`nx_staghyg.nx` source

↩ module page · 642 lines · 33655 B
1// nx_staghyg.nx -- STAGING-AREA HYGIENE: census, verdict, and expiry for the deploy queue.
2//
3// THE MEASURED PROBLEM (debt 1785531571, sev-9): the staging area has no expiry, so a .new file that
4// PREDATES the live binary it would replace sits there looking deployable forever. Promoting it is a
5// ROLLBACK WEARING AN UPGRADE FILENAME. Nothing in the tree measured this per-artifact, and nothing
6// refused it at the moment of promote.
7//
8// FOUR VERBS, DELIBERATELY SEPARATED (Rule 9 -- each does ONE thing):
9//   census [root]        report size+mtime for BOTH sides and DECIDE NOTHING. This is the rung-0
10//                        instrument, modelled verbatim on nx_tree_diff, whose banked lesson is that a
11//                        tool which picks a direction is the clobber bug with a friendlier face.
12//   scan [root]          the classified verdict: every staged artifact bucketed, counts that SUM.
13//   check <livepath>     one target. exit 0 = promotable, exit 3 = refused. The gate/promote surface.
14//   expire [root] apply  disarm artifacts past the expiry window.
15//
16// *EXPIRY RENAMES, IT NEVER DELETES. An expired artifact becomes <name>.new.expired-<epoch>, which
17// md_promote_staged can no longer see (it opens exactly <name>.new) -- so the queue is disarmed while
18// every byte is kept and the act is reversible with a single rename back (Rule 13 additive-only,
19// Rule 26 fail-safe by construction). Without `apply` it only reports.
20//
21// *THE CENSUS COUNTS THE HEALTHY ROWS TOO. An instrument blind to the common case only ever sees
22// crises -- the banked crawler lesson. FORWARD and ORPHAN are reported beside every refusal, and the
23// class counts are printed so a reader can check they SUM to the number scanned (a partition is a
24// claim).
25// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
26import "nx_syscalls.nx"
27import "nx_staging_guard.nx"
28
29const SH_STDOUT: i64 = 1
30const SH_DIRBUF: i64 = 262144
31const SH_PATHCAP: i64 = 1024
32const SH_DIR_TYPE: i64 = 4
33const SH_ALLOWCAP: i64 = 1048576
34
35func sh_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(SH_STDOUT, s, n); return 0 }
36func sh_num(v: i64) -> i64 {
  var m: i64 = v
  if m < 0 { m = 0 - m; sys_write(SH_STDOUT, "-" as *u8, 1) }
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(32)
  var i: i64 = 0
  while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(SH_STDOUT, o, k)
  sys_munmap(t, 32)
  sys_munmap(o, 32)
  return 0
50}
51
52func sh_ends_new(nm: *u8) -> i64 {
  let n: i64 = sg_strlen(nm)
  if n < 5 { return 0 }
  if nm[n - 4] != (46 as u8) { return 0 }
  if nm[n - 3] != (110 as u8) { return 0 }
  if nm[n - 2] != (101 as u8) { return 0 }
  if nm[n - 1] != (119 as u8) { return 0 }
  return 1
60}
61
62// join dir + name, dropping `strip` trailing bytes of name (4 strips a .new suffix)
63func sh_join(dir: *u8, nm: *u8, out: *u8, strip: i64) -> i64 {
  var o: i64 = 0
  var i: i64 = 0
  while dir[i] != (0 as u8) { out[o] = dir[i]; o = o + 1; i = i + 1 }
  out[o] = 47 as u8; o = o + 1
  let nl: i64 = sg_strlen(nm) - strip
  i = 0
  while i < nl { out[o] = nm[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  return o
73}
74
75// Build the LIVE path a staged artifact would overwrite. THE MAPPING IS NOT A PLAIN SUFFIX STRIP:
76// /api/build stages <t>.sov.elf.new and /api/promote installs it as <t>.elf, so the live counterpart
77// of X.sov.elf.new is X.elf -- X.sov.elf NEVER EXISTS. Measured 2026-08-06: the naive strip reported
78// live=-1 for essentially every build-staged artifact, which would have classed them all ORPHAN
79// (nothing to lose) and made this entire guard VACUOUS. A pairing rule is a claim about the deploy
80// path; read the deploy path, do not guess it.
