`nx_seat.nx` source

↩ module page · 1544 lines · 75434 B
1// nx_seat.nx -- THE AGENT-SEAT token-engine organ (seat-system S0+S3, 2026-07-20).
2// MISSION (operator): move Claude's token lift INTO the ecosystem. Measured 12-session baseline:
3// cache_read 920.8M tok vs output 6.1M -- fat tool results re-read every turn dominate cost.
4// So: boot = ONE call, HARD-CAPPED <=4096B digest (vs ~40K-token memory-file boot); the substrate
5// is digested SERVER-SIDE and only the decision surface reaches a seat's context window.
6//   nx_seat boot <ws> [journal] [debtprefix] [frontierprefix] [meterlog]  -> capped JSON digest
7//   nx_seat meter <seat> <sessions> <out_tok> <cread_tok> <ccreate_tok> <note> [logpath]
8//        -> ONE O_APPEND TSV row to knowledge/status/token_efficiency.log (conflict-free, S3)
9//   nx_seat meterlog [n] [logpath]   -> last n metering rows (tail-window, declared)
10//   nx_seat shift [days] [meterlog] [ws.jrnl] -> ENGINE-SHIFT SCOREBOARD (F831): claude-vs-local
11//        seat-class aggregates + DONE-closures in window -> tokens-per-closed-rung, capped JSON
12//   nx_seat reap [actor] [note] [claims.jrnl] [ws.jrnl] -> F214 ORPHAN REAP: forks the nx_claims
13//        organ's reap verb (releases ONLY provably-EXPIRED claims, age>ttl by the claim's OWN
14//        ttl -- the wrapper NEVER decides expiry itself) then appends one ORPHAN-REAPED audit
15//        frame per reaped ws to the ws journal (who/when/why); idempotent, additive-only
16//   nx_seat selftest [tmpbase]       -> gv-lib gate T1..T6 incl SCALE tooth (300-frame journal
17//        -> output still <=4096B; fixture gates prove correctness NEVER scale -- ark v1 lesson)
18// SCALE-LAW: every read is tail-windowed with the true size DECLARED in output (journal_bytes vs
19// window_bytes); output budget declared as budget_bytes. AUTHORITY: nx_ws_cycle next remains the
20// scoped debt gate; boot is the recon DIGEST and says so in its output (no drift, no dup gate).
21// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
22import "nx_sovjson_lib.nx"
23import "nx_store_seed_lib.nx"
24import "nx_seg_store.nx"
25import "nx_gate_verdict.nx"
26import "nx_tool_run.nx"
27import "nx_syscalls.nx"
28// BOUNDED EXEC (seq1442). nx_seat forks helper organs (nx_debt, nx_frontier_board, ...) to build the
29// boot digest. tr_run_capture has no deadline, so ONE wedged helper hangs `nx_seat boot` -- the FIRST
30// call of every session -- with no way through. A digest missing one field is recoverable; a session
31// that cannot start is not. 30s: these are local store reads that normally return in well under a
32// second, so this can only ever catch a genuine hang.
33const ST_FORK_TIMEOUT_MS: i64 = 30000
34const ST_MAGIC_4096: i64 = 4096
35const ST_MAGIC_86400: i64 = 86400
36const ST_MAGIC_4092: i64 = 4092
37const ST_MAGIC_8192: i64 = 8192
38const ST_MAGIC_8188: i64 = 8188
39const ST_MAGIC_3600: i64 = 3600
40const ST_MAGIC_1024: i64 = 1024
41const ST_MAGIC_9000: i64 = 9000
42const ST_MAGIC_90000: i64 = 90000
43const ST_MAGIC_65536: i64 = 65536
44
45const ST_CAP: i64 = 1048576
46const ST_OUTCAP: i64 = 4096
47const ST_OUTBUF: i64 = 8192
48const ST_SEEK_SET: i64 = 0
49const ST_SEEK_END: i64 = 2
50const ST_TAB: i64 = 9
51const ST_NL: i64 = 10
52const ST_STDERR: i64 = 2
53const ST_SPAN: i64 = 16
54const ST_EXIT_USAGE: i64 = 2
55const ST_ACTIVE_MAX: i64 = 8
56const ST_FRONT_MAX: i64 = 5
57const ST_ROW_ESC: i64 = 240
58const ST_NOTE_ESC: i64 = 160
59const ST_WS_ESC: i64 = 40
60const ST_TITLE_ESC: i64 = 60
61const ST_STALE_SEC: i64 = 7200
62const ST_MODE_RW: i64 = 0x1a4
63const ST_ST_FRAMES: i64 = 300
64
65// helpers below DELEGATE to the shared nx_sovjson_lib (sj_*) -- one canonical copy, dup logic eaten (TS04)
66func st_puts(s: *u8) -> i64 { return sj_puts(s) }
67func st_werr(s: *u8) -> i64 { return sj_werr(s) }
68func st_vlen(s: *u8) -> i64 { return sj_vlen(s) }
69func st_cat(d: *u8, o: i64, s: *u8) -> i64 { return sj_cat(d, o, s) }
70func st_catn(d: *u8, o: i64, v: i64) -> i64 { return sj_catn(d, o, v) }
71func st_cat_esc(d: *u8, o: i64, q: *u8, s: i64, e: i64, maxn: i64) -> i64 { return sj_cat_esc(d, o, q, s, e, maxn) }
72func st_atoi_z(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
73func st_atoi_span(q: *u8, s: i64, e: i64) -> i64 { return sj_atoi_span(q, s, e) }
74func st_le(q: *u8, i: i64, n: i64) -> i64 { return sj_le(q, i, n) }
75func st_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64 { return sj_col(q, ls, le, c, out) }
76
77// Find the `_cap=<token>` inside a shift_verbs HINT column; fills cs[0]=off cs[1]=len. 0 = no cap declared.
78// WHY THIS EARNS ITS BYTES (seq1235, id 1785338488): that row MEASURED 44pct of all tool calls as raw shell and
79// named the cause as DISCOVERY, not capability -- nx_mgmt returns capability-denied unless the ADMIN cap rides
80// as _cap, which reads like the tool is unavailable, so seats fall back to ssh and never revisit. The conf has
81// ALREADY carried `_cap=admin.cap` in its hint column all along; the digest simply never emitted that column,
82// because the emitter reads col 0 and col 1 and stops.
83// u00e2u02dcu2026A HINT THAT EXISTS IN THE FILE AND NOT IN THE DIGEST IS A HINT NOBODY HAS.
84// Confirmed live 2026-07-31 on the session that fixed it: I read this exact digest at boot, saw the verb WITHOUT
85// the cap, called nx_mgmt, got capability-denied, and hand-hunted ~/.nishi/admin.cap -- the precise failure the
86// row predicted, on the session that closed it. Emits ONLY the token, never the whole hint, so the digest's
87// 512B tail reserve still holds.
88func st_cap_of(buf: *u8, off: i64, len: i64, cs: *i64) -> i64 {
  let pat: *u8 = "_cap=" as *u8
  let lim: i64 = off + len
  var i: i64 = off
  while i + 5 <= lim {
      var k: i64 = 0
      var ok: i64 = 1
      while k < 5 { if buf[i+k] != pat[k] { ok = 0; k = 5 } else { k = k + 1 } }
      if ok == 1 {
          var e: i64 = i + 5
          var go: i64 = 1
          while go == 1 {
              if e >= lim { go = 0 } else {
                  let c2: i64 = buf[e] as i64
                  if c2 == 59 { go = 0 } else { if c2 == 32 { go = 0 } else { e = e + 1 } }
              }
          }
          cs[0] = i + 5
          cs[1] = e - (i + 5)
          return 1
      }
      i = i + 1
  }
  return 0
112}
113func st_lit_eq(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { return sj_lit_eq(q, s, e, lit) }
114func st_span_eq(q: *u8, s1: i64, e1: i64, s2: i64, e2: i64) -> i64 {
  if e1 - s1 != e2 - s2 { return 0 }
  var i: i64 = 0
  while s1 + i < e1 { if q[s1+i] != q[s2+i] { return 0 } i = i + 1 }
  return 1
119}
120func st_contains(q: *u8, n: i64, lit: *u8) -> i64 { return sj_span_has(q, 0, n, lit) }
121// SCALE-LAW tail-window read: newest bytes win; partial first line dropped; true size declared.
122func st_read(path: *u8, buf: *u8, cap: i64, sizep: *i64) -> i64 {
  sizep[0] = 0
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  var size: i64 = sys_lseek(fd, 0, ST_SEEK_END)
  if size < 0 { size = 0 }
  sizep[0] = size
  var off: i64 = 0
  if size > cap { off = size - cap }
  sys_lseek(fd, off, ST_SEEK_SET)
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, ((buf as i64) + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
  sys_close(fd)
  if off > 0 {
      var fnl: i64 = 0
      var s: i64 = 1
      while s == 1 { if fnl >= n { s = 0 } else { if buf[fnl] == (ST_NL as u8) { s = 0 } else { fnl = fnl + 1 } } }
      if fnl < n {
          var t: i64 = 0
          let sk: i64 = fnl + 1
          while sk + t < n { buf[t] = buf[sk + t]; t = t + 1 }
          n = t
      }
  }
  return n
148}
149// one O_APPEND metering row: ts\tseat\tsessions\tout\tcread\tccreate\tnote\n (tabs/nl in note -> space)
150func st_meter_append(logpath: *u8, seat: *u8, sess: i64, outk: i64, cread: i64, ccre: i64, note: *u8) -> i64 {
  let ln: *u8 = sys_mmap(ST_MAGIC_4096)
  var o: i64 = 0
  o = st_catn(ln, o, sys_now_realtime_sec())
  ln[o] = ST_TAB as u8
  o = o + 1
  var i: i64 = 0
  while seat[i] != (0 as u8) { var c: i64 = seat[i] as i64; if c < 32 { c = 32 } ln[o] = c as u8; o = o + 1; i = i + 1 }
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_catn(ln, o, sess)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_catn(ln, o, outk)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_catn(ln, o, cread)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_catn(ln, o, ccre)
  ln[o] = ST_TAB as u8
  o = o + 1
  var j: i64 = 0
  while note[j] != (0 as u8) { var c2: i64 = note[j] as i64; if c2 < 32 { c2 = 32 } ln[o] = c2 as u8; o = o + 1; j = j + 1 }
  ln[o] = ST_NL as u8
  o = o + 1
  let fd: i64 = sys_openat_append(logpath, ST_MODE_RW)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, ln, o)
  sys_close(fd)
  return 0
181}
182// journal helpers (same frame grammar as ws_sync: ts\tVERB\tws\tactor\tnote)
183func st_has(q: *u8, n: i64, verb: *u8, ws: *u8) -> i64 {
  let cv: *i64 = sys_mmap(ST_SPAN) as *i64
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], verb) == 1 {
          if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 { return 1 } }
      } }
      i = le + 1
  }
  return 0
195}
196func st_first_kick(q: *u8, upto: i64, ws_s: i64, ws_e: i64) -> i64 {
  let cv: *i64 = sys_mmap(ST_SPAN) as *i64
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  var i: i64 = 0
  while i < upto {
      let le: i64 = st_le(q, i, upto)
      if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 {
          if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 0 } }
      } }
      i = le + 1
  }
  return 1
208}
209func st_last_ts_lit(q: *u8, n: i64, ws: *u8) -> i64 {
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  var last: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 {
          if st_col(q, i, le, 0, c0) == 1 { last = st_atoi_span(q, c0[0], c0[1]) }
      } }
      i = le + 1
  }
  return last
222}
223func st_last_ts_span(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 {
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  var last: i64 = 0 - 1
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 {
          if st_col(q, i, le, 0, c0) == 1 { last = st_atoi_span(q, c0[0], c0[1]) }
      } }
      i = le + 1
  }
  return last
236}
237// ctx-tax flush loop (ws=ctx-tax-function): the LAST CHECKPOINT frame for a ws -- ts returned,
238// note span into fs[0..1] -- so boot can surface in-flight state after a harness compact/clear
239func st_last_brief(q: *u8, n: i64, ws: *u8, fs: *i64) -> i64 {
  let cv: *i64 = sys_mmap(ST_SPAN) as *i64
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  let c4: *i64 = sys_mmap(ST_SPAN) as *i64
  var last: i64 = 0 - 1
  fs[0] = 0 - 1
  fs[1] = 0 - 1
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "CHECKPOINT" as *u8) == 1 {
          if st_col(q, i, le, 2, cw) == 1 { if st_lit_eq(q, cw[0], cw[1], ws) == 1 {
              if st_col(q, i, le, 0, c0) == 1 { if st_col(q, i, le, 4, c4) == 1 {
                  last = st_atoi_span(q, c0[0], c0[1])
                  fs[0] = c4[0]
                  fs[1] = c4[1]
              } }
          } }
      } }
      i = le + 1
  }
  return last
262}
263// top-severity OPEN debt (schema-aware: legacy 5-col sev@1 / v2 7-col sev@2, status@3 both).
