code wiki / (root) / nx_seg_store_gate.nx
`nx_seg_store_gate.nx` source

↩ module page · 226 lines · 15327 B
1﻿// nx_seg_store_gate.nx -- gates the sovereign append-only store: put a value, get it back byte-exact, absent key -> not
2// found. Turns the seg_store axis from LIVE-proven to GATE-proven. license_tier: ORIGINAL
3import "nx_seg_store.nx"
4import "nx_gate.nx"
5import "nx_gate_verdict.nx"
6const K_MAGIC_140712850411539: i64 = 140712850411539   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
7const K_MAGIC_1785516000000000: i64 = 1785516000000000   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
8const K_MAGIC_135251248111617: i64 = 135251248111617   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
9const K_MAGIC_139871015653377: i64 = 139871015653377   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
10const K_MAGIC_139925199040513: i64 = 139925199040513   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
11const K_MAGIC_140190138056705: i64 = 140190138056705   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
12const K_MAGIC_140712850411538: i64 = 140712850411538   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
13const K_MAGIC_1785516000: i64 = 1785516000   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
14const K_MAGIC_1785516000000: i64 = 1785516000000   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
15const K_MAGIC_1785516000000001: i64 = 1785516000000001   // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row.
16
17const G_BYTE_MAX: i64 = 255   // T15: the byte planted into a length field so the record runs past its buffer
18const G_KIND_BYTES: i64 = 1   // record layout: u8 kind | u32be klen | key | u32be vlen | value
19const G_U32_BYTES: i64 = 4
20func main() -> i64 {
  gw("=== nx_seg_store_gate: append-only store put/get round-trip ===\n" as *u8)
  var pass: i64=0; var tot: i64=0
  let P: *u8 = "knowledge/ssgate-test" as *u8
24
  // canonical writer idiom: fresh max+1 segid (uncapped); the old count-as-segid clobbers past the cap
  let segid: i64 = ss_next_segid(P)
  let w: *i64 = ss_begin()
  ss_add(w, 1, "k1" as *u8, "hello-seg-store" as *u8, 15)
  let cr: i64 = ss_commit(P, w, segid)
  tot=tot+1; if cr >= 0 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T1 commit (segid=" as *u8); gn(cr); gw(")\n" as *u8)
32
  let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64
  let r: i64 = ss_get(P, "k1" as *u8, pq, lq)
  tot=tot+1; if r==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T2 get k1 -> found\n" as *u8)
37
  let val: *u8 = pq[0] as *u8; let vl: i64 = lq[0]; let exp: *u8 = "hello-seg-store" as *u8
  var m: i64=0; if vl==15 { m=1; var c: i64=0; while c<15 { if val[c]!=exp[c] { m=0 } c=c+1 } }
  tot=tot+1; if m==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T3 value byte-exact (hello-seg-store)\n" as *u8)
42
  let r2: i64 = ss_get(P, "nope" as *u8, pq, lq)
  tot=tot+1; if r2 < 1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T4 absent key -> not found\n" as *u8)
46
  // T5 MMAP-SERVE EQUIVALENCE: ss_open2(P,1) file-backed maps must return the SAME bytes as ss_open (read).
  let hr: *i64 = ss_open(P)                 // read-all mode
  let hm: *i64 = ss_open2(P, 1)             // file-backed mmap mode
  let pr: *i64 = sys_mmap(16) as *i64; let lr: *i64 = sys_mmap(16) as *i64
  let pm: *i64 = sys_mmap(16) as *i64; let lm2: *i64 = sys_mmap(16) as *i64
  let gr: i64 = ss_hget(hr, "k1" as *u8, pr, lr)
  let gm: i64 = ss_hget(hm, "k1" as *u8, pm, lm2)
  var eqm: i64 = 0
  if gr == 1 { if gm == 1 { if lr[0] == lm2[0] {
      eqm = 1
      let ar: *u8 = pr[0] as *u8; let am: *u8 = pm[0] as *u8
      var c5: i64 = 0
      while c5 < lr[0] { if ar[c5] != am[c5] { eqm = 0; c5 = lr[0] } else { c5 = c5 + 1 } }
  } } }
  tot=tot+1; if eqm==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T5 mmap-open byte-identical to read-open (ss_open2 usemmap=1)\n" as *u8)
63
  // ---- T6-T9 IMPACT-ORDERED POSTINGS (.imp sidecar, the WAND rung 2026-07-25) ----
  // Own prefix: every segment under it is born with .imp (the legacy ssgate-test prefix carries
  // pre-WAND segments, which would trip the all-or-nothing -3 by design).