81func sh_live_path(dir: *u8, nm: *u8, out: *u8) -> i64 {
  let n: i64 = sg_strlen(nm)
  let keep: i64 = n - 4
  var sov: i64 = 0
  if keep >= 8 { if sg_eq_at(nm, keep - 8, ".sov.elf" as *u8, 8) == 1 { sov = 1 } }
  var lim: i64 = keep
  if sov == 1 { lim = keep - 8 }
  var o: i64 = 0
  var i: i64 = 0
  while dir[i] != (0 as u8) { out[o] = dir[i]; o = o + 1; i = i + 1 }
  out[o] = 47 as u8; o = o + 1
  i = 0
  while i < lim { out[o] = nm[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  if sov == 1 {
      out[o] = 46 as u8; o = o + 1
      out[o] = 101 as u8; o = o + 1
      out[o] = 108 as u8; o = o + 1
      out[o] = 102 as u8; o = o + 1
      out[o] = 0 as u8
  }
  return o
103}
104
105// 1 when `s` ends with `suf`.
106func sh_ends(s: *u8, suf: *u8) -> i64 {
  let n: i64 = sg_strlen(s)
  let m: i64 = sg_strlen(suf)
  if m > n { return 0 }
  var i: i64 = 0
  while i < m {
      if s[n - m + i] != suf[i] { return 0 }
      i = i + 1
  }
  return 1
116}
117
118// copy the tab-separated field `idx` of the line [ls,le) into out (NUL-terminated); returns its length.
119// tool_allowlist.conf rows are name<TAB>abs-elf<TAB>GREEN[<TAB>pinned-args].
120func sh_field(buf: *u8, ls: i64, le: i64, idx: i64, out: *u8, cap: i64) -> i64 {
  var f: i64 = 0
  var o: i64 = 0
  var i: i64 = ls
  while i < le {
      let c: u8 = buf[i]
      if c == (9 as u8) { f = f + 1 }
      if c != (9 as u8) {
          if f == idx { if o < (cap - 1) { out[o] = c; o = o + 1 } }
      }
      i = i + 1
  }
  out[o] = 0 as u8
  return o
134}
135
136// ABSOLUTE staged path -> the live path a promote would install. Same mapping sh_live_path applies to a
137// basename, but on a full path and with no directory join: /x/nx_foo.sov.elf.new -> /x/nx_foo.elf.
138// The .sov.elf rewrite matters -- /x/nx_foo.sov.elf never exists, so getting it wrong would report every
139// ARMED row as DANGLING.
140func sh_abs_live(p: *u8, out: *u8) -> i64 {
  let n: i64 = sg_strlen(p)
  var keep: i64 = n
  if sh_ends(p, ".new" as *u8) == 1 { keep = n - 4 }
  var sov: i64 = 0
  if keep >= 8 { if sg_eq_at(p, keep - 8, ".sov.elf" as *u8, 8) == 1 { sov = 1 } }
  var lim: i64 = keep
  if sov == 1 { lim = keep - 8 }
  var o: i64 = 0
  while o < lim { out[o] = p[o]; o = o + 1 }
  out[o] = 0 as u8
  if sov == 1 {
      out[o] = 46 as u8; o = o + 1
      out[o] = 101 as u8; o = o + 1
      out[o] = 108 as u8; o = o + 1
      out[o] = 102 as u8; o = o + 1
      out[o] = 0 as u8
  }
  return o
159}
160
161func sh_append_num(out: *u8, pos: i64, v: i64) -> i64 {
  var m: i64 = v
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var o: i64 = pos
  var i: i64 = 0
  while i < k { out[o] = t[k - 1 - i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  sys_munmap(t, 32)
  return o
173}
174
175func sh_append_str(out: *u8, pos: i64, s: *u8) -> i64 {
  var o: i64 = pos
  var i: i64 = 0
  while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  return o
181}
182
183func sh_row(nm: *u8, cls: i64, out: *i64) -> i64 {
  sh_puts("  " as *u8)
  sh_puts(sg_class_name(cls))
  sh_puts("\t" as *u8)
  sh_puts(nm)
