_join(je_path, jrn, ((je_nm as i64) + je_i * ST_RM_NAMECAP) as *u8) 2828 st_rm_jseats_file(je_path, ids, nids, ws, we, floor) 2829 je_i = je_i + 1 2830 } 2831 } else { st_rm_jseats_file(jrn, ids, nids, ws, we, floor) } 2832 return nids[0] 2833} 2834 2835// The journal's col1 carries a SESSION ID for seat frames and a plain actor name for beat-generated 2836// ones (measured: the harvester writes ws=harvest). A uuid-shaped id is a seat; anything else is a 2837// non-session actor and must NOT be read as a crashed seat. Shape test, not a name list: 36 chars with 2838// dashes at 8/13/18/23 -- the id's own format, so a new actor name cannot silently become a seat. 2839func st_rm_is_sid(id: *u8) -> i64 { 2840 if st_vlen(id) != ST_RM_SIDLEN { return 0 } 2841 if id[8] != (45 as u8) { return 0 } 2842 if id[13] != (45 as u8) { return 0 } 2843 if id[18] != (45 as u8) { return 0 } 2844 if id[23] != (45 as u8) { return 0 } 2845 return 1 2846} 2847 2848// journal-only seat block: what the ESTATE can see about a seat without any transcript. It states its 2849// own blindness -- frames cannot show a half-written tail, so the state is UNKNOWN, never COMPLETED. 2850func st_rm_jseat_block(sid: *u8, lb: *u8, frames: i64, lastts: i64, tool: *u8) -> i64 { 2851 var jb_o: i64 = st_cat(lb, 0, "SEAT id=" as *u8) 2852 jb_o = st_cat(lb, jb_o, sid) 2853 jb_o = st_cat(lb, jb_o, " source=journal-only actor_kind=" as *u8) 2854 if st_rm_is_sid(sid) == 1 { jb_o = st_cat(lb, jb_o, "session" as *u8) } else { 2855 // agent children are REAL work units -- both 2026-08-19 crashes killed agent children, not just 2856 // top-level seats -- so they get their own kind rather than being lumped with beat/actor rows. 2857 if st_starts(sid, 0, st_vlen(sid), "agent-" as *u8) == 1 { jb_o = st_cat(lb, jb_o, "agent-child" as *u8) } else { jb_o = st_cat(lb, jb_o, "actor (a beat row, NOT a seat)" as *u8) } 2858 } 2859 st_rm_emit(lb, jb_o) 2860 jb_o = st_cat(lb, 0, " state=UNKNOWN reason=journal-only (frames record actions, not the half-written tail an in-flight write leaves -- abstain, never acquit)" as *u8) 2861 st_rm_emit(lb, jb_o) 2862 jb_o = st_cat(lb, 0, " journal_seat frames=" as *u8) 2863 jb_o = st_catn(lb, jb_o, frames) 2864 jb_o = st_cat(lb, jb_o, " last_frame_ts=" as *u8) 2865 jb_o = st_catn(lb, jb_o, lastts) 2866 jb_o = st_cat(lb, jb_o, " nas_last_tool=" as *u8) 2867 jb_o = st_cat(lb, jb_o, tool) 2868 st_rm_emit(lb, jb_o) 2869 jb_o = st_cat(lb, 0, " resume> " as *u8) 2870 jb_o = st_cat(lb, jb_o, sid) 2871 jb_o = st_cat(lb, jb_o, " state=UNKNOWN act=" as *u8) 2872 jb_o = st_cat(lb, jb_o, tool) 2873 jb_o = st_cat(lb, jb_o, " inflight=UNOBSERVABLE next=fetch-the-transcript-or-run-where-it-lives-for-in-flight-adjudication" as *u8) 2874 st_rm_emit(lb, jb_o) 2875 return ST_RM_ST_UNKNOWN 2876} 2877 2878func st_rm_jstate_lit(s: i64) -> *u8 { 2879 if s == ST_RM_J_COVERS { return "COVERS" as *u8 } 2880 if s == ST_RM_J_PARTIAL { return "PARTIAL" as *u8 } 2881 return "SKIP" as *u8 2882} 2883 2884// one seat block: identity, mechanical state, condensed evidence, EVERY in-flight row, the entry-type 2885// census, children, and a composed resume line. Values are printed beside every verdict (gate law E5). 2886func st_rm_seat(dir: *u8, name: *u8, smt: i64, ssz: i64, troot: *u8, lb: *u8, res: *i64, strs: *u8, tn: *u8, tc: *i64, res2: *i64, strs2: *u8, tn2: *u8, tc2: *i64, jstate: i64, jfr_i: i64, jlt_i: i64, jtool_i: *u8) -> i64 { 2887 let sb_sid: *u8 = sys_mmap(ST_RM_NAMECAP) 2888 st_rm_sid(sb_sid, name) 2889 let sb_path: *u8 = sys_mmap(ST_RM_PATHCAP) 2890 st_rm_join(sb_path, dir, name) 2891 var sb_o: i64 = st_cat(lb, 0, "SEAT id=" as *u8) 2892 sb_o = st_cat(lb, sb_o, sb_sid) 2893 st_rm_emit(lb, sb_o) 2894 sb_o = st_cat(lb, 0, " path=" as *u8) 2895 sb_o = st_cat(lb, sb_o, sb_path) 2896 sb_o = st_cat(lb, sb_o, " bytes=" as *u8) 2897 sb_o = st_catn(lb, sb_o, ssz) 2898 sb_o = st_cat(lb, sb_o, " mtime=" as *u8) 2899 sb_o = st_catn(lb, sb_o, smt) 2900 st_rm_emit(lb, sb_o) 2901 st_rm_scan(sb_path, res, strs, tn, tc) 2902 let sb_code: i64 = st_rm_state_code(res) 2903 sb_o = st_cat(lb, 0, " state=" as *u8) 2904 sb_o = st_cat(lb, sb_o, st_rm_code_lit(sb_code)) 2905 sb_o = st_cat(lb, sb_o, " dangling=" as *u8) 2906 sb_o = st_catn(lb, sb_o, res[ST_RM_R_DANGLING]) 2907 sb_o = st_cat(lb, sb_o, " tail_malformed=" as *u8) 2908 sb_o = st_catn(lb, sb_o, res[ST_RM_R_TAILMAL]) 2909 sb_o = st_cat(lb, sb_o, " tail_unterminated=" as *u8) 2910 sb_o = st_catn(lb, sb_o, res[ST_RM_R_TAILUNTERM]) 2911 sb_o = st_cat(lb, sb_o, " nul_final=" as *u8) 2912 sb_o = st_catn(lb, sb_o, res[ST_RM_R_NULFINAL]) 2913 sb_o = st_cat(lb, sb_o, " lines=" as *u8) 2914 sb_o = st_catn(lb, sb_o, res[ST_RM_R_LINES]) 2915 sb_o = st_cat(lb, sb_o, " malformed_lines=" as *u8) 2916 sb_o = st_catn(lb, sb_o, res[ST_RM_R_MALFORMED]) 2917 sb_o = st_cat(lb, sb_o, " uses=" as *u8) 2918 sb_o = st_catn(lb, sb_o, res[ST_RM_R_USES]) 2919 sb_o = st_cat(lb, sb_o, " results=" as *u8) 2920 sb_o = st_catn(lb, sb_o, res[ST_RM_R_RESULTS]) 2921 sb_o = st_cat(lb, sb_o, " orphan_results=" as *u8) 2922 sb_o = st_catn(lb, sb_o, res[ST_RM_R_ORPHANRES]) 2923 st_rm_emit(lb, sb_o) 2924 sb_o = st_cat(lb, 0, " last_ts=" as *u8) 2925 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TS)) 2926 st_rm_emit(lb, sb_o) 2927 sb_o = st_cat(lb, 0, " title=" as *u8) 2928 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TITLE)) 2929 st_rm_emit(lb, sb_o) 2930 sb_o = st_cat(lb, 0, " first_prompt=" as *u8) 2931 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_PROMPT)) 2932 st_rm_emit(lb, sb_o) 2933 sb_o = st_cat(lb, 0, " last_prompt=" as *u8) 2934 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_LPROMPT)) 2935 st_rm_emit(lb, sb_o) 2936 sb_o = st_cat(lb, 0, " last_text=" as *u8) 2937 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TEXT)) 2938 st_rm_emit(lb, sb_o) 2939 sb_o = st_cat(lb, 0, " last_action tool=" as *u8) 2940 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TOOL)) 2941 sb_o = st_cat(lb, sb_o, " input=" as *u8) 2942 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_INPUT)) 2943 st_rm_emit(lb, sb_o) 2944 var sb_d: i64 = 0 2945 while sb_d < res[ST_RM_R_DANGLING] { 2946 sb_o = st_cat(lb, 0, " INFLIGHT " as *u8) 2947 sb_o = st_cat(lb, sb_o, (res[ST_RM_R_DANGBUF] + sb_d * ST_RM_DANGROW) as *u8) 2948 st_rm_emit(lb, sb_o) 2949 sb_d = sb_d + 1 2950 } 2951 if res[ST_RM_R_TAILMAL] == 1 { 2952 sb_o = st_cat(lb, 0, " INFLIGHT-SUSPECT final-line-unparseable len=" as *u8) 2953 sb_o = st_catn(lb, sb_o, res[ST_RM_R_TAILMALLEN]) 2954 sb_o = st_cat(lb, sb_o, " nul=" as *u8) 2955 sb_o = st_catn(lb, sb_o, res[ST_RM_R_NULFINAL]) 2956 sb_o = st_cat(lb, sb_o, " (half-written record -- adjudicate by artifact, never by receipt)" as *u8) 2957 st_rm_emit(lb, sb_o) 2958 } 2959 sb_o = st_cat(lb, 0, " types" as *u8) 2960 var sb_t: i64 = 0 2961 while sb_t < res[ST_RM_R_TYPES] { 2962 sb_o = st_cat(lb, sb_o, " " as *u8) 2963 sb_o = st_cat(lb, sb_o, ((tn as i64) + sb_t * ST_RM_TYPENAME) as *u8) 2964 sb_o = st_cat(lb, sb_o, "=" as *u8) 2965 sb_o = st_catn(lb, sb_o, tc[sb_t]) 2966 sb_t = sb_t + 1 2967 } 2968 if res[ST_RM_R_TYPEFLOOR] == 1 { sb_o = st_cat(lb, sb_o, " types_floor=1 (census table full -- these counts are a FLOOR)" as *u8) } 2969 st_rm_emit(lb, sb_o) 2970 // DM1 leg, per seat: the estate's own frames for THIS session id. agree= compares the NAS-derived 2971 // last tool with the laptop-derived one -- two independent instruments over one subject, so a DIFFER 2972 // LOCATES a defect (or a mid-drain delta) and is printed as evidence, never as a verdict on either. 2973 if jstate != ST_RM_J_SKIP { 2974 sb_o = st_cat(lb, 0, " journal_seat frames=" as *u8) 2975 sb_o = st_catn(lb, sb_o, jfr_i) 2976 sb_o = st_cat(lb, sb_o, " last_frame_ts=" as *u8) 2977 sb_o = st_catn(lb, sb_o, jlt_i) 2978 sb_o = st_cat(lb, sb_o, " nas_last_tool=" as *u8) 2979 sb_o = st_cat(lb, sb_o, jtool_i) 2980 var sb_ag: i64 = ST_RM_A_UNCOVERED 2981 if jfr_i > 0 { 2982 sb_ag = ST_RM_A_DIFFER 2983 if st_lit_eq(jtool_i, 0, st_vlen(jtool_i), st_rm_slot(strs, ST_RM_S_TOOL)) == 1 { sb_ag = ST_RM_A_AGREE } 2984 } 2985 sb_o = st_cat(lb, sb_o, " laptop_last_tool=" as *u8) 2986 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TOOL)) 2987 sb_o = st_cat(lb, sb_o, " agree=" as *u8) 2988 if sb_ag == ST_RM_A_AGREE { sb_o = st_cat(lb, sb_o, "YES" as *u8) } 2989 if sb_ag == ST_RM_A_DIFFER { sb_o = st_cat(lb, sb_o, "DIFFER (two instruments disagree -- locate the defect; a mid-drain journal legitimately lags)" as *u8) } 2990 if sb_ag == ST_RM_A_UNCOVERED { sb_o = st_cat(lb, sb_o, "UNCOVERED (no frames for this seat -- its own bucket, NOT no-activity)" as *u8) } 2991 st_rm_emit(lb, sb_o) 2992 } 2993 if st_lit_eq(troot, 0, st_vlen(troot), "-" as *u8) == 0 { st_rm_children(troot, sb_sid, lb, res2, strs2, tn2, tc2) } 2994 sb_o = st_cat(lb, 0, " resume> " as *u8) 2995 sb_o = st_cat(lb, sb_o, sb_sid) 2996 sb_o = st_cat(lb, sb_o, " state=" as *u8) 2997 sb_o = st_cat(lb, sb_o, st_rm_code_lit(sb_code)) 2998 sb_o = st_cat(lb, sb_o, " lane='" as *u8) 2999 let sb_ti: *u8 = st_rm_slot(strs, ST_RM_S_TITLE) 3000 if sb_ti[0] != (0 as u8) { sb_o = st_cat(lb, sb_o, sb_ti) } else { 3001 let sb_pp: *u8 = st_rm_slot(strs, ST_RM_S_PROMPT) 3002 if sb_pp[0] != (0 as u8) { sb_o = st_cat(lb, sb_o, sb_pp) } else { sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_LPROMPT)) } 3003 } 3004 sb_o = st_cat(lb, sb_o, "' last_ts=" as *u8) 3005 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TS)) 3006 sb_o = st_cat(lb, sb_o, " act=" as *u8) 3007 sb_o = st_cat(lb, sb_o, st_rm_slot(strs, ST_RM_S_TOOL)) 3008 sb_o = st_cat(lb, sb_o, " inflight=" as *u8) 3009 sb_o = st_catn(lb, sb_o, res[ST_RM_R_DANGLING] + res[ST_RM_R_TAILMAL] + res[ST_RM_R_TAILUNTERM]) 3010 if sb_code == ST_RM_ST_CRASHED { sb_o = st_cat(lb, sb_o, " next=adjudicate-inflight-by-artifact-then-relaunch-from-lane" as *u8) } 3011 if sb_code == ST_RM_ST_IDLE { sb_o = st_cat(lb, sb_o, " next=no-write-in-flight-relaunch-from-lane" as *u8) } 3012 if sb_code == ST_RM_ST_COMPLETED { sb_o = st_cat(lb, sb_o, " next=turn-closed-relaunch-only-if-lane-open-per-last_text" as *u8) } 3013 if sb_code == ST_RM_ST_UNKNOWN { sb_o = st_cat(lb, sb_o, " next=inspect-by-hand-record-lacks-evidence" as *u8) } 3014 st_rm_emit(lb, sb_o) 3015 return sb_code 3016} 3017 3018// THE VERB: enumerate the FULL transcript population, partition by window (parts printed and summed), 3019// emit one evidence block per in-window seat (mtime desc), then the partition and the DM1 journal leg 3020// (absent -> SKIP UNOBSERVABLE: abstain, never acquit). latest-mode window = newest mtime back 3021// ST_STALE_SEC (the incumbent's own staleness calibration), both bounds printed. 