264// fills row span fs[0..1] + sev fs[2]; returns open count.
265func st_topdebt(dp: *u8, dbuf: *u8, fs: *i64) -> i64 {
  let n: i64 = sts_load(dp, dbuf, ST_CAP)
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  let c3: *i64 = sys_mmap(ST_SPAN) as *i64
  let cs: *i64 = sys_mmap(ST_SPAN) as *i64
  fs[0] = 0 - 1
  fs[1] = 0 - 1
  fs[2] = 0 - 1
  var k: i64 = 0
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(dbuf, i, n)
      if st_col(dbuf, i, le, 3, c3) == 1 { if st_lit_eq(dbuf, c3[0], c3[1], "open" as *u8) == 1 {
          k = k + 1
          var sevcol: i64 = 2
          if st_col(dbuf, i, le, 0, c0) == 1 {
              if c0[1] - c0[0] >= 8 {
                  var alldig: i64 = 1
                  var p: i64 = c0[0]
                  while p < c0[1] { let c: i64 = dbuf[p] as i64; if c < 48 { alldig = 0; p = c0[1] } else { if c > 57 { alldig = 0; p = c0[1] } else { p = p + 1 } } }
                  if alldig == 1 { sevcol = 1 }
              }
          }
          if st_col(dbuf, i, le, sevcol, cs) == 1 {
              let sev: i64 = st_atoi_span(dbuf, cs[0], cs[1])
              if sev > fs[2] { fs[2] = sev; fs[0] = i; fs[1] = le }
          }
      } }
      i = le + 1
  }
  return k
296}
297// status CHAR (i64) of the frontier row whose col0 == id span [ids,ide) in fbuf; 0 if not found.
298// Same-buffer span compare (ids/ide and the scanned col0 both index fbuf).
299func st_frontier_status(fbuf: *u8, fn: i64, ids: i64, ide: i64) -> i64 {
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  let c5: *i64 = sys_mmap(ST_SPAN) as *i64
  var i: i64 = 0
  while i < fn {
      let le: i64 = st_le(fbuf, i, fn)
      if st_col(fbuf, i, le, 0, c0) == 1 {
          if st_span_eq(fbuf, c0[0], c0[1], ids, ide) == 1 {
              if st_col(fbuf, i, le, 5, c5) == 1 { if c5[1] > c5[0] { return fbuf[c5[0]] as i64 } }
              return 0
          }
      }
      i = le + 1
  }
  return 0
314}
315// count of BLOCKING deps in a deps-column span [ds,de): each internal F-ref whose status != D.
316// "-"/empty => 0 (ready). External (non-F) or unresolvable refs do NOT block (can't gate here).
317// 68='D' 70='F' 45='-' 44=',' 59=';' 32=' '
318func st_deps_block_count(fbuf: *u8, fn: i64, ds: i64, de: i64) -> i64 {
  if de <= ds { return 0 }
  if de - ds == 1 { if fbuf[ds] == (45 as u8) { return 0 } }
  var block: i64 = 0
  var p: i64 = ds
  while p < de {
      var sk: i64 = 1
      while sk == 1 { if p >= de { sk = 0 } else { let c: i64 = fbuf[p] as i64; if c == 44 { p = p + 1 } else { if c == 59 { p = p + 1 } else { if c == 32 { p = p + 1 } else { sk = 0 } } } } }
      if p < de {
          let ts: i64 = p
          var s2: i64 = 1
          while s2 == 1 { if p >= de { s2 = 0 } else { let c2: i64 = fbuf[p] as i64; if c2 == 44 { s2 = 0 } else { if c2 == 59 { s2 = 0 } else { if c2 == 32 { s2 = 0 } else { p = p + 1 } } } } }
          let te: i64 = p
          if te > ts { if fbuf[ts] == (70 as u8) {
              let stt: i64 = st_frontier_status(fbuf, fn, ts, te)
              if stt != 0 { if stt != 68 { block = block + 1 } }
          } }
      }
  }
  return block
338}
339// THE READY DIGEST (F832): deps-resolved READY frontier set from the SAME seg-store the 33.7KB
340// nx_frontier_board reads -- a seat picks work in ~1KB, not the full CPM dump. READY = status T
341// with every internal F-dep at status D. Lane filter ("*"/empty = all). Envelope DECLARED
342// (store_bytes/ready_total vs shown/cap). Authority pointers preserved (debt-gate + full CPM).
343func st_ready(lane: *u8, maxn: i64, fp: *u8, out: *u8) -> i64 {
  let fbuf: *u8 = sys_mmap(ST_CAP)
  let fn: i64 = sts_load(fp, fbuf, ST_CAP)
  let now: i64 = sys_now_realtime_sec()
  let lanelen: i64 = st_vlen(lane)
  var nofilter: i64 = 0
  if lanelen == 0 { nofilter = 1 }
  if lanelen == 1 { if lane[0] == (42 as u8) { nofilter = 1 } }
  var o: i64 = 0
  o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"verb\":\"ready\",\"epoch\":" as *u8)
  o = st_catn(out, o, now)
  o = st_cat(out, o, ",\"budget_bytes\":" as *u8)
  o = st_catn(out, o, ST_OUTCAP)
  o = st_cat(out, o, ",\"store_bytes\":" as *u8)
  o = st_catn(out, o, fn)
  o = st_cat(out, o, ",\"lane\":\"" as *u8)
  o = st_cat_esc(out, o, lane, 0, lanelen, ST_WS_ESC)
  o = st_cat(out, o, "\",\"ready\":[" as *u8)
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  let c1: *i64 = sys_mmap(ST_SPAN) as *i64
  let c5: *i64 = sys_mmap(ST_SPAN) as *i64
  let c6: *i64 = sys_mmap(ST_SPAN) as *i64
  let c8: *i64 = sys_mmap(ST_SPAN) as *i64
  var nready: i64 = 0
  var nblocked: i64 = 0
  var ntodo: i64 = 0
  var shown: i64 = 0
  let c2w: *i64 = sys_mmap(ST_SPAN) as *i64
  // RANKW1 (big-rocks sharpening 2026-07-20): the digest must surface the BIGGEST rocks first,
  // not first-inserted. Pass 1 counts; pass 2 emits in weight bands 9..0 (col 2; store order
  // within a band; missing/non-numeric w = 0 = last). <=10 in-memory passes, no sort machinery.
  var i: i64 = 0
  while i < fn {
      let le: i64 = st_le(fbuf, i, fn)
      if st_col(fbuf, i, le, 5, c5) == 1 { if st_lit_eq(fbuf, c5[0], c5[1], "T" as *u8) == 1 {
          var lanematch: i64 = nofilter
          if lanematch == 0 { if st_col(fbuf, i, le, 8, c8) == 1 { if st_lit_eq(fbuf, c8[0], c8[1], lane) == 1 { lanematch = 1 } } }
          if lanematch == 1 {
              ntodo = ntodo + 1
              var blk: i64 = 0
              if st_col(fbuf, i, le, 6, c6) == 1 { blk = st_deps_block_count(fbuf, fn, c6[0], c6[1]) }
              if blk > 0 { nblocked = nblocked + 1 } else { nready = nready + 1 }
          }
      } }
      i = le + 1
  }
  var band: i64 = 9
  while band >= 0 {
      var j: i64 = 0
      while j < fn {
          let le2: i64 = st_le(fbuf, j, fn)
          if shown < maxn { if st_col(fbuf, j, le2, 5, c5) == 1 { if st_lit_eq(fbuf, c5[0], c5[1], "T" as *u8) == 1 {
              var lm2: i64 = nofilter
              if lm2 == 0 { if st_col(fbuf, j, le2, 8, c8) == 1 { if st_lit_eq(fbuf, c8[0], c8[1], lane) == 1 { lm2 = 1 } } }
              if lm2 == 1 {
                  var wv: i64 = 0
                  if st_col(fbuf, j, le2, 2, c2w) == 1 { wv = st_atoi_span(fbuf, c2w[0], c2w[1]) }
                  if wv > 9 { wv = 9 }
                  if wv < 0 { wv = 0 }
                  if wv == band {
                      var blk2: i64 = 0
                      if st_col(fbuf, j, le2, 6, c6) == 1 { blk2 = st_deps_block_count(fbuf, fn, c6[0], c6[1]) }
                      if blk2 == 0 {
                          if st_col(fbuf, j, le2, 0, c0) == 1 { if st_col(fbuf, j, le2, 1, c1) == 1 {
                              if shown > 0 { o = st_cat(out, o, "," as *u8) }
                              o = st_cat(out, o, "{\"id\":\"" as *u8)
                              o = st_cat_esc(out, o, fbuf, c0[0], c0[1], ST_WS_ESC)
                              o = st_cat(out, o, "\",\"w\":" as *u8)
                              o = st_catn(out, o, wv)
                              o = st_cat(out, o, ",\"t\":\"" as *u8)
                              o = st_cat_esc(out, o, fbuf, c1[0], c1[1], ST_TITLE_ESC)
                              o = st_cat(out, o, "\",\"lane\":\"" as *u8)
                              if st_col(fbuf, j, le2, 8, c8) == 1 { o = st_cat_esc(out, o, fbuf, c8[0], c8[1], ST_WS_ESC) }
                              o = st_cat(out, o, "\"}" as *u8)
                              shown = shown + 1
                          } }
                      }
                  }
              }
          } } }
          j = le2 + 1
      }
      band = band - 1
  }
  o = st_cat(out, o, "],\"ready_total\":" as *u8)
  o = st_catn(out, o, nready)
  o = st_cat(out, o, ",\"shown\":" as *u8)
  o = st_catn(out, o, shown)
  o = st_cat(out, o, ",\"blocked_total\":" as *u8)
  o = st_catn(out, o, nblocked)
  o = st_cat(out, o, ",\"todo_total\":" as *u8)
  o = st_catn(out, o, ntodo)
  o = st_cat(out, o, ",\"env\":\"frontier-store-digest;ready=T-with-all-F-deps-D;order=w-desc;cap-" as *u8)
  o = st_catn(out, o, maxn)
  o = st_cat(out, o, "\",\"authority\":\"debt-gate=nx_ws_cycle-next;full-CPM=nx_frontier_board\"}" as *u8)
  out[o] = ST_NL as u8
  o = o + 1
  return o
441}
442func st_has_span_done(q: *u8, n: i64, ws_s: i64, ws_e: i64) -> i64 {
  let cv: *i64 = sys_mmap(ST_SPAN) as *i64
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "DONE" as *u8) == 1 {
          if st_col(q, i, le, 2, cw) == 1 { if st_span_eq(q, cw[0], cw[1], ws_s, ws_e) == 1 { return 1 } }
      } }
      i = le + 1
  }
  return 0
454}
455// THE ENGINE-SHIFT SCOREBOARD (F831 half 2): seat-class aggregates from the SAME evidence log
456// meter writes + DONE closures from the SAME journal boot reads. The plan's gauge: engine-shift
457// = claude out-per-done FALLING while local zero-API closure rows RISE. class = seat prefix
458// "claude" vs everything-else=local; both reads tail-windowed + declared (scale-law).