  sh_puts("  live=" as *u8); sh_num(out[SG_O_LIVESZ])
  sh_puts("b/mt=" as *u8); sh_num(out[SG_O_LIVEMT])
  sh_puts("  staged=" as *u8); sh_num(out[SG_O_NEWSZ])
  sh_puts("b/mt=" as *u8); sh_num(out[SG_O_NEWMT])
  sh_puts("  age=" as *u8); sh_num(out[SG_O_AGEDAYS])
  sh_puts("d shrink=" as *u8); sh_num(out[SG_O_SHRINKPERMIL])
  sh_puts("permil caploss=" as *u8); sh_num(out[SG_O_LOSTPERMIL])
  sh_puts("permil (" as *u8); sh_num(out[SG_O_MISSING])
  sh_puts("/" as *u8); sh_num(out[SG_O_CHECKED])
  sh_puts(" live tokens absent)\n" as *u8)
  return 0
199}
200
201func main(argc: i64, argv: *i64) -> i64 {
  var verb: *u8 = "scan" as *u8
  if argc >= 2 { verb = argv[1] as *u8 }
  var root: *u8 = "." as *u8
205
  let cfg: *i64 = sys_mmap(8 * SG_C_SLOTS) as *i64
  let hadconf: i64 = sg_conf_load(cfg)
  // The reference set for expiry's PROVE-UNREFERENCED half. Loaded ONCE, not per artifact: this is the
  // registry that decides whether renaming a staged file would break a live tool.
  let allowbuf: *u8 = sys_mmap(SH_ALLOWCAP)
  let allown: i64 = sg_slurp("tool_allowlist.conf" as *u8, allowbuf, SH_ALLOWCAP - 2)
  let now: i64 = sys_now_realtime_sec()
  let out: *i64 = sys_mmap(8 * SG_OUT_SLOTS) as *i64
214
  // ---- check <livepath>: ONE target, exit code is the answer ----
  if sg_contains(verb, sg_strlen(verb), "check" as *u8, 5) == 1 {
      if argc < 3 {
          sh_puts("usage: nx_staghyg check <live-path>\nverdict=RED rule=usage\n" as *u8)
          sys_exit(2); return 2
      }
      let lp: *u8 = argv[2] as *u8
      // TWO NAMES FOR ONE ARTIFACT, and this verb only ever built one of them (debt 1786067334).
      // /api/build stages <t>.sov.elf.new -- 553 such files on this root -- while the legacy upload path
      // stages <artifact>.new (35). `check` appended ONLY ".new", so for every target carrying both it
      // judged an artifact the promoter will never consume.
      // MEASURED 2026-08-06: for nx_law_warden.elf it read nx_law_warden.elf.new (191901b, SIX DAYS OLD)
      // and answered class=BACKDATE promotable=NO REFUSED -- while nx_contentdiff on the artifact
      // /api/build had produced minutes earlier (nx_law_warden.sov.elf.new, 216596b) returned
      // lost_from_live=0, 3/3 GREEN. A clean upgrade reported as a refused backdate.
      // PRECEDENCE LIFTED VERBATIM FROM nx_hostctl.hc_deploy_one, WHICH LEARNED IT THE EXPENSIVE WAY:
      // "prefer the SANCTIONED BUILD artifact (.sov.elf.new). Preferring the legacy upload name let ONE
      // stale leftover permanently shadow every fresh build -- a promote that reported success and shipped
      // the wrong binary." Same trap, second organ, and the second one is an ADVISOR rather than a
      // promoter -- which is why it went unnoticed: nothing it says takes effect, so nothing contradicts it.
      // The classifier (nx_staging_guard) is shared and CORRECT; only the path RESOLUTION here was wrong.
      // Existence is probed via the classifier itself (SG_NONE == nothing staged) so this needs no new
      // stat helper and cannot disagree with the classifier about what "staged" means.