3022func st_resume_map(dir: *u8, troot: *u8, latest: i64, wsin: i64, wein: i64, jrn: *u8) -> i64 { 3023 let rm_lb: *u8 = sys_mmap(ST_RM_LINE) 3024 let rm_nonj: *i64 = sys_mmap(ST_SPAN) as *i64 3025 let rm_sf: *i64 = sys_mmap(ST_SPAN) as *i64 3026 let rm_gw: *i64 = sys_mmap(ST_SPAN) as *i64 3027 rm_nonj[0] = 0 3028 rm_sf[0] = 0 3029 rm_gw[0] = 0 3030 let rm_dm: *u8 = sys_mmap(ST_RM_NAMECAP) 3031 let rm_di: *i64 = sys_mmap(ST_SPAN) as *i64 3032 let rm_jg: *i64 = sys_mmap(ST_RM_JG_SLOTS * ST_RM_I64B) as *i64 3033 var rm_jdecl: i64 = 0 3034 if st_lit_eq(jrn, 0, st_vlen(jrn), "-" as *u8) == 0 { rm_jdecl = 1 } 3035 var rm_c0: i64 = st_rm_enum(dir, ".jsonl" as *u8, rm_dm, rm_di, rm_di, 0, rm_nonj, rm_sf, rm_gw) 3036 // ESTATE-ONLY: no transcripts reachable (the NAS case) but a frames journal IS declared -> the map is 3037 // built from the estate's own record. Without a journal this stays a hard failure: a map with neither 3038 // source is not a map. 3039 var rm_estate: i64 = 0 3040 if rm_c0 <= 0 { 3041 if rm_jdecl == 1 { rm_estate = 1; rm_c0 = 0 } else { 3042 var rm_eo: i64 = st_cat(rm_lb, 0, "RESUME-MAP-FAIL transcripts dir unreadable/empty and no frames journal declared: " as *u8) 3043 rm_eo = st_cat(rm_lb, rm_eo, dir) 3044 rm_lb[rm_eo] = ST_NL as u8 3045 sys_write(ST_STDERR, rm_lb, rm_eo + 1) 3046 return 1 3047 } 3048 } 3049 rm_nonj[0] = 0 3050 let rm_nm: *u8 = sys_mmap((rm_c0 + 1) * ST_RM_NAMECAP) 3051 let rm_mt: *i64 = sys_mmap((rm_c0 + 1) * ST_RM_I64B) as *i64 3052 let rm_sz: *i64 = sys_mmap((rm_c0 + 1) * ST_RM_I64B) as *i64 3053 let rm_n: i64 = st_rm_enum(dir, ".jsonl" as *u8, rm_nm, rm_mt, rm_sz, rm_c0, rm_nonj, rm_sf, rm_gw) 3054 var rm_ws: i64 = wsin 3055 var rm_we: i64 = wein 3056 if latest == 1 { 3057 var rm_mx: i64 = 0 3058 var rm_q: i64 = 0 3059 while rm_q < rm_n { if rm_mt[rm_q] > rm_mx { rm_mx = rm_mt[rm_q] } rm_q = rm_q + 1 } 3060 // estate-only: there are no transcript mtimes, so the newest evidence is the journal's own 3061 // newest frame. Probe pass with an empty seat table fills the derived coverage only. 3062 if rm_estate == 1 { 3063 let rm_pi: *u8 = sys_mmap(ST_RM_NAMECAP) 3064 let rm_pf: *i64 = sys_mmap(ST_RM_I64B) as *i64 3065 st_rm_jrnl(jrn, rm_pi, 0, rm_pf, rm_pf, rm_pi, rm_jg, 0, 0) 3066 rm_mx = rm_jg[ST_RM_JG_MAXTS] 3067 } 3068 rm_we = rm_mx 3069 rm_ws = rm_mx - ST_STALE_SEC 3070 } 3071 var rm_o: i64 = st_cat(rm_lb, 0, "RESUME-MAP dir=" as *u8) 3072 rm_o = st_cat(rm_lb, rm_o, dir) 3073 rm_o = st_cat(rm_lb, rm_o, " temp_root=" as *u8) 3074 rm_o = st_cat(rm_lb, rm_o, troot) 3075 st_rm_emit(rm_lb, rm_o) 3076 rm_o = st_cat(rm_lb, 0, "WINDOW mode=" as *u8) 3077 if latest == 1 { rm_o = st_cat(rm_lb, rm_o, "latest span_src=ST_STALE_SEC" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, "args" as *u8) } 3078 rm_o = st_cat(rm_lb, rm_o, " start=" as *u8) 3079 rm_o = st_catn(rm_lb, rm_o, rm_ws) 3080 rm_o = st_cat(rm_lb, rm_o, " end=" as *u8) 3081 rm_o = st_catn(rm_lb, rm_o, rm_we) 3082 st_rm_emit(rm_lb, rm_o) 3083 let rm_in: *i64 = sys_mmap((rm_n + 1) * ST_RM_I64B) as *i64 3084 var rm_ninw: i64 = 0 3085 var rm_nout: i64 = 0 3086 var rm_p2: i64 = 0 3087 while rm_p2 < rm_n { 3088 var rm_iw: i64 = 0 3089 if rm_mt[rm_p2] >= rm_ws { if rm_mt[rm_p2] <= rm_we { rm_iw = 1 } } 3090 if rm_iw == 1 { rm_in[rm_ninw] = rm_p2; rm_ninw = rm_ninw + 1 } else { rm_nout = rm_nout + 1 } 3091 rm_p2 = rm_p2 + 1 3092 } 3093 var rm_s1: i64 = 0 3094 while rm_s1 < rm_ninw { 3095 var rm_bi: i64 = rm_s1 3096 var rm_s2: i64 = rm_s1 + 1 3097 while rm_s2 < rm_ninw { if rm_mt[rm_in[rm_s2]] > rm_mt[rm_in[rm_bi]] { rm_bi = rm_s2 } rm_s2 = rm_s2 + 1 } 3098 let rm_tp: i64 = rm_in[rm_s1] 3099 rm_in[rm_s1] = rm_in[rm_bi] 3100 rm_in[rm_bi] = rm_tp 3101 rm_s1 = rm_s1 + 1 3102 } 3103 let rm_res: *i64 = sys_mmap(ST_RM_R_SLOTS * ST_RM_I64B) as *i64 3104 let rm_st: *u8 = sys_mmap(ST_RM_S_N * ST_RM_SLOT) 3105 let rm_tn: *u8 = sys_mmap(ST_RM_TYPEMAX * ST_RM_TYPENAME) 3106 let rm_tc: *i64 = sys_mmap(ST_RM_TYPEMAX * ST_RM_I64B) as *i64 3107 let rm_res2: *i64 = sys_mmap(ST_RM_R_SLOTS * ST_RM_I64B) as *i64 3108 let rm_st2: *u8 = sys_mmap(ST_RM_S_N * ST_RM_SLOT) 3109 let rm_tn2: *u8 = sys_mmap(ST_RM_TYPEMAX * ST_RM_TYPENAME) 3110 let rm_tc2: *i64 = sys_mmap(ST_RM_TYPEMAX * ST_RM_I64B) as *i64 3111 // ---- DM1 leg runs BEFORE the seat blocks so every seat can carry its estate-side evidence ---- 3112 let rm_ids2: *u8 = sys_mmap((ST_RM_JSEATMAX + 1) * ST_RM_NAMECAP) 3113 let rm_ids: *u8 = sys_mmap((rm_ninw + 1) * ST_RM_NAMECAP) 3114 var rm_b1: i64 = 0 3115 while rm_b1 < rm_ninw { 3116 st_rm_sid(((rm_ids as i64) + rm_b1 * ST_RM_NAMECAP) as *u8, ((rm_nm as i64) + rm_in[rm_b1] * ST_RM_NAMECAP) as *u8) 3117 rm_b1 = rm_b1 + 1 3118 } 3119 var rm_nseats: i64 = rm_ninw 3120 var rm_efloor: i64 = 0 3121 if rm_estate == 1 { 3122 let rm_en: *i64 = sys_mmap(ST_SPAN) as *i64 3123 let rm_ef: *i64 = sys_mmap(ST_SPAN) as *i64 3124 st_rm_jseats(jrn, rm_ids2, rm_en, rm_ws, rm_we, rm_ef) 3125 rm_nseats = rm_en[0] 3126 rm_efloor = rm_ef[0] 3127 } 3128 let rm_jfr: *i64 = sys_mmap((rm_nseats + 1) * ST_RM_I64B) as *i64 3129 let rm_jlt: *i64 = sys_mmap((rm_nseats + 1) * ST_RM_I64B) as *i64 3130 let rm_jtl: *u8 = sys_mmap((rm_nseats + 1) * ST_RM_TOOLCAP) 3131 var rm_jst: i64 = ST_RM_J_SKIP 3132 var rm_src: *u8 = rm_ids 3133 if rm_estate == 1 { rm_src = rm_ids2 } 3134 if rm_jdecl == 1 { rm_jst = st_rm_jrnl(jrn, rm_src, rm_nseats, rm_jfr, rm_jlt, rm_jtl, rm_jg, rm_ws, rm_we) } 3135 if rm_estate == 1 { 3136 var rm_e1: i64 = 0 3137 var rm_esess: i64 = 0 3138 while rm_e1 < rm_nseats { 3139 let rm_eid: *u8 = ((rm_ids2 as i64) + rm_e1 * ST_RM_NAMECAP) as *u8 3140 if st_rm_is_sid(rm_eid) == 1 { rm_esess = rm_esess + 1 } 3141 st_rm_jseat_block(rm_eid, rm_lb, rm_jfr[rm_e1], rm_jlt[rm_e1], ((rm_jtl as i64) + rm_e1 * ST_RM_TOOLCAP) as *u8) 3142 rm_e1 = rm_e1 + 1 3143 } 3144 rm_o = st_cat(rm_lb, 0, "ESTATE-ONLY source=journal actors=" as *u8) 3145 rm_o = st_catn(rm_lb, rm_o, rm_nseats) 3146 rm_o = st_cat(rm_lb, rm_o, " session_seats=" as *u8) 3147 rm_o = st_catn(rm_lb, rm_o, rm_esess) 3148 rm_o = st_cat(rm_lb, rm_o, " agent_children_and_actors=" as *u8) 3149 rm_o = st_catn(rm_lb, rm_o, rm_nseats - rm_esess) 3150 rm_o = st_cat(rm_lb, rm_o, " sum=" as *u8) 3151 rm_o = st_catn(rm_lb, rm_o, rm_esess + (rm_nseats - rm_esess)) 3152 if rm_esess + (rm_nseats - rm_esess) == rm_nseats { rm_o = st_cat(rm_lb, rm_o, " SUM-OK" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, " SUM-LEAK" as *u8) } 3153 rm_o = st_cat(rm_lb, rm_o, " transcripts_reachable=0 (in-flight detection UNOBSERVABLE from frames -- every seat state is UNKNOWN by construction, never COMPLETED)" as *u8) 3154 if rm_efloor == 1 { rm_o = st_cat(rm_lb, rm_o, " seats_floor=1 (id table full -- this seat count is a FLOOR, not a total)" as *u8) } 3155 st_rm_emit(rm_lb, rm_o) 3156 } 3157 var rm_ccr: i64 = 0 3158 var rm_cco: i64 = 0 3159 var rm_cid: i64 = 0 3160 var rm_cun: i64 = 0 3161 var rm_s3: i64 = 0 3162 while rm_s3 < rm_ninw { 3163 let rm_ix: i64 = rm_in[rm_s3] 3164 let rm_cd: i64 = st_rm_seat(dir, ((rm_nm as i64) + rm_ix * ST_RM_NAMECAP) as *u8, rm_mt[rm_ix], rm_sz[rm_ix], troot, rm_lb, rm_res, rm_st, rm_tn, rm_tc, rm_res2, rm_st2, rm_tn2, rm_tc2, rm_jst, rm_jfr[rm_s3], rm_jlt[rm_s3], ((rm_jtl as i64) + rm_s3 * ST_RM_TOOLCAP) as *u8) 3165 if rm_cd == ST_RM_ST_CRASHED { rm_ccr = rm_ccr + 1 } 3166 if rm_cd == ST_RM_ST_COMPLETED { rm_cco = rm_cco + 1 } 3167 if rm_cd == ST_RM_ST_IDLE { rm_cid = rm_cid + 1 } 3168 if rm_cd == ST_RM_ST_UNKNOWN { rm_cun = rm_cun + 1 } 3169 rm_s3 = rm_s3 + 1 3170 } 3171 let rm_sum: i64 = rm_ninw + rm_nout 3172 rm_o = st_cat(rm_lb, 0, "PARTITION scope=transcripts total_jsonl=" as *u8) 3173 rm_o = st_catn(rm_lb, rm_o, rm_n) 3174 rm_o = st_cat(rm_lb, rm_o, " in_window=" as *u8) 3175 rm_o = st_catn(rm_lb, rm_o, rm_ninw) 3176 rm_o = st_cat(rm_lb, rm_o, " out_of_window=" as *u8) 3177 rm_o = st_catn(rm_lb, rm_o, rm_nout) 3178 rm_o = st_cat(rm_lb, rm_o, " sum=" as *u8) 3179 rm_o = st_catn(rm_lb, rm_o, rm_sum) 3180 if rm_sum == rm_n { rm_o = st_cat(rm_lb, rm_o, " SUM-OK" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, " SUM-LEAK" as *u8) } 3181 rm_o = st_cat(rm_lb, rm_o, " nonjsonl=" as *u8) 3182 rm_o = st_catn(rm_lb, rm_o, rm_nonj[0]) 3183 rm_o = st_cat(rm_lb, rm_o, " statfail=" as *u8) 3184 rm_o = st_catn(rm_lb, rm_o, rm_sf[0]) 3185 rm_o = st_cat(rm_lb, rm_o, " grew_during_enum=" as *u8) 3186 rm_o = st_catn(rm_lb, rm_o, rm_gw[0]) 3187 st_rm_emit(rm_lb, rm_o) 3188 let rm_is: i64 = rm_ccr + rm_cco + rm_cid + rm_cun 3189 rm_o = st_cat(rm_lb, 0, "INWINDOW crashed_midaction=" as *u8) 3190 rm_o = st_catn(rm_lb, rm_o, rm_ccr) 3191 rm_o = st_cat(rm_lb, rm_o, " completed=" as *u8) 3192 rm_o = st_catn(rm_lb, rm_o, rm_cco) 3193 rm_o = st_cat(rm_lb, rm_o, " idle=" as *u8) 3194 rm_o = st_catn(rm_lb, rm_o, rm_cid) 3195 rm_o = st_cat(rm_lb, rm_o, " unknown=" as *u8) 3196 rm_o = st_catn(rm_lb, rm_o, rm_cun) 3197 rm_o = st_cat(rm_lb, rm_o, " sum=" as *u8) 3198 rm_o = st_catn(rm_lb, rm_o, rm_is) 3199 if rm_is == rm_ninw { rm_o = st_cat(rm_lb, rm_o, " SUM-OK" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, " SUM-LEAK" as *u8) } 3200 st_rm_emit(rm_lb, rm_o) 3201 // ---- DM1 leg verdict: SKIP (abstain) / PARTIAL (covered window STATED) / COVERS ---- 3202 if rm_jdecl == 0 { 3203 rm_o = st_cat(rm_lb, 0, "JOURNAL none-declared SKIP UNOBSERVABLE (no frames journal passed -- pass knowledge/status/chbeat or a chbeat_<YYYYMMDD>.jrnl day file)" as *u8) 3204 st_rm_emit(rm_lb, rm_o) 3205 } else { 3206 rm_o = st_cat(rm_lb, 0, "JOURNAL path=" as *u8) 3207 rm_o = st_cat(rm_lb, rm_o, jrn) 3208 rm_o = st_cat(rm_lb, rm_o, " verdict=" as *u8) 3209 rm_o = st_cat(rm_lb, rm_o, st_rm_jstate_lit(rm_jst)) 3210 rm_o = st_cat(rm_lb, rm_o, " files=" as *u8) 3211 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_FILES]) 3212 rm_o = st_cat(rm_lb, rm_o, " bytes=" as *u8) 3213 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_BYTES]) 3214 rm_o = st_cat(rm_lb, rm_o, " frames=" as *u8) 3215 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_FRAMES]) 3216 rm_o = st_cat(rm_lb, rm_o, " frames_in_window=" as *u8) 3217 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_INWIN]) 3218 rm_o = st_cat(rm_lb, rm_o, " tszero=" as *u8) 3219 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_TSZERO]) 3220 rm_o = st_cat(rm_lb, rm_o, " malformed=" as *u8) 3221 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_MALFORMED]) 3222 st_rm_emit(rm_lb, rm_o) 3223 rm_o = st_cat(rm_lb, 0, "JOURNAL covered_window=" as *u8) 3224 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_MINTS]) 3225 rm_o = st_cat(rm_lb, rm_o, ".." as *u8) 3226 rm_o = st_catn(rm_lb, rm_o, rm_jg[ST_RM_JG_MAXTS]) 3227 rm_o = st_cat(rm_lb, rm_o, " requested_window=" as *u8) 3228 rm_o = st_catn(rm_lb, rm_o, rm_ws) 3229 rm_o = st_cat(rm_lb, rm_o, ".." as *u8) 3230 rm_o = st_catn(rm_lb, rm_o, rm_we) 3231 if rm_jst == ST_RM_J_SKIP { rm_o = st_cat(rm_lb, rm_o, " SKIP UNOBSERVABLE reason=absent-or-empty (abstain, never acquit)" as *u8) } 3232 if rm_jst == ST_RM_J_PARTIAL { rm_o = st_cat(rm_lb, rm_o, " PARTIAL: the journal does NOT span the requested window (backfill mid-drain) -- per-seat journal evidence is a FLOOR, absence of frames is NOT absence of activity" as *u8) } 3233 if rm_jst == ST_RM_J_COVERS { rm_o = st_cat(rm_lb, rm_o, " COVERS: derived coverage spans the requested window; a seat with zero frames is UNCOVERED, still its own bucket" as *u8) } 3234 st_rm_emit(rm_lb, rm_o) 3235 var rm_ag: i64 = 0 3236 var rm_df: i64 = 0 3237 var rm_uc: i64 = 0 3238 var rm_a1: i64 = 0 3239 while rm_a1 < rm_nseats { 3240 if rm_jfr[rm_a1] <= 0 { rm_uc = rm_uc + 1 } else { rm_ag = rm_ag + 1 } 3241 rm_a1 = rm_a1 + 1 3242 } 3243 rm_df = rm_nseats - rm_ag - rm_uc 3244 rm_o = st_cat(rm_lb, 0, "JOURNAL seats_with_frames=" as *u8) 3245 rm_o = st_catn(rm_lb, rm_o, rm_ag) 3246 rm_o = st_cat(rm_lb, rm_o, " seats_uncovered=" as *u8) 3247 rm_o = st_catn(rm_lb, rm_o, rm_uc) 3248 rm_o = st_cat(rm_lb, rm_o, " residual=" as *u8) 3249 rm_o = st_catn(rm_lb, rm_o, rm_df) 3250 rm_o = st_cat(rm_lb, rm_o, " sum=" as *u8) 3251 rm_o = st_catn(rm_lb, rm_o, rm_ag + rm_uc + rm_df) 3252 if rm_ag + rm_uc + rm_df == rm_nseats { rm_o = st_cat(rm_lb, rm_o, " SUM-OK" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, " SUM-LEAK" as *u8) } 3253 st_rm_emit(rm_lb, rm_o) 3254 } 3255 rm_o = st_cat(rm_lb, 0, "RESUME-MAP-END seats=" as *u8) 3256 rm_o = st_catn(rm_lb, rm_o, rm_nseats) 3257 rm_o = st_cat(rm_lb, rm_o, " source=" as *u8) 3258 if rm_estate == 1 { rm_o = st_cat(rm_lb, rm_o, "estate-journal" as *u8) } else { rm_o = st_cat(rm_lb, rm_o, "transcripts" as *u8) } 3259 if rm_jdecl == 1 { rm_o = st_cat(rm_lb, rm_o, "+journal" as *u8) } 3260 st_rm_emit(rm_lb, rm_o) 3261 return 0 3262} 3263 3264func st_selftest(base0: *u8) -> i64 { 3265 let ctr: *i64 = gv_ctr() 3266 gv_head("nx_seat selftest -- boot digest + meter evidence + SCALE cap (seat-system S0+S3)" as *u8) 3267 let now: i64 = sys_now_realtime_sec() 3268 // FIXTURE-PATH UNIQUENESS IS PER-RUN, AND IT IS APPLIED ONCE AT base ITSELF (2026-08-22). 