459func st_starts(q: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  var i: i64 = 0
  while lit[i] != (0 as u8) {
      if s + i >= e { return 0 }
      if q[s+i] != lit[i] { return 0 }
      i = i + 1
  }
  return 1
467}
468func st_shift(days: i64, ml: *u8, jr: *u8, out: *u8) -> i64 {
  let now: i64 = sys_now_realtime_sec()
  let win: i64 = days * ST_MAGIC_86400
  var cutoff: i64 = now - win
  if days <= 0 { cutoff = 0 }
  let mb: *u8 = sys_mmap(ST_CAP)
  let msz: *i64 = sys_mmap(ST_SPAN) as *i64
  let mn: i64 = st_read(ml, mb, ST_CAP - 4, msz)
  let c0: *i64 = sys_mmap(ST_SPAN) as *i64
  let c1: *i64 = sys_mmap(ST_SPAN) as *i64
  let c2: *i64 = sys_mmap(ST_SPAN) as *i64
  let c3: *i64 = sys_mmap(ST_SPAN) as *i64
  let c4: *i64 = sys_mmap(ST_SPAN) as *i64
  let c5: *i64 = sys_mmap(ST_SPAN) as *i64
  var crows: i64 = 0
  var csess: i64 = 0
  var coutv: i64 = 0
  var ccread: i64 = 0
  var cccre: i64 = 0
  var lrows: i64 = 0
  var lsess: i64 = 0
  var lout: i64 = 0
  var i: i64 = 0
  while i < mn {
      let le: i64 = st_le(mb, i, mn)
      if st_col(mb, i, le, 0, c0) == 1 {
          let ts: i64 = st_atoi_span(mb, c0[0], c0[1])
          if ts >= cutoff { if st_col(mb, i, le, 1, c1) == 1 {
              var sess: i64 = 0
              var outv: i64 = 0
              var crd: i64 = 0
              var ccr: i64 = 0
              if st_col(mb, i, le, 2, c2) == 1 { sess = st_atoi_span(mb, c2[0], c2[1]) }
              if st_col(mb, i, le, 3, c3) == 1 { outv = st_atoi_span(mb, c3[0], c3[1]) }
              if st_col(mb, i, le, 4, c4) == 1 { crd = st_atoi_span(mb, c4[0], c4[1]) }
              if st_col(mb, i, le, 5, c5) == 1 { ccr = st_atoi_span(mb, c5[0], c5[1]) }
              if st_starts(mb, c1[0], c1[1], "claude" as *u8) == 1 {
                  crows = crows + 1
                  csess = csess + sess
                  coutv = coutv + outv
                  ccread = ccread + crd
                  cccre = cccre + ccr
              } else {
                  lrows = lrows + 1
                  lsess = lsess + sess
                  lout = lout + outv
              }
          } }
      }
      i = le + 1
  }
  let q: *u8 = sys_mmap(ST_CAP)
  let jsz: *i64 = sys_mmap(ST_SPAN) as *i64
  let n: i64 = st_read(jr, q, ST_CAP - 4, jsz)
  let d0: *i64 = sys_mmap(ST_SPAN) as *i64
  let d1: *i64 = sys_mmap(ST_SPAN) as *i64
  var done: i64 = 0
  var j: i64 = 0
  while j < n {
      let jle: i64 = st_le(q, j, n)
      if st_col(q, j, jle, 1, d1) == 1 { if st_lit_eq(q, d1[0], d1[1], "DONE" as *u8) == 1 {
          if st_col(q, j, jle, 0, d0) == 1 { if st_atoi_span(q, d0[0], d0[1]) >= cutoff { done = done + 1 } }
      } }
      j = jle + 1
  }
  var tpd: i64 = 0 - 1
  var cpd: i64 = 0 - 1
  if done > 0 { tpd = coutv / done }
  if done > 0 { cpd = ccread / done }
  var o: i64 = 0
  o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"verb\":\"shift\",\"epoch\":" as *u8)
  o = st_catn(out, o, now)
  o = st_cat(out, o, ",\"budget_bytes\":" as *u8)
  o = st_catn(out, o, ST_OUTCAP)
  o = st_cat(out, o, ",\"days\":" as *u8)
  o = st_catn(out, o, days)
  o = st_cat(out, o, ",\"log_bytes\":" as *u8)
  o = st_catn(out, o, msz[0])
  o = st_cat(out, o, ",\"log_window\":" as *u8)
  o = st_catn(out, o, mn)
  o = st_cat(out, o, ",\"jr_bytes\":" as *u8)
  o = st_catn(out, o, jsz[0])
  o = st_cat(out, o, ",\"jr_window\":" as *u8)
  o = st_catn(out, o, n)
  o = st_cat(out, o, ",\"claude\":{\"rows\":" as *u8)
  o = st_catn(out, o, crows)
  o = st_cat(out, o, ",\"sessions\":" as *u8)
  o = st_catn(out, o, csess)
  o = st_cat(out, o, ",\"out\":" as *u8)
  o = st_catn(out, o, coutv)
  o = st_cat(out, o, ",\"cread\":" as *u8)
  o = st_catn(out, o, ccread)
  o = st_cat(out, o, ",\"ccreate\":" as *u8)
  o = st_catn(out, o, cccre)
  o = st_cat(out, o, "},\"local\":{\"rows\":" as *u8)
  o = st_catn(out, o, lrows)
  o = st_cat(out, o, ",\"sessions\":" as *u8)
  o = st_catn(out, o, lsess)
  o = st_cat(out, o, ",\"out\":" as *u8)
  o = st_catn(out, o, lout)
  o = st_cat(out, o, "},\"done_ws\":" as *u8)
  o = st_catn(out, o, done)
  o = st_cat(out, o, ",\"claude_out_per_done\":" as *u8)
  o = st_catn(out, o, tpd)
  o = st_cat(out, o, ",\"claude_cread_per_done\":" as *u8)
  o = st_catn(out, o, cpd)
  o = st_cat(out, o, ",\"env\":\"tail-1MiB-both-declared;class=seat-prefix-claude-else-local;done=DONE-frames-in-window;out-hard-" as *u8)
  o = st_catn(out, o, ST_OUTCAP)
  o = st_cat(out, o, "\",\"authority\":\"evidence=token_efficiency.log+ws_sync.jrnl;goal=out-per-done-falling-local-rows-rising\"}" as *u8)
  out[o] = ST_NL as u8
  o = o + 1
  return o
580}
581// THE BOOT DIGEST: one hard-capped JSON. Returns emitted length (<= ST_OUTCAP by construction).
582func st_boot(ws: *u8, jr: *u8, dp: *u8, fp: *u8, ml: *u8, out: *u8) -> i64 {
  let q: *u8 = sys_mmap(ST_CAP)
  let jsz: *i64 = sys_mmap(ST_SPAN) as *i64
  let n: i64 = st_read(jr, q, ST_CAP - 4, jsz)
  let now: i64 = sys_now_realtime_sec()
  var o: i64 = 0
  o = st_cat(out, o, "{\"organ\":\"nx_seat\",\"epoch\":" as *u8)
  o = st_catn(out, o, now)
  o = st_cat(out, o, ",\"budget_bytes\":" as *u8)
  o = st_catn(out, o, ST_OUTCAP)
  o = st_cat(out, o, ",\"journal_bytes\":" as *u8)
  o = st_catn(out, o, jsz[0])
  o = st_cat(out, o, ",\"window_bytes\":" as *u8)
  o = st_catn(out, o, n)
  o = st_cat(out, o, ",\"ws\":\"" as *u8)
  o = st_cat_esc(out, o, ws, 0, st_vlen(ws), ST_WS_ESC)
  o = st_cat(out, o, "\",\"phase\":\"" as *u8)
  let lt: i64 = st_last_ts_lit(q, n, ws)
  if st_has(q, n, "DONE" as *u8, ws) == 1 { o = st_cat(out, o, "DONE" as *u8) } else {
      if lt >= 0 { o = st_cat(out, o, "INFLIGHT" as *u8) } else { o = st_cat(out, o, "UNKNOWN" as *u8) }
  }
  o = st_cat(out, o, "\",\"age_s\":" as *u8)
  if lt >= 0 { o = st_catn(out, o, now - lt) } else { o = st_catn(out, o, 0 - 1) }
  // ctx-tax flush loop: surface the last CHECKPOINT so post-compact re-entry keeps state
  let bfs: *i64 = sys_mmap(ST_SPAN) as *i64
  let bts: i64 = st_last_brief(q, n, ws, bfs)
  o = st_cat(out, o, ",\"brief_age_s\":" as *u8)
  if bts >= 0 { o = st_catn(out, o, now - bts) } else { o = st_catn(out, o, 0 - 1) }
  o = st_cat(out, o, ",\"last_brief\":\"" as *u8)
  if bfs[0] >= 0 { o = st_cat_esc(out, o, q, bfs[0], bfs[1], ST_NOTE_ESC) }
  o = st_cat(out, o, "\"" as *u8)
  // debts: open count + THE top-severity row (eat-most-important-first pointer)
  let dbuf: *u8 = sys_mmap(ST_CAP)
  let fs: *i64 = sys_mmap(ST_SPAN * 2) as *i64
  let k: i64 = st_topdebt(dp, dbuf, fs)
  o = st_cat(out, o, ",\"open_debts\":" as *u8)
  o = st_catn(out, o, k)
  o = st_cat(out, o, ",\"top_sev\":" as *u8)
  o = st_catn(out, o, fs[2])
  o = st_cat(out, o, ",\"top_debt\":\"" as *u8)
  if fs[0] >= 0 { o = st_cat_esc(out, o, dbuf, fs[0], fs[1], ST_ROW_ESC) }
  o = st_cat(out, o, "\",\"active\":[" as *u8)
  // board digest: ACTIVE ws (fresh within window) capped, DONE/STALE counted only
  let cv: *i64 = sys_mmap(ST_SPAN) as *i64
  let cw: *i64 = sys_mmap(ST_SPAN) as *i64
  var nact: i64 = 0
  var ndone: i64 = 0
  var nstale: i64 = 0
  var i: i64 = 0
  while i < n {
      let le: i64 = st_le(q, i, n)
      if st_col(q, i, le, 1, cv) == 1 { if st_lit_eq(q, cv[0], cv[1], "KICKOFF" as *u8) == 1 {
          if st_col(q, i, le, 2, cw) == 1 { if st_first_kick(q, i, cw[0], cw[1]) == 1 {
              if st_has_span_done(q, n, cw[0], cw[1]) == 1 { ndone = ndone + 1 } else {
                  let wlt: i64 = st_last_ts_span(q, n, cw[0], cw[1])
                  if now - wlt <= ST_STALE_SEC {
                      if nact < ST_ACTIVE_MAX {
                          if nact > 0 { o = st_cat(out, o, "," as *u8) }
                          o = st_cat(out, o, "{\"ws\":\"" as *u8)
                          o = st_cat_esc(out, o, q, cw[0], cw[1], ST_WS_ESC)
                          o = st_cat(out, o, "\",\"age_s\":" as *u8)
                          o = st_catn(out, o, now - wlt)
                          o = st_cat(out, o, "}" as *u8)
                      }
                      nact = nact + 1
                  } else { nstale = nstale + 1 }
              }
          } }
      } }
      i = le + 1
  }
  o = st_cat(out, o, "],\"active_total\":" as *u8)
  o = st_catn(out, o, nact)
  o = st_cat(out, o, ",\"done_ws\":" as *u8)
  o = st_catn(out, o, ndone)
  o = st_cat(out, o, ",\"stale_ws\":" as *u8)
  o = st_catn(out, o, nstale)
  // frontier: first N TODO rows (id + capped title) + totals
  let fbuf: *u8 = sys_mmap(ST_CAP)
  let fn: i64 = sts_load(fp, fbuf, ST_CAP)
  let f0: *i64 = sys_mmap(ST_SPAN) as *i64
  let f1: *i64 = sys_mmap(ST_SPAN) as *i64
  let f5: *i64 = sys_mmap(ST_SPAN) as *i64
  o = st_cat(out, o, ",\"frontier_todo\":[" as *u8)
  var nf: i64 = 0
  var tf: i64 = 0
