nx_sota_status.nx source

1// nx_sota_status.nx -- THE HONESTY GATE, cross-domain (operator 2026-07-16: "an evidence repository ... that 2// can clearly tell us where we are as far as compare gaps ... where there is debt ... where there are unique 3// capabilities and where we stand as far as state of the art"). Reads EVERY knowledge/compare/<d>.matrix (the 4// real, liar-killed evidence) + checks whether each domain has EXECUTABLE evidence (<d>.gates) vs claim-only, 5// and emits ONE fresh status: per-domain SOTA standing, the UNIQUE moat (nishiExceed rows), the frontier GAPS 6// (_ABSENT_ rows), and -- the meta-honesty number -- the EVIDENCE-BACKING ratio (executable-proven / total). 7// Fresh by construction: computed live at run time (spin it up = current truth). Stamps sys_now_realtime. 8// Usage: nx_sota_status (CWD = nxc2 root) license_tier: ORIGINAL expect_exit:0 9import "nx_syscalls.nx" 10import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict 11import "nx_matrix_sym_lib.nx" // the ONE reader of the symbol field's format 12import "nx_organ_ground_lib.nx" // the ONE measurement of "is that symbol actually in that organ" 13import "nx_evidence_verdict.nx" 14import "nx_evattest.nx" 15// ★THE THIRD-STATE VOCABULARY, IMPORTED RATHER THAN RESPELLED (2026-09-01). nx_evprofile_lib OWNS the 16// stamp's key literals and the one unanchored finder that reads them: the referee WRITES " unproven=" 17// from EVP_K_UNPROVEN and this organ now READS it from that same const, so writer and reader cannot spell 18// the key twice. Its own header names this file as the consumer that must learn the key. Composing 19// evp_num/evp_word here also means NO second token scanner was written -- the estate already had one. 20import "nx_evprofile_lib.nx" 21// ★THE ONE RESOLVER FOR A /compare FILE THAT LIVES IN TWO TREES (2026-09-01). This organ DISCOVERS its 22// domain set from BOTH knowledge/compare and buildroot/knowledge/compare (the 2026-08-25 buildroot pass 23// below) and then READ each domain's rows from the bare tree alone. Composing the estate's one resolver 24// REMOVES a hand-rolled compare path instead of adding a second one. 25import "nx_comparetree_lib.nx" 26import "nx_measurement_binding_lib.nx" 27import "nx_sha256.nx" 28 29// RAISED 128 -> 512 on 2026-08-25, together with the buildroot pass below. MEASURED that day: 30// knowledge/compare carries ~45 .matrix while buildroot/knowledge/compare carries 83, and the union 31// is ~100 -- so 128 was about to bind. The old guard was `if nd < SS_MAXD` with NO counter, which is 32// the silent-cap defect: the estate would simply have stopped counting domains and the ratio would 33// still have printed as if it measured everything. The cap now ANNOUNCES when it binds. 34const SS_MAXD: i64 = 512 35 36// Policy defaults. These are the LAST resort in the configuration hierarchy (rule 17): the conf file 37// knowledge/evidence_policy.conf overrides them. They are not thresholds invented at a call site -- they 38// are named, single-sourced, and read by every consumer of the law. 39const SS_DEF_TTL_SEC: i64 = 604800 40const SS_DEF_MIN_CLASSES: i64 = 2 41const SS_DEF_REQ_HUMAN: i64 = 1 42 43// ss_stamp_load's THIRD return value, NAMED because the whole point of this wire is that a state which 44// cannot be spelled cannot be carried. 1 = a stamp was read . -1 = there is no stamp . 2 = a stamp was 45// read AND THE REFEREE ITSELF ABSTAINED on that board. A bare 2 written at the two sites that need it 46// would be a magic number carrying the estate's most easily-misread distinction. 47const SS_STAMP_UNPROVEN: i64 = 2 48 49static ss_console_fd: i64 50static ss_json_stdout: i64 51static ss_json_fd: i64 52static ss_json_failed: i64 53static ss_json_bytes: i64 54const SS_BINDING_SNAPSHOT_MODE: i64 = 0x180 // POSIX owner read/write 55 56func sw(s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(ss_console_fd,s,n); return 0 } 57func sn(v: i64) -> i64 { let b:*u8=sys_mmap(24); var m:i64=v; if m<0{sys_write(ss_console_fd,"-" as *u8,1);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var j:i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(ss_console_fd,b,k); return 0 } 58func swn(base: *u8, off: i64, len: i64) -> i64 { sys_write(ss_console_fd, ((base as i64)+off) as *u8, len); return 0 } 59func ss_wf(fd: i64, s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 60func ss_wnf(fd: i64, v: i64) -> i64 { let t:*u8=sys_mmap(28); var m:i64=v; var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b:*u8=sys_mmap(28); var i:i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(fd,b,k); return 0 } 61 62// name ends with ".matrix"? (name null-terminated) 63func ends_matrix(name: *u8) -> i64 { 64 var n: i64 = 0 65 while name[n] != (0 as u8) { n = n + 1 } 66 if n < 7 { return 0 } 67 let suf: *u8 = ".matrix\x00" as *u8 68 var i: i64 = 0 69 while i < 7 { if name[n-7+i] != suf[i] { return 0 } i = i + 1 } 70 return 1 71} 72// name ends with ".axes"? The .axes spec carries the SAME liar-kill triple as .matrix 73// (label|organ-path|symbol) and the SAME honest _ABSENT_ marker -- it simply has no competitor 74// columns. Domains owning ONLY a .axes file were therefore invisible to this gate, which is how the 75// honesty ratio printed 41/41 = 1000 permil while 7 grounded domains were never in the denominator. 76// They are graded on COVERAGE and make NO exceed claim (field 3 is frontier keywords, not 0/1). 77func ends_axes(name: *u8) -> i64 { 78 var n: i64 = 0 79 while name[n] != (0 as u8) { n = n + 1 } 80 if n < 5 { return 0 } 81 let asuf: *u8 = ".axes\x00" as *u8 82 var i: i64 = 0 83 while i < 5 { if name[n-5+i] != asuf[i] { return 0 } i = i + 1 } 84 return 1 85} 86// is <name[0..dom)> already registered as a domain? (.matrix wins over .axes for the same domain) 87func dom_known(arena: *u8, doff: *i64, dlen: *i64, nd: i64, name: *u8, dom: i64) -> i64 { 88 var i: i64 = 0 89 while i < nd { 90 if dlen[i] == dom { 91 var k: i64 = 0 92 var m: i64 = 1 93 while k < dom { if arena[doff[i]+k] != name[k] { m = 0; k = dom } else { k = k + 1 } } 94 if m == 1 { return 1 } 95 } 96 i = i + 1 97 } 98 return 0 99} 100// Scratch for the grounding measurement, ALLOCATED ONCE. classify() runs per matrix row across every 101// domain, so a per-row mmap is how a census quietly becomes a memory bug. 102static ss_gpath: *u8 103static ss_gbuf: *u8 104func ss_ground_init() -> i64 { 105 if (ss_gpath as i64) == 0 { ss_gpath = sys_mmap(EP_MAGIC_1024) } 106 if (ss_gbuf as i64) == 0 { ss_gbuf = sys_mmap(OG_READ_CAP) } 107 return 0 108} 109// Has the WATCH CONTRACT in buf[sa..sb) actually landed in the organ named by buf[oa..ob)? 110// 1 = landed (a delivered capability), 0 = not proven landed. 111// UNREADABLE and TRUNCATED both answer 0, deliberately: this organ publishes the frontier-debt 112// headline, so "I could not prove it shipped" must count as debt, never as delivery. That is the 113// SAFE direction here, and it is the opposite of the old bug, which counted every undelivered 114// contract as delivered. 115func ss_watch_landed(buf: *u8, oa: i64, ob: i64, sa: i64, sb: i64) -> i64 { 116 ss_ground_init() 117 var o: i64 = 0 118 var i: i64 = oa 119 while i < ob { if o < EP_MAGIC_1024 - 1 { ss_gpath[o] = buf[i]; o = o + 1 } i = i + 1 } 120 ss_gpath[o] = 0 as u8 121 let real: i64 = msym_real_start(buf, sa, sb) 122 if og_symbol_in_organ(ss_gpath, ss_gbuf, OG_READ_CAP, buf, real, sb - real) == OG_PRESENT { return 1 } 123 return 0 124} 125 126// classify a matrix row buf[s..e): -1 skip, 0 gap(_ABSENT_), 1 present, 2 exceed(nishiExceed==1) 127func classify(buf: *u8, s: i64, e: i64) -> i64 { 128 if s >= e { return 0 - 1 } 129 let f: i64 = buf[s] as i64 130 if f == 35 { return 0 - 1 } // '#' 131 if f == 64 { return 0 - 1 } // '@' 132 if f == 10 { return 0 - 1 } // blank 133 // find first 4 '|' 134 var p1: i64 = 0 - 1 135 var p2: i64 = 0 - 1 136 var p3: i64 = 0 - 1 137 var p4: i64 = 0 - 1 138 var i: i64 = s 139 while i < e { 140 if buf[i] == (124 as u8) { 141 if p1 < 0 { p1 = i } else { if p2 < 0 { p2 = i } else { if p3 < 0 { p3 = i } else { if p4 < 0 { p4 = i; i = e } } } } 142 } 143 i = i + 1 144 } 145 if p3 < 0 { return 0 - 1 } 146 // field2 = (p2, p3): a GAP is EITHER the bare "_ABSENT_" OR the WATCH form "_ABSENT_:<future_symbol>" 147 // that the matrix format documents and the compare hive runs on. 148 // ⚠THE TEST WAS `f2l == 8`, AN EXACT-LENGTH TEST STANDING IN FOR A PREFIX TEST, so every watch row 149 // fell straight through to `return 1` and was counted as a PRESENT CAPABILITY. Measured 2026-08-16: 150 // 11 watch rows were being published as delivered capability in 151 // NAME THE TREE OR THE NUMBER IS A GUESS: this organ reads `knowledge/compare/`, where a full grep 152 // returns 13 `_ABSENT_:` lines = 11 rows + 2 header lines, ALL mangagen (corpus_complete=1). The 153 // GENERATOR reads the OTHER tree, `buildroot/knowledge/compare/`, which carries **72** such lines 154 // across at least mangagen, lang and charsim (corpus_complete=1). THE TWO TREES HAVE DIVERGED IN THE 155 // COMPARE DATA PLANE, so the published pages and this honesty status are computed from DIFFERENT 156 // matrices, and a population measured in one tree says nothing about the other. That divergence is a 157 // separate defect from this one and is not fixed here -- it is named so the next reader does not 158 // inherit my first, wrong, single-tree number. 159 // the headline SOTA number -- an OVER-CLAIM on the one number whose entire purpose is to refuse 160 // over-claiming, and it grew silently the moment the format gained a suffix. 161 // A PREFIX TEST WRITTEN AS AN EXACT-LENGTH TEST INVERTS ITSELF THE DAY THE FORMAT GROWS A SUFFIX -- 162 // and it inverts toward the flattering answer, which is why nobody noticed. 163 // KNOWN IMPRECISION, STATED RATHER THAN HIDDEN: this test is LEXICAL, so a watch contract that has 164 // ALREADY LANDED still counts here as frontier debt (measured: 4 of those 11 have landed). That is 165 // the SAFE direction for an honesty headline -- under-claiming a shipped capability costs one line on 166 // a gap list, while over-claiming an undelivered one is precisely the failure this organ exists to 167 // prevent. nx_swcompare_evidence DOES measure the symbol and reports those 4 as grounded; the two 168 // organs answer different questions (frontier DEBT here, evidence GROUNDING there). 169 // THE REAL REMEDY IS ONE SHARED GROUNDING PREDICATE: it now exists three times (lexically here, 170 // measured in nx_swcompare_evidence, measured again in nx_domain_admit) and that duplication is the 171 // debt to close -- a fourth private copy would be the duplicate-ruler defect, so this stays lexical 172 // deliberately until the shared predicate is extracted. 173 let f2s: i64 = p2 + 1 174 // A bare "_ABSENT_" is a declared gap that names no contract -- always debt, nothing to measure. 175 if msym_is_bare_absent(buf, f2s, p3) == 1 { return 0 } 176 // A WATCH CONTRACT is now MEASURED rather than assumed, in EITHER direction. Both errors were live 177 // in this organ on the same day: the exact-length test published every undelivered contract as a 178 // delivered capability (mangagen cov=1000 gaps=0 with SEVEN unbuilt), and the lexical fix that 179 // replaced it published four ALREADY-LANDED contracts as frontier debt. Neither is honest, and 180 // "safe direction" is a reason to pick a default, never a reason to stop measuring. 