3269 // Every fixture path here was keyed on sys_now_realtime_sec() -- WHOLE SECONDS -- so two runs in the 3270 // same second SHARED EVERY FIXTURE and the second measured the FIRST run's leftovers. 3271 // MEASURED: nx_behaveprobe runs live and staged back-to-back, and with two BYTE-IDENTICAL binaries 3272 // (both sha 10fc38a0) it reported live_rc=0 other_rc=1 -- identical code cannot disagree by code, so 3273 // the RED was the shared fixture, not the organ. first_diff_off=180 landed on T3, which reads the ws 3274 // journal the previous run had already closed with a DONE frame, so T3 saw DONE where it asserts 3275 // INFLIGHT. A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER -- 3276 // and this one made the ship loop's OWN comparand a FALSE-RED GENERATOR for the entire organ. 3277 // Applied at `base`, NOT at each of the ~18 sites below: patching sites one by one fixes the ones 3278 // someone happened to enumerate and silently leaves the rest sharing state -- the same 3279 // partial-coverage defect in a new costume. Uniquifying `base` covers every fixture BY CONSTRUCTION, 3280 // including any added later by someone who never reads this comment. There is deliberately NO second 3281 // uniquifier below: TWO MECHANISMS FOR ONE INVARIANT IS THE DUPLICATE-RULER DEFECT. 3282 // `now` stays in SECONDS because the teeth compare frame timestamps against it. 3283 let base: *u8 = sys_mmap(256) 3284 var ubo: i64 = st_cat(base, 0, base0) 3285 ubo = st_catn(base, ubo, sys_now_realtime_us()) 3286 ubo = st_cat(base, ubo, "_" as *u8) 3287 base[ubo] = 0 as u8 3288 // unique fixture paths (append-only world: never reuse a stale fixture) 3289 let jr: *u8 = sys_mmap(256) 3290 var o1: i64 = st_cat(jr, 0, base) 3291 o1 = st_cat(jr, o1, ".jrnl" as *u8) 3292 jr[o1] = 0 as u8 3293 let ml: *u8 = sys_mmap(256) 3294 var o2: i64 = st_cat(ml, 0, base) 3295 o2 = st_cat(ml, o2, ".log" as *u8) 3296 ml[o2] = 0 as u8 3297 let dp: *u8 = sys_mmap(256) 3298 var o3: i64 = st_cat(dp, 0, base) 3299 o3 = st_cat(dp, o3, "debt-" as *u8) 3300 dp[o3] = 0 as u8 3301 let fp: *u8 = sys_mmap(256) 3302 var o4: i64 = st_cat(fp, 0, base) 3303 o4 = st_cat(fp, o4, "front-" as *u8) 3304 fp[o4] = 0 as u8 3305 // T1 meter appends one row, rc 0 3306 let mrc: i64 = st_meter_append(ml, "st-seat" as *u8, 1, 11, 22, 33, "st-note" as *u8) 3307 var t1: i64 = 0 3308 if mrc == 0 { t1 = 1 } 3309 gv_check("T1 meter append rc0" as *u8, t1, ctr) 3310 // T2 the row is really in the log (read-back, not asserted) 3311 let mb: *u8 = sys_mmap(ST_MAGIC_8192) 3312 let msz: *i64 = sys_mmap(ST_SPAN) as *i64 3313 let mn: i64 = st_read(ml, mb, ST_MAGIC_8188, msz) 3314 gv_check("T2 meter row read-back" as *u8, st_contains(mb, mn, "st-seat" as *u8), ctr) 3315 // T3 boot derives INFLIGHT from a real KICKOFF frame, zero debts on absent plane 3316 st_frame(jr, now, "KICKOFF" as *u8, "stws" as *u8, "stactor" as *u8, "st-go" as *u8) 3317 let ob: *u8 = sys_mmap(ST_OUTBUF) 3318 var bl: i64 = st_boot("stws" as *u8, jr, dp, fp, ml, ob) 3319 // T3w..T3y EC57: the two census lines ride in EVERY boot digest -- a line or a NAMED absence, never a missing field 3320 var t3w: i64 = 0 3321 if st_contains(ob, bl, ",\"unfinished_census\":\"" as *u8) == 1 { if st_contains(ob, bl, ",\"wip_census\":\"" as *u8) == 1 { t3w = 1 } } 3322 gv_check("T3w boot carries unfinished_census AND wip_census (the started-not-landed line or its named absence)" as *u8, t3w, ctr) 3323 let ptp: *u8 = sys_mmap(256) 3324 var o3p: i64 = st_cat(ptp, 0, base) 3325 o3p = st_catn(ptp, o3p, now) 3326 o3p = st_cat(ptp, o3p, "passthrough.status" as *u8) 3327 ptp[o3p] = 0 as u8 3328 let ppl: *u8 = "old line\nWIP planted=1\n" as *u8 3329 let pfd: i64 = sys_openat_wr(ptp, ST_MODE_RW) 3330 if pfd >= 0 { sys_write(pfd, ppl, st_vlen(ppl)); sys_close(pfd) } 3331 let pob: *u8 = sys_mmap(ST_OUTBUF) 3332 let pn1: i64 = st_passthrough(pob, 0, "k" as *u8, ptp, "ABSENT-X" as *u8) 3333 var t3x: i64 = 0 3334 if st_contains(pob, pn1, ",\"k\":\"WIP planted=1\"" as *u8) == 1 { if st_contains(pob, pn1, "old line" as *u8) == 0 { t3x = 1 } } 3335 gv_check("T3x passthrough carries the LAST line verbatim and nothing before it" as *u8, t3x, ctr) 3336 let pn2: i64 = st_passthrough(pob, 0, "k" as *u8, "/nonexistent/nx_seat_passthrough" as *u8, "ABSENT-X" as *u8) 3337 gv_check("T3y neg-control: an absent status file reads its NAMED absence, never an empty string" as *u8, st_contains(pob, pn2, ",\"k\":\"ABSENT-X\"" as *u8), ctr) 3338 var t3: i64 = 0 3339 if st_contains(ob, bl, "\"phase\":\"INFLIGHT\"" as *u8) == 1 { if st_contains(ob, bl, "\"open_debts\":0" as *u8) == 1 { t3 = 1 } } 3340 gv_check("T3 boot INFLIGHT + zero-debt honest" as *u8, t3, ctr) 3341 // T4 envelope DECLARED in output (scale-law: silent windowing forbidden) 3342 var t4: i64 = 0 3343 if st_contains(ob, bl, "budget_bytes" as *u8) == 1 { if st_contains(ob, bl, "journal_bytes" as *u8) == 1 { t4 = 1 } } 3344 gv_check("T4 envelope declared" as *u8, t4, ctr) 3345 // T5 SCALE tooth: 300 long frames -> output STILL <= budget (production-shape, not fixture) 3346 var f: i64 = 0 3347 while f < ST_ST_FRAMES { 3348 st_frame(jr, now + f, "BEAT" as *u8, "stws" as *u8, "stactor" as *u8, "scale-frame-note-padding-0123456789-abcdefghijklmnopqrstuvwxyz-0123456789-abcdefghijklmnopqrstuvwxyz" as *u8) 3349 f = f + 1 3350 } 3351 bl = st_boot("stws" as *u8, jr, dp, fp, ml, ob) 3352 var t5: i64 = 0 3353 if bl <= ST_OUTCAP { t5 = 1 } 3354 gv_check("T5 scale cap holds under 300 frames" as *u8, t5, ctr) 3355 // T6 DONE frame flips the derived phase (evidence-derived, no self-report) 3356 st_frame(jr, now + 900, "DONE" as *u8, "stws" as *u8, "stactor" as *u8, "st-done" as *u8) 3357 bl = st_boot("stws" as *u8, jr, dp, fp, ml, ob) 3358 gv_check("T6 boot derives DONE from the frame" as *u8, st_contains(ob, bl, "\"phase\":\"DONE\"" as *u8), ctr) 3359 // T6b (2026-08-06, debt 1786054445) THE REAP-IS-NOT-ACTIVITY TOOTH. Runs on its OWN journal so the 3360 // count is deterministic and the 300 scale frames above cannot crowd the assertion out of active[]. 3361 // THREE DIRECTIONS, because only the middle one is the fix and the other two are what stop it from 3362 // passing vacuously: (1) a kicked-off lane MUST appear in active[] -- otherwise the tooth can see 3363 // nothing at all and would "prove" the fix by observing an empty list; (2) once an ORPHAN-REAPED 3364 // frame lands it MUST vanish -- the defect, measured live as debt-eat and debt-eater TOPPING the 3365 // boot digest at the exact reap timestamp; (3) after a LATER BEAT it MUST come back -- proving we 3366 // suppressed a reap rather than every lane that was ever reaped, which is the sibling's T11 rule. 3367 let jr2: *u8 = sys_mmap(256) 3368 var o9: i64 = st_cat(jr2, 0, base) 3369 o9 = st_catn(jr2, o9, now) 3370 o9 = st_cat(jr2, o9, "reapdigest.jrnl" as *u8) 3371 jr2[o9] = 0 as u8 3372 st_frame(jr2, now, "KICKOFF" as *u8, "streap" as *u8, "seatR" as *u8, "go" as *u8) 3373 bl = st_boot("stprobe" as *u8, jr2, dp, fp, ml, ob) 3374 let r1: i64 = st_contains(ob, bl, "\"ws\":\"streap\"" as *u8) 3375 st_frame(jr2, now + 10, "ORPHAN-REAPED" as *u8, "streap" as *u8, "reaper" as *u8, "expired-ttl" as *u8) 3376 bl = st_boot("stprobe" as *u8, jr2, dp, fp, ml, ob) 3377 let r2: i64 = st_contains(ob, bl, "\"ws\":\"streap\"" as *u8) 3378 st_frame(jr2, now + 20, "BEAT" as *u8, "streap" as *u8, "seatR" as *u8, "back-to-work" as *u8) 3379 bl = st_boot("stprobe" as *u8, jr2, dp, fp, ml, ob) 3380 let r3: i64 = st_contains(ob, bl, "\"ws\":\"streap\"" as *u8) 3381 var t6b: i64 = 0 3382 if r1 == 1 { if r2 == 0 { if r3 == 1 { t6b = 1 } } } 3383 gv_check("T6b reaped ws leaves active, later BEAT revives it" as *u8, t6b, ctr) 3384 // T6c CLAIM-AWARE TOP-DEBT SELECTION (2026-08-22). FOUR DIRECTIONS, because only the second is 3385 // the fix and the other three are what stop it passing vacuously: 3386 // (a) NEG-CONTROL: on an EMPTY claims journal a real row MUST be selected -- otherwise every 3387 // assertion below could "pass" against an empty board (gate-passes-on-the-empty-set); 3388 // (b) THE FIX: a row held by ANOTHER actor is passed over, the count rises, and the holder is 3389 // NAMED -- a skip that cannot say who holds it sends the next seat hunting; 3390 // (c) ANTI-VACUITY: a row held by THIS actor is STILL selected. An implementation that simply 3391 // skipped every claimed row would pass (b) and FAIL here. This is crash-resume; 3392 // (d) RESTORE: after RELEASE the original row returns, proving live holdership is read rather 3393 // than latched on the first claim ever seen. 3394 // BOTH planes are per-run FIXTURES under base -- nothing here reads or writes production. 3395 // The debt plane is SEEDED rather than read live. Reading the production board made every assertion 3396 // RELATIVE ("a different row") instead of EXACT, made the tooth depend on data that changes under 3397 // it, and would have turned it RED whenever that plane was unreadable for reasons unrelated to this 3398 // code. Seeding also makes two edge cases assertable AT ALL: 3399 // 1785000004 is sev-9 but status=eaten -> MUST be ignored, proving the status filter is live and 3400 // that picking "the highest sev" is not silently picking the highest sev of ANY status; 3401 // NOTANIDXX has a non-integer id -> MUST land in the unclaimable bucket, never in "unclaimed". 3402 // Row grammar is the debt plane's own: <id> TAB <sev> TAB <scope> TAB <status> TAB <desc>. 