  var fi: i64 = 0
  while fi < fn {
      let fle: i64 = st_le(fbuf, fi, fn)
      if st_col(fbuf, fi, fle, 5, f5) == 1 { if st_lit_eq(fbuf, f5[0], f5[1], "T" as *u8) == 1 {
          tf = tf + 1
          if nf < ST_FRONT_MAX {
              if st_col(fbuf, fi, fle, 0, f0) == 1 { if st_col(fbuf, fi, fle, 1, f1) == 1 {
                  if nf > 0 { o = st_cat(out, o, "," as *u8) }
                  o = st_cat(out, o, "{\"id\":\"" as *u8)
                  o = st_cat_esc(out, o, fbuf, f0[0], f0[1], ST_WS_ESC)
                  o = st_cat(out, o, "\",\"t\":\"" as *u8)
                  o = st_cat_esc(out, o, fbuf, f1[0], f1[1], ST_TITLE_ESC)
                  o = st_cat(out, o, "\"}" as *u8)
                  nf = nf + 1
              } }
          }
      } }
      fi = fle + 1
  }
  o = st_cat(out, o, "],\"frontier_todo_total\":" as *u8)
  o = st_catn(out, o, tf)
  // metering pointer: last row of the token-efficiency evidence log
  let mbuf: *u8 = sys_mmap(ST_CAP)
  let msz: *i64 = sys_mmap(ST_SPAN) as *i64
  let mn: i64 = st_read(ml, mbuf, ST_MAGIC_4096, msz)
  o = st_cat(out, o, ",\"meter_last\":\"" as *u8)
  if mn > 0 {
      var ls: i64 = 0
      var mi: i64 = 0
      while mi < mn { let mle: i64 = st_le(mbuf, mi, mn); if mle < mn { ls = mi } else { if mle > mi { ls = mi } } mi = mle + 1 }
      let lse: i64 = st_le(mbuf, ls, mn)
      o = st_cat_esc(out, o, mbuf, ls, lse, ST_NOTE_ESC)
  }
  o = st_cat(out, o, "\"" as *u8)   // 2026-07-29: the shift_verbs insertion dropped meter_last's CLOSING quote -- the whole boot digest was INVALID JSON (a human reader skims past it; every machine consumer -- makers, cheap-model seats, scripts -- dies on JSON.parse, which is precisely who the digest is for)
  // SHIFT-VERBS: the sovereign path for each work class a session would
  // otherwise rediscover by shelling out (discovery-is-the-bottleneck,
  // knowledge/status/self_sufficiency_map_20260729.md). Data-driven per
  // rule 11: knowledge/shift_verbs.conf rows task<TAB>verb<TAB>hint --
  // extend the conf, never rebuild the seat. Additive field (rule 19);
  // conf absent => empty list, the FIELD is always present (honest zero).
  // Row emission is BUDGET-DERIVED, not a taste top-N (bounds law 07-29):
  // rows emit while output stays under ST_OUTCAP minus ST_SV_RESERVE bytes.
  let svb: *u8 = sys_mmap(ST_CAP)
  let svz: *i64 = sys_mmap(ST_SPAN) as *i64
  let svn: i64 = st_read("knowledge/shift_verbs.conf" as *u8, svb, ST_MAGIC_4096, svz)
  o = st_cat(out, o, ",\"shift_verbs\":[" as *u8)
  var nsv: i64 = 0
  if svn > 0 {
      let s0: *i64 = sys_mmap(ST_SPAN) as *i64
      let s1: *i64 = sys_mmap(ST_SPAN) as *i64
      // Allocated ONCE outside the row loop on purpose: a sys_mmap per row is an allocator in a loop, which
      // this ecosystem has already paid for twice (the unfreed-mmap class). Both are pure out-params.
      let s2: *i64 = sys_mmap(ST_SPAN) as *i64
      let cs: *i64 = sys_mmap(ST_SPAN) as *i64
      var si: i64 = 0
      while si < svn {
          let sle: i64 = st_le(svb, si, svn)
          if sle > si + 2 { if svb[si] != (35 as u8) {
              // ST_SV_RESERVE units=BYTES: measured digest tail after this
              // field (env+authority strings ~230B) + one max row (task
              // ST_WS_ESC + verb ST_TITLE_ESC + json wrappers ~200B) + NL,
              // rounded up = 512. When this bound bites the fix is a wider
              // ST_OUTCAP envelope or a leaner tail -- never a smaller list.
              if o < ST_OUTCAP - 512 {
                  if st_col(svb, si, sle, 0, s0) == 1 { if st_col(svb, si, sle, 1, s1) == 1 {
                      if nsv > 0 { o = st_cat(out, o, "," as *u8) }
                      o = st_cat(out, o, "{\"t\":\"" as *u8)
                      o = st_cat_esc(out, o, svb, s0[0], s0[1], ST_WS_ESC)
                      o = st_cat(out, o, "\",\"v\":\"" as *u8)
                      o = st_cat_esc(out, o, svb, s1[0], s1[1], ST_TITLE_ESC)
                      // Carry the cap token when the hint declares one. Additive field (rule 19): consumers
                      // that ignore it are unaffected, and a row with no _cap= emits exactly what it did
                      // before, so a conf without caps produces a byte-identical digest.
                      if st_col(svb, si, sle, 2, s2) == 1 {
                          if st_cap_of(svb, s2[0], s2[1], cs) == 1 {
                              o = st_cat(out, o, "\",\"cap\":\"" as *u8)
                              // Direct byte copy, not st_cat_esc: the first cut emitted "cap":"" and the
                              // escaper is the only unknown in that path. A cap token is [a-z0-9._-] by
                              // construction (it names a file in ~/.nishi), so there is nothing to escape and
                              // nothing to be gained by routing it through a helper whose contract I would be
                              // guessing at. Bounded by cs[1], which st_cap_of derived from the slice itself.
                              var cq: i64 = 0
                              while cq < cs[1] { out[o] = svb[cs[0] + cq]; o = o + 1; cq = cq + 1 }
                          }
                      }
                      o = st_cat(out, o, "\"}" as *u8)
                      nsv = nsv + 1
                  } }
              }
          } }
          si = sle + 1
      }
  }
  o = st_cat(out, o, "],\"shift_src\":\"knowledge/shift_verbs.conf;rows-budget-derived-512B-reserve\"" as *u8)
  o = st_cat(out, o, ",\"env\":\"jr-tail-1MiB-declared;debt-plane-1MiB;frontier-first-" as *u8)
  o = st_catn(out, o, ST_FRONT_MAX)
  o = st_cat(out, o, ";out-hard-" as *u8)
  o = st_catn(out, o, ST_OUTCAP)
  o = st_cat(out, o, "\",\"authority\":\"nx_ws_cycle-next-is-the-scoped-gate;this-is-the-recon-digest\"}" as *u8)
  out[o] = ST_NL as u8
  o = o + 1
  return o
770}
771// append one journal frame (selftest fixture writer; same grammar as ws_sync)
772func st_frame(jr: *u8, ts: i64, verb: *u8, ws: *u8, actor: *u8, note: *u8) -> i64 {
  let ln: *u8 = sys_mmap(ST_MAGIC_4096)
  var o: i64 = 0
  o = st_catn(ln, o, ts)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, verb)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, ws)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, actor)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, note)
  ln[o] = ST_NL as u8
  o = o + 1
  let fd: i64 = sys_openat_append(jr, ST_MODE_RW)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, ln, o)
  sys_close(fd)
  return 0
795}
796// claims-grammar fixture frame (ts\tVERB\tres\tactor\tttl\tnote) -- selftest injects OLD ts
797// to synthesize a provably-EXPIRED claim in a SCRATCH journal (never the prod store)
798func st_cframe(cjr: *u8, ts: i64, verb: *u8, res: *u8, actor: *u8, ttl: i64, note: *u8) -> i64 {
  let ln: *u8 = sys_mmap(ST_MAGIC_4096)
  var o: i64 = 0
  o = st_catn(ln, 0, ts)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, verb)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, res)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, actor)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_catn(ln, o, ttl)
  ln[o] = ST_TAB as u8
  o = o + 1
  o = st_cat(ln, o, note)
  ln[o] = ST_NL as u8
  o = o + 1
  let fd: i64 = sys_openat_append(cjr, ST_MODE_RW)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, ln, o)
  sys_close(fd)
  return 0
824}
825// CTX-TAX FLUSH VERB (the warden's ecosystem-side function): ONE CHECKPOINT frame captures the
826// in-flight state so the operator can /compact or /clear LOSSLESSLY; re-entry = boot, whose 1KB
827// digest now carries last_brief. Journal-append only -- additive, conflict-free, rule-19.
828func st_do_brief(ws: *u8, actor: *u8, note: *u8, wj: *u8, out: *u8) -> i64 {
  let rc: i64 = st_frame(wj, sys_now_realtime_sec(), "CHECKPOINT" as *u8, ws, actor, note)
  var o: i64 = 0
  if rc != 0 {
      o = st_cat(out, 0, "BRIEF-FAIL journal unwritable jr=" as *u8)
      o = st_cat_esc(out, o, wj, 0, st_vlen(wj), 200)
      out[o] = ST_NL as u8
      o = o + 1
      sys_write(1, out, o)
      return 1
  }
  o = st_cat(out, 0, "BRIEF ws=" as *u8)
  o = st_cat(out, o, ws)
  o = st_cat(out, o, " checkpoint=1 flush-safe=1 reboot=nx_seat-boot note=" as *u8)
  o = st_cat_esc(out, o, note, 0, st_vlen(note), 160)
  out[o] = ST_NL as u8
  o = o + 1
  sys_write(1, out, o)
  return 0
847}
848// S1 ONE-CALL PROTOCOL (composes the sibling nx_claims organ by FORK -- its derived-holdership
849// parser stays THE one copy, no dup): checkin = claim(fail-closed CONTENDED) then KICKOFF frame;
850// checkout = DONE frame then release. A seat's whole session protocol = two calls.