      let npA: *u8 = sys_mmap(SH_PATHCAP)
      let npB: *u8 = sys_mmap(SH_PATHCAP)
      let eA: i64 = sh_append_str(npA, 0, lp)
      sh_append_str(npA, eA, ".new" as *u8)
      let lpn: i64 = sg_strlen(lp)
      var cut: i64 = lpn
      if lpn > 4 { if lp[lpn-4] == (46 as u8) { if lp[lpn-3] == (101 as u8) { if lp[lpn-2] == (108 as u8) { if lp[lpn-1] == (102 as u8) { cut = lpn - 4 } } } } }
      var bo: i64 = 0
      while bo < cut { npB[bo] = lp[bo]; bo = bo + 1 }
      let eB: i64 = sh_append_str(npB, cut, ".sov.elf.new" as *u8)
      npB[eB] = 0 as u8
      let outB: *i64 = sys_mmap(8 * SG_OUT_SLOTS) as *i64
      let cB: i64 = sg_classify(lp, npB, now, cfg, outB)
      let cA: i64 = sg_classify(lp, npA, now, cfg, out)
      var c: i64 = cA
      var np: *u8 = npA
      if cB != SG_NONE {
          c = cB
          np = npB
          var oi: i64 = 0
          while oi < SG_OUT_SLOTS { out[oi] = outB[oi]; oi = oi + 1 }
      }
      var bothstaged: i64 = 0
      if cA != SG_NONE { if cB != SG_NONE { bothstaged = 1 } }
      sh_row(lp, c, out)
      // DECLARE WHICH FILE WAS JUDGED. An advisory verdict that does not name its subject cannot be
      // checked against the promoter, which is exactly how this stayed wrong.
      sh_puts("  judged=" as *u8); sh_puts(np)
      if bothstaged == 1 {
          // AMBIGUITY IS ITS OWN HAZARD, not something to resolve silently: with two staged artifacts for
          // one target the question "is it safe to promote?" has TWO answers, and picking one quietly is
          // how the wrong binary ships. Say both facts out loud and name which one actually ships.
          sh_puts("  BOTH-STAGED=1 other=" as *u8); sh_puts(npA)
          sh_puts(" (two staged artifacts for one target; /api/promote consumes the .sov.elf.new, so the other will NOT ship -- delete it or promote deliberately)" as *u8)
      }
      sh_puts("\n" as *u8)
      if c == SG_NONE {
          sh_puts("NX-STAGHYG check target=" as *u8); sh_puts(lp)
          sh_puts(" class=NONE nothing-staged verdict=GREEN\n" as *u8)
          sys_exit(0); return 0
      }
      if sg_allows(c) == 1 {
          sh_puts("NX-STAGHYG check target=" as *u8); sh_puts(lp)
          sh_puts(" class=" as *u8); sh_puts(sg_class_name(c))
          sh_puts(" promotable=YES verdict=GREEN\n" as *u8)
          sys_exit(0); return 0
      }
      sh_puts("NX-STAGHYG check target=" as *u8); sh_puts(lp)
      sh_puts(" class=" as *u8); sh_puts(sg_class_name(c))
      sh_puts(" promotable=NO REFUSED verdict=GREEN\n" as *u8)
      sys_exit(3); return 3
  }
290
  // ---- stagedref: TURN A COUNT INTO A WORK ORDER ------------------------------------------------
  // nx_shipcheck counts registry rows whose binary path is a staging artifact and NEVER NAMES THEM --
  // its log carries totals only. The number sat at EXACTLY 45 from 2026-08-01 to 2026-08-06, looking
  // perfectly well-instrumented, because nobody could act on it. A METRIC THAT CANNOT NAME ITS MEMBERS
  // IS A SCOREBOARD, NOT A WORK ORDER.
  // And the rows are NOT homogeneous, which is the second reason a bare count could never drive this:
  //   BY-DESIGN     a *_staged alias whose whole purpose IS to run the staged build. Repairing it
  //                 DESTROYS working tooling. Five of the 46 are these.
  //   REPOINT-ONLY  a live <name>.elf already exists -- no build needed, just re-point the row.
  //   ARMED         the staged artifact still exists; a promote would CONSUME it and strand the row,
  //                 so promote and re-point must happen together.
  //   DANGLING      the staged artifact is already gone: the tool is ALREADY DEAD (exit 127).