3403 let dseed: *u8 = sys_mmap(ST_MAGIC_1024) 3404 var dso: i64 = 0 3405 dso = st_cat(dseed, dso, "1785000001\t9\tfx-a\topen\tfirst sev9 row\n" as *u8) 3406 dso = st_cat(dseed, dso, "1785000002\t9\tfx-b\topen\tsecond sev9 row\n" as *u8) 3407 dso = st_cat(dseed, dso, "1785000003\t7\tfx-c\topen\tlower sev row\n" as *u8) 3408 dso = st_cat(dseed, dso, "1785000004\t9\tfx-d\teaten\tsev9 but NOT open\n" as *u8) 3409 dso = st_cat(dseed, dso, "NOTANIDXX\t9\tfx-e\topen\tnon-integer id\n" as *u8) 3410 let rdp: *u8 = sys_mmap(256) 3411 var rdo: i64 = st_cat(rdp, 0, base) 3412 rdo = st_cat(rdp, rdo, "t6cdebt-" as *u8) 3413 rdp[rdo] = 0 as u8 3414 sts_seed(rdp, dseed, dso) 3415 let cj3: *u8 = sys_mmap(256) 3416 var oc3: i64 = st_cat(cj3, 0, base) 3417 oc3 = st_cat(cj3, oc3, "claims.jrnl" as *u8) 3418 cj3[oc3] = 0 as u8 3419 let bp3: *i64 = sys_mmap(ST_SPAN) as *i64 3420 let fs3: *i64 = sys_mmap(ST_SPAN * 3) as *i64 3421 let cb3: *i64 = sys_mmap(ST_SPAN * 4) as *i64 // 7 slots cb[0..6], same as the caller in st_boot_cj 3422 let k3: i64 = st_topdebt_unclaimed(rdp, bp3, fs3, cj3, "st-meseat" as *u8, now, cb3) 3423 let base_row: i64 = fs3[0] 3424 // EVERY AGGREGATE BOUND TO ITS DENOMINATOR: k3 is the OPEN count, so asserting it is 4 (not 5) is 3425 // what proves the eaten sev-9 was excluded rather than merely out-ranked. 3426 var t6ca: i64 = 0 3427 if base_row >= 0 { if cb3[0] == 0 { if k3 == 4 { if cb3[5] == 1 { if fs3[2] == 9 { t6ca = 1 } } } } } 3428 gv_check("T6c-a neg-control exact: 4 open of 5 seeded, sev9 picked, 0 held, 1 unclaimable id" as *u8, t6ca, ctr) 3429 // the claim resource is derived from the SELECTED row's own id column -- same derivation the 3430 // selector uses, so the tooth cannot pass by agreeing with a different naming rule. 3431 let d3: *u8 = bp3[0] as *u8 3432 let c03: *i64 = sys_mmap(ST_SPAN) as *i64 3433 let res3: *u8 = sys_mmap(ST_CLAIMRES_B) 3434 var haveid: i64 = 0 3435 if base_row >= 0 { if st_col(d3, fs3[0], fs3[1], 0, c03) == 1 { 3436 var or3: i64 = st_cat(res3, 0, ST_CLAIMRES_PFX) 3437 var pq: i64 = c03[0] 3438 while pq < c03[1] { res3[or3] = d3[pq]; or3 = or3 + 1; pq = pq + 1 } 3439 res3[or3] = 0 as u8 3440 haveid = 1 3441 } } 3442 cl_append(cj3, now, "CLAIM" as *u8, res3, "st-otherseat" as *u8, ST_MAGIC_3600, "gate-other" as *u8) 3443 st_topdebt_unclaimed(rdp, bp3, fs3, cj3, "st-meseat" as *u8, now, cb3) 3444 var t6cb: i64 = 0 3445 if haveid == 1 { if fs3[0] != base_row { if cb3[0] >= 1 { if cb3[1] >= 0 { t6cb = 1 } } } } 3446 gv_check("T6c-b row held by ANOTHER actor is skipped, COUNTED and its holder NAMED" as *u8, t6cb, ctr) 3447 let cj4: *u8 = sys_mmap(256) 3448 var oc4: i64 = st_cat(cj4, 0, base) 3449 oc4 = st_catn(cj4, oc4, now) 3450 oc4 = st_cat(cj4, oc4, "claims-mine.jrnl" as *u8) 3451 cj4[oc4] = 0 as u8 3452 cl_append(cj4, now, "CLAIM" as *u8, res3, "st-meseat" as *u8, ST_MAGIC_3600, "gate-mine" as *u8) 3453 st_topdebt_unclaimed(rdp, bp3, fs3, cj4, "st-meseat" as *u8, now, cb3) 3454 var t6cc: i64 = 0 3455 if haveid == 1 { if fs3[0] == base_row { if cb3[4] == 1 { if cb3[0] == 0 { t6cc = 1 } } } } 3456 gv_check("T6c-c anti-vacuity: a row held by THIS actor is STILL offered (crash-resume)" as *u8, t6cc, ctr) 3457 cl_append(cj3, now + 1, "RELEASE" as *u8, res3, "st-otherseat" as *u8, 0, "gate-release" as *u8) 3458 st_topdebt_unclaimed(rdp, bp3, fs3, cj3, "st-meseat" as *u8, now, cb3) 3459 var t6cd: i64 = 0 3460 if haveid == 1 { if fs3[0] == base_row { if cb3[0] == 0 { t6cd = 1 } } } 3461 gv_check("T6c-d RELEASE restores the original row (live holdership, not a latch)" as *u8, t6cd, ctr) 3462 // T6d THE CALL SITE, NOT THE DEFINITION. T6c proves st_topdebt_unclaimed's LOGIC; NOTHING above 3463 // proves BOOT ACTUALLY REACHES IT -- that it passes the right journal, passes ws AS THE ACTOR, and 3464 // emits the fields. A fix that is correct and unreached is indistinguishable from a bug nobody has 3465 // found, and that is the entire reason this tooth exists. Hermetic: the SAME seeded debt plane plus 3466 // fresh fixture claims journals, through st_boot_cj (the injectable form), so production is untouched. 3467 let cjb: *u8 = sys_mmap(256) 3468 var ocb: i64 = st_cat(cjb, 0, base) 3469 ocb = st_cat(cjb, ocb, "bootclaims.jrnl" as *u8) 3470 cjb[ocb] = 0 as u8 3471 let bout: *u8 = sys_mmap(ST_OUTBUF) 3472 var bn: i64 = st_boot_cj("st-meseat" as *u8, jr, rdp, fp, ml, cjb, bout) 3473 var t6d1: i64 = 0 3474 // EXACT counts, derived from the seeded plane: only 1785000001 clears the running max, so exactly 3475 // ONE row is holdership-tested and NONE is skipped. Asserting the DENOMINATOR is what makes the 3476 // skip count readable -- 0 skipped of 1 tested is a different fact from 0 skipped of 4140. 3477 if st_contains(bout, bn, "\"top_debt_skipped_held\":0" as *u8) == 1 { if st_contains(bout, bn, "\"top_debt_holdership_tested\":1" as *u8) == 1 { if st_contains(bout, bn, "1785000001" as *u8) == 1 { if st_contains(bout, bn, "\"top_debt_unclaimable_ids\":1" as *u8) == 1 { t6d1 = 1 } } } } 3478 gv_check("T6d-a boot WIRES the selector: top row + 0 skipped of 1 tested + 1 unclaimable in digest" as *u8, t6d1, ctr) 3479 cl_append(cjb, now, "CLAIM" as *u8, "debt-1785000001" as *u8, "st-otherseat" as *u8, ST_MAGIC_3600, "gate-boot" as *u8) 3480 bn = st_boot_cj("st-meseat" as *u8, jr, rdp, fp, ml, cjb, bout) 3481 var t6d2: i64 = 0 3482 // EXACT: 1785000001 is tested and SKIPPED, then 1785000002 is tested and taken -> skipped 1 of 2 3483 // tested. The pair is what proves the skip is a SKIP and not a silent drop: the denominator moved. 3484 if st_contains(bout, bn, "\"top_debt_skipped_held\":1" as *u8) == 1 { if st_contains(bout, bn, "\"top_debt_holdership_tested\":2" as *u8) == 1 { if st_contains(bout, bn, "st-otherseat" as *u8) == 1 { if st_contains(bout, bn, "1785000002" as *u8) == 1 { t6d2 = 1 } } } } 3485 gv_check("T6d-b foreign-held row skipped end-to-end: 1 skipped of 2 tested, holder named, next served" as *u8, t6d2, ctr) 3486 // THE DISCRIMINATOR for the ACTOR wiring: claim the SAME row as the booting ws itself. If boot passed 3487 // anything other than ws as the actor, this row would read as foreign and be SKIPPED -- so only the 3488 // correct wiring can produce resume_is_mine=1 AND the original row. 3489 let cjm: *u8 = sys_mmap(256) 3490 var ocm: i64 = st_cat(cjm, 0, base) 3491 ocm = st_cat(cjm, ocm, "bootmine.jrnl" as *u8) 3492 cjm[ocm] = 0 as u8 3493 cl_append(cjm, now, "CLAIM" as *u8, "debt-1785000001" as *u8, "st-meseat" as *u8, ST_MAGIC_3600, "gate-bootmine" as *u8) 3494 bn = st_boot_cj("st-meseat" as *u8, jr, rdp, fp, ml, cjm, bout) 3495 var t6d3: i64 = 0 3496 if st_contains(bout, bn, "\"top_debt_resume_is_mine\":1" as *u8) == 1 { if st_contains(bout, bn, "1785000001" as *u8) == 1 { t6d3 = 1 } } 3497 gv_check("T6d-c boot passes ws AS THE ACTOR: own claim -> resume_is_mine=1, same row still served" as *u8, t6d3, ctr) 3498 // T7-T9 S1 protocol vs the REAL nx_claims organ (fork composition; temp journals) 3499 let cjp: *u8 = sys_mmap(256) 3500 var o5: i64 = st_cat(cjp, 0, base) 3501 o5 = st_catn(cjp, o5, now) 3502 o5 = st_cat(cjp, o5, "claims.jrnl" as *u8) 3503 cjp[o5] = 0 as u8 3504 let s1out: *u8 = sys_mmap(ST_MAGIC_4096) 3505 let ci: i64 = st_do_checkin("stws2" as *u8, "seatA" as *u8, ST_MAGIC_3600, "s1-go" as *u8, cjp, jr, s1out) 3506 var t7: i64 = 0 3507 let q2: *u8 = sys_mmap(ST_CAP) 3508 let q2sz: *i64 = sys_mmap(ST_SPAN) as *i64 3509 let q2n: i64 = st_read(jr, q2, ST_CAP - 4, q2sz) 3510 if ci == 0 { if st_has(q2, q2n, "KICKOFF" as *u8, "stws2" as *u8) == 1 { t7 = 1 } } 3511 gv_check("T7 checkin claims+kickoff one call" as *u8, t7, ctr) 3512 let ci2: i64 = st_do_checkin("stws2" as *u8, "seatB" as *u8, ST_MAGIC_3600, "s1-steal" as *u8, cjp, jr, s1out) 3513 var t8: i64 = 0 3514 if ci2 == 3 { t8 = 1 } 3515 gv_check("T8 contended checkin REFUSED fail-closed" as *u8, t8, ctr) 3516 let co: i64 = st_do_checkout("stws2" as *u8, "seatA" as *u8, "s1-done" as *u8, cjp, jr, s1out) 3517 var t9: i64 = 0 3518 let q3n: i64 = st_read(jr, q2, ST_CAP - 4, q2sz) 3519 if co == 0 { if st_has(q2, q3n, "DONE" as *u8, "stws2" as *u8) == 1 { t9 = 1 } } 3520 gv_check("T9 checkout done+release one call" as *u8, t9, ctr) 3521 // T10 ready = deps-resolved frontier DIGEST (F832). Fixture store: lane1 -> F900 (no dep) + 3522 // F903 (dep F904=D) READY; F901 (dep F902=T) BLOCKED. Proves the ~1KB projection the 33.7KB 3523 // nx_frontier_board would otherwise need a full CPM dump to answer. 3524 let fseed: *u8 = sys_mmap(ST_CAP) 3525 var fo: i64 = 0 3526 fo = st_cat(fseed, fo, "F900\ttest-ready-nodeps\t8\t1\towner\tT\t-\tm\tlane1\n" as *u8) 3527 fo = st_cat(fseed, fo, "F901\ttest-blocked\t7\t1\towner\tT\tF902\tm\tlane1\n" as *u8) 3528 fo = st_cat(fseed, fo, "F902\ttest-dep-open\t5\t1\towner\tT\t-\tm\tlane2\n" as *u8) 3529 fo = st_cat(fseed, fo, "F903\ttest-ready-depdone\t6\t1\towner\tT\tF904\tm\tlane1\n" as *u8) 3530 fo = st_cat(fseed, fo, "F904\ttest-dep-done\t5\t1\towner\tD\t-\tm\tlane2\n" as *u8) 3531 let fpr: *u8 = sys_mmap(256) 3532 var fpo: i64 = st_cat(fpr, 0, base) 3533 fpo = st_catn(fpr, fpo, now) 3534 fpo = st_cat(fpr, fpo, "rdyfront-" as *u8) 3535 fpr[fpo] = 0 as u8 3536 sts_seed(fpr, fseed, fo) 3537 let rout: *u8 = sys_mmap(ST_OUTBUF) 3538 let rn: i64 = st_ready("lane1" as *u8, 12, fpr, rout) 3539 var t10hits: i64 = 0 3540 if st_contains(rout, rn, "F900" as *u8) == 1 { t10hits = t10hits + 1 } 3541 if st_contains(rout, rn, "F903" as *u8) == 1 { t10hits = t10hits + 1 } 3542 if st_contains(rout, rn, "F901" as *u8) == 0 { t10hits = t10hits + 1 } 3543 if st_contains(rout, rn, "\"ready_total\":2" as *u8) == 1 { t10hits = t10hits + 1 } 3544 if st_contains(rout, rn, "\"blocked_total\":1" as *u8) == 1 { t10hits = t10hits + 1 } 3545 var t10: i64 = 0 3546 if t10hits == 5 { t10 = 1 } 3547 gv_check("T10 ready = deps-resolved frontier digest (F832)" as *u8, t10, ctr) 3548 // T10b RANKW1: w-DESC ordering. F905 (w=9) seeded AFTER F900 (w=8); with maxn=1 the banded 3549 // emit MUST pick F905 and exclude F900 -- store-order would do the opposite (discriminating). 3550 let f9seed: *u8 = sys_mmap(ST_MAGIC_1024) 3551 var f9o: i64 = 0 3552 f9o = st_cat(f9seed, f9o, "F900\ttest-ready-nodeps\t8\t1\towner\tT\t-\tm\tlane1\n" as *u8) 3553 f9o = st_cat(f9seed, f9o, "F905\ttest-ready-bigger-rock\t9\t1\towner\tT\t-\tm\tlane1\n" as *u8) 3554 let f9pr: *u8 = sys_mmap(256) 3555 var f9po: i64 = st_cat(f9pr, 0, base) 3556 f9po = st_catn(f9pr, f9po, now) 3557 f9po = st_cat(f9pr, f9po, "rdyw-" as *u8) 3558 f9pr[f9po] = 0 as u8 3559 sts_seed(f9pr, f9seed, f9o) 3560 let r1out: *u8 = sys_mmap(ST_OUTBUF) 3561 let r1n: i64 = st_ready("lane1" as *u8, 1, f9pr, r1out) 3562 var t10b: i64 = 0 3563 if st_contains(r1out, r1n, "F905" as *u8) == 1 { if st_contains(r1out, r1n, "F900" as *u8) == 0 { if st_contains(r1out, r1n, "\"w\":9" as *u8) == 1 { t10b = 1 } } } 3564 gv_check("T10b ready orders biggest-w first (RANKW1)" as *u8, t10b, ctr) 3565 // T10c CLAIM ANNOTATION ON ready (2026-08-22). THREE DIRECTIONS: (a) neg-control -- on an EMPTY 3566 // claims journal every row reads held-empty and shown_held 0, so nothing below can pass against a 3567 // list that was already annotated; (b) the fix -- a claimed row carries its HOLDER and the count 3568 // rises; (c) the DISCRIMINATOR -- the claimed row is STILL IN THE LIST and its neighbour is STILL 3569 // held-empty, which is what separates "annotates the right row" from "skips work" and from "marks 3570 // everything". ready ANNOTATES rather than skips because a held row is work IN PROGRESS, not work 3571 // that should vanish from the board. The claims journal is a per-run FIXTURE; the production plane 3572 // is never touched. Reuses the T10b frontier fixture (F905 w=9, F900 w=8) already seeded above. 