851func st_claims_run(verb: *u8, cj: *u8, ws: *u8, actor: *u8, ttl: i64, note: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 {
  let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8
  let av: *i64 = sys_mmap(16 * 8) as *i64
  let tb: *u8 = sys_mmap(28)
  av[0] = elf as i64
  av[1] = verb as i64
  av[2] = cj as i64
  av[3] = ws as i64
  av[4] = actor as i64
  var n: i64 = 5
  if ttl >= 0 {
      let te: i64 = st_catn(tb, 0, ttl)
      tb[te] = 0 as u8
      av[5] = tb as i64
      n = 6
  }
  av[n] = note as i64
  av[n+1] = 0
  return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS)
870}
871func st_do_checkin(ws: *u8, actor: *u8, ttl: i64, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 {
  let cout: *u8 = sys_mmap(ST_MAGIC_4096)
  let colen: *i64 = sys_mmap(ST_SPAN) as *i64
  let rc: i64 = st_claims_run("claim" as *u8, cj, ws, actor, ttl, note, cout, ST_MAGIC_4092, colen)
  var o: i64 = 0
  if rc != 0 {
      o = st_cat(out, o, "CHECKIN-REFUSED rc=" as *u8)
      o = st_catn(out, o, rc)
      o = st_cat(out, o, " claim=" as *u8)
      o = st_cat_esc(out, o, cout, 0, colen[0], 300)
      out[o] = ST_NL as u8
      o = o + 1
      sys_write(1, out, o)
      return rc
  }
  st_frame(wj, sys_now_realtime_sec(), "KICKOFF" as *u8, ws, actor, note)
  o = st_cat(out, o, "CHECKIN ws=" as *u8)
  o = st_cat(out, o, ws)
  o = st_cat(out, o, " claim=HELD kickoff=1 note=" as *u8)
  o = st_cat_esc(out, o, note, 0, st_vlen(note), 160)
  out[o] = ST_NL as u8
  o = o + 1
  sys_write(1, out, o)
  return 0
895}
896// ---------- seq543/seq552 checkout honesty ----------
897// ROOT CAUSE: the de-facto seat protocol is `checkout <ws> <actor> done <note>` while the v2
898// grammar was `checkout <ws> <actor> <note> [claims.jrnl]` -- the RESULT NOTE was consumed as
899// the CLAIMS JOURNAL PATH, so release forked at a phantom journal -> ABSENT -> NOT-HOLDER(3)
900// while the real claim in knowledge/status/claims.jrnl stayed HELD. A journal arg must LOOK
901// like a journal (contains '/' or ends ".jrnl"); interpretation is data-shape-driven.
902func st_jpathish(s: *u8) -> i64 {
  var i: i64 = 0
  var slash: i64 = 0
  while s[i] != (0 as u8) { if s[i] == (47 as u8) { slash = 1 } i = i + 1 }
  if slash == 1 { return 1 }
  if i < 5 { return 0 }
  if s[i-5] != (46 as u8) { return 0 }
  if s[i-4] != (106 as u8) { return 0 }
  if s[i-3] != (114 as u8) { return 0 }
  if s[i-2] != (110 as u8) { return 0 }
  if s[i-1] != (108 as u8) { return 0 }
  return 1
914}
915// checkout arg interpretation (T16): a5 jpathish -> classic `<note> [claims]` form (oi=5, note
916// untouched); else a4 was a status token -> note = "a4 a5" merged, journals shift (oi=6)
917func st_co_argshift(a4: *u8, a5: *u8, nout: *i64) -> i64 {
  nout[0] = a4 as i64
  if st_jpathish(a5) == 1 { return 5 }
  let mb: *u8 = sys_mmap(ST_MAGIC_4096)
  var mo: i64 = st_cat(mb, 0, a4)
  mo = st_cat(mb, mo, " " as *u8)
  mo = st_cat(mb, mo, a5)
  mb[mo] = 0 as u8
  nout[0] = mb as i64
  return 6
927}
928// single-resource state probe through the sibling organ (holdership derivation stays THE one copy)
929func st_claims_state(cj: *u8, ws: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 {
  let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8
  let vb: *u8 = "state" as *u8
  let av: *i64 = sys_mmap(8 * 8) as *i64
  av[0] = elf as i64
  av[1] = vb as i64
  av[2] = cj as i64
  av[3] = ws as i64
  av[4] = 0
  return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS)
939}
940// CHECKOUT rewrite (rule-3, not a patch cascade). DONE frame ALWAYS lands first (kept).
941// (1) an unreadable claims journal cannot hold a claim -- forking release at it can only lie
942//     NOT-HOLDER while the real claim stays held; refuse LOUD rc=2, never fork (fail-safe).
943// (2) release rc=3 is CLASSIFIED via the sibling's state probe: FREE/ABSENT -> benign
944//     ALREADY-FREE (rc=0, honest note; covers ttl-lapse-then-reap); HELD/EXPIRED by ANOTHER
945//     actor -> FOREIGN-HELD stays rc=3 LOUD (nx_claims refuses foreign release; no force path
946//     exists here); probe unavailable/unparsable -> NOT-HOLDER-UNCLASSIFIED stays rc=3
947//     (never guess benign). Output prefix + fields are ADDITIVE (rule 19).
948func st_do_checkout(ws: *u8, actor: *u8, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 {
  st_frame(wj, sys_now_realtime_sec(), "DONE" as *u8, ws, actor, note)
  let jfd: i64 = sys_openat_rd(cj)
  if jfd < 0 {
      var ob: i64 = 0
      ob = st_cat(out, 0, "CHECKOUT ws=" as *u8)
      ob = st_cat(out, ob, ws)
      ob = st_cat(out, ob, " done=1 release-rc=2 release=BAD-CLAIMS-JOURNAL cj=" as *u8)
      ob = st_cat_esc(out, ob, cj, 0, st_vlen(cj), 200)
      out[ob] = ST_NL as u8
      ob = ob + 1
      sys_write(1, out, ob)
      return 2
  }
  sys_close(jfd)
  let cout: *u8 = sys_mmap(ST_MAGIC_4096)
  let colen: *i64 = sys_mmap(ST_SPAN) as *i64
  let rc: i64 = st_claims_run("release" as *u8, cj, ws, actor, 0 - 1, note, cout, ST_MAGIC_4092, colen)
  var frc: i64 = rc
  var cls: i64 = 0
  let sbuf: *u8 = sys_mmap(ST_MAGIC_4096)
  let slen: *i64 = sys_mmap(ST_SPAN) as *i64
  let hsp: *i64 = sys_mmap(ST_SPAN) as *i64
  if rc == 3 {
      cls = 3
      let src: i64 = st_claims_state(cj, ws, sbuf, ST_MAGIC_4092, slen)
      if src == 0 {
          let sn: i64 = slen[0]
          let sle: i64 = st_le(sbuf, 0, sn)
          let ssp2: *i64 = sys_mmap(ST_SPAN) as *i64
          if st_tagval(sbuf, 0, sle, " state=" as *u8, ssp2) == 1 {
              var isfree: i64 = 0
              if st_lit_eq(sbuf, ssp2[0], ssp2[1], "FREE" as *u8) == 1 { isfree = 1 }
              if st_lit_eq(sbuf, ssp2[0], ssp2[1], "ABSENT" as *u8) == 1 { isfree = 1 }
              if isfree == 1 { cls = 1; frc = 0 }
              if isfree == 0 { if st_tagval(sbuf, 0, sle, " holder=" as *u8, hsp) == 1 { cls = 2 } }
          }
      }
  }
  var o: i64 = 0
  o = st_cat(out, 0, "CHECKOUT ws=" as *u8)
  o = st_cat(out, o, ws)
  o = st_cat(out, o, " done=1 release-rc=" as *u8)
  o = st_catn(out, o, frc)
  if cls == 1 { o = st_cat(out, o, " release=ALREADY-FREE" as *u8) }
  if cls == 2 {
      o = st_cat(out, o, " release=FOREIGN-HELD holder=" as *u8)
      o = st_cat_esc(out, o, sbuf, hsp[0], hsp[1], 120)
  }
  if cls == 3 { o = st_cat(out, o, " release=NOT-HOLDER-UNCLASSIFIED" as *u8) }
  o = st_cat(out, o, " fork-rc=" as *u8)
  o = st_catn(out, o, rc)
  o = st_cat(out, o, " " as *u8)
  o = st_cat_esc(out, o, cout, 0, colen[0], 200)
  out[o] = ST_NL as u8
  o = o + 1
  sys_write(1, out, o)
  return frc
1006}
1007// ---------- F214 ORPHAN REAP (seat layer) ----------
1008// forks the sibling nx_claims organ's reap verb (its derived-EXPIRED judgment stays THE one
1009// copy -- this wrapper NEVER decides expiry itself), then appends one ORPHAN-REAPED audit
1010// frame per reaped ws to the ws journal via the SAME append discipline checkin uses.
1011func st_tagval(q: *u8, ls: i64, le: i64, tag: *u8, out: *i64) -> i64 {
  let tl: i64 = st_vlen(tag)
  var i: i64 = ls
  while i + tl <= le {
      var k: i64 = 0
      var ok: i64 = 1
      while k < tl { if q[i+k] != tag[k] { ok = 0; k = tl } else { k = k + 1 } }
      if ok == 1 {
          let vs: i64 = i + tl
          var ve: i64 = vs
          var s: i64 = 1
          while s == 1 { if ve >= le { s = 0 } else { if q[ve] == (32 as u8) { s = 0 } else { ve = ve + 1 } } }
          out[0] = vs
          out[1] = ve
          return 1
      }
      i = i + 1
  }
  return 0
1030}
1031func st_reap_run(cj: *u8, actor: *u8, note: *u8, cout: *u8, ccap: i64, colen: *i64) -> i64 {
  let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_claims.elf" as *u8
  let vb: *u8 = "reap" as *u8
  let av: *i64 = sys_mmap(8 * 8) as *i64
  av[0] = elf as i64
  av[1] = vb as i64
  av[2] = cj as i64
  av[3] = actor as i64
  av[4] = note as i64
  av[5] = 0
  return tr_run_capture_to(elf, av, cout, ccap, colen, ST_FORK_TIMEOUT_MS)
1042}
1043func st_do_reap(actor: *u8, note: *u8, cj: *u8, wj: *u8, out: *u8) -> i64 {
  let cout: *u8 = sys_mmap(ST_MAGIC_65536)
  let colen: *i64 = sys_mmap(ST_SPAN) as *i64
  let rc: i64 = st_reap_run(cj, actor, note, cout, ST_MAGIC_65536 - 4, colen)
  let cn: i64 = colen[0]
  let rv: *i64 = sys_mmap(ST_SPAN) as *i64
  let hv: *i64 = sys_mmap(ST_SPAN) as *i64
  let wsb: *u8 = sys_mmap(512)
  let nb: *u8 = sys_mmap(ST_MAGIC_1024)
  var frames: i64 = 0
  var i: i64 = 0
  while i < cn {
      let le: i64 = st_le(cout, i, cn)
      if st_tagval(cout, i, le, "REAPED resource=" as *u8, rv) == 1 {
          if st_tagval(cout, i, le, " holder=" as *u8, hv) == 1 {
              if rv[1] - rv[0] < 500 {
                  let rvs: i64 = rv[0]
                  let rve: i64 = rv[1]
                  var a: i64 = 0
                  while rvs + a < rve { wsb[a] = cout[rvs + a]; a = a + 1 }
                  wsb[a] = 0 as u8
                  var o: i64 = 0
                  o = st_cat(nb, 0, "orphan-reap holder=" as *u8)
                  let hvs: i64 = hv[0]
                  let hve: i64 = hv[1]
                  var b: i64 = 0
                  while hvs + b < hve { if b < 200 { nb[o] = cout[hvs + b]; o = o + 1 } b = b + 1 }
                  o = st_cat(nb, o, " why=ttl-expired " as *u8)
                  o = st_cat(nb, o, note)
                  nb[o] = 0 as u8
                  st_frame(wj, sys_now_realtime_sec(), "ORPHAN-REAPED" as *u8, wsb, actor, nb)
                  frames = frames + 1
              }
          }
      }
      i = le + 1
  }
  var o2: i64 = 0
  o2 = st_cat(out, 0, "REAP claims-rc=" as *u8)
  o2 = st_catn(out, o2, rc)
  o2 = st_cat(out, o2, " ws-frames=" as *u8)