  // Remedy for every non-BY-DESIGN row: /api/build -> /api/promote with expect_sha256 ->
  // /api/tools/register name=&elf=<name>.elf&update=yes&confirm=yes (update=yes does an atomic row
  // replace and PRESERVES pinned args when args= is omitted).
  if sg_contains(verb, sg_strlen(verb), "stagedref" as *u8, 9) == 1 {
      let ab: *u8 = sys_mmap(SH_ALLOWCAP)
      let an2: i64 = sg_slurp("tool_allowlist.conf" as *u8, ab, SH_ALLOWCAP - 2)
      if an2 <= 0 {
          sh_puts("NX-STAGHYG stagedref verdict=RED rule=allowlist-unreadable\n" as *u8)
          sys_exit(1); return 1
      }
      let fname: *u8 = sys_mmap(SH_PATHCAP)
      let fpath: *u8 = sys_mmap(SH_PATHCAP)
      let livep2: *u8 = sys_mmap(SH_PATHCAP)
      var nrows: i64 = 0
      var nsr: i64 = 0
      var nbydesign: i64 = 0
      var nrepoint: i64 = 0
      var narmed: i64 = 0
      var ndangling: i64 = 0
      sh_puts("=== NX-STAGHYG stagedref -- every row NAMED with its remedy ===\n" as *u8)
      var ls: i64 = 0
      while ls < an2 {
          // walk to the newline; `le` lands ON it (or on an2). The first cut of this loop set
          // le = an2 + 1 on a hit, which jumped straight to EOF and parsed the WHOLE FILE as one row --
          // and it still printed partition=OK, because a partition check is VACUOUSLY TRUE over an
          // empty set. rows=1 against an 849-row file was the only tell.
          var le: i64 = ls
          var eol: i64 = 0
          while eol == 0 {
              if le >= an2 { eol = 1 }
              if eol == 0 {
                  if ab[le] == (10 as u8) { eol = 1 }
                  if eol == 0 { le = le + 1 }
              }
          }
          let lend: i64 = le
          if lend > ls {
              if ab[ls] != (35 as u8) {
                  nrows = nrows + 1
                  sh_field(ab, ls, lend, 0, fname, SH_PATHCAP)
                  sh_field(ab, ls, lend, 1, fpath, SH_PATHCAP)
                  if sh_ends(fpath, ".new" as *u8) == 1 {
                      nsr = nsr + 1
                      sh_abs_live(fpath, livep2)
                      let stagedsz: i64 = sg_size(fpath)
                      let livesz: i64 = sg_size(livep2)
                      if sh_ends(fname, "_staged" as *u8) == 1 {
                          nbydesign = nbydesign + 1
                          sh_puts("  BY-DESIGN      " as *u8); sh_puts(fname)
                          sh_puts("  points at its STAGED build on purpose -- do NOT repair\n" as *u8)
                      }
                      if sh_ends(fname, "_staged" as *u8) == 0 {
                          if livesz >= 0 {
                              nrepoint = nrepoint + 1
                              sh_puts("  REPOINT-ONLY   " as *u8); sh_puts(fname)
                              sh_puts("  live exists " as *u8); sh_num(livesz)
                              sh_puts("b -- no build needed, register update=yes\n" as *u8)
                          }
                          if livesz < 0 {
                              if stagedsz >= 0 {
                                  narmed = narmed + 1
                                  sh_puts("  ARMED          " as *u8); sh_puts(fname)
                                  sh_puts("  staged " as *u8); sh_num(stagedsz)
                                  sh_puts("b exists -- a promote CONSUMES it, so promote+repoint together\n" as *u8)
                              }
                              if stagedsz < 0 {
                                  ndangling = ndangling + 1
                                  sh_puts("  DANGLING       " as *u8); sh_puts(fname)
                                  sh_puts("  staged artifact GONE -- this tool is ALREADY DEAD (exit 127)\n" as *u8)
                              }
                          }
                      }
                  }
              }
          }
          ls = le + 1
      }
      // NON-VACUITY FLOOR: this file has hundreds of rows. A parse that yields almost nothing must SAY SO
      // rather than emit a confident GREEN over an empty set -- which is exactly what the first cut did.