3573 let rcj3: *u8 = sys_mmap(256) 3574 var rc3o: i64 = st_cat(rcj3, 0, base) 3575 rc3o = st_cat(rcj3, rc3o, "rdyclaims.jrnl" as *u8) 3576 rcj3[rc3o] = 0 as u8 3577 let r2out: *u8 = sys_mmap(ST_OUTBUF) 3578 let r2n: i64 = st_ready_cj("lane1" as *u8, 2, f9pr, rcj3, r2out) 3579 var t10ca: i64 = 0 3580 if st_contains(r2out, r2n, "\"shown_held\":0" as *u8) == 1 { if st_contains(r2out, r2n, "F905" as *u8) == 1 { if st_contains(r2out, r2n, "F900" as *u8) == 1 { t10ca = 1 } } } 3581 gv_check("T10c-a neg-control: unclaimed frontier rows read held-empty, shown_held 0" as *u8, t10ca, ctr) 3582 cl_append(rcj3, now, "CLAIM" as *u8, "frontier-F905" as *u8, "st-otherseat" as *u8, ST_MAGIC_3600, "gate-rdy" as *u8) 3583 let r3out: *u8 = sys_mmap(ST_OUTBUF) 3584 let r3n: i64 = st_ready_cj("lane1" as *u8, 2, f9pr, rcj3, r3out) 3585 var t10cb: i64 = 0 3586 if st_contains(r3out, r3n, "st-otherseat" as *u8) == 1 { if st_contains(r3out, r3n, "\"shown_held\":1" as *u8) == 1 { t10cb = 1 } } 3587 gv_check("T10c-b claimed frontier row carries its HOLDER and shown_held rises" as *u8, t10cb, ctr) 3588 var t10cc: i64 = 0 3589 if st_contains(r3out, r3n, "F905" as *u8) == 1 { if st_contains(r3out, r3n, "F900" as *u8) == 1 { if st_contains(r3out, r3n, "\"held\":\"\"" as *u8) == 1 { t10cc = 1 } } } 3590 gv_check("T10c-c held row is ANNOTATED not skipped, neighbour stays held-empty" as *u8, t10cc, ctr) 3591 // T11 shift scoreboard (F831): seeded seat classes + closures -> EXACT derived numbers 3592 let sml: *u8 = sys_mmap(256) 3593 var o6: i64 = st_cat(sml, 0, base) 3594 o6 = st_catn(sml, o6, now) 3595 o6 = st_cat(sml, o6, "shift.log" as *u8) 3596 sml[o6] = 0 as u8 3597 st_meter_append(sml, "claude-fable" as *u8, 2, 600, ST_MAGIC_9000, 70, "cl-a" as *u8) 3598 st_meter_append(sml, "claude-fable" as *u8, 1, 400, 1000, 30, "cl-b" as *u8) 3599 st_meter_append(sml, "maker-local-s2" as *u8, 1, 0, 0, 0, "loc-a" as *u8) 3600 st_meter_append(sml, "maker-local-s2" as *u8, 1, 0, 0, 0, "loc-b" as *u8) 3601 let sjr: *u8 = sys_mmap(256) 3602 var o7: i64 = st_cat(sjr, 0, base) 3603 o7 = st_catn(sjr, o7, now) 3604 o7 = st_cat(sjr, o7, "shift.jrnl" as *u8) 3605 sjr[o7] = 0 as u8 3606 st_frame(sjr, now - ST_MAGIC_90000, "DONE" as *u8, "oldws" as *u8, "a" as *u8, "beyond-window" as *u8) 3607 st_frame(sjr, now - 100, "DONE" as *u8, "ws1" as *u8, "a" as *u8, "in-window" as *u8) 3608 st_frame(sjr, now - 50, "DONE" as *u8, "ws2" as *u8, "a" as *u8, "in-window" as *u8) 3609 st_frame(sjr, now - 10, "KICKOFF" as *u8, "ws3" as *u8, "a" as *u8, "not-a-closure" as *u8) 3610 // EC56: for these teeth the ledger is ABSENT (the landed axis must abstain, never invent) and the stamp is a FIXTURE 3611 // path -- a selftest that wrote knowledge/status/seat_gauge.stamp would forge the production heartbeat with planted numbers 3612 let nlg: *u8 = sys_mmap(256) 3613 var o7l: i64 = st_cat(nlg, 0, base) 3614 o7l = st_catn(nlg, o7l, now) 3615 o7l = st_cat(nlg, o7l, "absent.ledger" as *u8) 3616 nlg[o7l] = 0 as u8 3617 let fst: *u8 = sys_mmap(256) 3618 var o7s: i64 = st_cat(fst, 0, base) 3619 o7s = st_catn(fst, o7s, now) 3620 o7s = st_cat(fst, o7s, "gauge.stamp" as *u8) 3621 fst[o7s] = 0 as u8 3622 let sob: *u8 = sys_mmap(ST_OUTBUF) 3623 let sn: i64 = st_shift(1, sml, sjr, nlg, fst, sob) 3624 var t11h: i64 = 0 3625 if st_contains(sob, sn, "\"claude\":{\"rows\":2,\"sessions\":3,\"out\":1000,\"cread\":10000,\"ccreate\":100}" as *u8) == 1 { t11h = t11h + 1 } 3626 if st_contains(sob, sn, "\"local\":{\"rows\":2,\"sessions\":2,\"out\":0}" as *u8) == 1 { t11h = t11h + 1 } 3627 if st_contains(sob, sn, "\"done_ws\":2" as *u8) == 1 { t11h = t11h + 1 } 3628 if st_contains(sob, sn, "\"claude_out_per_done\":500" as *u8) == 1 { t11h = t11h + 1 } 3629 if st_contains(sob, sn, "\"claude_cread_per_done\":5000" as *u8) == 1 { t11h = t11h + 1 } 3630 var t11: i64 = 0 3631 if t11h == 5 { t11 = 1 } 3632 gv_check("T11 shift scoreboard exact aggregates + window filter" as *u8, t11, ctr) 3633 // T12 shift honest on EMPTY evidence: div0 guarded (-1 sentinels), cap holds, no crash 3634 let eml: *u8 = sys_mmap(256) 3635 var o8: i64 = st_cat(eml, 0, base) 3636 o8 = st_catn(eml, o8, now) 3637 o8 = st_cat(eml, o8, "empty.log" as *u8) 3638 eml[o8] = 0 as u8 3639 let en: i64 = st_shift(7, eml, eml, nlg, fst, sob) 3640 var t12: i64 = 0 3641 if en <= ST_OUTCAP { if st_contains(sob, en, "\"done_ws\":0" as *u8) == 1 { if st_contains(sob, en, "\"claude_out_per_done\":-1" as *u8) == 1 { t12 = 1 } } } 3642 gv_check("T12 shift empty-evidence honest + cap" as *u8, t12, ctr) 3643 // T12b/T12c ES18 ratchet: the SAME log with a previous window seeded, both directions. days=1 -> windows 3644 // [now-86400, now] and [now-172800, now-86400); rows at now-100000 fall in the previous window. 3645 var t12b: i64 = 0 3646 if st_contains(sob, en, "\"ratchet\":\"UNMEASURED\"" as *u8) == 1 { t12b = 1 } 3647 gv_check("T12b ratchet abstains UNMEASURED on empty evidence (a window with zero closed rungs is never a win)" as *u8, t12b, ctr) 3648 // T12k EC56: with NO ledger the landed axis abstains by name -- never a zero that reads as a measurement 3649 var t12k: i64 = 0 3650 if st_contains(sob, en, "\"claude_out_per_landed\":-1" as *u8) == 1 { if st_contains(sob, en, "\"ratchet_landed\":\"UNMEASURED\"" as *u8) == 1 { if st_contains(sob, en, "\"gauge_basis\":\"none\"" as *u8) == 1 { if st_contains(sob, en, "\"ledger_bytes\":0" as *u8) == 1 { t12k = 1 } } } } 3651 gv_check("T12k neg-control: an ABSENT ledger abstains (per-landed -1, ratchet_landed UNMEASURED, basis none, ledger_bytes 0)" as *u8, t12k, ctr) 3652 let rml: *u8 = sys_mmap(256) 3653 var o8r: i64 = st_cat(rml, 0, base) 3654 o8r = st_catn(rml, o8r, now) 3655 o8r = st_cat(rml, o8r, "ratchet.log" as *u8) 3656 rml[o8r] = 0 as u8 3657 let rjr: *u8 = sys_mmap(256) 3658 var o8j: i64 = st_cat(rjr, 0, base) 3659 o8j = st_catn(rjr, o8j, now) 3660 o8j = st_cat(rjr, o8j, "ratchet.jrnl" as *u8) 3661 rjr[o8j] = 0 as u8 3662 // previous window: 200 out over 2 closures = 100 per rung; current: 1000 over 2 = 500 -> RED 3663 st_meter_append_at(rml, now - ST_MAGIC_100000, "claude-fable" as *u8, 1, 200, 400, 4, "prev-a" as *u8) 3664 st_frame(rjr, now - ST_MAGIC_100000, "DONE" as *u8, "pws1" as *u8, "a" as *u8, "prev-window" as *u8) 3665 st_frame(rjr, now - ST_MAGIC_100000 + 5, "DONE" as *u8, "pws2" as *u8, "a" as *u8, "prev-window" as *u8) 3666 st_meter_append(rml, "claude-fable" as *u8, 1, 1000, ST_FIX_CUR_CREAD, 20, "cur-a" as *u8) 3667 st_frame(rjr, now - 50, "DONE" as *u8, "cws1" as *u8, "a" as *u8, "in-window" as *u8) 3668 st_frame(rjr, now - 10, "DONE" as *u8, "cws2" as *u8, "a" as *u8, "in-window" as *u8) 3669 let rn1: i64 = st_shift(1, rml, rjr, nlg, fst, sob) 3670 var t12c: i64 = 0 3671 if st_contains(sob, rn1, "\"claude_out_per_done\":500" as *u8) == 1 { if st_contains(sob, rn1, "\"prev\":{\"days\":1,\"measured\":1,\"claude_rows\":1,\"claude_out\":200,\"done_ws\":2,\"claude_out_per_done\":100}" as *u8) == 1 { if st_contains(sob, rn1, "\"ratchet\":\"RED\"" as *u8) == 1 { t12c = 1 } } } 3672 gv_check("T12c ratchet RED when out per closed rung rose 100 -> 500 against the previous window (exact prev aggregates)" as *u8, t12c, ctr) 3673 // the same shape reversed: previous 4000 over 2 = 2000, current 500 -> GREEN 3674 let gml: *u8 = sys_mmap(256) 3675 var o8g: i64 = st_cat(gml, 0, base) 3676 o8g = st_catn(gml, o8g, now) 3677 o8g = st_cat(gml, o8g, "ratchetg.log" as *u8) 3678 gml[o8g] = 0 as u8 3679 st_meter_append_at(gml, now - ST_MAGIC_100000, "claude-fable" as *u8, 1, ST_FIX_PREV_OUT_HIGH, 400, 4, "prev-b" as *u8) 3680 st_meter_append(gml, "claude-fable" as *u8, 1, 1000, ST_FIX_CUR_CREAD, 20, "cur-b" as *u8) 3681 let rn2: i64 = st_shift(1, gml, rjr, nlg, fst, sob) 3682 var t12d: i64 = 0 3683 if st_contains(sob, rn2, "\"claude_out_per_done\":500" as *u8) == 1 { if st_contains(sob, rn2, "\"prev\":{\"days\":1,\"measured\":1,\"claude_rows\":1,\"claude_out\":4000,\"done_ws\":2,\"claude_out_per_done\":2000}" as *u8) == 1 { if st_contains(sob, rn2, "\"ratchet\":\"GREEN\"" as *u8) == 1 { t12d = 1 } } } 3684 gv_check("T12d ratchet GREEN when out per closed rung fell 2000 -> 500 (neg-control for T12c: same reader, opposite direction)" as *u8, t12d, ctr) 3685 var t12e: i64 = 0 3686 if st_contains(sob, rn2, "\"quality\":{\"src\":\"knowledge/status/gateroster.stamp\",\"observed\":" as *u8) == 1 { if st_contains(sob, rn2, "\"grade_delta\":\"UNMEASURED-single-stamp\"" as *u8) == 1 { t12e = 1 } } 3687 gv_check("T12e the quality floor travels with the number and its unmeasured half is DECLARED, never dropped" as *u8, t12e, ctr) 3688 // T12f..T12l EC56: the LANDED axis from a PLANTED ledger. The seat protocol recorded nothing (no DONE frames at all); 3689 // the boards journaled two rungs in the window (R2 landed twice, R1 retracted once) and one rung in the window before. 3690 let lml: *u8 = sys_mmap(256) 3691 var o8l: i64 = st_cat(lml, 0, base) 3692 o8l = st_catn(lml, o8l, now) 3693 o8l = st_cat(lml, o8l, "landed.log" as *u8) 3694 lml[o8l] = 0 as u8 3695 st_meter_append_at(lml, now - ST_MAGIC_100000, "claude-fable" as *u8, 1, 300, 400, 4, "prev-l" as *u8) 3696 st_meter_append(lml, "claude-fable" as *u8, 1, 1000, ST_FIX_CUR_CREAD, 20, "cur-l" as *u8) 3697 let llg: *u8 = sys_mmap(256) 3698 var o8d: i64 = st_cat(llg, 0, base) 3699 o8d = st_catn(llg, o8d, now) 3700 o8d = st_cat(llg, o8d, "landed.ledger" as *u8) 3701 llg[o8d] = 0 as u8 3702 let lst2: *u8 = sys_mmap(256) 3703 var o8t: i64 = st_cat(lst2, 0, base) 3704 o8t = st_catn(lst2, o8t, now) 3705 o8t = st_cat(lst2, o8t, "landed.stamp" as *u8) 3706 lst2[o8t] = 0 as u8 3707 let lgb: *u8 = sys_mmap(ST_MAGIC_1024) 3708 var lo2: i64 = st_cat(lgb, 0, "cal|" as *u8) 3709 lo2 = st_catn(lgb, lo2, now) 3710 lo2 = st_cat(lgb, lo2, "|1|3|9|0|3|2|1|0|100|100|500|4\nland|fx|R1|" as *u8) 3711 lo2 = st_catn(lgb, lo2, now - 50) 3712 lo2 = st_cat(lgb, lo2, "|20\nland|fx|R2|" as *u8) 3713 lo2 = st_catn(lgb, lo2, now - 40) 3714 lo2 = st_cat(lgb, lo2, "|15\nland|fx|R2|" as *u8) 3715 lo2 = st_catn(lgb, lo2, now - 30) 3716 lo2 = st_cat(lgb, lo2, "|15\nretract|fx|R1|" as *u8) 3717 lo2 = st_catn(lgb, lo2, now - 20) 3718 lo2 = st_cat(lgb, lo2, "\nland|fx|R0|" as *u8) 3719 lo2 = st_catn(lgb, lo2, now - ST_MAGIC_100000) 3720 lo2 = st_cat(lgb, lo2, "|10\n" as *u8) 3721 let lfd: i64 = sys_openat_wr(llg, ST_MODE_RW) 3722 var lwrote: i64 = 0 3723 if lfd >= 0 { sys_write(lfd, lgb, lo2); sys_close(lfd); lwrote = 1 } 3724 gv_check("T12f0 fixture-reached-the-condition: the planted ledger was written" as *u8, lwrote, ctr) 3725 let ln1: i64 = st_shift(1, lml, eml, llg, lst2, sob) 3726 var t12f: i64 = 0 3727 if st_contains(sob, ln1, "\"done_ws\":0" as *u8) == 1 { if st_contains(sob, ln1, "\"events\":3,\"rungs\":2,\"relanded\":1,\"retracts\":1,\"deciu\":35,\"ledger_land_events\":4}" as *u8) == 1 { if st_contains(sob, ln1, "\"claude_out_per_landed\":500" as *u8) == 1 { t12f = 1 } } } 3728 gv_check("T12f landed from the boards' journal with ZERO DONE frames: 3 events, 2 distinct rungs, 1 relanded, 1 retract, 35 