  o2 = st_catn(out, o2, frames)
  o2 = st_cat(out, o2, " claims-said: " as *u8)
  o2 = st_cat_esc(out, o2, cout, 0, cn, 600)
  out[o2] = ST_NL as u8
  o2 = o2 + 1
  sys_write(1, out, o2)
  return rc
1091}
1092func st_selftest(base: *u8) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_seat selftest -- boot digest + meter evidence + SCALE cap (seat-system S0+S3)" as *u8)
  let now: i64 = sys_now_realtime_sec()
  // unique fixture paths (append-only world: never reuse a stale fixture)
  let jr: *u8 = sys_mmap(256)
  var o1: i64 = st_cat(jr, 0, base)
  o1 = st_catn(jr, o1, now)
  o1 = st_cat(jr, o1, ".jrnl" as *u8)
  jr[o1] = 0 as u8
  let ml: *u8 = sys_mmap(256)
  var o2: i64 = st_cat(ml, 0, base)
  o2 = st_catn(ml, o2, now)
  o2 = st_cat(ml, o2, ".log" as *u8)
  ml[o2] = 0 as u8
  let dp: *u8 = sys_mmap(256)
  var o3: i64 = st_cat(dp, 0, base)
  o3 = st_catn(dp, o3, now)
  o3 = st_cat(dp, o3, "debt-" as *u8)
  dp[o3] = 0 as u8
  let fp: *u8 = sys_mmap(256)
  var o4: i64 = st_cat(fp, 0, base)
  o4 = st_catn(fp, o4, now)
  o4 = st_cat(fp, o4, "front-" as *u8)
  fp[o4] = 0 as u8
  // T1 meter appends one row, rc 0
  let mrc: i64 = st_meter_append(ml, "st-seat" as *u8, 1, 11, 22, 33, "st-note" as *u8)
  var t1: i64 = 0
  if mrc == 0 { t1 = 1 }
  gv_check("T1 meter append rc0" as *u8, t1, ctr)
  // T2 the row is really in the log (read-back, not asserted)
  let mb: *u8 = sys_mmap(ST_MAGIC_8192)
  let msz: *i64 = sys_mmap(ST_SPAN) as *i64
  let mn: i64 = st_read(ml, mb, ST_MAGIC_8188, msz)
  gv_check("T2 meter row read-back" as *u8, st_contains(mb, mn, "st-seat" as *u8), ctr)
  // T3 boot derives INFLIGHT from a real KICKOFF frame, zero debts on absent plane
  st_frame(jr, now, "KICKOFF" as *u8, "stws" as *u8, "stactor" as *u8, "st-go" as *u8)
  let ob: *u8 = sys_mmap(ST_OUTBUF)
  var bl: i64 = st_boot("stws" as *u8, jr, dp, fp, ml, ob)
  var t3: i64 = 0
  if st_contains(ob, bl, "\"phase\":\"INFLIGHT\"" as *u8) == 1 { if st_contains(ob, bl, "\"open_debts\":0" as *u8) == 1 { t3 = 1 } }
  gv_check("T3 boot INFLIGHT + zero-debt honest" as *u8, t3, ctr)
  // T4 envelope DECLARED in output (scale-law: silent windowing forbidden)
  var t4: i64 = 0
  if st_contains(ob, bl, "budget_bytes" as *u8) == 1 { if st_contains(ob, bl, "journal_bytes" as *u8) == 1 { t4 = 1 } }
  gv_check("T4 envelope declared" as *u8, t4, ctr)
  // T5 SCALE tooth: 300 long frames -> output STILL <= budget (production-shape, not fixture)
  var f: i64 = 0
  while f < ST_ST_FRAMES {
      st_frame(jr, now + f, "BEAT" as *u8, "stws" as *u8, "stactor" as *u8, "scale-frame-note-padding-0123456789-abcdefghijklmnopqrstuvwxyz-0123456789-abcdefghijklmnopqrstuvwxyz" as *u8)
      f = f + 1
  }
  bl = st_boot("stws" as *u8, jr, dp, fp, ml, ob)
  var t5: i64 = 0
  if bl <= ST_OUTCAP { t5 = 1 }
  gv_check("T5 scale cap holds under 300 frames" as *u8, t5, ctr)
  // T6 DONE frame flips the derived phase (evidence-derived, no self-report)
  st_frame(jr, now + 900, "DONE" as *u8, "stws" as *u8, "stactor" as *u8, "st-done" as *u8)
  bl = st_boot("stws" as *u8, jr, dp, fp, ml, ob)
  gv_check("T6 boot derives DONE from the frame" as *u8, st_contains(ob, bl, "\"phase\":\"DONE\"" as *u8), ctr)
  // T7-T9 S1 protocol vs the REAL nx_claims organ (fork composition; temp journals)
  let cjp: *u8 = sys_mmap(256)
  var o5: i64 = st_cat(cjp, 0, base)
  o5 = st_catn(cjp, o5, now)
  o5 = st_cat(cjp, o5, "claims.jrnl" as *u8)
  cjp[o5] = 0 as u8
  let s1out: *u8 = sys_mmap(ST_MAGIC_4096)
  let ci: i64 = st_do_checkin("stws2" as *u8, "seatA" as *u8, ST_MAGIC_3600, "s1-go" as *u8, cjp, jr, s1out)
  var t7: i64 = 0
  let q2: *u8 = sys_mmap(ST_CAP)
  let q2sz: *i64 = sys_mmap(ST_SPAN) as *i64
  let q2n: i64 = st_read(jr, q2, ST_CAP - 4, q2sz)
  if ci == 0 { if st_has(q2, q2n, "KICKOFF" as *u8, "stws2" as *u8) == 1 { t7 = 1 } }
  gv_check("T7 checkin claims+kickoff one call" as *u8, t7, ctr)
  let ci2: i64 = st_do_checkin("stws2" as *u8, "seatB" as *u8, ST_MAGIC_3600, "s1-steal" as *u8, cjp, jr, s1out)
  var t8: i64 = 0
  if ci2 == 3 { t8 = 1 }
  gv_check("T8 contended checkin REFUSED fail-closed" as *u8, t8, ctr)
  let co: i64 = st_do_checkout("stws2" as *u8, "seatA" as *u8, "s1-done" as *u8, cjp, jr, s1out)
  var t9: i64 = 0
  let q3n: i64 = st_read(jr, q2, ST_CAP - 4, q2sz)
  if co == 0 { if st_has(q2, q3n, "DONE" as *u8, "stws2" as *u8) == 1 { t9 = 1 } }
  gv_check("T9 checkout done+release one call" as *u8, t9, ctr)
  // T10 ready = deps-resolved frontier DIGEST (F832). Fixture store: lane1 -> F900 (no dep) +
  // F903 (dep F904=D) READY; F901 (dep F902=T) BLOCKED. Proves the ~1KB projection the 33.7KB
  // nx_frontier_board would otherwise need a full CPM dump to answer.
  let fseed: *u8 = sys_mmap(ST_CAP)
  var fo: i64 = 0
  fo = st_cat(fseed, fo, "F900\ttest-ready-nodeps\t8\t1\towner\tT\t-\tm\tlane1\n" as *u8)
  fo = st_cat(fseed, fo, "F901\ttest-blocked\t7\t1\towner\tT\tF902\tm\tlane1\n" as *u8)
  fo = st_cat(fseed, fo, "F902\ttest-dep-open\t5\t1\towner\tT\t-\tm\tlane2\n" as *u8)
  fo = st_cat(fseed, fo, "F903\ttest-ready-depdone\t6\t1\towner\tT\tF904\tm\tlane1\n" as *u8)
  fo = st_cat(fseed, fo, "F904\ttest-dep-done\t5\t1\towner\tD\t-\tm\tlane2\n" as *u8)
  let fpr: *u8 = sys_mmap(256)
  var fpo: i64 = st_cat(fpr, 0, base)
  fpo = st_catn(fpr, fpo, now)
  fpo = st_cat(fpr, fpo, "rdyfront-" as *u8)
  fpr[fpo] = 0 as u8
  sts_seed(fpr, fseed, fo)
  let rout: *u8 = sys_mmap(ST_OUTBUF)
  let rn: i64 = st_ready("lane1" as *u8, 12, fpr, rout)
  var t10hits: i64 = 0
  if st_contains(rout, rn, "F900" as *u8) == 1 { t10hits = t10hits + 1 }
  if st_contains(rout, rn, "F903" as *u8) == 1 { t10hits = t10hits + 1 }
  if st_contains(rout, rn, "F901" as *u8) == 0 { t10hits = t10hits + 1 }
  if st_contains(rout, rn, "\"ready_total\":2" as *u8) == 1 { t10hits = t10hits + 1 }
  if st_contains(rout, rn, "\"blocked_total\":1" as *u8) == 1 { t10hits = t10hits + 1 }
  var t10: i64 = 0
  if t10hits == 5 { t10 = 1 }
  gv_check("T10 ready = deps-resolved frontier digest (F832)" as *u8, t10, ctr)
  // T10b RANKW1: w-DESC ordering. F905 (w=9) seeded AFTER F900 (w=8); with maxn=1 the banded
  // emit MUST pick F905 and exclude F900 -- store-order would do the opposite (discriminating).
  let f9seed: *u8 = sys_mmap(ST_MAGIC_1024)
  var f9o: i64 = 0
  f9o = st_cat(f9seed, f9o, "F900\ttest-ready-nodeps\t8\t1\towner\tT\t-\tm\tlane1\n" as *u8)
  f9o = st_cat(f9seed, f9o, "F905\ttest-ready-bigger-rock\t9\t1\towner\tT\t-\tm\tlane1\n" as *u8)
  let f9pr: *u8 = sys_mmap(256)
  var f9po: i64 = st_cat(f9pr, 0, base)
  f9po = st_catn(f9pr, f9po, now)
  f9po = st_cat(f9pr, f9po, "rdyw-" as *u8)
  f9pr[f9po] = 0 as u8
  sts_seed(f9pr, f9seed, f9o)
  let r1out: *u8 = sys_mmap(ST_OUTBUF)
  let r1n: i64 = st_ready("lane1" as *u8, 1, f9pr, r1out)
  var t10b: i64 = 0
  if st_contains(r1out, r1n, "F905" as *u8) == 1 { if st_contains(r1out, r1n, "F900" as *u8) == 0 { if st_contains(r1out, r1n, "\"w\":9" as *u8) == 1 { t10b = 1 } } }
  gv_check("T10b ready orders biggest-w first (RANKW1)" as *u8, t10b, ctr)
  // T11 shift scoreboard (F831): seeded seat classes + closures -> EXACT derived numbers
  let sml: *u8 = sys_mmap(256)
  var o6: i64 = st_cat(sml, 0, base)
  o6 = st_catn(sml, o6, now)
  o6 = st_cat(sml, o6, "shift.log" as *u8)
  sml[o6] = 0 as u8
  st_meter_append(sml, "claude-fable" as *u8, 2, 600, ST_MAGIC_9000, 70, "cl-a" as *u8)
  st_meter_append(sml, "claude-fable" as *u8, 1, 400, 1000, 30, "cl-b" as *u8)
  st_meter_append(sml, "maker-local-s2" as *u8, 1, 0, 0, 0, "loc-a" as *u8)
  st_meter_append(sml, "maker-local-s2" as *u8, 1, 0, 0, 0, "loc-b" as *u8)
  let sjr: *u8 = sys_mmap(256)
  var o7: i64 = st_cat(sjr, 0, base)
  o7 = st_catn(sjr, o7, now)
  o7 = st_cat(sjr, o7, "shift.jrnl" as *u8)
  sjr[o7] = 0 as u8
  st_frame(sjr, now - ST_MAGIC_90000, "DONE" as *u8, "oldws" as *u8, "a" as *u8, "beyond-window" as *u8)
  st_frame(sjr, now - 100, "DONE" as *u8, "ws1" as *u8, "a" as *u8, "in-window" as *u8)
  st_frame(sjr, now - 50, "DONE" as *u8, "ws2" as *u8, "a" as *u8, "in-window" as *u8)
  st_frame(sjr, now - 10, "KICKOFF" as *u8, "ws3" as *u8, "a" as *u8, "not-a-closure" as *u8)
  let sob: *u8 = sys_mmap(ST_OUTBUF)
  let sn: i64 = st_shift(1, sml, sjr, sob)
  var t11h: i64 = 0
  if st_contains(sob, sn, "\"claude\":{\"rows\":2,\"sessions\":3,\"out\":1000,\"cread\":10000,\"ccreate\":100}" as *u8) == 1 { t11h = t11h + 1 }
  if st_contains(sob, sn, "\"local\":{\"rows\":2,\"sessions\":2,\"out\":0}" as *u8) == 1 { t11h = t11h + 1 }
  if st_contains(sob, sn, "\"done_ws\":2" as *u8) == 1 { t11h = t11h + 1 }
  if st_contains(sob, sn, "\"claude_out_per_done\":500" as *u8) == 1 { t11h = t11h + 1 }
  if st_contains(sob, sn, "\"claude_cread_per_done\":5000" as *u8) == 1 { t11h = t11h + 1 }
  var t11: i64 = 0
  if t11h == 5 { t11 = 1 }
  gv_check("T11 shift scoreboard exact aggregates + window filter" as *u8, t11, ctr)
  // T12 shift honest on EMPTY evidence: div0 guarded (-1 sentinels), cap holds, no crash
  let eml: *u8 = sys_mmap(256)
  var o8: i64 = st_cat(eml, 0, base)
  o8 = st_catn(eml, o8, now)
  o8 = st_cat(eml, o8, "empty.log" as *u8)
  eml[o8] = 0 as u8
  let en: i64 = st_shift(7, eml, eml, sob)
  var t12: i64 = 0
  if en <= ST_OUTCAP { if st_contains(sob, en, "\"done_ws\":0" as *u8) == 1 { if st_contains(sob, en, "\"claude_out_per_done\":-1" as *u8) == 1 { t12 = 1 } } }
  gv_check("T12 shift empty-evidence honest + cap" as *u8, t12, ctr)
  // T13 F214 reap wrapper: a synthesized EXPIRED claim (old ts, tiny ttl) is reaped through the
  // REAL nx_claims fork; ORPHAN-REAPED audit frame lands in the ws journal; live claim untouched.