  let P2: *u8 = "knowledge/ssgimp-" as *u8
  let segid2: i64 = ss_next_segid(P2)
  let w2: *i64 = ss_begin()
  ss_add(w2, 1, "ka" as *u8, "zebraq" as *u8, 6)
  ss_add(w2, 1, "kb" as *u8, "zebraq zebraq zebraq zebraq zebraq" as *u8, 34)
  ss_add(w2, 1, "kc" as *u8, "zebraq zebraq zebraq" as *u8, 20)
  ss_commit(P2, w2, segid2)
  let h6: *i64 = ss_open(P2)
  let kp6: *i64 = sys_mmap(8 * 8) as *i64
  let kl6: *i64 = sys_mmap(8 * 8) as *i64
  let tf6: *i64 = sys_mmap(8 * 8) as *i64
  let sat6: *i64 = sys_mmap(16) as *i64
  // T6: max=2 keeps the HIGHEST-tf docs (kb tf=5, kc tf=3) -- the legacy ascending cap would keep
  // ka (doc 0) and kb. This is the discriminating candidacy tooth for seq606.
  let n6: i64 = ss_term_top(P2, h6, "zebraq" as *u8, kp6, kl6, tf6, 2, sat6)
  let sat_t6: i64 = sat6[0]
  var ok6: i64 = 0
  if n6 == 2 { if kl6[0] == 2 { if kl6[1] == 2 {
      let ka6: *u8 = kp6[0] as *u8
      let kb6: *u8 = kp6[1] as *u8
      if ka6[0] == (107 as u8) { if ka6[1] == (98 as u8) { if kb6[0] == (107 as u8) { if kb6[1] == (99 as u8) { ok6 = 1 } } } }
  } } }
  tot=tot+1; if ok6==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T6 impact candidacy: cap=2 keeps kb(tf5),kc(tf3) not ascending ka,kb\n" as *u8)
  // T7: returned tf values are the true occurrence counts
  var ok7: i64 = 0
  if n6 == 2 { if tf6[0] == 5 { if tf6[1] == 3 { ok7 = 1 } } }
  tot=tot+1; if ok7==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T7 impact tf values true (5,3)\n" as *u8)
  // T8: fallback contract -- hide this run's .imp: ss_term_top must return -3 (all-or-nothing) and
  // legacy ss_term must still answer; then the sidecar is RESTORED (and that restore must succeed,
  // or every later run would inherit a -3 shard).
  let hidef: *u8 = sys_mmap(512)
  let realf: *u8 = sys_mmap(512)
  ss_auxname(P2, segid2, ".imp" as *u8, 0, realf)
  ss_auxname(P2, segid2, ".hid" as *u8, 0, hidef)
  sys_renameat(realf, hidef)
  let n8: i64 = ss_term_top(P2, h6, "zebraq" as *u8, kp6, kl6, tf6, 2, sat6)
  let n8b: i64 = ss_term(h6, "zebraq" as *u8, kp6, kl6, 2)
  let rr8: i64 = sys_renameat(hidef, realf)
  var ok8: i64 = 0
  if n8 == (0 - 3) { if n8b == 2 { if rr8 == 0 { ok8 = 1 } } }
  tot=tot+1; if ok8==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T8 absent .imp -> -3 fallback, legacy path answers, sidecar restored\n" as *u8)
  // T9: currency -- a NEW version of kb without the term must vanish from impact results (the
  // live-doc map filters the stale high-tf posting exactly like ss_term does).