deci-u, out per landed 500" as *u8, t12f, ctr) 3729 var t12g: i64 = 0 3730 if st_contains(sob, ln1, "\"prev_landed\":{\"rungs\":1,\"retracts\":0,\"claude_out_per_landed\":300}" as *u8) == 1 { if st_contains(sob, ln1, "\"ratchet_landed\":\"RED\"" as *u8) == 1 { t12g = 1 } } 3731 gv_check("T12g ratchet_landed RED when out per landed rung rose 300 -> 500 against the previous window (exact prev aggregates)" as *u8, t12g, ctr) 3732 // the gauge: basis landed, written to the CALLER'S stamp path and nowhere else 3733 let gsb: *u8 = sys_mmap(ST_MAGIC_1024) 3734 let gsz: *i64 = sys_mmap(ST_SPAN) as *i64 3735 let gsn: i64 = st_read(lst2, gsb, ST_MAGIC_1024 - 4, gsz) 3736 var t12h: i64 = 0 3737 if st_contains(sob, ln1, "\"gauge_basis\":\"landed\"" as *u8) == 1 { if gsn > 0 { if st_contains(gsb, gsn, "gauge=500 " as *u8) == 1 { t12h = 1 } } } 3738 gv_check("T12h the gauge stamp is written from the landed basis (gauge=500) at the caller's stamp path" as *u8, t12h, ctr) 3739 var t12i: i64 = 0 3740 if st_contains(sob, ln1, "landed.stamp\"" as *u8) == 1 { if st_contains(sob, ln1, "seat_gauge.stamp" as *u8) == 0 { t12i = 1 } } 3741 gv_check("T12i neg-control: a fixture run names its OWN stamp and never the production heartbeat" as *u8, t12i, ctr) 3742 // the same ledger against a log whose previous window was dearer: 4000 over 1 landed rung -> 500 now -> GREEN 3743 let ln2: i64 = st_shift(1, gml, eml, llg, lst2, sob) 3744 var t12j: i64 = 0 3745 if st_contains(sob, ln2, "\"prev_landed\":{\"rungs\":1,\"retracts\":0,\"claude_out_per_landed\":4000}" as *u8) == 1 { if st_contains(sob, ln2, "\"ratchet_landed\":\"GREEN\"" as *u8) == 1 { t12j = 1 } } 3746 gv_check("T12j ratchet_landed GREEN when out per landed rung fell 4000 -> 500 (neg-control for T12g: same reader, opposite direction)" as *u8, t12j, ctr) 3747 let sbs: *u8 = st_stamp_beside("x.log" as *u8) 3748 var t12l: i64 = 0 3749 if st_vlen(sbs) == 17 { if st_contains(sbs, 17, "x.log.gauge.stamp" as *u8) == 1 { t12l = 1 } } 3750 gv_check("T12l a non-default run stamps beside its own meter log: x.log -> x.log.gauge.stamp" as *u8, t12l, ctr) 3751 // T12m EC57: a closure the door later REOPENED is not a closure -- the count reads the NEWEST word per ws 3752 let ojr: *u8 = sys_mmap(256) 3753 var o8o: i64 = st_cat(ojr, 0, base) 3754 o8o = st_catn(ojr, o8o, now) 3755 o8o = st_cat(ojr, o8o, "reopen.jrnl" as *u8) 3756 ojr[o8o] = 0 as u8 3757 st_frame(ojr, now - 60, "DONE" as *u8, "fx:R1" as *u8, "a" as *u8, "closed" as *u8) 3758 st_frame(ojr, now - 50, "DONE" as *u8, "fx:R2" as *u8, "a" as *u8, "closed" as *u8) 3759 st_frame(ojr, now - 40, "REOPENED" as *u8, "fx:R1" as *u8, "a" as *u8, "withdrawn" as *u8) 3760 st_frame(ojr, now - 30, "REOPENED" as *u8, "fx:R9" as *u8, "a" as *u8, "another rung entirely" as *u8) 3761 let on1: i64 = st_shift(1, lml, ojr, nlg, fst, sob) 3762 gv_check("T12m a DONE frame a later REOPENED withdrew is not counted: two closures, one reopened, done_ws 1 (an unrelated REOPENED withdraws nothing)" as *u8, st_contains(sob, on1, "\"done_ws\":1," as *u8), ctr) 3763 // T13 F214 reap wrapper: a synthesized EXPIRED claim (old ts, tiny ttl) is reaped through the 3764 // REAL nx_claims fork; ORPHAN-REAPED audit frame lands in the ws journal; live claim untouched. 3765 let rcj: *u8 = sys_mmap(256) 3766 var o9: i64 = st_cat(rcj, 0, base) 3767 o9 = st_catn(rcj, o9, now) 3768 o9 = st_cat(rcj, o9, "reapclaims.jrnl" as *u8) 3769 rcj[o9] = 0 as u8 3770 let rwj: *u8 = sys_mmap(256) 3771 var o10: i64 = st_cat(rwj, 0, base) 3772 o10 = st_catn(rwj, o10, now) 3773 o10 = st_cat(rwj, o10, "reapws.jrnl" as *u8) 3774 rwj[o10] = 0 as u8 3775 st_cframe(rcj, now - ST_MAGIC_86400, "CLAIM" as *u8, "orphanws" as *u8, "deadsess" as *u8, 60, "crashed-session" as *u8) 3776 st_cframe(rcj, now, "CLAIM" as *u8, "livews" as *u8, "livesess" as *u8, ST_MAGIC_3600, "alive" as *u8) 3777 let r13o: *u8 = sys_mmap(ST_OUTBUF) 3778 let rrc: i64 = st_do_reap("st-reaper" as *u8, "t13-sweep" as *u8, rcj, rwj, r13o) 3779 let wq: *u8 = sys_mmap(ST_CAP) 3780 let wqsz: *i64 = sys_mmap(ST_SPAN) as *i64 3781 let wqn: i64 = st_read(rwj, wq, ST_CAP - 4, wqsz) 3782 let cb: *u8 = sys_mmap(ST_CAP) 3783 let cbsz: *i64 = sys_mmap(ST_SPAN) as *i64 3784 let cbn: i64 = st_read(rcj, cb, ST_CAP - 4, cbsz) 3785 var t13: i64 = 0 3786 if rrc == 0 { if st_has(wq, wqn, "ORPHAN-REAPED" as *u8, "orphanws" as *u8) == 1 { if st_has(wq, wqn, "ORPHAN-REAPED" as *u8, "livews" as *u8) == 0 { if st_contains(cb, cbn, "ORPHAN-REAPED by=st-reaper" as *u8) == 1 { t13 = 1 } } } } 3787 gv_check("T13 reap wrapper reaps expired + audits ws journal (F214)" as *u8, t13, ctr) 3788 // T14 the unblocked-sibling tooth: checkin on the reaped ws by a NEW actor now SUCCEEDS, 3789 // while the live unexpired ws stays CONTENDED fail-closed (never stolen). 3790 let ci3: i64 = st_do_checkin("orphanws" as *u8, "seatC" as *u8, ST_MAGIC_3600, "post-reap" as *u8, rcj, rwj, s1out) 3791 let ci4: i64 = st_do_checkin("livews" as *u8, "seatD" as *u8, ST_MAGIC_3600, "steal-live" as *u8, rcj, rwj, s1out) 3792 var t14: i64 = 0 3793 if ci3 == 0 { if ci4 == 3 { t14 = 1 } } 3794 gv_check("T14 checkin succeeds on reaped ws refused on live ws" as *u8, t14, ctr) 3795 // T15 idempotent: re-run reap -> zero ws frames, claims journal byte-identical 3796 let csz1: *i64 = sys_mmap(ST_SPAN) as *i64 3797 st_read(rcj, wq, ST_CAP - 4, csz1) 3798 let r15o: *u8 = sys_mmap(ST_OUTBUF) 3799 let rrc2: i64 = st_do_reap("st-reaper" as *u8, "t15-rerun" as *u8, rcj, rwj, r15o) 3800 let csz2: *i64 = sys_mmap(ST_SPAN) as *i64 3801 st_read(rcj, wq, ST_CAP - 4, csz2) 3802 let rl15: i64 = st_vlen(r15o) 3803 var t15: i64 = 0 3804 if rrc2 == 0 { if csz1[0] == csz2[0] { if st_contains(r15o, rl15, "ws-frames=0" as *u8) == 1 { t15 = 1 } } } 3805 gv_check("T15 reap idempotent nothing expired nothing written" as *u8, t15, ctr) 3806 // T15a/b/c (2026-08-06) THE UNCLAIMED-WS SWEEP -- the population the claims reaper structurally 3807 // cannot reach: rows opened by a bare `nx_ws_sync kickoff`, no claim, therefore no ttl to expire. 3808 // MEASURED on the live board: 9 of 12 in-flight rows were exactly this, silent 17-20 DAYS. 3809 let zswj: *u8 = sys_mmap(256) 3810 var zo1: i64 = st_cat(zswj, 0, base) 3811 zo1 = st_catn(zswj, zo1, now) 3812 zo1 = st_cat(zswj, zo1, "sweepws.jrnl" as *u8) 3813 zswj[zo1] = 0 as u8 3814 st_frame(zswj, now - ST_MAGIC_90000, "KICKOFF" as *u8, "idlews" as *u8, "deadseat" as *u8, "long-silent" as *u8) 3815 st_frame(zswj, now - 10, "KICKOFF" as *u8, "livews" as *u8, "liveseat" as *u8, "just-started" as *u8) 3816 let zcov: *i64 = sys_mmap(ST_SPAN) as *i64 3817 let zsw1: i64 = st_ws_sweep(zswj, "st-sweeper" as *u8, "t15a" as *u8, ST_MAGIC_3600, now, zcov) 3818 let zswq: *u8 = sys_mmap(ST_CAP) 3819 let zswsz: *i64 = sys_mmap(ST_SPAN) as *i64 3820 let zswn: i64 = st_read(zswj, zswq, ST_CAP - 4, zswsz) 3821 var zt15a: i64 = 0 3822 // BOTH DIRECTIONS on purpose: reaping the idle row proves it fires, LEAVING the fresh row proves 3823 // it discriminates. Asserting only the first would also pass for a sweep that reaped everything. 3824 if zsw1 == 1 { if st_has(zswq, zswn, "ORPHAN-REAPED" as *u8, "idlews" as *u8) == 1 { 3825 if st_has(zswq, zswn, "ORPHAN-REAPED" as *u8, "livews" as *u8) == 0 { zt15a = 1 } } } 3826 gv_check("T15a ws-sweep reaps idle unclaimed row leaves fresh one" as *u8, zt15a, ctr) 3827 let zsw2: i64 = st_ws_sweep(zswj, "st-sweeper" as *u8, "t15b" as *u8, ST_MAGIC_3600, now, zcov) 3828 var zt15b: i64 = 0 3829 if zsw2 == 0 { zt15b = 1 } 3830 gv_check("T15b ws-sweep idempotent second pass writes nothing" as *u8, zt15b, ctr) 3831 // T15c THE FAIL-SAFE DIRECTION. A missing or unreadable ttl config must reap NOTHING. If this ever 3832 // inverts, ONE unattended run with an absent config closes every row on the board simultaneously. 3833 let zcwj: *u8 = sys_mmap(256) 3834 var zo2: i64 = st_cat(zcwj, 0, base) 3835 zo2 = st_catn(zcwj, zo2, now) 3836 zo2 = st_cat(zcwj, zo2, "sweepzero.jrnl" as *u8) 3837 zcwj[zo2] = 0 as u8 3838 st_frame(zcwj, now - ST_MAGIC_90000, "KICKOFF" as *u8, "ancientws" as *u8, "deadseat" as *u8, "ancient" as *u8) 3839 let zsw3: i64 = st_ws_sweep(zcwj, "st-sweeper" as *u8, "t15c" as *u8, 0, now, zcov) 3840 let zczq: *u8 = sys_mmap(ST_CAP) 3841 let zczsz: *i64 = sys_mmap(ST_SPAN) as *i64 3842 let zczn: i64 = st_read(zcwj, zczq, ST_CAP - 4, zczsz) 3843 var zt15c: i64 = 0 3844 if zsw3 == 0 { if st_has(zczq, zczn, "ORPHAN-REAPED" as *u8, "ancientws" as *u8) == 0 { zt15c = 1 } } 3845 gv_check("T15c ws-sweep with absent ttl config reaps NOTHING" as *u8, zt15c, ctr) 3846 // T15d THE TRAP THAT ALREADY FIRED ONCE, now nailed down. A config whose value is on LINE 1 must 3847 // still parse when the file grows PAST the read window. The first cut of st_reap_ttl used st_read 3848 // (a TAIL reader) and this exact geometry -- 1267B file, 1020B window -- returned 0, which for a 3849 // reaper means SILENTLY DISABLED. The fixture is deliberately oversized to reproduce the real 3850 // geometry rather than a toy: a tooth that only tests a small config cannot see this class at all. 3851 let zcfg: *u8 = sys_mmap(256) 3852 var zo3: i64 = st_cat(zcfg, 0, base) 3853 zo3 = st_catn(zcfg, zo3, now) 3854 zo3 = st_cat(zcfg, zo3, "ttlbig.conf" as *u8) 3855 zcfg[zo3] = 0 as u8 3856 let zbig: *u8 = sys_mmap(ST_MAGIC_4096) 3857 var zbo: i64 = st_cat(zbig, 0, "172800\n" as *u8) 3858 var zk: i64 = 0 3859 while zk < 40 { zbo = st_cat(zbig, zbo, "# padding comment line to push this file past the read window\n" as *u8); zk = zk + 1 } 3860 let zfd: i64 = sys_openat_wr(zcfg, ST_MODE_RW) 3861 var zt15d: i64 = 0 3862 if zfd >= 0 { 3863 sys_write(zfd, zbig, zbo) 3864 sys_close(zfd) 3865 if st_reap_ttl(zcfg) == ST_MAGIC_172800 { zt15d = 1 } 3866 } 3867 gv_check("T15d ttl config parses line 1 even when file exceeds read window" as *u8, zt15d, ctr) 3868 // T15e THE MORTALITY TOOTH. The reaper can only release a claim past its OWN declared ttl, so an 3869 // absurd ttl is an opt-out of the whole mechanism. MEASURED: two live claims held ttl_sec=7200000 3870 // (83 DAYS) at 14 days of age. All four directions asserted, because a clamp that only fires is as 3871 // wrong as one that never does: over-ceiling CLAMPS, under-ceiling is UNTOUCHED (a clamp that 3872 // rewrote every ttl would quietly shorten every honest lease), exactly-at-ceiling is UNTOUCHED 3873 // (off-by-one would clamp a legal value), and ceil=0 is UNTOUCHED (absent config must never change 3874 // what a claim means). 