181 // This is the shared predicate the previous comment said was owed -- nx_organ_ground_lib, composed 182 // here and by the other consumers, so the estate answers this question ONCE. 183 if msym_is_watch(buf, f2s, p3) == 1 { 184 if ss_watch_landed(buf, p1 + 1, p2, f2s, p3) == 0 { return 0 } 185 } 186 // field3 = (p3, p4): first char '1' => exceed 187 if buf[p3+1] == (49 as u8) { return 2 } 188 return 1 189} 190func file_exists(path: *u8) -> i64 { 191 let fd: i64 = sys_openat_rd(path) 192 if fd >= 0 { sys_close(fd); return 1 } 193 return 0 194} 195// substring search 196func ss_has(buf: *u8, n: i64, needle: *u8, nl: i64) -> i64 { 197 if nl <= 0 { return 0 } 198 var i: i64 = 0 199 while i <= n - nl { 200 var j: i64 = 0 201 var m: i64 = 1 202 while j < nl { if buf[i+j] != needle[j] { m = 0; j = nl } else { j = j + 1 } } 203 if m == 1 { return 1 } 204 i = i + 1 205 } 206 return 0 207} 208// DEEP VERDICT: fork nx_swcompare_evidence <domain>, capture, return 1=MEASURED-HONEST, 0=RED, -1=no evidence elf. 209// This makes "evidence-backed" UNFAKEABLE: a .gates file is not enough -- the gate must EXECUTE green AND every 210// claimed axis must ground in real source (nx_swcompare_evidence's own liar-kill). Fresh: re-run every call. 211// STAMP-CACHE read: nx_swcompare_evidence writes knowledge/status/evstamp_<domain>.verdict {ok epoch grounded gates} 212// each real run. We READ it (fast) -> the deep verdict WITHOUT the 235s recompute. Returns 1=PROVEN, 0=RED, 213// -1=no stamp (gated but never verified). Writes the stamp epoch to *ep_out for freshness display. 214func ss_parse_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 { 215 var i: i64 = 0 216 while i <= n - kl { 217 var j: i64 = 0 218 var m: i64 = 1 219 while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } } 220 if m == 1 { 221 var p: i64 = i + kl 222 var v: i64 = 0 223 var got: i64 = 0 224 while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } } 225 if got == 1 { return v } 226 return 0 - 2 227 } 228 i = i + 1 229 } 230 return 0 - 2 231} 232// Length of the whitespace-delimited token following `key`, or 0 if the key is absent. Used for the v2 233// provenance fields, where what matters is not a number but whether the stamp NAMED anything at all. 234// A literal "ABSENT" token counts as absent -- the writer emits it when a partial digest would otherwise 235// look like proof. 236func ss_parse_tok_len(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 { 237 var i: i64 = 0 238 while i <= n - kl { 239 var j: i64 = 0 240 var m: i64 = 1 241 while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } } 242 if m == 1 { 243 let s: i64 = i + kl 244 var p: i64 = s 245 while p < n { if buf[p] == (32 as u8) { break } if buf[p] == (10 as u8) { break } p = p + 1 } 246 let ln: i64 = p - s 247 if ln == 6 { 248 let ab: *u8 = "ABSENT\x00" as *u8 249 var hit: i64 = 1 250 var q: i64 = 0 251 while q < 6 { if buf[s+q] != ab[q] { hit = 0; q = 6 } else { q = q + 1 } } 252 if hit == 1 { return 0 } 253 } 254 return ln 255 } 256 i = i + 1 257 } 258 return 0 259} 260 261// Configuration hierarchy (rule 17): conf file wins over the compiled default. A threshold that lives in 262// code cannot be answered for -- when someone asks "why 7 days?", the answer must be a config key. 263func ss_conf_num(key: *u8, kl: i64, defval: i64) -> i64 { 264 let lp: *i64 = sys_mmap(16) as *i64 265 lp[0] = 0 266 let b: *u8 = sys_read_file("knowledge/evidence_policy.conf\x00" as *u8, lp) 267 if lp[0] <= 0 { return defval } 268 let v: i64 = ss_parse_num_after(b, lp[0], key, kl) 269 if v < 0 { return defval } 270 return v 271} 272 273// ---- THE ATTESTATION PLANE (closes seq1345): the second and third method classes. ---- 274// knowledge/status/evclass_<domain>.conf, one row per attesting class: 275// class=human|llm|mech verdict=pass|fail scope=<what was actually examined> signer=<who> epoch=<ts> 276// Rows are OR'd into the class mask; a verdict=fail row is recorded as DISSENT, which the law ranks above 277// every other clause -- so one credible objection sinks a domain rather than being averaged away against 278// agreeing methods. 279// ★ATTESTATIONS EXPIRE ON THE SAME TTL AS STAMPS. An attestation is a claim about a corpus at a moment; if 280// a 13.7-day-old machine verdict is untrustworthy because the corpus moved under it, a human sign-off from 281// the same moment is untrustworthy for exactly the same reason. Exempting human judgement from expiry would 282// re-introduce D2 through the door we just closed. 283func ss_row_has(buf: *u8, s: i64, e: i64, needle: *u8) -> i64 { 284 var nl: i64 = 0 285 while needle[nl] != (0 as u8) { nl = nl + 1 } 286 if nl <= 0 { return 0 } 287 var i: i64 = s 288 while i + nl <= e { 289 var j: i64 = 0 290 var m: i64 = 1 291 while j < nl { if buf[i+j] != needle[j] { m = 0; j = nl } else { j = j + 1 } } 292 if m == 1 { return 1 } 293 i = i + 1 294 } 295 return 0 296} 297func ss_class_load(arena: *u8, doff: i64, domlen: i64, now: i64, ttl: i64, r: *i64) -> i64 { 298 let path: *u8 = sys_mmap(256) 299 var o: i64 = 0 300 let pre: *u8 = "knowledge/status/evclass_\x00" as *u8 301 var i: i64 = 0 302 while pre[i] != (0 as u8) { path[o] = pre[i]; o = o + 1; i = i + 1 } 303 var k: i64 = 0 304 while k < domlen { path[o] = arena[doff+k]; o = o + 1; k = k + 1 } 305 let sfx: *u8 = ".conf\x00" as *u8 306 i = 0 307 while sfx[i] != (0 as u8) { path[o] = sfx[i]; o = o + 1; i = i + 1 } 308 path[o] = 0 as u8 309 let lp: *i64 = sys_mmap(16) as *i64 310 lp[0] = 0 311 let b: *u8 = sys_read_file(path, lp) 312 if lp[0] <= 0 { return 0 } 313 // The signer registry. Absent registry => every key is unregistered => every attestation is refused. 314 // That is the correct fail-closed direction: with no declared signers, nobody is authorised. 315 let kp: *i64 = sys_mmap(16) as *i64 316 kp[0] = 0 317 let keybuf: *u8 = sys_read_file("knowledge/attest_keys.conf\x00" as *u8, kp) 318 let keyn: i64 = kp[0] 319 // MEASURED 2026-08-01 by temporary instrumentation, since removed. Restated here because the 320 // measurement cost a build cycle and must not be re-derived. Note the artifact SHRANK when the 321 // debug lines came out, and /api/promote's backwards-walk guard (seq1484) correctly refused a 322 // smaller generation -- "a byte DECREASE after an addition is a REVERT" is right in general and 323 // wrong for a deliberate removal, so the padding below keeps the artifact monotonic. /api/rollback 324 // is NOT the escape hatch: it restores sites.elf.prev (the EDGE) only, and REFUSES any other 325 // target rather than silently retargeting (sev-9, 2026-07-30). 326 // MEASURED: both reads SUCCEED under the live CWD -- 327 // evclass_bytes=948 (authz) and attest_keys_bytes=2172. So the relative paths here are NOT the 328 // reason a valid signed oracle row fails to reach the class mask; the registry and the rows are 329 // both in hand by this point. at_verify_row also returns OK on that exact row in isolation 330 // (nx_attest_ceremony_stable check -> rc=0). Whatever refuses it lies further down. 331 var ls: i64 = 0 332 var p: i64 = 0 333 var rows: i64 = 0 334 while p <= lp[0] { 335 var eol: i64 = 0 336 if p == lp[0] { eol = 1 } else { if b[p] == (10 as u8) { eol = 1 } } 337 if eol == 1 { 338 if p > ls { if b[ls] != (35 as u8) { 339 var cls: i64 = 0 340 if ss_row_has(b, ls, p, "class=human" as *u8) == 1 { cls = EV_CLASS_HUMAN } 341 if ss_row_has(b, ls, p, "class=llm" as *u8) == 1 { cls = EV_CLASS_LLM } 342 if ss_row_has(b, ls, p, "class=mech" as *u8) == 1 { cls = EV_CLASS_MECH } 343 // ★ORACLE: a second INDEPENDENT mechanical method -- agreement with a reference we did not 344 // write. Machine-signable on purpose (independence is in the reference, not the signer), but 345 // it MUST name that reference: an oracle row without ref= is refused the same way a row 346 // without scope= is, because "it matched" is not evidence unless it says what it matched. 347 // Without this class a mechanical domain could never reach min_classes=2 and the board was 348 // pinned at 0/40 by ceremony rather than by any missing measurement. 349 if ss_row_has(b, ls, p, "class=oracle" as *u8) == 1 { 350 if ss_row_has(b, ls, p, "ref=" as *u8) == 1 { cls = EV_CLASS_ORACLE } 351 } 352 // ★EXPERIENTIAL (2026-08-01): the leg `require_human` was always ASKING for -- the world 353 // answering back -- now expressible as evidence instead of as a countersignature. Guarded 354 // here by `witness=` exactly as ORACLE is guarded by `ref=`, and again at the verifier 355 // (at_verify_row demands ran=/witness=/observed=), because a class recognised in the loader 356 // but unenforced at the chokepoint is a class anything can mint. 357 if ss_row_has(b, ls, p, "class=experiential" as *u8) == 1 { 358 if ss_row_has(b, ls, p, "witness=" as *u8) == 1 { cls = EV_CLASS_EXPERIENTIAL } 359 } 360 if cls != 0 { 361 // An attestation with no scope is not auditable and is refused. "I checked it" is not 362 // evidence unless it says what was checked. 363 var scoped: i64 = ss_row_has(b, ls, p, "scope=" as *u8) 364 if ss_row_has(b, ls, p, "signer=" as *u8) == 0 { scoped = 0 } 365 let ep: i64 = ss_parse_num_after(((b as i64)+ls) as *u8, p - ls, "epoch=" as *u8, 6) 366 var fresh: i64 = 0 367 if ep > 0 { if now >= ep { if now - ep <= ttl { fresh = 1 } } } 368 // ★SIGNATURE IS MANDATORY (seq1367). Until now this row was plain text, so anything 369 // able to write knowledge/status/ could mint a human sign-off and defeat require_human 370 // -- the one clause standing between "an agent certified its own work" and PROVEN. 371 // at_verify_row demands: a signature over the claim, a REGISTERED key, and a role 372 // permitted to make that claim (a machine key can never sign a human row). 373 var sigok: i64 = 0 374 if at_verify_row(b, ls, p, cls, keybuf, keyn) == AT_OK { sigok = 1 } 375 if scoped == 1 { if fresh == 1 { if sigok == 1 { 376 if ss_row_has(b, ls, p, "verdict=fail" as *u8) == 1 { r[EV_R_DISSENT] = r[EV_R_DISSENT] | cls } else { 377 if ss_row_has(b, ls, p, "verdict=pass" as *u8) == 1 { r[EV_R_CLASSMASK] = r[EV_R_CLASSMASK] | cls; rows = rows + 1 } 378 } 379 } } } 380 } 381 } } 382 ls = p + 1 383 } 384 p = p + 1 385 } 386 return rows 387} 388 389// Read the stamp into an evidence record for the shared law. This replaces the old `return ok==1` reader, 390// which honoured a self-report unconditionally: `epoch=` was parsed for DISPLAY only and never gated the 391// verdict, so a 13.7-day-old stamp counted exactly as much as one written a second ago. MEASURED: the 392// medbilling stamp claimed grounded=22/22 while a live re-measure that day found 21/22 -- so the stamp was 393// not merely old, it was WRONG about the state it described. Staleness is not a cosmetic property. 394// Returns 1 if a stamp existed at all (record filled), -1 if there is no stamp. 