      if nrows < 10 { sh_puts("  PARSE-SUSPECT: only " as *u8); sh_num(nrows); sh_puts(" rows parsed from a file this size -- treat the counts below as UNTRUSTWORTHY
383" as *u8) }
      sh_puts("NX-STAGHYG stagedref rows=" as *u8); sh_num(nrows)
      sh_puts(" stagedref=" as *u8); sh_num(nsr)
      sh_puts(" BY-DESIGN=" as *u8); sh_num(nbydesign)
      sh_puts(" REPOINT-ONLY=" as *u8); sh_num(nrepoint)
      sh_puts(" ARMED=" as *u8); sh_num(narmed)
      sh_puts(" DANGLING=" as *u8); sh_num(ndangling)
      let srsum: i64 = nbydesign + nrepoint + narmed + ndangling
      sh_puts(" classes_sum=" as *u8); sh_num(srsum)
      if srsum != nsr { sh_puts(" PARTITION-BROKEN" as *u8) }
      if srsum == nsr { sh_puts(" partition=OK" as *u8) }
      sh_puts(" actionable=" as *u8); sh_num(nsr - nbydesign)
      sh_puts(" verdict=GREEN\n" as *u8)
      sys_exit(0)
      return 0
  }
399
  if argc >= 3 { root = argv[2] as *u8 }
  var doapply: i64 = 0
  if argc >= 4 { if sg_contains(argv[3] as *u8, sg_strlen(argv[3] as *u8), "apply" as *u8, 5) == 1 { doapply = 1 } }
403
  let iscensus: i64 = sg_contains(verb, sg_strlen(verb), "census" as *u8, 6)
  let isexpire: i64 = sg_contains(verb, sg_strlen(verb), "expire" as *u8, 6)
406
  let fd: i64 = sys_openat_rd(root)
  if fd < 0 {
      sh_puts("NX-STAGHYG verdict=RED rule=root-absent root=" as *u8); sh_puts(root); sh_puts("\n" as *u8)
      sys_exit(1); return 1
  }
412
  let dbuf: *u8 = sys_mmap(SH_DIRBUF)
  let lp: *u8 = sys_mmap(SH_PATHCAP)
  let np: *u8 = sys_mmap(SH_PATHCAP)
  let xp: *u8 = sys_mmap(SH_PATHCAP)
417
  var nstaged: i64 = 0
  var cNONE: i64 = 0
  var cFWD: i64 = 0
  var cORPH: i64 = 0
  var cBACK: i64 = 0
  var cEXP: i64 = 0
  var cSHR: i64 = 0
  var cCAP: i64 = 0
  var nrefused: i64 = 0
  var npaired: i64 = 0
  var nolder: i64 = 0
  var nsmaller: i64 = 0
  var nexpired_applied: i64 = 0
  var nwould_expire: i64 = 0
  var nstale_orphan: i64 = 0
  var nblindspot: i64 = 0
  var nrestage: i64 = 0
  var nref_blocked: i64 = 0
  // FLAG TALLIES, reported BESIDE the class partition. The class is the FIRST refusal reason in a fixed
  // precedence, so class counts alone under-report: a 16-day-old ORPHAN returns ORPHAN and never shows
  // up as EXPIRED, and a backdated artifact that ALSO loses tokens is only counted once. These tallies
  // OVERLAP by design and deliberately do NOT sum to `staged` -- that is the honest shape of the data.
  var fBACK: i64 = 0
  var fEXP: i64 = 0
  var fSHR: i64 = 0
  var fCAP: i64 = 0
444
  if iscensus == 1 { sh_puts("=== NX-STAGHYG census -- size+mtime BOTH sides; DECIDES NOTHING ===\n" as *u8) }
  if iscensus == 0 { sh_puts("=== NX-STAGHYG scan -- classified staging verdict ===\n" as *u8) }
447
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, SH_DIRBUF)
      if nr <= 0 { go = 0 }
      if go == 1 {
          var off: i64 = 0
          while off < nr {
              let rec: *u8 = ((dbuf as i64) + off) as *u8
              let ty: i64 = dirent_type(rec)
              let nm: *u8 = dirent_name(rec)
              if ty != SH_DIR_TYPE {
                  if sh_ends_new(nm) == 1 {
                      nstaged = nstaged + 1
                      sh_join(root, nm, np, 0)
                      sh_live_path(root, nm, lp)
463
                      if iscensus == 1 {
                          // RUNG 0: report both sides, mark which is newer, decide nothing.