  let segid3: i64 = ss_next_segid(P2)
  let w3: *i64 = ss_begin()
  ss_add(w3, 1, "kb" as *u8, "plainword here" as *u8, 14)
  ss_commit(P2, w3, segid3)
  let h9: *i64 = ss_open(P2)
  let n9: i64 = ss_term_top(P2, h9, "zebraq" as *u8, kp6, kl6, tf6, 8, sat6)
  var ok9: i64 = 0
  if n9 == 2 { if kl6[0] == 2 { if kl6[1] == 2 {
      let ka9: *u8 = kp6[0] as *u8
      let kb9: *u8 = kp6[1] as *u8
      if ka9[0] == (107 as u8) { if ka9[1] == (99 as u8) { if kb9[0] == (107 as u8) { if kb9[1] == (97 as u8) { ok9 = 1 } } } }
  } } }
  tot=tot+1; if ok9==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T9 currency: shadowed kb drops out; kc(tf3),ka(tf1) remain in impact order\n" as *u8)
  // T10 saturation flag both ways: the T6 call truncated at max=2 (3 live matches) -> sat=1; the T9
  // call returned every live match (2 <= max=8) -> sat=0. This is the honest-total rung's foundation.
  var ok10: i64 = 0
  if sat_t6 == 1 { if sat6[0] == 0 { ok10 = 1 } }
  tot=tot+1; if ok10==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T10 truncation flag: capped call sat=1, complete call sat=0\n" as *u8)
133
  // ---- seq1730 teeth: the pointer-shaped-segid guard must BITE, and bite FOR THE RIGHT REASON ------
  // T11 ALONE WOULD BE VACUOUS: a store that refused every write would pass it too. T12 is the negative
  // control -- identical writer shape, ONLY the segid differs -- so T11+T12 together isolate the SEGID
  // as the cause of the refusal. Both prefixes are re-run safe: T11's can never gain a manifest (every
  // commit to it is refused by construction), so the gate is idempotent (rule 10).
  let PPOI: *u8 = "/tmp/nx_ssgate_poison-" as *u8
  let PGOOD: *u8 = "/tmp/nx_ssgate_good-" as *u8
  let want: i64 = 0 - 7
  let wp: *i64 = ss_begin()
  ss_add(wp, 1, "poison" as *u8, "should never land" as *u8, 17)
  let rcp: i64 = ss_commit(PPOI, wp, K_MAGIC_140712850411539)
  var ok11: i64 = 0
  if rcp == want { if ss_next_segid(PPOI) == 0 { ok11 = 1 } }
  tot=tot+1; if ok11==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T11 pointer-shaped segid REFUSED (rc=-7) and NOTHING written\n" as *u8)
149
  let wg: *i64 = ss_begin()
  ss_add(wg, 1, "good" as *u8, "must land" as *u8, 9)
  let rcg: i64 = ss_commit(PGOOD, wg, K_MAGIC_1785516000000000)
  var ok12: i64 = 0
  if rcg == 0 { ok12 = 1 }
  tot=tot+1; if ok12==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T12 NEG-CONTROL: legitimate epoch-us segid COMMITS (so T11 refused the ID, not the write)\n" as *u8)
157
  var ok13: i64 = 1
  if ss_segid_ok(K_MAGIC_135251248111617) != 0 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_139871015653377) != 0 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_139925199040513) != 0 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_140190138056705) != 0 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_140712850411538) != 0 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_140712850411539) != 0 { ok13 = 0 }
  if ss_segid_ok(0) != 1 { ok13 = 0 }
  if ss_segid_ok(1) != 1 { ok13 = 0 }
  if ss_segid_ok(1001) != 1 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_1785516000) != 1 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_1785516000000) != 1 { ok13 = 0 }
  if ss_segid_ok(K_MAGIC_1785516000000000) != 1 { ok13 = 0 }
  tot=tot+1; if ok13==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T13 boundary: all 6 OBSERVED poison ids refused; counters + epoch sec/ms/us all accepted\n" as *u8)
173
  // T14 (seq1730): PROVE THE GUARD IS AT THE RIGHT DEPTH. Compactors call ss_write_seg DIRECTLY and
  // hand-write the manifest, never touching ss_commit -- so T11 (which goes through ss_commit) cannot
  // detect a hole on that path. This tooth exercises it, and also accepts a legitimate id so it cannot
  // pass by refusing everything. Re-run safe: the poison prefix never gains a manifest.