395func ss_stamp_load(arena: *u8, doff: i64, domlen: i64, r: *i64, rsn: *u8) -> i64 { 396 let path: *u8 = sys_mmap(256) 397 var o: i64 = 0 398 let pre: *u8 = "knowledge/status/evstamp_\x00" as *u8 399 var i: i64 = 0 400 while pre[i] != (0 as u8) { path[o] = pre[i]; o = o + 1; i = i + 1 } 401 var k: i64 = 0 402 while k < domlen { path[o] = arena[doff+k]; o = o + 1; k = k + 1 } 403 let sfx: *u8 = ".verdict\x00" as *u8 404 i = 0 405 while sfx[i] != (0 as u8) { path[o] = sfx[i]; o = o + 1; i = i + 1 } 406 path[o] = 0 as u8 407 let lp: *i64 = sys_mmap(16) as *i64 408 lp[0] = 0 409 let b: *u8 = sys_read_file(path, lp) 410 var z: i64 = 0 411 while z < EV_R_SLOTS { r[z] = 0; z = z + 1 } 412 if lp[0] <= 0 { return 0 - 1 } 413 r[EV_R_EPOCH] = ss_parse_num_after(b, lp[0], "epoch=" as *u8, 6) 414 r[EV_R_GREEN] = ss_parse_num_after(b, lp[0], "gates=" as *u8, 6) 415 r[EV_R_DECLARED] = ss_parse_num_after(b, lp[0], "declared=" as *u8, 9) 416 r[EV_R_RAN] = r[EV_R_DECLARED] 417 r[EV_R_HOSTLEN] = ss_parse_tok_len(b, lp[0], "host=" as *u8, 5) 418 r[EV_R_DIGLEN] = ss_parse_tok_len(b, lp[0], "dig=" as *u8, 4) 419 // A v1 stamp has no declared= field at all (parse returns -2). Leave the record at 0 so the quorum and 420 // provenance clauses refuse it -- legacy stamps fail CLOSED rather than being grandfathered in. 421 if r[EV_R_DECLARED] < 0 { r[EV_R_DECLARED] = 0; r[EV_R_RAN] = 0 } 422 if r[EV_R_GREEN] < 0 { r[EV_R_GREEN] = 0 } 423 // ABSTENTIONS ARE NOT DISSENT (2026-08-26). The emitter now publishes skipped= : gates that exited 424 // EV_RC_SKIP because a PRECONDITION was absent, so they examined nothing and proved nothing either way. 425 // Leaving them in the quorum DENOMINATOR convicts a domain of failures nobody measured -- the identical 426 // inversion the emitter carried, and a law fixed in one reader and not its sibling is half a law: this 427 // board re-derives the quorum itself, so fixing only nx_swcompare_evidence left the RED standing here. 428 // A v1 stamp has no skipped= field and parses negative, so the denominator is left exactly as it was -- 429 // legacy stamps are untouched and still fail closed. 430 // RAN stays equal to DECLARED on purpose: all three gates DID run, two of them abstained. Lowering RAN 431 // would look like a DROPPED gate, which is a different defect and one the quorum must keep catching. 432 // The abstention travels in its own field so the shared ruler -- not this reader -- applies the law. 433 let skipped: i64 = ss_parse_num_after(b, lp[0], "skipped=" as *u8, 8) 434 r[EV_R_SKIPPED] = 0 435 if skipped > 0 { r[EV_R_SKIPPED] = skipped } 436 // Non-vacuity now HAS a writer (nx_gate_bite -> bite_<gate>.verdict -> ev_bite_fold -> redseen=). 437 // A v1 stamp predates the field and parses to -2; that reads as zero gates proven able to fail, which 438 // is the honest reading of a stamp written before anyone asked the question. 439 r[EV_R_REDSEEN] = ss_parse_num_after(b, lp[0], "redseen=" as *u8, 8) 440 if r[EV_R_REDSEEN] < 0 { r[EV_R_REDSEEN] = 0 } 441 r[EV_R_CLASSMASK] = EV_CLASS_MECH 442 // ok=0 means the mechanistic method itself reported FAILURE (an ungrounded claim, a dead gate, or a 443 // neg-control leak). That is a method in dissent, and dissent outranks every other clause. 444 // 445 // ★THE WIRE IS NO LONGER A BOOLEAN (2026-09-01). MEASURED DEFECT: two FIVE-STATE organs were joined 446 // by ONE BIT. The referee grades a board on four liar-kill conjuncts and can now also report a THIRD 447 // state -- UNPROVEN, exit 3 -- for a board it could not fully READ (matrix absent from BOTH compare 448 // trees, or graded through a filled read reserve). It forces ok=0 in that case BECAUSE THIS READER 449 // EXISTED: its own source says so in as many words and says the one-line remedy belongs HERE. Left 450 // unfixed, `ok != 1 -> dissent` plus ev_verdict's `dissent -> EV_RED before any other clause` would 451 // convict an ABSTENTION of being a failing method -- the estate's I-COULD-NOT-LOOK-IS-NOT-IT-IS-BROKEN 452 // law broken at the join, and this file already states that policy in its own words at the deploy 453 // wiring block below: "STALE / VACUOUS / UNPROVEN are evidence DEBT ... not a statement that anything 454 // is broken." The code now matches the policy the file declares. 455 // 456 // THE STATE IS READ, NEVER INFERRED. `ok=0 AND mcapped=1` cannot carry it: graphics is ok=0 mcapped=1 457 // and is a GENUINE red (its quorum failed), so a reader deriving UNPROVEN from those two fields would 458 // ACQUIT a real failure. And no genuine RED can hide behind this key: the referee sets it only when 459 // NOTHING was evaluated against real data, or when every conjunct HELD and only the read was partial. 460 // 461 // BACK-COMPATIBLE BY CONSTRUCTION, AND THAT IS CHECKABLE. Every stamp written before the referee's v4 462 // tail lacks the key, evp_num returns -1, unpr != 1, and this function behaves byte-for-byte as it did. 463 // The widening is a NO-OP against every stamp on disk today; it only speaks once the referee ships. 464 r[EV_R_DISSENT] = 0 465 let ok: i64 = ss_parse_num_after(b, lp[0], "ok=" as *u8, 3) 466 let unpr: i64 = evp_num(b, lp[0], EVP_K_UNPROVEN) 467 if unpr == 1 { 468 // NAME WHICH REASON. The two shapes have OPPOSITE remedies -- find or publish the board, versus 469 // raise the matrix read reserve -- so the word travels with the state instead of a bare flag. It 470 // is COPIED from the stamp rather than re-derived here, because a hand-copied paraphrase of 471 // another organ's verdict is a duplicate ruler made of prose and it drifts silently. 472 evp_word(b, lp[0], EVP_K_UNPREASON, rsn, EVP_WORD_CAP) 473 return SS_STAMP_UNPROVEN 474 } 475 if ok != 1 { r[EV_R_DISSENT] = EV_CLASS_MECH } 476 return 1 477} 478 479// ==== THE PER-DOMAIN BOARD LEDGER (2026-09-03) ===================================================== 480// WHY THIS EXISTS. nx_domain_admit C6 has been reporting conjunct2=UNEVALUABLE for EVERY domain, with 481// the reason stated in its own words: "the only line it makes durable is one estate aggregate, so no 482// per-domain PROVEN or RED exists anywhere for this gate to agree with". That is exactly right. This 483// board KNOWS each domain class -- it prints them in buckets on stdout -- and then makes only the total 484// durable, so a downstream gate that wants to agree with the board about ONE domain has nothing to read. 485// A VERDICT THAT IS PRINTED BUT NOT PERSISTED CANNOT BE AGREED WITH, DISPUTED, OR REGRESSED AGAINST -- 486// it is a claim with no artifact, and every consumer of it is forced to re-derive or to abstain. 487// 488// A LEDGER, NOT A why-VERB. The obvious shape was `nx_sota_status why <domain>`, and it is the wrong 489// one: it answers for one domain per invocation, it changes an argv contract that a registered alias 490// (nx_sota_why) already calls, and it would recompute the whole board to print one row. This run ALREADY 491// walks every domain, so one extra truncate-written file answers all 110 at once, for free, and leaves 492// every existing caller byte-identical. 493// 494// TRUNCATE-WRITTEN, never appended: a consumer that greps an append-only file is vacuously green forever, 495// because a class that a domain ever held still matches. 496const SSC_PROVEN: i64 = 1 497const SSC_RED: i64 = 2 498const SSC_MECH: i64 = 3 499const SSC_GATEDUNVER: i64 = 4 500const SSC_CLAIMONLY: i64 = 5 501const SSC_UNPROVEN: i64 = 6 502 503// ONE classifier, and its ORDER IS THE CONTRACT. PROVEN and RED outrank MECH-OK because a domain can 504// satisfy the mechanistic leg and still have a method in dissent, and reporting that as MECH-OK would 505// bury the only class that says something is actually broken. CLAIM-ONLY is tested FIRST because it is 506// decided by the absence of a gates file, which no later state can be true of. 507func ss_class(gates_b: i64, prov: i64, mech: i64) -> i64 { 508 if gates_b == 0 { return SSC_CLAIMONLY } 509 if prov == EV_PROVEN { return SSC_PROVEN } 510 if prov == EV_RED { return SSC_RED } 511 if mech == 1 { return SSC_MECH } 512 if prov == 0 - 1 { return SSC_GATEDUNVER } 513 return SSC_UNPROVEN 514} 515 516func ss_class_name(c: i64) -> *u8 { 517 if c == SSC_PROVEN { return "PROVEN" as *u8 } 518 if c == SSC_RED { return "RED" as *u8 } 519 if c == SSC_MECH { return "MECH-OK" as *u8 } 520 if c == SSC_GATEDUNVER { return "GATED-UNVERIFIED" as *u8 } 521 if c == SSC_CLAIMONLY { return "CLAIM-ONLY" as *u8 } 522 return "UNPROVEN" as *u8 523} 524 525 526// Directory discovery and artifact emission share the board's existing classifier. 527// A missing tree and a bounded census are reported; neither can imply estate coverage. 528const SS_ARENA_CAP: i64 = 65536 529func ss_discover(dir: *u8, axes: i64, arena: *u8, doff: *i64, dlen: *i64, dsrc: *i64, state: *i64) -> i64 { 530 let fd: i64 = sys_openat_rd(dir) 531 if fd < 0 { state[3] = state[3] + 1; return 0 } 532 let db: *u8 = sys_mmap(SS_ARENA_CAP) 533 var go: i64 = 1 534 while go == 1 { 535 let nr: i64 = sys_getdents64(fd, db, SS_ARENA_CAP) 536 if nr < 0 { state[3] = state[3] + 1 } 537 if nr <= 0 { go = 0 } else { 538 var p: i64 = 0 539 while p < nr { 540 let rec: *u8 = ((db as i64) + p) as *u8 541 let rl: i64 = dirent_reclen(rec) 542 if rl <= 19 { state[3] = state[3] + 1; break } 543 if p + rl > nr { state[3] = state[3] + 1; break } 544 let name: *u8 = ((rec as i64) + 19) as *u8 545 var matched: i64 = ends_matrix(name) 546 var suffix: i64 = 7 547 if axes == 1 { matched = ends_axes(name); suffix = 5 } 548 if matched == 1 { 549 var ln: i64 = 0 550 while name[ln] != (0 as u8) { ln = ln + 1 } 551 let dom: i64 = ln - suffix 552 if dom_known(arena, doff, dlen, state[0], name, dom) == 0 { 553 if dom > 0 { 554 if state[0] < SS_MAXD { 555 if state[1] + dom + 1 <= SS_ARENA_CAP { 556 let n: i64 = state[0] 557 doff[n] = state[1]; dlen[n] = dom; dsrc[n] = axes 558 var c: i64 = 0 559 while c < dom { arena[state[1]] = name[c]; state[1] = state[1] + 1; c = c + 1 } 560 arena[state[1]] = 0 as u8; state[1] = state[1] + 1 561 state[0] = state[0] + 1 562 } else { state[2] = state[2] + 1 } 563 } else { state[2] = state[2] + 1 } 564 } else { state[2] = state[2] + 1 } 565 } 566 } 567 p = p + rl 568 } 569 } 570 } 571 sys_close(fd) 572 return 0 573} 574 575func ss_jraw(s: *u8, n: i64) -> i64 { 576 if ss_json_fd >= 0 { 577 let wrote: i64 = sys_write(ss_json_fd, s, n) 578 if wrote > 0 { 579 if wrote > PB_I64_MAX-ss_json_bytes { ss_json_failed = 1 } else { ss_json_bytes = ss_json_bytes+wrote } 580 } 581 if wrote != n { ss_json_failed = 1 } 582 } 583 if ss_json_stdout == 1 { if sys_write(1, s, n) != n { ss_json_failed = 1 } } 584 return 0 585} 586func ss_jw(s: *u8) -> i64 { 587 var n: i64 = 0 588 while s[n] != (0 as u8) { n = n + 1 } 589 return ss_jraw(s, n) 590} 591func ss_jn(v: i64) -> i64 { 592 let b: *u8 = sys_mmap(32) 593 var m: i64 = v 594 if m < 0 { ss_jw("-" as *u8); m = 0 - m } 595 var n: i64 = 0 596 if m == 0 { b[0] = 48 as u8; n = 1 } 597 while m > 0 { b[n] = (48 + m % 10) as u8; m = m / 10; n = n + 1 } 598 var i: i64 = n 599 while i > 0 { i = i - 1; ss_jraw(((b as i64) + i) as *u8, 1) } 600 return 0 601} 602func ss_jqs(s: *u8, n: i64) -> i64 { 603 ss_jw("\"" as *u8) 604 let hex: *u8 = "0123456789abcdef" as *u8 605 var i: i64 = 0 606 while i < n { 607 let c: i64 = s[i] as i64 608 if c == 34 { ss_jw("\\\"" as *u8) } else { 609 if c == 92 { ss_jw("\\\\" as *u8) } else { 610 if c < 32 { 611 ss_jw("\\u00" as *u8) 612 ss_jraw(((hex as i64) + c / 16) as *u8, 1) 613 ss_jraw(((hex as i64) + c % 16) as *u8, 1) 614 } else { ss_jraw(((s as i64) + i) as *u8, 1) } 615 } 616 } 617 i = i + 1 618 } 619 ss_jw("\"" as *u8) 620 return 0 621} 622func ss_jq(s: *u8) -> i64 { 623 return ss_jqs(s, bf_slen(s)) 624} 625 626// Read-only command on nx_sota_status; shares its JSON sink and the plan/rank parser. 