  let rcj: *u8 = sys_mmap(256)
  var o9: i64 = st_cat(rcj, 0, base)
  o9 = st_catn(rcj, o9, now)
  o9 = st_cat(rcj, o9, "reapclaims.jrnl" as *u8)
  rcj[o9] = 0 as u8
  let rwj: *u8 = sys_mmap(256)
  var o10: i64 = st_cat(rwj, 0, base)
  o10 = st_catn(rwj, o10, now)
  o10 = st_cat(rwj, o10, "reapws.jrnl" as *u8)
  rwj[o10] = 0 as u8
  st_cframe(rcj, now - ST_MAGIC_86400, "CLAIM" as *u8, "orphanws" as *u8, "deadsess" as *u8, 60, "crashed-session" as *u8)
  st_cframe(rcj, now, "CLAIM" as *u8, "livews" as *u8, "livesess" as *u8, ST_MAGIC_3600, "alive" as *u8)
  let r13o: *u8 = sys_mmap(ST_OUTBUF)
  let rrc: i64 = st_do_reap("st-reaper" as *u8, "t13-sweep" as *u8, rcj, rwj, r13o)
  let wq: *u8 = sys_mmap(ST_CAP)
  let wqsz: *i64 = sys_mmap(ST_SPAN) as *i64
  let wqn: i64 = st_read(rwj, wq, ST_CAP - 4, wqsz)
  let cb: *u8 = sys_mmap(ST_CAP)
  let cbsz: *i64 = sys_mmap(ST_SPAN) as *i64
  let cbn: i64 = st_read(rcj, cb, ST_CAP - 4, cbsz)
  var t13: i64 = 0
  if rrc == 0 { if st_has(wq, wqn, "ORPHAN-REAPED" as *u8, "orphanws" as *u8) == 1 { if st_has(wq, wqn, "ORPHAN-REAPED" as *u8, "livews" as *u8) == 0 { if st_contains(cb, cbn, "ORPHAN-REAPED by=st-reaper" as *u8) == 1 { t13 = 1 } } } }
  gv_check("T13 reap wrapper reaps expired + audits ws journal (F214)" as *u8, t13, ctr)
  // T14 the unblocked-sibling tooth: checkin on the reaped ws by a NEW actor now SUCCEEDS,
  // while the live unexpired ws stays CONTENDED fail-closed (never stolen).
  let ci3: i64 = st_do_checkin("orphanws" as *u8, "seatC" as *u8, ST_MAGIC_3600, "post-reap" as *u8, rcj, rwj, s1out)
  let ci4: i64 = st_do_checkin("livews" as *u8, "seatD" as *u8, ST_MAGIC_3600, "steal-live" as *u8, rcj, rwj, s1out)
  var t14: i64 = 0
  if ci3 == 0 { if ci4 == 3 { t14 = 1 } }
  gv_check("T14 checkin succeeds on reaped ws refused on live ws" as *u8, t14, ctr)
  // T15 idempotent: re-run reap -> zero ws frames, claims journal byte-identical
  let csz1: *i64 = sys_mmap(ST_SPAN) as *i64
  st_read(rcj, wq, ST_CAP - 4, csz1)
  let r15o: *u8 = sys_mmap(ST_OUTBUF)
  let rrc2: i64 = st_do_reap("st-reaper" as *u8, "t15-rerun" as *u8, rcj, rwj, r15o)
  let csz2: *i64 = sys_mmap(ST_SPAN) as *i64
  st_read(rcj, wq, ST_CAP - 4, csz2)
  let rl15: i64 = st_vlen(r15o)
  var t15: i64 = 0
  if rrc2 == 0 { if csz1[0] == csz2[0] { if st_contains(r15o, rl15, "ws-frames=0" as *u8) == 1 { t15 = 1 } } }
  gv_check("T15 reap idempotent nothing expired nothing written" as *u8, t15, ctr)
  // T16-T20 seq543/seq552 checkout-honesty teeth ------------------------------------------
  // T16 arg interpretation: status-form (`done <note>`) shifts oi=6 + merges the note; an
  // explicit jpathish journal arg keeps the classic form (oi=5, note untouched)
  let nsl: *i64 = sys_mmap(ST_SPAN) as *i64
  let oiA: i64 = st_co_argshift("done" as *u8, "seq552-result-note" as *u8, nsl)
  let mnA: *u8 = nsl[0] as *u8
  var t16: i64 = 0
  if oiA == 6 { if st_lit_eq(mnA, 0, st_vlen(mnA), "done seq552-result-note" as *u8) == 1 {
      let oiB: i64 = st_co_argshift("real-note" as *u8, "scratch/claims.jrnl" as *u8, nsl)
      let mnB: *u8 = nsl[0] as *u8
      if oiB == 5 { if st_lit_eq(mnB, 0, st_vlen(mnB), "real-note" as *u8) == 1 { t16 = 1 } }
  } }
  gv_check("T16 checkout arg-shift status-form merges note jpath form classic (seq552)" as *u8, t16, ctr)
  // T17 BAD-CLAIMS-JOURNAL fail-safe: phantom journal (the old bug shape: a note used as the
  // path) -> rc=2 LOUD, release NEVER forked, the REAL claims journal is byte-identical
  let hcj: *u8 = sys_mmap(256)
  var o11: i64 = st_cat(hcj, 0, base)
  o11 = st_catn(hcj, o11, now)
  o11 = st_cat(hcj, o11, "honesty.jrnl" as *u8)
  hcj[o11] = 0 as u8
  st_cframe(hcj, now, "CLAIM" as *u8, "heldws" as *u8, "seatE" as *u8, ST_MAGIC_3600, "live" as *u8)
  let hsz1: *i64 = sys_mmap(ST_SPAN) as *i64
  st_read(hcj, wq, ST_CAP - 4, hsz1)
  let hout: *u8 = sys_mmap(ST_OUTBUF)
  let hrc: i64 = st_do_checkout("heldws" as *u8, "seatE" as *u8, "note-shape" as *u8, "seq552-phantom-journal-note" as *u8, rwj, hout)
  let hsz2: *i64 = sys_mmap(ST_SPAN) as *i64
  st_read(hcj, wq, ST_CAP - 4, hsz2)
  var t17: i64 = 0
  if hrc == 2 { if st_contains(hout, st_vlen(hout), "release=BAD-CLAIMS-JOURNAL" as *u8) == 1 { if hsz1[0] == hsz2[0] { t17 = 1 } } }
  gv_check("T17 phantom claims journal refused LOUD rc=2 claim untouched (seq543)" as *u8, t17, ctr)
  // T18 ALREADY-FREE benign: a released ws AND a never-claimed ws both checkout rc=0 with the
  // honest note (covers ttl-lapse-then-reap: reap emits RELEASE frames -> state FREE)
  st_cframe(hcj, now, "RELEASE" as *u8, "heldws" as *u8, "seatE" as *u8, 0, "freed" as *u8)
  let f1out: *u8 = sys_mmap(ST_OUTBUF)
  let farc: i64 = st_do_checkout("heldws" as *u8, "seatE" as *u8, "post-free" as *u8, hcj, rwj, f1out)
  let f2out: *u8 = sys_mmap(ST_OUTBUF)
  let fbrc: i64 = st_do_checkout("neverws" as *u8, "seatE" as *u8, "absent" as *u8, hcj, rwj, f2out)
  var t18: i64 = 0
  if farc == 0 { if fbrc == 0 { if st_contains(f1out, st_vlen(f1out), "release=ALREADY-FREE" as *u8) == 1 { if st_contains(f2out, st_vlen(f2out), "release=ALREADY-FREE" as *u8) == 1 { t18 = 1 } } } }
  gv_check("T18 already-free checkout benign rc=0 honest note (freed + absent)" as *u8, t18, ctr)
  // T19 FOREIGN-HELD stays LOUD rc=3 and the foreign live claim is NEVER released
  st_cframe(hcj, now, "CLAIM" as *u8, "foreignws" as *u8, "seatG" as *u8, ST_MAGIC_3600, "theirs" as *u8)
  let g1out: *u8 = sys_mmap(ST_OUTBUF)
  let grc: i64 = st_do_checkout("foreignws" as *u8, "seatH" as *u8, "try-steal" as *u8, hcj, rwj, g1out)
  let gq: *u8 = sys_mmap(ST_CAP)
  let gqsz: *i64 = sys_mmap(ST_SPAN) as *i64
  let gqn: i64 = st_read(hcj, gq, ST_CAP - 4, gqsz)
  var t19: i64 = 0
  if grc == 3 { if st_contains(g1out, st_vlen(g1out), "release=FOREIGN-HELD holder=seatG" as *u8) == 1 { if st_has(gq, gqn, "RELEASE" as *u8, "foreignws" as *u8) == 0 { t19 = 1 } } }
  gv_check("T19 live-foreign claim refused LOUD rc=3 never released" as *u8, t19, ctr)
  // T20 the EXACT failing protocol shape e2e: real-fork checkin then status-form checkout
  // (`done <note>` through st_co_argshift) releases CLEAN rc=0 (seq543/seq552 regression)
  let p1out: *u8 = sys_mmap(ST_MAGIC_4096)
  let pci: i64 = st_do_checkin("protows" as *u8, "seatI" as *u8, ST_MAGIC_3600, "proto-go" as *u8, hcj, rwj, p1out)
  let psl: *i64 = sys_mmap(ST_SPAN) as *i64
  let poi: i64 = st_co_argshift("done" as *u8, "proto-shipped" as *u8, psl)
  let pnote: *u8 = psl[0] as *u8
  let p2out: *u8 = sys_mmap(ST_OUTBUF)
  let pco: i64 = st_do_checkout("protows" as *u8, "seatI" as *u8, pnote, hcj, rwj, p2out)
  var t20: i64 = 0
  if pci == 0 { if poi == 6 { if pco == 0 { if st_contains(p2out, st_vlen(p2out), "RELEASED" as *u8) == 1 { t20 = 1 } } } }
  gv_check("T20 de-facto protocol done+note checkout releases clean e2e (seq552)" as *u8, t20, ctr)
  // T21 ctx-tax flush loop: brief lands a CHECKPOINT + boot surfaces it as last_brief
  let b21o: *u8 = sys_mmap(ST_OUTBUF)
  let b21rc: i64 = st_do_brief("stws" as *u8, "stactor" as *u8, "flush-state-alpha" as *u8, jr, b21o)
  let b21b: *u8 = sys_mmap(ST_OUTBUF)
  let b21n: i64 = st_boot("stws" as *u8, jr, dp, fp, ml, b21b)
  var t21: i64 = 0
  if b21rc == 0 { if st_contains(b21b, b21n, "\"last_brief\":\"flush-state-alpha\"" as *u8) == 1 { t21 = 1 } }
  gv_check("T21 brief CHECKPOINT + boot last_brief surfacing (ctx-tax flush loop)" as *u8, t21, ctr)
  // T22 SHIFT-VERBS field ALWAYS present in boot (discovery-is-the-bottleneck,
  // self_sufficiency_map 07-29): conf absent => empty list + src pointer --
  // a session must never have to rediscover the sovereign path for a work
  // class. Environment-agnostic: checks the FIELD, not the row count.