3875 var zt15e: i64 = 0 3876 if st_clamp_ttl(ST_MAGIC_7200000, ST_MAGIC_86400) == ST_MAGIC_86400 { 3877 if st_clamp_ttl(ST_MAGIC_3600, ST_MAGIC_86400) == ST_MAGIC_3600 { 3878 if st_clamp_ttl(ST_MAGIC_86400, ST_MAGIC_86400) == ST_MAGIC_86400 { 3879 if st_clamp_ttl(ST_MAGIC_7200000, 0) == ST_MAGIC_7200000 { zt15e = 1 } 3880 } 3881 } 3882 } 3883 gv_check("T15e ttl ceiling clamps the immortal claim leaves honest ones alone" as *u8, zt15e, ctr) 3884 // T16-T20 seq543/seq552 checkout-honesty teeth ------------------------------------------ 3885 // T16 arg interpretation: status-form (`done <note>`) shifts oi=6 + merges the note; an 3886 // explicit jpathish journal arg keeps the classic form (oi=5, note untouched) 3887 let nsl: *i64 = sys_mmap(ST_SPAN) as *i64 3888 let oiA: i64 = st_co_argshift("done" as *u8, "seq552-result-note" as *u8, nsl) 3889 let mnA: *u8 = nsl[0] as *u8 3890 var t16: i64 = 0 3891 if oiA == 6 { if st_lit_eq(mnA, 0, st_vlen(mnA), "done seq552-result-note" as *u8) == 1 { 3892 let oiB: i64 = st_co_argshift("real-note" as *u8, "scratch/claims.jrnl" as *u8, nsl) 3893 let mnB: *u8 = nsl[0] as *u8 3894 if oiB == 5 { if st_lit_eq(mnB, 0, st_vlen(mnB), "real-note" as *u8) == 1 { t16 = 1 } } 3895 } } 3896 gv_check("T16 checkout arg-shift status-form merges note jpath form classic (seq552)" as *u8, t16, ctr) 3897 // T17 BAD-CLAIMS-JOURNAL fail-safe: phantom journal (the old bug shape: a note used as the 3898 // path) -> rc=2 LOUD, release NEVER forked, the REAL claims journal is byte-identical 3899 let hcj: *u8 = sys_mmap(256) 3900 var o11: i64 = st_cat(hcj, 0, base) 3901 o11 = st_catn(hcj, o11, now) 3902 o11 = st_cat(hcj, o11, "honesty.jrnl" as *u8) 3903 hcj[o11] = 0 as u8 3904 st_cframe(hcj, now, "CLAIM" as *u8, "heldws" as *u8, "seatE" as *u8, ST_MAGIC_3600, "live" as *u8) 3905 let hsz1: *i64 = sys_mmap(ST_SPAN) as *i64 3906 st_read(hcj, wq, ST_CAP - 4, hsz1) 3907 let hout: *u8 = sys_mmap(ST_OUTBUF) 3908 let hrc: i64 = st_do_checkout("heldws" as *u8, "seatE" as *u8, "note-shape" as *u8, "seq552-phantom-journal-note" as *u8, rwj, hout) 3909 let hsz2: *i64 = sys_mmap(ST_SPAN) as *i64 3910 st_read(hcj, wq, ST_CAP - 4, hsz2) 3911 var t17: i64 = 0 3912 if hrc == 2 { if st_contains(hout, st_vlen(hout), "release=BAD-CLAIMS-JOURNAL" as *u8) == 1 { if hsz1[0] == hsz2[0] { t17 = 1 } } } 3913 gv_check("T17 phantom claims journal refused LOUD rc=2 claim untouched (seq543)" as *u8, t17, ctr) 3914 // T18 ALREADY-FREE benign: a released ws AND a never-claimed ws both checkout rc=0 with the 3915 // honest note (covers ttl-lapse-then-reap: reap emits RELEASE frames -> state FREE) 3916 st_cframe(hcj, now, "RELEASE" as *u8, "heldws" as *u8, "seatE" as *u8, 0, "freed" as *u8) 3917 let f1out: *u8 = sys_mmap(ST_OUTBUF) 3918 let farc: i64 = st_do_checkout("heldws" as *u8, "seatE" as *u8, "post-free" as *u8, hcj, rwj, f1out) 3919 let f2out: *u8 = sys_mmap(ST_OUTBUF) 3920 let fbrc: i64 = st_do_checkout("neverws" as *u8, "seatE" as *u8, "absent" as *u8, hcj, rwj, f2out) 3921 var t18: i64 = 0 3922 if farc == 0 { if fbrc == 0 { if st_contains(f1out, st_vlen(f1out), "release=ALREADY-FREE" as *u8) == 1 { if st_contains(f2out, st_vlen(f2out), "release=ALREADY-FREE" as *u8) == 1 { t18 = 1 } } } } 3923 gv_check("T18 already-free checkout benign rc=0 honest note (freed + absent)" as *u8, t18, ctr) 3924 // T19 FOREIGN-HELD stays LOUD rc=3 and the foreign live claim is NEVER released 3925 st_cframe(hcj, now, "CLAIM" as *u8, "foreignws" as *u8, "seatG" as *u8, ST_MAGIC_3600, "theirs" as *u8) 3926 let g1out: *u8 = sys_mmap(ST_OUTBUF) 3927 let grc: i64 = st_do_checkout("foreignws" as *u8, "seatH" as *u8, "try-steal" as *u8, hcj, rwj, g1out) 3928 let gq: *u8 = sys_mmap(ST_CAP) 3929 let gqsz: *i64 = sys_mmap(ST_SPAN) as *i64 3930 let gqn: i64 = st_read(hcj, gq, ST_CAP - 4, gqsz) 3931 var t19: i64 = 0 3932 if grc == 3 { if st_contains(g1out, st_vlen(g1out), "release=FOREIGN-HELD holder=seatG" as *u8) == 1 { if st_has(gq, gqn, "RELEASE" as *u8, "foreignws" as *u8) == 0 { t19 = 1 } } } 3933 gv_check("T19 live-foreign claim refused LOUD rc=3 never released" as *u8, t19, ctr) 3934 // T20 the EXACT failing protocol shape e2e: real-fork checkin then status-form checkout 3935 // (`done <note>` through st_co_argshift) releases CLEAN rc=0 (seq543/seq552 regression) 3936 let p1out: *u8 = sys_mmap(ST_MAGIC_4096) 3937 let pci: i64 = st_do_checkin("protows" as *u8, "seatI" as *u8, ST_MAGIC_3600, "proto-go" as *u8, hcj, rwj, p1out) 3938 let psl: *i64 = sys_mmap(ST_SPAN) as *i64 3939 let poi: i64 = st_co_argshift("done" as *u8, "proto-shipped" as *u8, psl) 3940 let pnote: *u8 = psl[0] as *u8 3941 let p2out: *u8 = sys_mmap(ST_OUTBUF) 3942 let pco: i64 = st_do_checkout("protows" as *u8, "seatI" as *u8, pnote, hcj, rwj, p2out) 3943 var t20: i64 = 0 3944 if pci == 0 { if poi == 6 { if pco == 0 { if st_contains(p2out, st_vlen(p2out), "RELEASED" as *u8) == 1 { t20 = 1 } } } } 3945 gv_check("T20 de-facto protocol done+note checkout releases clean e2e (seq552)" as *u8, t20, ctr) 3946 // T21 ctx-tax flush loop: brief lands a CHECKPOINT + boot surfaces it as last_brief 3947 let b21o: *u8 = sys_mmap(ST_OUTBUF) 3948 let b21rc: i64 = st_do_brief("stws" as *u8, "stactor" as *u8, "flush-state-alpha" as *u8, jr, b21o) 3949 let b21b: *u8 = sys_mmap(ST_OUTBUF) 3950 let b21n: i64 = st_boot("stws" as *u8, jr, dp, fp, ml, b21b) 3951 var t21: i64 = 0 3952 if b21rc == 0 { if st_contains(b21b, b21n, "\"last_brief\":\"flush-state-alpha\"" as *u8) == 1 { t21 = 1 } } 3953 gv_check("T21 brief CHECKPOINT + boot last_brief surfacing (ctx-tax flush loop)" as *u8, t21, ctr) 3954 // T21b..T21d EC62: a checkpoint past the digest's note budget is NAMED truncated and is recoverable WHOLE in one call 3955 let lbnote: *u8 = sys_mmap(ST_MAGIC_1024) 3956 var lbo: i64 = 0 3957 var lbk: i64 = 0 3958 while lbk < 30 { lbo = st_cat(lbnote, lbo, "0123456789" as *u8); lbk = lbk + 1 } 3959 lbo = st_cat(lbnote, lbo, "TAIL-MARK" as *u8) 3960 lbnote[lbo] = 0 as u8 3961 st_do_brief("stws" as *u8, "stactor" as *u8, lbnote, jr, b21o) 3962 let b21d: *u8 = sys_mmap(ST_OUTBUF) // its OWN buffer: T22 below still reads b21b with b21n 3963 let b21c: i64 = st_boot("stws" as *u8, jr, dp, fp, ml, b21d) 3964 var t21b: i64 = 0 3965 if st_contains(b21d, b21c, "\"last_brief_bytes\":309" as *u8) == 1 { if st_contains(b21d, b21c, "\"last_brief_more\":\"" as *u8) == 1 { if st_contains(b21d, b21c, "TAIL-MARK" as *u8) == 0 { t21b = 1 } } } 3966 gv_check("T21b a checkpoint past the note budget is NAMED truncated in the digest (its byte count and the call that returns it) and its tail is not there" as *u8, t21b, ctr) 3967 let lbbuf2: *u8 = sys_mmap(ST_OUTBUF) 3968 let lbl1: i64 = st_lastbrief_into("stws" as *u8, jr, lbbuf2, ST_OUTBUF) 3969 var t21c: i64 = 0 3970 if st_contains(lbbuf2, lbl1, "LASTBRIEF ws=stws age_s=" as *u8) == 1 { if st_contains(lbbuf2, lbl1, " bytes=309" as *u8) == 1 { if st_contains(lbbuf2, lbl1, "TAIL-MARK" as *u8) == 1 { t21c = 1 } } } 3971 gv_check("T21c lastbrief returns the WHOLE checkpoint, tail included" as *u8, t21c, ctr) 3972 let lbl2: i64 = st_lastbrief_into("no-such-ws" as *u8, jr, lbbuf2, ST_OUTBUF) 3973 gv_check("T21d neg-control: a ws with no checkpoint reads NONE, never another ws's note" as *u8, st_contains(lbbuf2, lbl2, "LASTBRIEF ws=no-such-ws NONE" as *u8), ctr) 3974 // T23..T23g EC57 c CLOSE-FIRST: ready names the rungs NEAREST to closed before any new work, from a PLANTED worklist 3975 // (the list, the frontier store and the claims journal are all fixture paths: nothing here reads the production census) 3976 let cfw: *u8 = sys_mmap(256) 3977 var cfwo: i64 = st_cat(cfw, 0, base) 3978 cfwo = st_catn(cfw, cfwo, now) 3979 cfwo = st_cat(cfw, cfwo, "closefirst.worklist" as *u8) 3980 cfw[cfwo] = 0 as u8 3981 let cfa: *u8 = sys_mmap(256) 3982 var cfao: i64 = st_cat(cfa, 0, base) 3983 cfao = st_catn(cfa, cfao, now) 3984 cfao = st_cat(cfa, cfao, "closefirst.absent-" as *u8) 3985 cfa[cfao] = 0 as u8 3986 let cfb: *u8 = sys_mmap(rgc_work_head_bound() + ST_CF_FIX_ROWS * (ST_CF_FIX_NAME_B + rgc_work_row_fixed())) 3987 var cfbn: i64 = rgc_work_head(cfb, 0, now - 5) 3988 cfbn = rgc_work_row(cfb, cfbn, RGC_ST_STARTED, "fxdom" as *u8, "S1" as *u8, RGC_L_BUILT, 0, now - 50, 0) 3989 cfbn = rgc_work_row(cfb, cfbn, RGC_ST_OPERATED, "fxdom" as *u8, "P2" as *u8, RGC_L_PAGE, 0, now - 50, 0) 3990 cfbn = rgc_work_row(cfb, cfbn, RGC_ST_ALPHA, "other" as *u8, "W3" as *u8, RGC_L_WIRED, 1, now - ST_CF_DAY_S * 3, 0) 3991 let cffd: i64 = sys_openat_wr(cfw, ST_MODE_RW) 3992 var cfwrote: i64 = 0 3993 if cffd >= 0 { sys_write(cffd, cfb, cfbn); sys_close(cffd); cfwrote = 1 } 3994 gv_check("T23 fixture-reached-the-condition: the planted close-first worklist was written" as *u8, cfwrote, ctr) 3995 let cfout: *u8 = sys_mmap(ST_OUTBUF) 3996 let cfl: i64 = st_ready_wl("*" as *u8, 12, cfa, cfa, cfw, cfout) 3997 gv_check("T23a close_first ORDER and FIELDS: OPERATED before ALPHA before STARTED though the list plants STARTED first; needs, could_not_look and idle days travel (the close ruler's v2 stage words, 2026-09-18)" as *u8, st_contains(cfout, cfl, "\"rung\":\"P2\",\"state\":\"OPERATED\",\"needs\":\"page\",\"could_not_look\":0,\"idle_d\":0},{\"dom\":\"other\",\"rung\":\"W3\",\"state\":\"ALPHA\",\"needs\":\"wired\",\"could_not_look\":1,\"idle_d\":3},{\"dom\":\"fxdom\",\"rung\":\"S1\",\"state\":\"STARTED\"" as *u8), ctr) 3998 gv_check("T23b close_first accounting: the list is FRESH and total equals shown when the cap allows" as *u8, st_contains(cfout, cfl, "\"close_first_list\":\"FRESH\"" as *u8) * st_contains(cfout, cfl, "\"close_first_total\":3,\"close_first_shown\":3,\"close_first_malformed\":0" as *u8), ctr) 3999 gv_check("T23c close_first is read BEFORE the ready list: finish first, then start" as *u8, st_contains(cfout, cfl, "quotes-no-rows\",\"ready\":[" as *u8), ctr) 4000 let cfl2: i64 = st_ready_wl("fxdom" as *u8, 12, cfa, cfa, cfw, cfout) 4001 gv_check("T23d the lane names a board: only that board's rungs (W3 on the other board stays out)" as *u8, st_contains(cfout, cfl2, "\"close_first_total\":2," as *u8) * (1 - st_contains(cfout, cfl2, "\"rung\":\"W3\"" as *u8)), ctr) 4002 let cfl3: i64 = st_ready_wl("*" as *u8, 12, cfa, cfa, cfa, cfout) 4003 gv_check("T23e neg-control: an ABSENT worklist is NAMED absent, quotes no rows and its total reads -1, never 0" as *u8, st_contains(cfout, cfl3, "\"close_first\":[],\"close_first_list\":\"ABSENT\",\"close_first_asof\":-1,\"close_first_total\":-1," as *u8), ctr) 4004 let cfn4: i64 = rgc_work_head(cfb, 0, now - ST_CF_DAY_S * 3) 4005 let cfn5: i64 = rgc_work_row(cfb, cfn4, RGC_ST_OPERATED, "fxdom" as *u8, "P2" as *u8, RGC_L_PAGE, 0, now - 50, 0) 4006 let cffd2: i64 = sys_openat_wr(cfw, ST_MODE_RW) 4007 if cffd2 >= 0 { sys_write(cffd2, cfb, cfn5); sys_close(cffd2) } 4008 let cfl4: i64 = st_ready_wl("*" as *u8, 12, cfa, cfa, cfw, cfout) 4009 gv_check("T23f neg-control: a FOSSIL list (three days old) quotes NO rows though it holds one, and says FOSSIL" as *u8, st_contains(cfout, cfl4, "\"close_first\":[],\"close_first_list\":\"FOSSIL\"" as *u8) * st_contains(cfout, cfl4, "\"close_first_total\":-1," as *u8), ctr) 4010 // T24/T24b EC62: a census line longer than the digest's row budget is NAMED as cut 4011 let ptp: *u8 = sys_mmap(256) 4012 var ptpo: i64 = st_cat(ptp, 0, base) 4013 ptpo = st_catn(ptp, ptpo, now) 4014 ptpo = st_cat(ptp, ptpo, "passthrough.status" as *u8) 4015 ptp[ptpo] = 0 as u8 4016 let ptb: *u8 = sys_mmap(ST_MAGIC_1024) 4017 var pto: i64 = 0 4018 var ptk: i64 = 0 4019 while ptk < 30 { pto = st_cat(ptb, pto, "0123456789" as *u8); ptk = ptk + 1 } 4020 ptb[pto] = ST_NL as u8 4021 pto = pto + 1 4022 let ptfd: i64 = sys_openat_wr(ptp, ST_MODE_RW) 4023 if ptfd >= 0 { sys_write(ptfd, ptb, pto); sys_close(ptfd) } 4024 let ptout: *u8 = sys_mmap(ST_OUTBUF) 4025 let ptl: i64 = st_passthrough(ptout, 0, "k" as *u8, ptp, "ABSENT" as *u8) 4026 gv_check("T24 a 300-byte census line is NAMED as cut, with its true length and the budget" as *u8, st_contains(ptout, ptl, "\"k_cut\":\"the line is 300 bytes and the digest quotes the first 240" as *u8), ctr) 4027 let ptfd2: i64 = sys_openat_wr(ptp, ST_MODE_RW) 4028 let ptshort: *u8 = "short line\n" as *u8 4029 if ptfd2 >= 0 { sys_write(ptfd2, ptshort, st_vlen(ptshort)); sys_close(ptfd2) } 4030 let ptl2: i64 = st_passthrough(ptout, 0, "k" as *u8, ptp, "ABSENT" as *u8) 4031 gv_check("T24b neg-control: a line inside the budget carries no cut marker" as *u8, st_contains(ptout, ptl2, "\"k\":\"short line\"" as *u8) * (1 - st_contains(ptout, ptl2, "_cut" as *u8)), ctr) 4032 // T22 SHIFT-VERBS field ALWAYS present in boot (discovery-is-the-bottleneck, 4033 // self_sufficiency_map 07-29): conf absent => empty list + src pointer -- 4034 // a session must never have to rediscover the sovereign path for a work 4035 // class. Environment-agnostic: checks the FIELD, not the row count. 