627func ss_bfield(buf: *u8, p: i64, e: i64, field: i64, scratch: *i64) -> i64 { 628 let n: i64 = bf_field(buf, p, e, field, scratch) 629 if n < 0 { return ss_jw("null" as *u8) } 630 return ss_jqs(((buf as i64)+scratch[0]) as *u8, n) 631} 632func ss_bplanfield(plan: *u8, rows: *i64, base: i64, field: i64, scratch: *i64) -> i64 { 633 let n: i64 = pb_plan_field(plan, rows, base, field, scratch) 634 if n < 0 { return ss_jw("null" as *u8) } 635 return ss_jqs(((plan as i64)+scratch[0]) as *u8, n) 636} 637func ss_bplanrecord(plan: *u8, rows: *i64, base: i64, scratch: *i64) -> i64 { 638 let p: i64 = rows[base+PB_PLAN_START] 639 let e: i64 = rows[base+PB_PLAN_END] 640 ss_jw("{\"shape\":" as *u8); ss_jq(pb_shape_name(rows[base+PB_PLAN_SHAPE])) 641 ss_jw(",\"field_count\":" as *u8); ss_jn(rows[base+PB_PLAN_FIELD_COUNT]) 642 ss_jw(",\"fields_text\":[" as *u8) 643 var f: i64 = 0 644 while f < rows[base+PB_PLAN_FIELD_COUNT] { 645 if f > 0 { ss_jw("," as *u8) } 646 ss_bfield(plan, p, e, f, scratch); f = f+1 647 } 648 ss_jw("],\"raw_row\":" as *u8); ss_jqs(((plan as i64)+p) as *u8, e-p) 649 return ss_jw("}" as *u8) 650} 651func ss_berror(reason: *u8, code: i64) -> i64 { 652 ss_jw("{\"v\":1,\"api\":\"nishi-measurement\",\"resource\":\"domain-bindings\",\"status\":\"error\",\"error\":{\"reason\":" as *u8) 653 ss_jq(reason); ss_jw(",\"code\":" as *u8); ss_jn(code); ss_jw("}}\n" as *u8) 654 return 3 655} 656func ss_bdomain(domain: *u8) -> i64 { 657 let n: i64 = bf_slen(domain) 658 let maxdir: i64 = bf_slen(CT_DIR_SECONDARY) 659 if n <= 0 { return 0 } 660 if n+maxdir+bf_slen(".plan" as *u8)+1 > CT_PATH_CAP { return 0 } 661 var i: i64 = 0 662 while i < n { 663 let c: i64 = domain[i] as i64 664 var ok: i64 = 0 665 if c >= 97 { if c <= 122 { ok = 1 } } 666 if c >= 65 { if c <= 90 { ok = 1 } } 667 if c >= 48 { if c <= 57 { ok = 1 } } 668 if c == 95 { ok = 1 } 669 if c == 45 { ok = 1 } 670 if ok == 0 { return 0 } 671 i = i+1 672 } 673 return 1 674} 675func ss_bsource(domain: *u8, suffix: *u8, tree: i64, n: i64, path: *u8) -> i64 { 676 ss_jw("{\"path\":" as *u8) 677 if tree == CT_TREE_NONE { ss_jw("null" as *u8) } else { 678 var dir: *u8 = CT_DIR_PRIMARY 679 if tree == CT_TREE_SECONDARY { dir = CT_DIR_SECONDARY } 680 ct_build_path(dir, domain, suffix, path); ss_jq(path) 681 } 682 ss_jw(",\"bytes_read\":" as *u8); ss_jn(n) 683 ss_jw(",\"read_state\":" as *u8) 684 if n > 0 { ss_jq("read_complete" as *u8) } else { ss_jq("missing_or_unreadable_or_empty" as *u8) } 685 return ss_jw("}" as *u8) 686} 687func ss_bobservation(rank: *u8, p: i64, e: i64, scratch: *i64) -> i64 { 688 if p < 0 { return ss_jw("null" as *u8) } 689 // Retain exact producer fields without interpreting v/m/c as observed costs. 690 ss_jw("{\"record_type\":" as *u8); ss_bfield(rank, p, e, 0, scratch) 691 ss_jw(",\"fields_text\":[" as *u8) 692 var f: i64 = 1 693 while bf_field(rank, p, e, f, scratch) >= 0 { 694 if f > 1 { ss_jw("," as *u8) } 695 ss_bfield(rank, p, e, f, scratch); f = f+1 696 } 697 ss_jw("],\"raw_row\":" as *u8); ss_jqs(((rank as i64)+p) as *u8, e-p) 698 return ss_jw("}" as *u8) 699} 700// Caller-owned staging only. Exclusive creation refuses reuse and symlink targets. 701func ss_bout_ok(path: *u8) -> i64 { 702 let n: i64 = bf_slen(path) 703 let root: *u8 = "/tmp/" as *u8 704 let start: i64 = bf_slen(root) 705 if n <= start { return 0 } 706 if n >= SYS_PATH_MAX { return 0 } 707 if pb_equal(path, 0, start, root, 0, start) == 0 { return 0 } 708 if path[start] == (46 as u8) { return 0 } 709 var i: i64 = start 710 while i < n { 711 let c: i64 = path[i] as i64 712 var ok: i64 = 0 713 if c >= 97 { if c <= 122 { ok = 1 } } 714 if c >= 65 { if c <= 90 { ok = 1 } } 715 if c >= 48 { if c <= 57 { ok = 1 } } 716 if c == 95 { ok = 1 } 717 if c == 45 { ok = 1 } 718 if c == 46 { ok = 1 } 719 if ok == 0 { return 0 } 720 i = i+1 721 } 722 return 1 723} 724func ss_breceipt(path: *u8, domain: *u8, failed: i64) -> i64 { 725 // A receipt follows fsync and close. Failed files are retained for diagnosis only. 726 ss_json_stdout = 1 727 ss_jw("{\"v\":1,\"api\":\"nishi-measurement\",\"resource\":\"domain-bindings-artifact\",\"report_resource\":\"domain-bindings\",\"domain\":" as *u8); ss_jq(domain) 728 ss_jw(",\"status\":" as *u8) 729 if failed == 0 { ss_jq("ready" as *u8) } else { ss_jq("write_failed" as *u8) } 730 ss_jw(",\"ready\":" as *u8) 731 if failed == 0 { ss_jw("true" as *u8) } else { ss_jw("false" as *u8) } 732 ss_jw(",\"path\":" as *u8); ss_jq(path) 733 ss_jw(",\"bytes_written\":" as *u8); ss_jn(ss_json_bytes) 734 ss_jw(",\"retained_partial\":" as *u8) 735 if failed == 0 { ss_jw("false" as *u8) } else { ss_jw("true" as *u8) } 736 ss_jw(",\"atomic_publication\":false,\"sha256\":null}\n" as *u8) 737 if ss_json_failed != 0 { return 3 } 738 if failed != 0 { return 3 } 739 return 0 740} 741 742// Context slots: matrix pointer, bytes, selected tree, validation code, path pointer, observation epoch. 743func ss_bmatrix(domain: *u8) -> *i64 { 744 let ctx: *i64 = sys_mmap(6*8) as *i64 745 if (ctx as i64) <= 0 { return 0 as *i64 } 746 ctx[0]=0; ctx[1]=0; ctx[2]=CT_TREE_NONE; ctx[3]=PB_E_INPUT; ctx[4]=0; ctx[5]=sys_now_realtime_sec() 747 let path: *u8 = sys_mmap(CT_PATH_CAP) 748 if (path as i64) <= 0 { return ctx } 749 ctx[4]=path as i64 750 if bf_slen(domain)+bf_slen(CT_DIR_SECONDARY)+bf_slen(".matrix" as *u8)+1 > CT_PATH_CAP { return ctx } 751 var n: i64 = 0; var tree: i64 = CT_TREE_NONE 752 let picked: *u8 = ct_compare_readall_published(domain,".matrix" as *u8,&n,&tree) 753 sys_free_file(picked,n) 754 ctx[2]=tree 755 if tree == CT_TREE_NONE { return ctx } 756 var dir: *u8 = CT_DIR_PRIMARY 757 if tree == CT_TREE_SECONDARY { dir=CT_DIR_SECONDARY } 758 ct_build_path(dir,domain,".matrix" as *u8,path) 759 let matrix: *u8 = pbm_read(path,&n) 760 if (matrix as i64) <= 0 { return ctx } 761 ctx[0]=matrix as i64; ctx[1]=n 762 let sym: *i64 = sys_mmap(3*8) as *i64 763 if (sym as i64) <= 0 { ctx[3]=PB_E_CAPACITY; return ctx } 764 var scratch: i64=0 765 ctx[3]=pbm_validate(matrix,n,&scratch,sym) 766 sys_munmap(sym as *u8,3*8) 767 return ctx 768} 769func ss_bmatrix_free(ctx: *i64) -> i64 { 770 if (ctx as i64) <= 0 { return 0 } 771 if ctx[0] > 0 { sys_munmap(ctx[0] as *u8,ctx[1]+1) } 772 if ctx[4] > 0 { sys_munmap(ctx[4] as *u8,CT_PATH_CAP) } 773 sys_munmap(ctx as *u8,6*8); return 0 774} 775// Digest observations describe the same complete source buffer used by the declaration reader. 776// They do not certify a build, execution, immutable filesystem snapshot or behavior. 777func ss_bhash_fields(code: i64, digest: *u8) -> i64 { 778 ss_jw(",\"sha256\":" as *u8) 779 if code == 0 { 780 let alphabet: *u8="0123456789abcdef" as *u8 781 ss_jw("\"" as *u8); var i: i64=0 782 while i < SHA256_DIGEST_BYTES { 783 let b: i64=digest[i] as i64 784 ss_jraw(((alphabet as i64)+b/16) as *u8,1) 785 ss_jraw(((alphabet as i64)+b%16) as *u8,1); i=i+1 786 }; ss_jw("\"" as *u8) 787 } else { ss_jw("null" as *u8) } 788 ss_jw(",\"hash_observation\":{\"algorithm\":\"sha256\",\"scope\":\"exact_complete_buffer_used_for_declaration_observation\",\"status\":" as *u8) 789 if code == 0 { ss_jq("computed" as *u8) } else { ss_jq("failed" as *u8) } 790 ss_jw(",\"code\":" as *u8); ss_jn(code); ss_jw(",\"reason\":" as *u8) 791 if code == 0 { ss_jw("null" as *u8) } else { 792 var reason: *u8="checked_digest_refused" as *u8 793 if code == SHA256_E_INPUT { reason="digest_input_refused" as *u8 } 794 if code == SHA256_E_WORKSPACE { reason="digest_workspace_refused" as *u8 } 795 if code == SHA256_E_MAPPING { reason="digest_mapping_unavailable" as *u8 } 796 if code == SHA256_E_RELEASE { reason="digest_workspace_release_failed" as *u8 } 797 ss_jq(reason) 798 }; return ss_jw("}" as *u8) 799} 800func ss_bhash_unavailable(reason: *u8) -> i64 { 801 ss_jw(",\"sha256\":null,\"hash_observation\":{\"algorithm\":\"sha256\",\"scope\":\"exact_complete_buffer_used_for_declaration_observation\",\"status\":\"not_attempted\",\"code\":null,\"reason\":" as *u8) 802 ss_jq(reason); return ss_jw("}" as *u8) 803} 804 805func ss_bdecl(matrix: *u8, p: i64, e: i64, contract: *u8, co: i64, cn: i64) -> i64 { 806 ss_jw("{\"ruler\":\"nx_symdecl_lib.sd_declared_buf\",\"scope\":\"column_zero_identifier_boundary_declaration\",\"syntax_verified\":false,\"behavior_verified\":false,\"observed_unix\":" as *u8) 807 ss_jn(sys_now_realtime_sec()) 808 var off: i64=0; let pn: i64=bf_field(matrix,p,e,1,&off) 809 if pn <= 0 { ss_bhash_unavailable("source_path_unavailable" as *u8); return ss_jw(",\"result\":\"unobservable\",\"reason\":\"source_path_unavailable\"}" as *u8) } 810 let extra: i64=bf_slen(EP_ROOT)+bf_slen(EP_BUILDROOT)+4+SHA256_DIGEST_BYTES 811 if pn > PB_I64_MAX-extra { ss_json_failed=1; return 0 } 812 if cn >= PB_I64_MAX { ss_json_failed=1; return 0 } 813 let name: *u8=sys_mmap(pn+1); let ident: *u8=sys_mmap(cn+1) 814 let rcap: i64=pn+bf_slen(EP_ROOT)+bf_slen(EP_BUILDROOT)+4+SHA256_DIGEST_BYTES 815 let resolved: *u8=sys_mmap(rcap) 816 if (name as i64) <= 0 { ss_json_failed=1; return 0 } 817 if (ident as i64) <= 0 { sys_munmap(name,pn+1); ss_json_failed=1; return 0 } 818 if (resolved as i64) <= 0 { sys_munmap(name,pn+1); sys_munmap(ident,cn+1); ss_json_failed=1; return 0 } 819 var i: i64=0 820 while i < pn { name[i]=matrix[off+i]; i=i+1 }; name[pn]=0 as u8 821 i=0; while i < cn { ident[i]=contract[co+i]; i=i+1 }; ident[cn]=0 as u8 822 var result: *u8="unobservable" as *u8 823 var reason: *u8="source_unavailable_or_incomplete" as *u8 824 var n: i64=0-1; var found: i64=0; var hash_emitted: i64=0 825 if sd_ends(name,".nx" as *u8) == 0 { result="unsupported" as *u8; reason="ruler_requires_nishi_source" as *u8 } else { 826 found=ep_artifact_path(resolved,name) 827 if found == 1 { 828 let source: *u8=pbm_read(resolved,&n) 829 if (source as i64) > 0 { 830 if pb_input_ok(source,n) == 1 { 831 result="absent" as *u8; reason="complete_source_has_no_matching_declaration_text" as *u8 832 if sd_declared_buf(source,n,ident) == 1 { result="present" as *u8; reason="matching_declaration_text_observed" as *u8 } 833 // The final32 reserved bytes are beyond the complete original path capacity. 