  var t22: i64 = 0
  if st_contains(b21b, b21n, "\"shift_verbs\":[" as *u8) == 1 { if st_contains(b21b, b21n, "\"shift_src\":\"knowledge/shift_verbs.conf" as *u8) == 1 { t22 = 1 } }
  gv_check("T22 boot carries shift_verbs + shift_src (present even when conf absent)" as *u8, t22, ctr)
  let rc: i64 = gv_verdict("SEAT-GATE" as *u8, ctr, "S0 boot + S3 meter + S1 protocol + F832 ready-digest + F831 shift scoreboard + F214 orphan-reap + seq543/seq552 checkout honesty + ctx-tax brief flush + shift-verbs discovery line proven at production shape" as *u8)
  return rc
1381}
1382func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 {
      st_werr("usage: nx_seat {boot <ws> [jrnl] [debt-] [frontier-] [meterlog] | ready [lane|*] [max] [frontier-] | checkin <ws> <actor> <ttl_sec> <note> [claims.jrnl] [ws.jrnl] | checkout <ws> <actor> [status] <note> [claims.jrnl] [ws.jrnl] | brief <ws> <actor> <note> [ws.jrnl] | meter <seat> <sessions> <out> <cread> <ccreate> <note> [logpath] | meterlog [n] [logpath] | shift [days] [meterlog] [ws.jrnl] | reap [actor] [note] [claims.jrnl] [ws.jrnl] | selftest [tmpbase]}\n" as *u8)
      sys_exit(ST_EXIT_USAGE)
      return ST_EXIT_USAGE
  }
  let verb: *u8 = argv[1] as *u8
  if st_lit_eq(verb, 0, st_vlen(verb), "boot" as *u8) == 1 {
      if argc < 3 { st_werr("SEAT-FAIL boot needs <ws>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE }
      var jr: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      var dp: *u8 = "knowledge/store/debt-" as *u8
      var fp: *u8 = "knowledge/store/frontier-" as *u8
      var ml: *u8 = "knowledge/status/token_efficiency.log" as *u8
      if argc > 3 { jr = argv[3] as *u8 }
      if argc > 4 { dp = argv[4] as *u8 }
      if argc > 5 { fp = argv[5] as *u8 }
      if argc > 6 { ml = argv[6] as *u8 }
      let out: *u8 = sys_mmap(ST_OUTBUF)
      let n: i64 = st_boot(argv[2] as *u8, jr, dp, fp, ml, out)
      sys_write(1, out, n)
      sys_exit(0)
      return 0
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "ready" as *u8) == 1 {
      var lane: *u8 = "*" as *u8
      var maxn: i64 = 12
      var frp: *u8 = "knowledge/store/frontier-" as *u8
      if argc > 2 { lane = argv[2] as *u8 }
      if argc > 3 { maxn = st_atoi_z(argv[3] as *u8) }
      if argc > 4 { frp = argv[4] as *u8 }
      if maxn < 1 { maxn = 1 }
      if maxn > 24 { maxn = 24 }
      let out: *u8 = sys_mmap(ST_OUTBUF)
      let n: i64 = st_ready(lane, maxn, frp, out)
      sys_write(1, out, n)
      sys_exit(0)
      return 0
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "checkin" as *u8) == 1 {
      if argc < 6 { st_werr("SEAT-FAIL checkin needs <ws> <actor> <ttl_sec> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE }
      var cj: *u8 = "knowledge/status/claims.jrnl" as *u8
      var wj: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      if argc > 6 { cj = argv[6] as *u8 }
      if argc > 7 { wj = argv[7] as *u8 }
      let out: *u8 = sys_mmap(ST_OUTBUF)
      let rc: i64 = st_do_checkin(argv[2] as *u8, argv[3] as *u8, st_atoi_z(argv[4] as *u8), argv[5] as *u8, cj, wj, out)
      sys_exit(rc)
      return rc
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "checkout" as *u8) == 1 {
      if argc < 5 { st_werr("SEAT-FAIL checkout needs <ws> <actor> [status] <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE }
      var cj2: *u8 = "knowledge/status/claims.jrnl" as *u8
      var wj2: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      // seq543/seq552: de-facto protocol `checkout <ws> <actor> done <note>` -- the old grammar
      // consumed that NOTE as the claims journal; st_co_argshift interprets by data shape
      var note2: *u8 = argv[4] as *u8
      var oi: i64 = 5
      if argc > 5 {
          let nsl2: *i64 = sys_mmap(ST_SPAN) as *i64
          oi = st_co_argshift(argv[4] as *u8, argv[5] as *u8, nsl2)
          note2 = nsl2[0] as *u8
      }
      if argc > oi { cj2 = argv[oi] as *u8 }
      let oi1: i64 = oi + 1
      if argc > oi1 { wj2 = argv[oi1] as *u8 }
      let out2: *u8 = sys_mmap(ST_OUTBUF)
      let rc2: i64 = st_do_checkout(argv[2] as *u8, argv[3] as *u8, note2, cj2, wj2, out2)
      sys_exit(rc2)
      return rc2
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "reap" as *u8) == 1 {
      var ra: *u8 = "nx-seat-reaper" as *u8
      var rno: *u8 = "ttl-expired-orphan-sweep" as *u8
      var rcj2: *u8 = "knowledge/status/claims.jrnl" as *u8
      var rwj2: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      if argc > 2 { ra = argv[2] as *u8 }
      if argc > 3 { rno = argv[3] as *u8 }
      if argc > 4 { rcj2 = argv[4] as *u8 }
      if argc > 5 { rwj2 = argv[5] as *u8 }
      let rout2: *u8 = sys_mmap(ST_OUTBUF)
      let rrc3: i64 = st_do_reap(ra, rno, rcj2, rwj2, rout2)
      sys_exit(rrc3)
      return rrc3
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "brief" as *u8) == 1 {
      if argc < 5 { st_werr("SEAT-FAIL brief needs <ws> <actor> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE }
      var bwj: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      if argc > 5 { bwj = argv[5] as *u8 }
      let bout: *u8 = sys_mmap(ST_OUTBUF)
      let brc: i64 = st_do_brief(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, bwj, bout)
      sys_exit(brc)
      return brc
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "meter" as *u8) == 1 {
      if argc < 8 { st_werr("SEAT-FAIL meter needs <seat> <sessions> <out> <cread> <ccreate> <note>\n" as *u8); sys_exit(ST_EXIT_USAGE); return ST_EXIT_USAGE }
      var lp: *u8 = "knowledge/status/token_efficiency.log" as *u8
      if argc > 8 { lp = argv[8] as *u8 }
      let rc: i64 = st_meter_append(lp, argv[2] as *u8, st_atoi_z(argv[3] as *u8), st_atoi_z(argv[4] as *u8), st_atoi_z(argv[5] as *u8), st_atoi_z(argv[6] as *u8), argv[7] as *u8)
      if rc != 0 { st_werr("SEAT-FAIL meter append (log path unwritable?)\n" as *u8); sys_exit(1); return 1 }
      st_puts("METERED row appended\n" as *u8)
      sys_exit(0)
      return 0
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "meterlog" as *u8) == 1 {
      var nl: i64 = 5
      var lp2: *u8 = "knowledge/status/token_efficiency.log" as *u8
      if argc > 2 { nl = st_atoi_z(argv[2] as *u8) }
      if argc > 3 { lp2 = argv[3] as *u8 }
      if nl < 1 { nl = 1 }
      if nl > 50 { nl = 50 }
      let b: *u8 = sys_mmap(ST_CAP)
      let sz: *i64 = sys_mmap(ST_SPAN) as *i64
      let n: i64 = st_read(lp2, b, ST_MAGIC_65536, sz)
      st_puts("METERLOG file_bytes=" as *u8)
      let hb: *u8 = sys_mmap(64)
      var ho: i64 = st_catn(hb, 0, sz[0])
      hb[ho] = ST_NL as u8
      sys_write(1, hb, ho + 1)
      // count lines, then print the last nl of them
      var lines: i64 = 0
      var i: i64 = 0
      while i < n { let le: i64 = st_le(b, i, n); if le > i { lines = lines + 1 } i = le + 1 }
      var skip: i64 = lines - nl
      if skip < 0 { skip = 0 }
      var li: i64 = 0
      i = 0
      while i < n {
          let le2: i64 = st_le(b, i, n)
          if le2 > i {
              if li >= skip { sys_write(1, ((b as i64) + i) as *u8, le2 - i); sys_write(1, "\n" as *u8, 1) }
              li = li + 1
          }
          i = le2 + 1
      }
      sys_exit(0)
      return 0
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "shift" as *u8) == 1 {
      var sdays: i64 = 7
      var smlp: *u8 = "knowledge/status/token_efficiency.log" as *u8
      var sjrp: *u8 = "knowledge/status/ws_sync.jrnl" as *u8
      if argc > 2 { sdays = st_atoi_z(argv[2] as *u8) }
      if argc > 3 { smlp = argv[3] as *u8 }
      if argc > 4 { sjrp = argv[4] as *u8 }
      if sdays < 0 { sdays = 0 }
      if sdays > 365 { sdays = 365 }
      let sout: *u8 = sys_mmap(ST_OUTBUF)
      let sn2: i64 = st_shift(sdays, smlp, sjrp, sout)
      sys_write(1, sout, sn2)
      sys_exit(0)
      return 0
  }
  if st_lit_eq(verb, 0, st_vlen(verb), "selftest" as *u8) == 1 {
      var base: *u8 = "/tmp/nxseat_st" as *u8
      if argc > 2 { base = argv[2] as *u8 }
      let rc: i64 = st_selftest(base)
      sys_exit(rc)
      return rc
  }
  st_werr("SEAT-FAIL unknown verb\n" as *u8)
  sys_exit(ST_EXIT_USAGE)
  return ST_EXIT_USAGE
1544}
nx_seat.nx source

`nx_seat.nx` source