  let PCOMP: *u8 = "/tmp/nx_ssgate_compactor-" as *u8
  let want14: i64 = 0 - 7
  let wc: *i64 = ss_begin()
  ss_add(wc, 1, "compacted" as *u8, "the compactor path" as *u8, 18)
  var ok14: i64 = 0
  if ss_write_seg(PCOMP, wc, K_MAGIC_140712850411539) == want14 { ok14 = 1 }
  let wc2: *i64 = ss_begin()
  ss_add(wc2, 1, "compacted" as *u8, "the compactor path" as *u8, 18)
  if ss_write_seg(PCOMP, wc2, K_MAGIC_1785516000000001) != 0 { ok14 = 0 }
  tot=tot+1; if ok14==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T14 COMPACTOR PATH: ss_write_seg (bypasses ss_commit) refuses the poison AND accepts a real id\n" as *u8)
189
  // T15 (2026-09-14): a MALFORMED writer record is REFUSED by ss_build_keys, never walked -- its key-emit loop
  // faulted once during an estate ingest. A clean writer builds first (the positive control); then the first
  // record's key length is planted past the buffer and must refuse by name; a second writer's value length
  // likewise. The codes are the store's own consts, not a second copy.
  var ok15: i64 = 1
  let w15: *i64 = ss_begin()
  ss_add(w15, 1, "wellformed" as *u8, "value" as *u8, ss_len("value" as *u8))
  let k15: *u8 = sys_mmap(ss_keyblob_cap(w15))
  if ss_build_keys(w15, k15) < 0 { ok15 = 0 }
  let b15: *u8 = w15[0] as *u8
  var p15: i64 = 0
  while p15 < G_U32_BYTES { b15[G_KIND_BYTES + p15] = G_BYTE_MAX as u8; p15 = p15 + 1 }
  if ss_build_keys(w15, k15) != SS_KEYS_REFUSE_KEY { ok15 = 0 }
  tot=tot+1; if ok15==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T15 a key length planted past the writer buffer is REFUSED by name after the clean buffer built\n" as *u8)
  var ok15b: i64 = 1
  let w15b: *i64 = ss_begin()
  ss_add(w15b, 1, "wellformed" as *u8, "value" as *u8, ss_len("value" as *u8))
  let b15b: *u8 = w15b[0] as *u8
  let vlo: i64 = G_KIND_BYTES + G_U32_BYTES + ss_len("wellformed" as *u8)
  var p15b: i64 = 0
  while p15b < G_U32_BYTES { b15b[vlo + p15b] = G_BYTE_MAX as u8; p15b = p15b + 1 }
  if ss_build_keys(w15b, k15) != SS_KEYS_REFUSE_VALUE { ok15b = 0 }
  tot=tot+1; if ok15b==1 { pass=pass+1; gw("  [PASS] " as *u8) } else { gw("  [FAIL] " as *u8) }
  gw("T15b neg-control-a-value-length-planted-past-the-buffer is REFUSED by name\n" as *u8)
215
  gw("\n=== nx_seg_store_gate " as *u8); gn(pass); gw("/" as *u8); gn(tot); gw(" ===\n" as *u8)
  // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
  // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
  // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
  let ctr__dry: *i64 = gv_ctr()
  ctr__dry[0] = pass
  ctr__dry[1] = tot
  let rc__dry: i64 = gv_verdict("SEG-STORE-GATE" as *u8, ctr__dry, "append-only put/get round-trip byte-exact" as *u8)
  sys_exit(rc__dry)
  return rc__dry
226}
nx_seg_store_gate.nx source

`nx_seg_store_gate.nx` source