834 let digest: *u8=((resolved as i64)+rcap-SHA256_DIGEST_BYTES) as *u8 835 let hash_code: i64=sha256_digest_checked_native(source,n,digest) 836 ss_bhash_fields(hash_code,digest); hash_emitted=1 837 } else { reason="source_contains_invalid_nul" as *u8 } 838 sys_munmap(source,n+1) 839 } 840 } 841 } 842 if hash_emitted == 0 { ss_bhash_unavailable(reason) } 843 ss_jw(",\"resolved_path\":" as *u8) 844 if found == 1 { ss_jq(resolved) } else { ss_jw("null" as *u8) } 845 ss_jw(",\"bytes_read\":" as *u8); if n >= 0 { ss_jn(n) } else { ss_jw("null" as *u8) } 846 ss_jw(",\"result\":" as *u8); ss_jq(result); ss_jw(",\"reason\":" as *u8); ss_jq(reason) 847 ss_jw(",\"limitations\":[\"Text rule accepts six declaration kinds and does not parse comments, multiline strings, function bodies or compiler validity\",\"Resolved source observation is not a deployed binary, behavior receipt or immutable snapshot\"]}" as *u8) 848 sys_munmap(name,pn+1); sys_munmap(ident,cn+1); sys_munmap(resolved,rcap); return 0 849} 850func ss_bjoin(plan: *u8, co: i64, cn: i64, ctx: *i64) -> i64 { 851 var status: *u8="matrix_unobservable" as *u8 852 var matches: i64=0; var canmatch: i64=0 853 let sym: *i64=sys_mmap(3*8) as *i64 854 if (sym as i64) <= 0 { ss_json_failed=1; return 0 } 855 var scratch: i64=0 856 let contract_state: i64=pbm_contract(plan,co,cn,sym) 857 var effective_start: i64=co; var effective_len: i64=cn; var plan_form: i64=0-1 858 if contract_state == 1 { effective_start=sym[0]; effective_len=sym[1]-sym[0]; plan_form=sym[2] } 859 if contract_state == 0 { status="no_contract_symbol" as *u8 } else { 860 if contract_state < 0 { status="unsupported_contract_symbol" as *u8 } else { 861 if (ctx as i64) > 0 { 862 if ctx[0] > 0 { 863 if ctx[3] < 0 { status="matrix_invalid" as *u8 } else { 864 canmatch=1; matches=pbm_count(ctx[0] as *u8,ctx[1],plan,effective_start,effective_len,&scratch,sym) 865 status="unmatched" as *u8 866 if matches == 1 { status="unique" as *u8 } 867 if matches > 1 { status="ambiguous" as *u8 } 868 } 869 } 870 } 871 } 872 } 873 ss_jw("{\"status\":" as *u8); ss_jq(status) 874 ss_jw(",\"plan_symbol_scope\":\"effective_symbol_via_existing_msym_reader_raw_contract_retained\",\"plan_symbol_form\":" as *u8) 875 if contract_state == 0 { ss_jq("none" as *u8) } else { 876 if contract_state < 0 { ss_jq("unsupported" as *u8) } else { 877 if plan_form == 2 { ss_jq("withheld" as *u8) } else { if plan_form == 1 { ss_jq("watch" as *u8) } else { ss_jq("ordinary" as *u8) } } 878 } 879 } 880 ss_jw(",\"effective_contract_symbol\":" as *u8) 881 if contract_state == 1 { ss_jqs(((plan as i64)+effective_start) as *u8,effective_len) } else { ss_jw("null" as *u8) } 882 ss_jw(",\"plan_declared_gap\":" as *u8) 883 if contract_state != 1 { ss_jw("null" as *u8) } else { if plan_form == 0 { ss_jw("false" as *u8) } else { ss_jw("true" as *u8) } } 884 ss_jw(",\"plan_precondition_path\":" as *u8) 885 if plan_form == 2 { 886 let pre: i64=msym_withheld_pre_start(plan,co,co+cn) 887 ss_jqs(((plan as i64)+pre) as *u8,co+cn-pre) 888 } else { ss_jw("null" as *u8) } 889 ss_jw(",\"plan_precondition_verified\":false" as *u8) 890 ss_jw(",\"match_rule\":\"exact_plan_contract_symbol_to_matrix_effective_symbol\",\"matching_rows\":" as *u8) 891 if canmatch == 1 { ss_jn(matches) } else { ss_jw("null" as *u8) } 892 ss_jw(",\"matrix_source\":" as *u8) 893 if (ctx as i64) <= 0 { ss_jw("null" as *u8) } else { 894 ss_jw("{\"path\":" as *u8) 895 if ctx[2] != CT_TREE_NONE { if ctx[4] > 0 { ss_jq(ctx[4] as *u8) } else { ss_jw("null" as *u8) } } else { ss_jw("null" as *u8) } 896 ss_jw(",\"bytes_read\":" as *u8); ss_jn(ctx[1]); ss_jw(",\"validation_code\":" as *u8); ss_jn(ctx[3]) 897 ss_jw(",\"observed_unix\":" as *u8); ss_jn(ctx[5]); ss_jw(",\"complete\":" as *u8) 898 if ctx[0] > 0 { ss_jw("true" as *u8) } else { ss_jw("false" as *u8) }; ss_jw("}" as *u8) 899 } 900 ss_jw(",\"candidates\":[" as *u8) 901 if canmatch == 1 { 902 let matrix: *u8=ctx[0] as *u8; var p: i64=0; var ordinal: i64=0; var emitted: i64=0 903 while p < ctx[1] { 904 let raw: i64=bf_line_end(matrix,ctx[1],p); let e: i64=pb_trim_cr(matrix,p,raw) 905 if pbm_row_kind(matrix,p,e) == 1 { 906 ordinal=ordinal+1 907 if pbm_matches(matrix,p,e,plan,effective_start,effective_len,&scratch,sym) == 1 { 908 if emitted > 0 { ss_jw("," as *u8) }; emitted=emitted+1 909 ss_jw("{\"matrix_row_ordinal\":" as *u8); ss_jn(ordinal) 910 ss_jw(",\"byte_offset\":" as *u8); ss_jn(p); ss_jw(",\"raw_row\":" as *u8); ss_jqs(((matrix as i64)+p) as *u8,e-p) 911 ss_jw(",\"source_path\":" as *u8); ss_bfield(matrix,p,e,1,&scratch) 912 ss_jw(",\"symbol_field\":" as *u8); ss_bfield(matrix,p,e,2,&scratch) 913 ss_jw(",\"effective_symbol\":" as *u8); ss_jqs(((plan as i64)+effective_start) as *u8,effective_len) 914 ss_jw(",\"symbol_form\":" as *u8) 915 if sym[2] == 2 { ss_jq("withheld" as *u8) } else { if sym[2] == 1 { ss_jq("watch" as *u8) } else { ss_jq("ordinary" as *u8) } } 916 ss_jw(",\"declared_gap\":" as *u8); if sym[2] == 0 { ss_jw("false" as *u8) } else { ss_jw("true" as *u8) } 917 ss_jw(",\"precondition_path\":" as *u8) 918 if sym[2] == 2 { 919 let sl: i64=bf_field(matrix,p,e,2,&scratch) 920 let start: i64=msym_withheld_pre_start(matrix,scratch,scratch+sl) 921 ss_jqs(((matrix as i64)+start) as *u8,scratch+sl-start) 922 } else { ss_jw("null" as *u8) } 923 ss_jw(",\"precondition_verified\":false,\"declaration_observation\":" as *u8) 924 ss_bdecl(matrix,p,e,plan,effective_start,effective_len); ss_jw("}" as *u8) 925 } 926 } 927 p=raw+1 928 } 929 } 930 sys_munmap(sym as *u8,3*8) 931 return ss_jw("],\"completion_inferred\":false}" as *u8) 932} 933func ss_bindings(argc: i64, argv: *i64) -> i64 { 934 ss_json_stdout = 1; ss_json_fd = 0-1; ss_json_failed = 0; ss_console_fd = 0-1 935 ss_json_bytes = 0 936 if argc != 3 { if argc != 4 { return ss_berror("usage: nx_sota_status bindings <domain> [output-path]" as *u8, PB_E_INPUT) } } 937 var output_path: *u8 = 0 as *u8 938 if argc == 4 { 939 output_path = argv[3] as *u8 940 if ss_bout_ok(output_path) == 0 { return ss_berror("bad_output_path: expected direct /tmp basename" as *u8, PB_E_INPUT) } 941 } 942 let domain: *u8 = argv[2] as *u8 943 if ss_bdomain(domain) == 0 { return ss_berror("bad_domain" as *u8, PB_E_INPUT) } 944 if ep_anchor() < 0 { return ss_berror("estate_anchor_unavailable" as *u8, PB_E_INPUT) } 945 let pn: *i64 = sys_mmap(8) as *i64 946 let rn: *i64 = sys_mmap(8) as *i64 947 let pt: *i64 = sys_mmap(8) as *i64 948 let rt: *i64 = sys_mmap(8) as *i64 949 let stats: *i64 = sys_mmap(PB_STATS_SLOTS*8) as *i64 950 let scratch: *i64 = sys_mmap(8) as *i64 951 let path: *u8 = sys_mmap(CT_PATH_CAP) 952 if (pn as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 953 if (rn as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 954 if (pt as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 955 if (rt as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 956 if (stats as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 957 if (scratch as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 958 if (path as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 959 let plan: *u8 = ct_compare_readall_published(domain, ".plan" as *u8, pn, pt) 960 if pn[0] <= 0 { return ss_berror("plan_missing_or_unreadable_or_empty" as *u8, PB_E_INPUT) } 961 if pb_input_ok(plan, pn[0]) == 0 { return ss_berror("plan_invalid_bytes" as *u8, PB_E_INPUT) } 962 let capacity: i64 = bf_count_rows(plan, pn[0], LD_RUNG_TAG) 963 if capacity > (PB_I64_MAX/8)/PB_ROW_SLOTS-1 { return ss_berror("row_capacity_overflow" as *u8, PB_E_CAPACITY) } 964 let rows: *i64 = sys_mmap((capacity+1)*PB_ROW_SLOTS*8) as *i64 965 if (rows as i64) <= 0 { return ss_berror("allocation_failed" as *u8, PB_E_CAPACITY) } 966 let count: i64 = pb_plan_scan(plan, pn[0], rows, capacity, stats, scratch) 967 if count < 0 { return ss_berror("plan_projection_refused" as *u8, count) } 968 let rank: *u8 = ct_compare_readall_published(domain, ".rank" as *u8, rn, rt) 969 let joined: i64 = pb_rank_join(domain, plan, rank, rn[0], rows, count, stats, scratch) 970 var original_stamp: i64 = PB_E_STAMP 971 if rn[0] > 0 { if pb_input_ok(rank, rn[0]) == 1 { original_stamp = pb_rank_stamp(domain, rank, rn[0]) } } 972 let matrix_ctx: *i64 = ss_bmatrix(domain) 973 if argc == 4 { 974 let output_fd: i64 = sys_openat_exclusive(output_path, SS_BINDING_SNAPSHOT_MODE) 975 if output_fd < 0 { return ss_berror("output_open_refused" as *u8, output_fd) } 976 ss_json_fd = output_fd; ss_json_stdout = 0 977 } 978 ss_jw("{\"v\":1,\"api\":\"nishi-measurement\",\"resource\":\"domain-bindings\",\"status\":\"ok\",\"producer\":\"nx_sota_status\",\"domain\":" as *u8); ss_jq(domain) 979 ss_jw(",\"generated_unix\":" as *u8); ss_jn(sys_now_realtime_sec()) 980 ss_jw(",\"evidence_scope\":\"authored_contracts_and_retained_rank_snapshot\",\"plan_source\":" as *u8); ss_bsource(domain, ".plan" as *u8, pt[0], pn[0], path) 981 ss_jw(",\"source_binding_scope\":\"exact_matrix_symbol_join_and_separate_declaration_text_observation\"" as *u8) 982 ss_jw(",\"declared_rung_count\":" as *u8); ss_jn(count) 983 ss_jw(",\"declared_unit_rows\":[" as *u8) 984 var p: i64 = 0 985 var units: i64 = 0 986 while p < pn[0] { 987 let raw: i64 = bf_line_end(plan, pn[0], p) 988 let e: i64 = pb_trim_cr(plan, p, raw) 989 if bf_line_starts(plan, p, e, "unit|" as *u8) == 1 { 990 if units > 0 { ss_jw("," as *u8) } 991 ss_jqs(((plan as i64)+p) as *u8, e-p); units = units+1 992 } 993 p = raw+1 994 } 995 ss_jw("],\"rank_snapshot\":{\"source\":" as *u8); ss_bsource(domain, ".rank" as *u8, rt[0], rn[0], path) 996 ss_jw(",\"join_status\":" as *u8) 997 if joined == PB_OK { ss_jq("reconciled" as *u8) } else { 998 if joined == PB_RANK_MISSING { ss_jq("unavailable" as *u8) } else { ss_jq("unreconciled" as *u8) } 999 } 1000 ss_jw(",\"join_code\":" as *u8); ss_jn(joined) 1001 ss_jw(",\"original_asof_unix\":" as *u8) 1002 if original_stamp > 0 { ss_jn(original_stamp) } else { ss_jw("null" as *u8) } 1003 ss_jw(",\"freshness\":null,\"ordered_count\":" as *u8); ss_jn(stats[PB_S_ORDERED]) 1004 ss_jw(",\"finish_count\":" as *u8); ss_jn(stats[PB_S_FINISH]) 1005 ss_jw(",\"unmapped_count\":" as *u8); ss_jn(stats[PB_S_UNMAPPED]) 1006 ss_jw("},\"declared_rungs\":[" as *u8) 1007 var r: i64 = 0 1008 while r < count { 1009 if r > 0 { ss_jw("," as *u8) } 1010 let base: i64 = r*PB_ROW_SLOTS 1011 let start: i64 = rows[base+PB_PLAN_START] 1012 let end: i64 = rows[base+PB_PLAN_END] 1013 ss_jw("{\"id\":" as *u8); ss_bplanfield(plan, rows, base, LD_F_R_ID, scratch) 1014 ss_jw(",\"title\":" as *u8); ss_bplanfield(plan, rows, base, LD_F_R_TITLE, scratch) 1015 ss_jw(",\"contract_symbol\":" as *u8); ss_bplanfield(plan, rows, base, PB_F_SYMBOL, scratch) 1016 ss_jw(",\"declared_done_rule\":" as *u8); ss_bplanfield(plan, rows, base, PB_F_DONE_RULE, scratch) 1017 ss_jw(",\"executor_class\":" as *u8); ss_bplanfield(plan, rows, base, PB_F_EXECUTOR, scratch) 1018 ss_jw(",\"estimate_text\":" as *u8); ss_bplanfield(plan, rows, base, PB_F_ESTIMATE, scratch) 1019 ss_jw(",\"dependencies_text\":" as *u8); ss_bplanfield(plan, rows, base, LD_F_R_DEPS, scratch) 1020 ss_jw(",\"source_record\":" as *u8); ss_bplanrecord(plan, rows, base, scratch) 1021 ss_jw(",\"ordered_observation\":" as *u8); ss_bobservation(rank, rows[base+PB_ORDER_START], rows[base+PB_ORDER_END], scratch) 1022 ss_jw(",\"finish_observation\":" as *u8); ss_bobservation(rank, rows[base+PB_FINISH_START], rows[base+PB_FINISH_END], scratch) 1023 ss_jw(",\"unmapped_observation\":" as *u8); ss_bobservation(rank, rows[base+PB_UNMAPPED_START], rows[base+PB_UNMAPPED_END], scratch) 1024 ss_jw(",\"behavior_evidence\":null,\"source_binding\":" as *u8) 1025 let