4036 var t22: i64 = 0 4037 if st_contains(b21b, b21n, "\"shift_verbs\":[" as *u8) == 1 { if st_contains(b21b, b21n, "\"shift_src\":\"knowledge/shift_verbs.conf" as *u8) == 1 { t22 = 1 } } 4038 gv_check("T22 boot carries shift_verbs + shift_src (present even when conf absent)" as *u8, t22, ctr) 4039 let rc: i64 = gv_verdict("SEAT-GATE" as *u8, ctr, "S0 boot + S3 meter + S1 protocol + F832 ready-digest + F831 shift scoreboard + F214 orphan-reap + seq543/seq552 checkout honesty + ctx-tax brief flush + shift-verbs discovery line proven at production shape" as *u8) 4040 return rc 4041} 4042func main(argc: i64, argv: *i64) -> i64 { 4043 if argc < 2 { 4044 st_werr("usage: nx_seat {boot <ws> [jrnl] [debt-] [frontier-] [meterlog] | ready [lane|*] [max] [frontier-] | checkin <ws> <actor> <ttl_sec> <note> [claims.jrnl] [ws.jrnl] | checkout <ws> <actor> [status] <note> [claims.jrnl] [ws.jrnl] | brief <ws> <actor> <note> [ws.jrnl] | meter <seat> <sessions> <out> <cread> <ccreate> <note> [logpath] | meterlog [n] [logpath] | shift [days] [meterlog] [ws.jrnl] | reap [actor] [note] [claims.jrnl] [ws.jrnl] | resume_map <transcripts_dir> <temp_root|-> <win_start_epoch|latest> [win_end_epoch] [frames_journal|-] | selftest [tmpbase]}\n" as *u8) 4045 sys_exit(ST_EXIT_USAGE) 4046 return ST_EXIT_USAGE 4047 } 4048 let verb: *u8 = argv[1] as *u8 4049 if st_lit_eq(verb, 0, st_vlen(verb), "boot" as *u8) == 1 { 4050 if argc < 3 { st_werr("SEAT-FAIL boot needs <ws>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4051 var jr: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4052 var dp: *u8 = "knowledge/store/debt-" as *u8 4053 var fp: *u8 = "knowledge/store/frontier-" as *u8 4054 var ml: *u8 = "knowledge/status/token_efficiency.log" as *u8 4055 if argc > 3 { jr = argv[3] as *u8 } 4056 if argc > 4 { dp = argv[4] as *u8 } 4057 if argc > 5 { fp = argv[5] as *u8 } 4058 if argc > 6 { ml = argv[6] as *u8 } 4059 let out: *u8 = sys_mmap(ST_OUTBUF) 4060 let n: i64 = st_boot(argv[2] as *u8, jr, dp, fp, ml, out) 4061 sys_write(1, out, n) 4062 sys_exit(0) 4063 return 0 4064 } 4065 if st_lit_eq(verb, 0, st_vlen(verb), "ready" as *u8) == 1 { 4066 var lane: *u8 = "*" as *u8 4067 var maxn: i64 = 12 4068 var frp: *u8 = "knowledge/store/frontier-" as *u8 4069 if argc > 2 { lane = argv[2] as *u8 } 4070 if argc > 3 { maxn = st_atoi_z(argv[3] as *u8) } 4071 if argc > 4 { frp = argv[4] as *u8 } 4072 if maxn < 1 { maxn = 1 } 4073 if maxn > 24 { maxn = 24 } 4074 let out: *u8 = sys_mmap(ST_OUTBUF) 4075 // EC57 c: the close-first worklist is argv[5], so a fixture run reads a planted list and never the production census 4076 var wlp: *u8 = ST_WORKLIST 4077 if argc > 5 { wlp = argv[5] as *u8 } 4078 let n: i64 = st_ready_wl(lane, maxn, frp, ST_CLAIMS_JRNL, wlp, out) 4079 sys_write(1, out, n) 4080 sys_exit(0) 4081 return 0 4082 } 4083 if st_lit_eq(verb, 0, st_vlen(verb), "checkin" as *u8) == 1 { 4084 if argc < 6 { st_werr("SEAT-FAIL checkin needs <ws> <actor> <ttl_sec> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4085 var cj: *u8 = ST_CLAIMS_JRNL 4086 var wj: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4087 if argc > 6 { cj = argv[6] as *u8 } 4088 if argc > 7 { wj = argv[7] as *u8 } 4089 let out: *u8 = sys_mmap(ST_OUTBUF) 4090 let rc: i64 = st_do_checkin(argv[2] as *u8, argv[3] as *u8, st_atoi_z(argv[4] as *u8), argv[5] as *u8, cj, wj, out) 4091 sys_exit(rc) 4092 return rc 4093 } 4094 if st_lit_eq(verb, 0, st_vlen(verb), "checkout" as *u8) == 1 { 4095 if argc < 5 { st_werr("SEAT-FAIL checkout needs <ws> <actor> [status] <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4096 var cj2: *u8 = ST_CLAIMS_JRNL 4097 var wj2: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4098 // seq543/seq552: de-facto protocol `checkout <ws> <actor> done <note>` -- the old grammar 4099 // consumed that NOTE as the claims journal; st_co_argshift interprets by data shape 4100 var note2: *u8 = argv[4] as *u8 4101 var oi: i64 = 5 4102 if argc > 5 { 4103 let nsl2: *i64 = sys_mmap(ST_SPAN) as *i64 4104 oi = st_co_argshift(argv[4] as *u8, argv[5] as *u8, nsl2) 4105 note2 = nsl2[0] as *u8 4106 } 4107 if argc > oi { cj2 = argv[oi] as *u8 } 4108 let oi1: i64 = oi + 1 4109 if argc > oi1 { wj2 = argv[oi1] as *u8 } 4110 let out2: *u8 = sys_mmap(ST_OUTBUF) 4111 let rc2: i64 = st_do_checkout(argv[2] as *u8, argv[3] as *u8, note2, cj2, wj2, out2) 4112 sys_exit(rc2) 4113 return rc2 4114 } 4115 if st_lit_eq(verb, 0, st_vlen(verb), "reap" as *u8) == 1 { 4116 var ra: *u8 = "nx-seat-reaper" as *u8 4117 var rno: *u8 = "ttl-expired-orphan-sweep" as *u8 4118 var rcj2: *u8 = ST_CLAIMS_JRNL 4119 var rwj2: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4120 if argc > 2 { ra = argv[2] as *u8 } 4121 if argc > 3 { rno = argv[3] as *u8 } 4122 if argc > 4 { rcj2 = argv[4] as *u8 } 4123 if argc > 5 { rwj2 = argv[5] as *u8 } 4124 let rout2: *u8 = sys_mmap(ST_OUTBUF) 4125 let rrc3: i64 = st_do_reap(ra, rno, rcj2, rwj2, rout2) 4126 sys_exit(rrc3) 4127 return rrc3 4128 } 4129 if st_lit_eq(verb, 0, st_vlen(verb), "brief" as *u8) == 1 { 4130 if argc < 5 { st_werr("SEAT-FAIL brief needs <ws> <actor> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4131 var bwj: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4132 if argc > 5 { bwj = argv[5] as *u8 } 4133 let bout: *u8 = sys_mmap(ST_OUTBUF) 4134 let brc: i64 = st_do_brief(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, bwj, bout) 4135 sys_exit(brc) 4136 return brc 4137 } 4138 if st_lit_eq(verb, 0, st_vlen(verb), "meter" as *u8) == 1 { 4139 if argc < 8 { st_werr("SEAT-FAIL meter needs <seat> <sessions> <out> <cread> <ccreate> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4140 var lp: *u8 = "knowledge/status/token_efficiency.log" as *u8 4141 if argc > 8 { lp = argv[8] as *u8 } 4142 let rc: i64 = st_meter_append(lp, argv[2] as *u8, st_atoi_z(argv[3] as *u8), st_atoi_z(argv[4] as *u8), st_atoi_z(argv[5] as *u8), st_atoi_z(argv[6] as *u8), argv[7] as *u8) 4143 if rc != 0 { st_werr("SEAT-FAIL meter append (log path unwritable?)\n" as *u8); sys_exit(1); return 1 } 4144 st_puts("METERED row appended\n" as *u8) 4145 sys_exit(0) 4146 return 0 4147 } 4148 if st_lit_eq(verb, 0, st_vlen(verb), "meterlog" as *u8) == 1 { 4149 var nl: i64 = 5 4150 var lp2: *u8 = "knowledge/status/token_efficiency.log" as *u8 4151 if argc > 2 { nl = st_atoi_z(argv[2] as *u8) } 4152 if argc > 3 { lp2 = argv[3] as *u8 } 4153 if nl < 1 { nl = 1 } 4154 if nl > 50 { nl = 50 } 4155 let b: *u8 = sys_mmap(ST_CAP) 4156 let sz: *i64 = sys_mmap(ST_SPAN) as *i64 4157 let n: i64 = st_read(lp2, b, ST_MAGIC_65536, sz) 4158 st_puts("METERLOG file_bytes=" as *u8) 4159 let hb: *u8 = sys_mmap(64) 4160 var ho: i64 = st_catn(hb, 0, sz[0]) 4161 hb[ho] = ST_NL as u8 4162 sys_write(1, hb, ho + 1) 4163 // count lines, then print the last nl of them 4164 var lines: i64 = 0 4165 var i: i64 = 0 4166 while i < n { let le: i64 = st_le(b, i, n); if le > i { lines = lines + 1 } i = le + 1 } 4167 var skip: i64 = lines - nl 4168 if skip < 0 { skip = 0 } 4169 var li: i64 = 0 4170 i = 0 4171 while i < n { 4172 let le2: i64 = st_le(b, i, n) 4173 if le2 > i { 4174 if li >= skip { sys_write(1, ((b as i64) + i) as *u8, le2 - i); sys_write(1, "\n" as *u8, 1) } 4175 li = li + 1 4176 } 4177 i = le2 + 1 4178 } 4179 sys_exit(0) 4180 return 0 4181 } 4182 if st_lit_eq(verb, 0, st_vlen(verb), "lastbrief" as *u8) == 1 { 4183 // EC62: nx_seat lastbrief <ws> [journal] -- the WHOLE last checkpoint, so a flush is lossless past the digest's note budget 4184 if argc < 3 { 4185 let lbu: *u8 = "usage: nx_seat lastbrief <ws> [journal]\n" as *u8 4186 sys_write(2, lbu, st_vlen(lbu)) 4187 sys_exit(ST_EXIT_USAGE) 4188 return ST_EXIT_USAGE 4189 } 4190 var lbj: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4191 if argc > 3 { lbj = argv[3] as *u8 } 4192 let lbbuf: *u8 = sys_mmap(ST_CAP + ST_MAGIC_1024) 4193 let lblen: i64 = st_lastbrief_into(argv[2] as *u8, lbj, lbbuf, ST_CAP + ST_MAGIC_1024) 4194 sys_write(1, lbbuf, lblen) 4195 sys_exit(0) 4196 return 0 4197 } 4198 if st_lit_eq(verb, 0, st_vlen(verb), "shift" as *u8) == 1 { 4199 var sdays: i64 = 7 4200 var smlp: *u8 = "knowledge/status/token_efficiency.log" as *u8 4201 var sjrp: *u8 = "knowledge/status/ws_sync.jrnl" as *u8 4202 if argc > 2 { sdays = st_atoi_z(argv[2] as *u8) } 4203 if argc > 3 { smlp = argv[3] as *u8 } 4204 if argc > 4 { sjrp = argv[4] as *u8 } 4205 if sdays < 0 { sdays = 0 } 4206 if sdays > 365 { sdays = 365 } 4207 let sout: *u8 = sys_mmap(ST_OUTBUF) 4208 var slgp: *u8 = ST_LEDGER 4209 if argc > 5 { slgp = argv[5] as *u8 } 4210 // EC56: only a default-evidence run may write the production heartbeat; any other stamps beside its own meter log 4211 var sstamp: *u8 = ST_GAUGE_STAMP 4212 if argc > 3 { sstamp = st_stamp_beside(smlp) } 4213 let sn2: i64 = st_shift(sdays, smlp, sjrp, slgp, sstamp, sout) 4214 sys_write(1, sout, sn2) 4215 sys_exit(0) 4216 return 0 4217 } 4218 if st_lit_eq(verb, 0, st_vlen(verb), "selftest" as *u8) == 1 { 4219 var base: *u8 = "/tmp/nxseat_st" as *u8 4220 if argc > 2 { base = argv[2] as *u8 } 4221 let rc: i64 = st_selftest(base) 4222 sys_exit(rc) 4223 return rc 4224 } 4225 if st_lit_eq(verb, 0, st_vlen(verb), "resume_map" as *u8) == 1 { 4226 if argc < 5 { st_werr("SEAT-FAIL resume_map needs <transcripts_dir> <temp_root|-> <win_start_epoch|latest> [win_end_epoch] [frames_journal|-]\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4227 var rm_lt: i64 = 0 4228 var rm_a: i64 = 0 4229 var rm_b: i64 = 0 4230 var rm_nx: i64 = 5 4231 if st_lit_eq(argv[4] as *u8, 0, st_vlen(argv[4] as *u8), "latest" as *u8) == 1 { rm_lt = 1 } else { 4232 if argc < 6 { st_werr("SEAT-FAIL resume_map explicit window needs BOTH <win_start_epoch> <win_end_epoch>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE } 4233 rm_a = st_atoi_z(argv[4] as *u8) 4234 rm_b = st_atoi_z(argv[5] as *u8) 4235 rm_nx = 6 4236 } 4237 var rm_j: *u8 = "-" as *u8 4238 if argc > rm_nx { rm_j = argv[rm_nx] as *u8 } 4239 let rm_rc: i64 = st_resume_map(argv[2] as *u8, argv[3] as *u8, rm_lt, rm_a, rm_b, rm_j) 4240 sys_exit(rm_rc) 4241 return rm_rc 4242 } 4243 st_werr("SEAT-FAIL unknown verb\n" as *u8) 4244 sys_exit(ST_EXIT_USAGE) 4245 return ST_EXIT_USAGE 4246}