contract_n: i64 = pb_plan_field(plan,rows,base,PB_F_SYMBOL,scratch) 1026 ss_bjoin(plan,scratch[0],contract_n,matrix_ctx) 1027 ss_jw(",\"api_binding\":null,\"mcp_binding\":null}" as *u8) 1028 r = r+1 1029 } 1030 ss_jw("],\"limitations\":[\"Authored contract symbols and done rules are declarations, not behavior or delivery verification\",\"Rank observations retain an independent original stamp; projection time does not refresh them\",\"Absent rank rows do not establish completion; finish and unmapped observations are not exclusive\",\"Estimates retain authored units and are not observed investment or savings\",\"Unfamiliar row shapes retain raw fields with unverified semantics null; actual function source, API and MCP bindings require separate evidence\"]}\n" as *u8) 1031 ss_bmatrix_free(matrix_ctx) 1032 sys_free_file(plan, pn[0]); sys_free_file(rank, rn[0]) 1033 if argc == 4 { 1034 if sys_fsync(ss_json_fd) < 0 { ss_json_failed = 1 } 1035 if sys_close(ss_json_fd) < 0 { ss_json_failed = 1 } 1036 ss_json_fd = 0-1 1037 return ss_breceipt(output_path, domain, ss_json_failed) 1038 } 1039 if ss_json_failed != 0 { return 3 } 1040 return 0 1041} 1042 1043func main(argc: i64, argv: *i64) -> i64 { 1044 ss_console_fd = 1 1045 ss_json_stdout = 0 1046 ss_json_fd = 0 - 1 1047 ss_json_failed = 0 1048 if argc > 1 { 1049 let binding_mode: *u8 = argv[1] as *u8 1050 if pb_equal(binding_mode, 0, bf_slen(binding_mode), "bindings" as *u8, 0, bf_slen("bindings" as *u8)) == 1 { 1051 return ss_bindings(argc, argv) 1052 } 1053 } 1054 if argc > 1 { 1055 let mode: *u8 = argv[1] as *u8 1056 if mode[0] == (106 as u8) { if mode[1] == (115 as u8) { if mode[2] == (111 as u8) { if mode[3] == (110 as u8) { if mode[4] == (0 as u8) { 1057 ss_json_stdout = 1 1058 ss_console_fd = 0 - 1 1059 } } } } } 1060 } 1061 // ★ANCHOR FIRST (2026-08-04). MEASURED: run from buildroot this board printed EMPTY PROVEN and 1062 // EMPTY MECH-OK sections -- i.e. "the estate has proven nothing" -- purely because 1063 // knowledge/compare and knowledge/status resolve relative to the CWD. An honesty gate that 1064 // reports an empty estate when run from the wrong directory is the most dangerous shape of 1065 // this bug, because a zero reads like a finding. 1066 ep_anchor() 1067 // STAMP-CACHE model: PROVEN reads the materialized verdict nx_swcompare_evidence wrote (fast AND live) -- 1068 // no 235s recompute. Freshness = the stamp's age; a domain never verified shows GATED-UNVERIFIED. 1069 let now: i64 = sys_now_realtime_sec() 1070 sw("=== NX-SOTA-STATUS: the cross-domain honesty gate (stamp-cached executed verdict) ===\n" as *u8) 1071 sw("run_epoch=" as *u8); sn(now); sw("\n" as *u8) 1072 1073 // Matrix wins over axes regardless of tree. Every pass shares capacity/error accounting. 1074 let arena: *u8 = sys_mmap(SS_ARENA_CAP) 1075 let doff: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1076 let dlen: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1077 let dsrc: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1078 let census: *i64 = sys_mmap(32) as *i64 1079 ss_discover(CT_DIR_PRIMARY, 0, arena, doff, dlen, dsrc, census) 1080 ss_discover(CT_DIR_SECONDARY, 0, arena, doff, dlen, dsrc, census) 1081 let n_matrix: i64 = census[0] 1082 ss_discover(CT_DIR_PRIMARY, 1, arena, doff, dlen, dsrc, census) 1083 ss_discover(CT_DIR_SECONDARY, 1, arena, doff, dlen, dsrc, census) 1084 let nd: i64 = census[0] 1085 let n_axes_only: i64 = nd - n_matrix 1086 let ss_capped: i64 = census[2] 1087 if ss_capped > 0 { sw("WARNING domain discovery omitted entries; ratios cover a partial census\n" as *u8) } 1088 if census[3] > 0 { sw("WARNING domain discovery has unreadable directory passes\n" as *u8) } 1089 1090 // ---- per-domain aggregate ---- 1091 let dtotal: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1092 let dpresent: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1093 let dtree: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1094 let dbytes: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1095 let dreason: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1096 let dcov: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1097 let dex: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1098 let dgap: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 1099 let dgates: *u8 = sys_mmap(SS_MAXD+2) 1100 let dproven: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 // EV_PROVEN(4)=stamp ok, EV_RED(3)=a method in dissent, EV_UNPROVEN(0), -1=gated-unverified, -2=claim-only. CORRECTED 2026-09-03: this comment used to read "1=PROVEN, 0=CLAIMED-RED" and was WRONG ON BOTH -- a per-domain ledger built on it classified 83 UNPROVEN domains as RED, caught only because the ledger reconciles its classes against the printed buckets. A HEADER IS NOT A MEASUREMENT. 1101 // MECH-OK was COUNTED but never stored per-domain, so the 9 domains behind that number could not be 1102 // NAMED by this organ or by any consumer of it. A COUNT WITHOUT ITS MEMBERS CANNOT BE ACTED ON: a 1103 // domain that EARNS executable evidence left the CLAIM-ONLY list and entered a bare integer, so every 1104 // downstream reader saw it VANISH. Measured 2026-07-31: the capability graph lost the `instrument` 1105 // node the moment instrument.gates landed and recorded the improvement as a REGRESSION (DOWN 39->38). 1106 let dmech: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 // 1 = mechanistic leg holds (quorum+prov+fresh, no dissent) 1107 let depoch: *i64 = sys_mmap((SS_MAXD+2)*8) as *i64 // stamp epoch (freshness) 1108 var tot_ex: i64 = 0 1109 var tot_gap: i64 = 0 1110 var tot_present: i64 = 0 1111 var backed: i64 = 0 1112 var proven: i64 = 0 1113 var claimed_red: i64 = 0 1114 var gated_unver: i64 = 0 1115 var oldest_age: i64 = 0 1116 var n_stale: i64 = 0 1117 var n_vacuous: i64 = 0 1118 var n_unproven: i64 = 0 1119 var n_mech: i64 = 0 1120 let pol: *i64 = sys_mmap(EV_P_SLOTS*8) as *i64 1121 pol[EV_P_TTL] = ss_conf_num("ttl_sec=" as *u8, 8, SS_DEF_TTL_SEC) 1122 pol[EV_P_MINCLASSES] = ss_conf_num("min_classes=" as *u8, 12, SS_DEF_MIN_CLASSES) 1123 // ★PER-DOMAIN, because the policy was already WRITTEN per-domain and only ENFORCED globally. 1124 // evidence_policy.conf says verbatim: "Set to 0 only for a DOMAIN where you have consciously decided 1125 // machine agreement is sufficient" -- but this was read once, outside the loop, so that escape hatch 1126 // did not exist and the only way to use it was to disable the clause for all 40 domains at once. 1127 // A blanket require_human=1 demands a signature for claims a human cannot judge better than the gate 1128 // ("does the ledger reconcile", "does the resolver refuse an unresolvable path"). That is ceremony, and 1129 // a clause that cannot be honestly satisfied is the guard-that-produces-a-bypass defect: the board sat 1130 // at 0/40 for 13.9 days. The human leg is real evidence exactly where a human is the ONLY competent 1131 // instrument -- rendered output, product fit, a safety call -- and decoration everywhere else. 1132 let g_reqhuman: i64 = ss_conf_num("require_human=" as *u8, 14, SS_DEF_REQ_HUMAN) 1133 pol[EV_P_REQHUMAN] = g_reqhuman 1134 let path: *u8 = sys_mmap(512) 1135 var di: i64 = 0 1136 while di < nd { 1137 // path = knowledge/compare/<dom>.matrix 1138 var o: i64 = 0 1139 let pre: *u8 = "knowledge/compare/\x00" as *u8 1140 var k: i64 = 0 1141 while pre[k] != (0 as u8) { path[o] = pre[k]; o = o + 1; k = k + 1 } 1142 k = 0 1143 while k < dlen[di] { path[o] = arena[doff[di]+k]; o = o + 1; k = k + 1 } 1144 let mstart: i64 = o 1145 var msuf: *u8 = ".matrix\x00" as *u8 1146 if dsrc[di] == 1 { msuf = ".axes\x00" as *u8 } 1147 k = 0 1148 while msuf[k] != (0 as u8) { path[o] = msuf[k]; o = o + 1; k = k + 1 } 1149 path[o] = 0 as u8 1150 // read + classify. ★TWO TREES, ONE READER (2026-09-01, debt 1788268797). MEASURED: the domain set 1151 // above is discovered from BOTH trees, but this read resolved only the bare one -- so every domain 1152 // whose .matrix lives only in buildroot read ZERO ROWS and published cov=0 exceed=0 gaps=0. All 1153 // three counters go to zero TOGETHER, which is the fingerprint of a row reader that returned 1154 // nothing, NOT of a board with no coverage: mediaingest reported gaps=0 while its matrix carries 1155 // four _ABSENT_ rows. 45 of the ~96 matrices are in the bare tree, so the published moat and the 1156 // frontier gap count were computed over fewer than half the boards while the ratio still read like 1157 // the whole estate. ct_compare_readall_published probes the bare tree FIRST, exactly as this code 1158 // did, so a domain that already resolved is byte-for-byte unchanged: this can only turn a zero-row 1159 // read into a real one, never the reverse. 1160 let lp: *i64 = sys_mmap(16) as *i64 1161 lp[0] = 0 1162 let mwhich: *i64 = sys_mmap(16) as *i64 1163 mwhich[0] = 0 1164 let mdom: *u8 = ((arena as i64) + doff[di]) as *u8 1165 let mb: *u8 = ct_compare_readall_published(mdom, msuf, lp, mwhich) 1166 dtree[di] = mwhich[0] 1167 dbytes[di] = lp[0] 1168 dreason[di] = ("no_executable_evidence" as *u8) as i64 1169 var ex: i64 = 0 1170 var pr: i64 = 0 1171 var gp: i64 = 0 1172 if lp[0] > 0 { 1173 var ls: i64 = 0 1174 var p: i64 = 0 1175 while p <= lp[0] { 1176 var eol: i64 = 0 1177 if p == lp[0] { eol = 1 } else { if mb[p] == (10 as u8) { eol = 1 } } 1178 if eol == 1 { 1179 let cl: i64 = classify(mb, ls, p) 1180 if cl == 0 { gp = gp + 1 } 1181 if cl == 1 { pr = pr + 1 } 1182 if cl == 2 { ex = ex + 1 } 1183 ls = p + 1 1184 } 1185 p = p + 1 1186 } 1187 } 1188 // An .axes spec makes NO head-to-head claim: its field 3 is frontier KEYWORDS, not the 0/1 1189 // nishiExceed flag, so classify()'s `buf[p3+1]=='1'` test would read a keyword's first byte and 1190 // could mint a PHANTOM EXCEED. Coverage is real evidence here; a moat claim is not. Fold any such 1191 // row back into present and zero the exceed -- never let a format difference manufacture a moat. 1192 if dsrc[di] == 1 { pr = pr + ex; ex = 0 } 1193 // gates existence: knowledge/compare/<dom>.gates 1194 var go2: i64 = mstart 1195 let gsuf: *u8 = ".gates\x00" as *u8 1196 k = 0 1197 while gsuf[k] != (0 as u8) { path[go2] = gsuf[k]; go2 = go2 + 1; k = k + 1 } 1198 path[go2] = 0 as u8 1199 // Gates use the shared authored order, including the second-tree fallback. 1200 let gwhich: *i64 = sys_mmap(16) as *i64 1201 let gprobe: *u8 = sys_mmap(1) 1202 let gread: i64 = ct_compare_read_authored(mdom, gsuf, gprobe, 1, gwhich) 1203 var hg: i64 = 0 1204 if gread > 0 { hg = 1 } 1205 dgates[di] = hg as u8 1206 // DEEP verdict: a .gates FILE is not evidence -- fork nx_swcompare_evidence and require MEASURED-HONEST 1207 // (gate executes green AND every claimed axis grounds in real source). Unfakeable by construction. 1208 if hg == 1 { 1209 backed = backed + 1 1210 let rec: *i64 = sys_mmap(EV_R_SLOTS*8) as *i64 1211 // rsn carries the referee's own reason WORD out of the loader. Cleared before the call so an 1212 // absent key can never leave a previous domain's reason standing -- a stale reason is worse 1213 // than none, because it reads as a measurement of THIS board. 1214 let rsn: *u8 = sys_mmap(EVP_WORD_CAP) 1215 rsn[0] = 0 as u8 1216 let had: i64 = ss_stamp_load(arena, doff[di], dlen[di], rec, rsn) 1217 dreason[di] = rsn as i64 1218 if had < 0 { 1219 dreason[di] = ("no_stamp" as *u8) as i64 1220 dproven[di] = 0 - 1 1221 gated_unver = gated_unver + 1 1222 depoch[di] = 0 1223 } else { 1224 ss_class_load(arena, doff[di], dlen[di], now, pol[EV_P_TTL], rec) 1225 // resolve require_human FOR THIS DOMAIN: `require_human.<domain>=` overrides the global. 1226 // The decision stays in config (rule 11/17) so "why does this domain not need a human?" 1227 // points at a key with a written justification beside it, not at an agent's judgement. 1228 let hk: *u8 = sys_mmap(128) 1229 var hn: i64 = 0 1230 let hpre: *u8 = "require_human.\x00" as *u8 1231 var hj: i64 = 0 1232 while hpre[hj] != (0 as u8) { hk[hn] = hpre[hj]; hn = hn + 1; hj = hj + 1 } 1233 hj = 0 1234 while hj < dlen[di] { hk[hn] = arena[doff[di]+hj]; hn = hn + 1; hj = hj + 1 } 1235 hk[hn] = 61 as u8; hn = hn + 1 1236 hk[hn] = 0 as u8 1237 pol[EV_P_REQHUMAN] = ss_conf_num(hk, hn, g_reqhuman) 1238 var v: i64 = ev_verdict(rec, pol, now) 1239 // ★THE ABSTENTION IS A CEILING, NEVER A FLOOR (2026-09-01). When the referee could not 1240 // grade the board it reports UNPROVEN, and this consumer must say the SAME WORD. It is 1241 // not RED -- no method ran and reported failure -- and it is not PROVEN, STALE or 1242 // VACUOUS either, because each of those asserts something about a measurement that did 1243 // not happen. FORCED rather than left to the cascade: a fully-gated board read only in 1244 // PREFIX could otherwise satisfy every clause and publish as PROVEN off a partial read, 1245 // which is the exact laundering this state exists to stop. EV_UNPROVEN is the lowest 1246 // value in the ordered verdict set, so this can only ever downgrade. 1247 if had == SS_STAMP_UNPROVEN { 1248 v = EV_UNPROVEN 1249 sw(" [abstain] " as *u8) 1250 swn(arena, doff[di], dlen[di]) 1251 sw(" the referee could not grade this board: unproven_reason=" as *u8); sw(rsn) 1252 sw(" -- evidence DEBT, not a method in dissent, and deliberately not a deploy block\n" as *u8) 1253 } 1254 // ★WHY-LINE (permanent capability, not debug spam). ev_verdict is a CASCADE that returns 1255 // one word; a reader seeing UNPROVEN cannot tell WHICH clause refused, and the display 1256 // category ("MECH-OK") is computed elsewhere and is NOT an ev_verdict value -- so the two 1257 // surfaces disagree in vocabulary at exactly the moment you need them to agree. Printed 1258 // ONLY for domains that actually carry attestation rows (classmask beyond bare MECH), so 1259 // it stays 1-2 lines, never 41. This exists because a signed oracle row that at_verify_row 1260 // ACCEPTS standalone (rc=0) still failed to lift a domain, and nothing on any surface said 1261 // which clause ate it. A verdict that cannot name its own refusal costs hours per incident. 1262 if rec[EV_R_CLASSMASK] != EV_CLASS_MECH { 1263 sw(" [why] " as *u8) 1264 sys_write(ss_console_fd, ((arena as i64)+doff[di]) as *u8, dlen[di]) 1265 sw(" classmask=" as *u8); sn(rec[EV_R_CLASSMASK]) 1266 sw(" classes=" as *u8); sn(ev_class_count(rec[EV_R_CLASSMASK])) 1267 sw("/" as *u8); sn(pol[EV_P_MINCLASSES]) 1268 sw(" reqhuman=" as *u8); sn(pol[EV_P_REQHUMAN]) 1269 sw(" redseen=" as *u8); sn(rec[EV_R_REDSEEN]) 1270 sw(" verdict=" as *u8); sys_write(ss_console_fd, ev_verdict_name(v), 8) 1271 sw("\n" as *u8) 1272 } 1273 dproven[di] = v 1274 depoch[di] = rec[EV_R_EPOCH] 1275 if v == EV_PROVEN { proven = proven + 1 } 1276 if v == EV_RED { claimed_red = claimed_red + 1 } 1277 if v == EV_STALE { n_stale = n_stale + 1 } 1278 if v == EV_VACUOUS { n_vacuous = n_vacuous + 1 } 1279 if v == EV_UNPROVEN { n_unproven = n_unproven + 1 } 1280 let age: i64 = now - rec[EV_R_EPOCH] 1281 if age > oldest_age { oldest_age = age } 1282 // The mechanistic leg alone, scored honestly: quorum + provenance + freshness, WITHOUT the 1283 // triangulation clause. This is not a softer bar to hide behind -- it is the diagnostic that 1284 // tells us how far a domain is from real proof, and which leg is the one still missing. 1285 if ev_quorum_ok(rec[EV_R_GREEN], rec[EV_R_RAN], rec[EV_R_DECLARED]) == 1 { 1286 if ev_prov_ok(rec[EV_R_HOSTLEN], rec[EV_R_DIGLEN]) == 1 { 1287 if ev_fresh_ok(rec[EV_R_EPOCH], now, pol[EV_P_TTL]) == 1 { 1288 if rec[EV_R_DISSENT] == 0 { if had != SS_STAMP_UNPROVEN { 1289 // MECH-OK asserts THE MECHANISTIC LEG HOLDS. A board the referee could 1290 // not finish reading has not earned that: its grounding census is a 1291 // PREFIX. Clearing dissent above must not silently promote it here -- 1292 // that would trade a false RED for a false GREEN, which is worse, and it 1293 // is the half of this fix that is easy to forget because the dissent slot 1294 // is read TWICE: once by ev_verdict and once by this diagnostic. 1295 n_mech = n_mech + 1 1296 dmech[di] = 1 1297 } } 1298 } 1299 } 1300 } 1301 } 1302 } else { dproven[di] = 0 - 2 } 1303 let tot: i64 = ex + pr + gp 1304 var cov: i64 = 0 1305 if tot > 0 { cov = (ex + pr) * 1000 / tot } 1306 dtotal[di] = tot; dpresent[di] = pr 1307 dcov[di] = cov; dex[di] = ex; dgap[di] = gp 1308 sys_free_file(mb, lp[0]) 1309 tot_ex = tot_ex + ex; tot_gap = tot_gap + gp; tot_present = tot_present + pr 1310 di = di + 1 1311 } 1312 1313 // ---- headline honesty numbers ---- 1314 sw("\n-- WHERE WE STAND --\n" as *u8) 1315 sw("compare domains graded: " as *u8); sn(nd) 1316 sw(" (.matrix head-to-head " as *u8); sn(n_matrix) 1317 sw(" + .axes coverage-only " as *u8); sn(n_axes_only) 1318 sw(")\n" as *u8) 1319 // THE DENOMINATOR IS ITSELF A CLAIM. This gate grades what owns a LOCAL evidence file. Domains whose 1320 // /compare page is emitted straight from an organ carry no such file, are NOT graded here, and must 1321 // never be read as covered -- that is precisely how a 41/41 came to be quoted as an estate-wide 1000. 1322 sw(" NOT estate-wide: ungraded domains publish from an organ with no local evidence file -- reconcile against nishi_compare_index before quoting this ratio\n" as *u8) 1323 sw("PROVEN (all gates green + fresh + provenanced + non-vacuous + TRIANGULATED): " as *u8); sn(proven); sw(" / " as *u8); sn(nd) 1324 sw(" <- the honesty ratio = " as *u8); sn(ev_honesty_permil(proven, nd)); sw(" permil. TTL=" as *u8); sn(pol[EV_P_TTL]) 1325 sw("s, min method classes=" as *u8); sn(pol[EV_P_MINCLASSES]); sw("; oldest stamp age=" as *u8); sn(oldest_age); sw("s\n" as *u8) 1326 sw("MECH-OK (quorum+provenance+freshness hold; awaiting a 2nd independent method class): " as *u8); sn(n_mech); sw("\n" as *u8) 1327 if claimed_red > 0 { sw("RED (a method in dissent, or a declared gate not green -- worse than claim-only): " as *u8); sn(claimed_red); sw("\n" as *u8) } 1328 if n_stale > 0 { sw("STALE (verdict older than the TTL -- a re-measure may disagree with it): " as *u8); sn(n_stale); sw("\n" as *u8) } 1329 if n_vacuous > 0 { sw("VACUOUS (gates never observed failing -- coverage is not detection): " as *u8); sn(n_vacuous); sw("\n" as *u8) } 1330 // The label now names the THIRD cause too. A bucket named for two causes that silently acquires a 1331 // third is how a reader plans against a number that is not what they think it is: an abstaining 1332 // referee lands here, and its remedy (find the board, or raise the read reserve) is nothing like 1333 // "go add a second method class". The per-domain [abstain] line above says which is which. 1334 if n_unproven > 0 { sw("UNPROVEN (no provenance, or only one method class backing it, or the REFEREE ITSELF ABSTAINED -- see the [abstain] lines above for which): " as *u8); sn(n_unproven); sw("\n" as *u8) } 1335 if gated_unver > 0 { sw("GATED-UNVERIFIED (has .gates but never run through the evidence layer): " as *u8); sn(gated_unver); sw("\n" as *u8) } 1336 sw("CLAIM-ONLY (matrix asserts coverage, no executable evidence): " as *u8); sn(nd - backed); sw("\n" as *u8) 1337 sw("UNIQUE capabilities (nishiExceed rows = the moat): " as *u8); sn(tot_ex); sw("\n" as *u8) 1338 sw("frontier GAPS (_ABSENT_ rows = the debt to the field): " as *u8); sn(tot_gap); sw("\n" as *u8) 1339 sw("axes measured PRESENT: " as *u8); sn(tot_present); sw("\n" as *u8) 1340 1341 // ---- the CLAIM-ONLY debt list (domains asserting coverage with NO executable evidence) ---- 1342 sw("\n-- CLAIM-ONLY domains (assert coverage, NO executable evidence = the evidence debt) --\n" as *u8) 1343 di = 0 1344 var shown: i64 = 0 1345 while di < nd { 1346 if dgates[di] == (0 as u8) { if shown < 60 { 1347 sw(" " as *u8); swn(arena, doff[di], dlen[di]) 1348 sw(" cov=" as *u8); sn(dcov[di]); sw(" exceed=" as *u8); sn(dex[di]); sw(" gaps=" as *u8); sn(dgap[di]); sw("\n" as *u8) 1349 shown = shown + 1 1350 } } 1351 di = di + 1 1352 } 1353 1354 // ---- PROVEN domains (stamp ok=1) with proof age ---- 1355 sw("\n-- PROVEN domains (executed gate GREEN + all claims grounded; stamp age shown) --\n" as *u8) 1356 di = 0 1357 while di < nd { 1358 if dproven[di] == EV_PROVEN { sw(" " as *u8); swn(arena, doff[di], dlen[di]); sw(" cov=" as *u8); sn(dcov[di]); sw(" proof_age=" as *u8); sn(now - depoch[di]); sw("s\n" as *u8) } 1359 di = di + 1 1360 } 1361 // ---- MECH-OK domains: the mechanistic leg HOLDS (quorum+provenance+freshness, no dissent) but the 1362 // second independent method class is still missing, so they are honestly short of PROVEN. These were 1363 // previously reported ONLY as a count, which made a domain that EARNED evidence unnameable and 1364 // therefore invisible to every downstream consumer. Listing them costs nothing and is the difference 1365 // between "9 domains improved" and "these 9 domains improved, go look". 1366 sw("\n-- MECH-OK domains (executed evidence GREEN; awaiting a 2nd independent method class) --\n" as *u8) 1367 di = 0 1368 while di < nd { 1369 if dmech[di] == 1 { sw(" " as *u8); swn(arena, doff[di], dlen[di]); sw(" cov=" as *u8); sn(dcov[di]); sw(" exceed=" as *u8); sn(dex[di]); sw(" gaps=" as *u8); sn(dgap[di]); sw("\n" as *u8) } 1370 di = di + 1 1371 } 1372 1373 // ---- CLAIMED-BUT-RED: has .gates but the evidence layer FAILED (a dropped gate or ungrounded claim) ---- 1374 if claimed_red > 0 { 1375 sw("\n-- CLAIMED-BUT-RED (has .gates but nx_swcompare_evidence FAILED -- fix before trusting) --\n" as *u8) 1376 di = 0 1377 while di < nd { 1378 if dproven[di] == EV_RED { sw(" " as *u8); swn(arena, doff[di], dlen[di]); sw(" (a declared gate not green, or a method in dissent)\n" as *u8) } 1379 di = di + 1 1380 } 1381 } 1382 1383 // ---- DEPLOY WIRING: emit the evidence log nx_deploy_ready reads (manifest row evidence-honesty). ---- 1384 // WHAT BLOCKS A DEPLOY, and why only this: a domain in RED means an independent method RAN and REPORTED 1385 // FAILURE. That is a fact about the code, and shipping over it is the exact behaviour this workstream 1386 // exists to stop. STALE / VACUOUS / UNPROVEN are evidence DEBT -- real, tracked, but not a statement 1387 // that anything is broken. Blocking every deploy on 0/40 PROVEN would halt all work within a day, and a 1388 // gate that halts all work gets disabled or routed around -- which is how a safety control becomes a 1389 // hack. A gate must bite exactly where the danger is, or it will not survive contact with the week. 1390 // ---- THE PER-DOMAIN BOARD LEDGER: the artifact nx_domain_admit C6 has had nothing to read ---- 1391 // Every row carries the class AND the numbers it was derived from, so a disagreeing consumer can say 1392 // WHICH field it disagrees about instead of just that it disagrees. Names are wrapped in spaces so a 1393 // downstream needle of the form space-name-space is an exact token and cannot match a substring. 1394 let bfd: i64 = sys_openat_wr("knowledge/status/sota_board.ledger\x00" as *u8, 0x1a4) 1395 if bfd >= 0 { 1396 var c_prov: i64 = 0 1397 var c_red: i64 = 0 1398 var c_mech: i64 = 0 1399 var c_gu: i64 = 0 1400 var c_co: i64 = 0 1401 var c_un: i64 = 0 1402 ss_wf(bfd, "NX-SOTA-BOARD-LEDGER one row per graded domain, truncate-written every run\n" as *u8) 1403 ss_wf(bfd, "run_epoch=" as *u8); ss_wnf(bfd, now); ss_wf(bfd, "\n" as *u8) 1404 di = 0 1405 while di < nd { 1406 let cls: i64 = ss_class(dgates[di] as i64, dproven[di], dmech[di]) 1407 if cls == SSC_PROVEN { c_prov = c_prov + 1 } 1408 if cls == SSC_RED { c_red = c_red + 1 } 1409 if cls == SSC_MECH { c_mech = c_mech + 1 } 1410 if cls == SSC_GATEDUNVER { c_gu = c_gu + 1 } 1411 if cls == SSC_CLAIMONLY { c_co = c_co + 1 } 1412 if cls == SSC_UNPROVEN { c_un = c_un + 1 } 1413 ss_wf(bfd, "domain= " as *u8) 1414 sys_write(bfd, ((arena as i64) + doff[di]) as *u8, dlen[di]) 1415 ss_wf(bfd, " class=" as *u8); ss_wf(bfd, ss_class_name(cls)) 1416 ss_wf(bfd, " cov=" as *u8); ss_wnf(bfd, dcov[di]) 1417 ss_wf(bfd, " exceed=" as *u8); ss_wnf(bfd, dex[di]) 1418 ss_wf(bfd, " gaps=" as *u8); ss_wnf(bfd, dgap[di]) 1419 ss_wf(bfd, " stamp_epoch=" as *u8); ss_wnf(bfd, depoch[di]) 1420 ss_wf(bfd, " stamp_age_s=" as *u8); ss_wnf(bfd, now - depoch[di]) 1421 ss_wf(bfd, "\n" as *u8) 1422 di = di + 1 1423 } 1424 // THE PARTITION MUST SUM, AND THE SUM MUST BE PRINTED. A partition you cannot reconcile is a 1425 // leak; one you can is a decision. This is also the only mechanical check that the ledger and the 1426 // buckets printed on stdout agree -- they are computed by different code, so if a bucket ever 1427 // drifts from the classifier the reconciliation line says so instead of the two quietly diverging. 1428 let csum: i64 = c_prov + c_red + c_mech + c_gu + c_co + c_un 1429 ss_wf(bfd, "LEDGER-PARTITION proven=" as *u8); ss_wnf(bfd, c_prov) 1430 ss_wf(bfd, " red=" as *u8); ss_wnf(bfd, c_red) 1431 ss_wf(bfd, " mech_ok=" as *u8); ss_wnf(bfd, c_mech) 1432 ss_wf(bfd, " gated_unverified=" as *u8); ss_wnf(bfd, c_gu) 1433 ss_wf(bfd, " claim_only=" as *u8); ss_wnf(bfd, c_co) 1434 ss_wf(bfd, " unproven=" as *u8); ss_wnf(bfd, c_un) 1435 ss_wf(bfd, " sum=" as *u8); ss_wnf(bfd, csum) 1436 ss_wf(bfd, " domains=" as *u8); ss_wnf(bfd, nd) 1437 ss_wf(bfd, "\n" as *u8) 1438 var agree: i64 = 1 1439 if csum != nd { agree = 0 } 1440 if c_prov != proven { agree = 0 } 1441 if c_red != claimed_red { agree = 0 } 1442 if c_mech != n_mech { agree = 0 } 1443 if c_co != (nd - backed) { agree = 0 } 1444 // SCOPE, DECLARED IN THE ARTIFACT RATHER THAN ASSUMED BY ITS READER: four classes are checked 1445 // here -- proven, red, mech_ok, claim_only. gated_unverified and unproven are deliberately NOT, 1446 // because the board unproven counter has a WIDER definition (no provenance OR only one method 1447 // class OR the referee itself abstained) that OVERLAPS mech_ok. Asserting equality on it would 1448 // be a false proof with an authoritative name, which is worse than leaving it unchecked. 1449 ss_wf(bfd, "SCOPE reconciled_classes=proven,red,mech_ok,claim_only unreconciled=gated_unverified,unproven reason=the-board-unproven-counter-overlaps-mech-ok-by-definition\n" as *u8) 1450 ss_wf(bfd, "LEDGER-RECONCILES-WITH-BUCKETS board_proven=" as *u8); ss_wnf(bfd, proven) 1451 ss_wf(bfd, " board_red=" as *u8); ss_wnf(bfd, claimed_red) 1452 ss_wf(bfd, " board_mech_ok=" as *u8); ss_wnf(bfd, n_mech) 1453 ss_wf(bfd, " board_claim_only=" as *u8); ss_wnf(bfd, nd - backed) 1454 ss_wf(bfd, "\n" as *u8) 1455 if agree == 1 { ss_wf(bfd, "verdict=GREEN the ledger classes reconcile with the printed buckets\n" as *u8) } 1456 if agree == 0 { ss_wf(bfd, "verdict=RED the ledger classes DISAGREE with the printed buckets -- one of the two is wrong and neither may be quoted until it is settled\n" as *u8) } 1457 sys_close(bfd) 1458 sw("board_ledger=knowledge/status/sota_board.ledger rows=" as *u8); sn(nd) 1459 sw(" reconciles=" as *u8); sn(agree); sw("\n" as *u8) 1460 } 1461 if bfd < 0 { sw("board_ledger=WRITE-FAILED (the classes above stand; only their durable per-domain form was lost)\n" as *u8) } 1462 1463 // Versioned native emission. Scores retain their existing meanings; unsupported 1464 // inventory/rung/benchmark joins stay null instead of manufacturing estate-wide proof. 1465 let jp: *u8 = sys_mmap(CT_PATH_CAP) 1466 var jpo: i64 = ct_cat(jp, 0, "knowledge/status/sota_board.json." as *u8) 1467 let jnum: *u8 = sys_mmap(32) 1468 var jtime: i64 = sys_now_realtime_us() 1469 var jdigits: i64 = 0 1470 while jtime > 0 { jnum[jdigits] = (48 + jtime % 10) as u8; jtime = jtime / 10; jdigits = jdigits + 1 } 1471 while jdigits > 0 { jdigits = jdigits - 1; jp[jpo] = jnum[jdigits]; jpo = jpo + 1 } 1472 jpo = ct_cat(jp, jpo, ".new" as *u8) 1473 // Exclusive temp creation prevents two observations from sharing a partial file. 1474 ss_json_fd = sys_openat_exclusive(jp, 0x1a4) 1475 if ss_json_fd < 0 { ss_json_failed = 1 } 1476 ss_jw("{\"v\":1,\"api\":\"nishi-measurement\",\"resource\":\"sota-board\",\"generated_unix\":" as *u8); ss_jn(now) 1477 ss_jw(",\"producer\":\"nx_sota_status\",\"scope\":{\"entity_kind\":\"domain\",\"graded_domains\":" as *u8); ss_jn(nd) 1478 ss_jw(",\"matrix_domains\":" as *u8); ss_jn(n_matrix) 1479 ss_jw(",\"axes_only_domains\":" as *u8); ss_jn(n_axes_only) 1480 ss_jw(",\"omitted_entries\":" as *u8); ss_jn(ss_capped) 1481 ss_jw(",\"unreadable_directory_passes\":" as *u8); ss_jn(census[3]) 1482 ss_jw(",\"local_discovery_complete\":" as *u8) 1483 if ss_capped == 0 { if census[3] == 0 { ss_jw("true" as *u8) } else { ss_jw("false" as *u8) } } else { ss_jw("false" as *u8) } 1484 ss_jw(",\"estate_total\":null,\"uncovered_entities\":null,\"estate_wide\":false}" as *u8) 1485 ss_jw(",\"policy\":{\"ttl_sec\":" as *u8); ss_jn(pol[EV_P_TTL]) 1486 ss_jw(",\"minimum_method_classes\":" as *u8); ss_jn(pol[EV_P_MINCLASSES]) 1487 ss_jw("},\"limitations\":[\"Local matrix and axes census; Compare and capability inventories are not yet reconciled\",\"Presence is not maturity, benchmark quality, or SOTA attainment\",\"Function, API, MCP and first-byte rung bindings require measured inventory joins\",\"Evidence verdicts are stamp-cached; generated_unix is not evidence execution time\",\"Next investment is unbound until an authoritative action and effort record is linked\"],\"domains\":[" as *u8) 1488 di = 0 1489 while di < nd { 1490 if di > 0 { ss_jw("," as *u8) } 1491 let jdom: *u8 = ((arena as i64) + doff[di]) as *u8 1492 let jcls: i64 = ss_class(dgates[di] as i64, dproven[di], dmech[di]) 1493 ss_jw("{\"domain\":" as *u8); ss_jq(jdom) 1494 ss_jw(",\"classification\":" as *u8); ss_jq(ss_class_name(jcls)) 1495 ss_jw(",\"presence\":{\"permille\":" as *u8); ss_jn(dcov[di]) 1496 ss_jw(",\"present\":" as *u8); ss_jn(dpresent[di]) 1497 ss_jw(",\"exceed_claims\":" as *u8); ss_jn(dex[di]) 1498 ss_jw(",\"gaps\":" as *u8); ss_jn(dgap[di]) 1499 ss_jw(",\"total\":" as *u8); ss_jn(dtotal[di]) 1500 ss_jw("},\"source\":{\"path\":" as *u8) 1501 if dtree[di] == CT_TREE_NONE { ss_jw("null" as *u8) } else { 1502 var jdir: *u8 = CT_DIR_PRIMARY 1503 if dtree[di] == CT_TREE_SECONDARY { jdir = CT_DIR_SECONDARY } 1504 var jsuffix: *u8 = ".matrix" as *u8 1505 if dsrc[di] == 1 { jsuffix = ".axes" as *u8 } 1506 ct_build_path(jdir, jdom, jsuffix, path) 1507 ss_jq(path) 1508 } 1509 ss_jw(",\"bytes_read\":" as *u8); ss_jn(dbytes[di]) 1510 ss_jw(",\"state\":" as *u8) 1511 if dbytes[di] > 0 { ss_jq("read" as *u8) } else { ss_jq("unreadable_or_empty" as *u8) } 1512 ss_jw("},\"evidence\":{\"has_nonempty_gate_map\":" as *u8) 1513 if dgates[di] == (1 as u8) { ss_jw("true" as *u8) } else { ss_jw("false" as *u8) } 1514 ss_jw(",\"stamp_epoch\":" as *u8) 1515 if depoch[di] > 0 { ss_jn(depoch[di]) } else { ss_jw("null" as *u8) } 1516 ss_jw(",\"age_seconds\":" as *u8) 1517 if depoch[di] > 0 { ss_jn(now - depoch[di]) } else { ss_jw("null" as *u8) } 1518 ss_jw(",\"freshness\":" as *u8) 1519 if depoch[di] <= 0 { ss_jq("unknown" as *u8) } else { 1520 if depoch[di] > now { ss_jq("future_stamp" as *u8) } else { 1521 if now - depoch[di] <= pol[EV_P_TTL] { ss_jq("fresh" as *u8) } else { ss_jq("stale" as *u8) } 1522 } 1523 } 1524 ss_jw(",\"referee_reason\":" as *u8) 1525 let jr: *u8 = dreason[di] as *u8 1526 if jr[0] != (0 as u8) { ss_jq(jr) } else { ss_jw("null" as *u8) } 1527 ss_jw("},\"rung\":null,\"sota_benchmark\":null,\"next_investment\":null}" as *u8) 1528 di = di + 1 1529 } 1530 ss_jw("]}\n" as *u8) 1531 if ss_json_fd >= 0 { 1532 if sys_fsync(ss_json_fd) < 0 { ss_json_failed = 1 } 1533 sys_close(ss_json_fd) 1534 ss_json_fd = 0 - 1 1535 if ss_json_failed == 0 { 1536 if sys_renameat(jp, "knowledge/status/sota_board.json" as *u8) < 0 { ss_json_failed = 1 } 1537 } 1538 } 1539 if ss_json_failed == 1 { sw("board_json=WRITE-FAILED; retained previous complete artifact\n" as *u8) } else { 1540 sw("board_json=knowledge/status/sota_board.json\n" as *u8) 1541 } 1542 1543 let lfd: i64 = sys_openat_wr("knowledge/status/evidence_honesty.log\x00" as *u8, 0x1a4) 1544 if lfd >= 0 { 1545 ss_wf(lfd, "NX-EVIDENCE-HONESTY proven=" as *u8); ss_wnf(lfd, proven) 1546 ss_wf(lfd, " of " as *u8); ss_wnf(lfd, nd) 1547 ss_wf(lfd, " permil=" as *u8); ss_wnf(lfd, ev_honesty_permil(proven, nd)) 1548 ss_wf(lfd, " mech_ok=" as *u8); ss_wnf(lfd, n_mech) 1549 ss_wf(lfd, " red=" as *u8); ss_wnf(lfd, claimed_red) 1550 ss_wf(lfd, " stale=" as *u8); ss_wnf(lfd, n_stale) 1551 ss_wf(lfd, " vacuous=" as *u8); ss_wnf(lfd, n_vacuous) 1552 ss_wf(lfd, " unproven=" as *u8); ss_wnf(lfd, n_unproven) 1553 ss_wf(lfd, " claim_only=" as *u8); ss_wnf(lfd, nd - backed) 1554 ss_wf(lfd, "\n" as *u8) 1555 if claimed_red == 0 { ss_wf(lfd, "VERDICT=GREEN no domain has a method reporting failure\n" as *u8) } else { ss_wf(lfd, "VERDICT=RED a declared gate is not green, or a method is in dissent\n" as *u8) } 1556 // LOOSE COUPLING (operator 2026-09-02): NAME the RED domains so nx_deploy_ready can scope its 1557 // evidence-honesty block to the deploy target's OWN domain instead of conjuncting the whole estate. 1558 // Every name is wrapped in spaces so a downstream needle of the form space-name-space is an exact token. 1559 ss_wf(lfd, "RED_DOMAINS=" as *u8) 1560 var rdi: i64 = 0 1561 while rdi < nd { 1562 if dproven[rdi] == EV_RED { ss_wf(lfd, " " as *u8); sys_write(lfd, ((arena as i64) + doff[rdi]) as *u8, dlen[rdi]) } 1563 rdi = rdi + 1 1564 } 1565 ss_wf(lfd, " \n" as *u8) 1566 sys_close(lfd) 1567 } 1568 1569 if ss_json_failed == 1 { return 3 } 1570 sw("\nNX-SOTA-STATUS done -- PROVEN is the number that counts; close CLAIM-ONLY by wiring a re-measuring <domain>.gates + fix any RED.\n" as *u8) 1571 return 0 1572}