                          let ls: i64 = sg_size(lp)
                          let ns: i64 = sg_size(np)
                          let lm: i64 = sg_mtime(lp)
                          let nmt: i64 = sg_mtime(np)
                          sh_puts("  " as *u8); sh_puts(nm)
                          sh_puts("  live=" as *u8); sh_num(ls); sh_puts("b/" as *u8); sh_num(lm)
                          sh_puts("  staged=" as *u8); sh_num(ns); sh_puts("b/" as *u8); sh_num(nmt)
                          if ls < 0 { sh_puts("  newer=NO-LIVE" as *u8) }
                          if ls >= 0 {
                              npaired = npaired + 1
                              if nmt > lm { sh_puts("  newer=STAGED" as *u8) }
                              if nmt < lm { sh_puts("  newer=LIVE" as *u8); nolder = nolder + 1 }
                              if nmt == lm { sh_puts("  newer=SAME-MTIME" as *u8) }
                              if ns < ls { sh_puts(" smaller=STAGED" as *u8); nsmaller = nsmaller + 1 }
                          }
                          sh_puts("\n" as *u8)
                      }
483
                      if iscensus == 0 {
                          let c: i64 = sg_classify(lp, np, now, cfg, out)
                          if c == SG_NONE { cNONE = cNONE + 1 }
                          if c == SG_FORWARD { cFWD = cFWD + 1 }
                          if c == SG_ORPHAN { cORPH = cORPH + 1 }
                          if c == SG_BACKDATE { cBACK = cBACK + 1 }
                          if c == SG_EXPIRED { cEXP = cEXP + 1 }
                          if c == SG_SHRINK { cSHR = cSHR + 1 }
                          if c == SG_CAPLOSS { cCAP = cCAP + 1 }
                          if out[SG_O_LIVESZ] >= 0 { npaired = npaired + 1 }
                          // THE BLIND SPOT, COUNTED. A staged artifact that is NEWER, the SAME SIZE, and
                          // shows ZERO capability change is exactly the signature of a MUTATION-CLASS
                          // defect (an ==/!= operator swap is size-preserving AND string-preserving by
                          // construction), and this guard ALLOWS it. Two such mutants have already escaped
                          // into this tree. Measured 2026-08-06 by a sibling seat: 5 of 18,060 files
                          // differed at equal size and 1 of those 5 was a mutant -- a 20pct hit rate INSIDE
                          // the blind spot against a 33pct base divergence rate. An instrument that cannot
                          // count its own blind spot cannot tell you whether to care about it.
                          if sg_allows(c) == 1 {
                              if out[SG_O_IDENTICAL] == 1 { nrestage = nrestage + 1 }
                              if out[SG_O_LIVESZ] > 0 {
                                  if out[SG_O_NEWSZ] == out[SG_O_LIVESZ] {
                                      if out[SG_O_LOSTPERMIL] == 0 {
                                          // ONLY a DIFFERING same-size artifact is the blind spot. A
                                          // byte-identical re-stage is harmless, and counting it here
                                          // would inflate the number that argues for the fix -- which is
                                          // the one number that must not be inflated.
                                          if out[SG_O_IDENTICAL] == 0 {
                                              nblindspot = nblindspot + 1
                                              sh_puts("  BLIND-SPOT " as *u8); sh_puts(nm)
                                              sh_puts("  same size " as *u8); sh_num(out[SG_O_NEWSZ])
                                              sh_puts("b, content DIFFERS, zero capability delta -- nothing in this guard can see what changed\n" as *u8)
                                          }
                                      }
                                  }
                              }
                          }
                          let fl: i64 = out[SG_O_FLAGS]
                          if (fl % 2) == 1 { fBACK = fBACK + 1 }
                          if ((fl / 2) % 2) == 1 { fEXP = fEXP + 1 }
                          if ((fl / 4) % 2) == 1 { fSHR = fSHR + 1 }
                          if ((fl / 8) % 2) == 1 { fCAP = fCAP + 1 }
                          if sg_allows(c) == 0 {
                              if c != SG_NONE {
                                  nrefused = nrefused + 1
                                  sh_row(nm, c, out)
                              }
                          }
                          // EXPIRY. Scope is deliberate: it disarms only artifacts that are past the
                          // window AND would be REFUSED -- i.e. actually armed to overwrite a live
                          // binary with something worse. A stale ORPHAN is staging-area rot, not a
                          // hazard (there is no live binary for it to destroy), so it is COUNTED and
                          // REPORTED but never touched: silently renaming hundreds of other seats'
                          // unpromoted builds would be its own act of destruction.
                          if out[SG_O_AGEDAYS] > cfg[SG_C_MAXAGE] {
                              if sg_allows(c) == 1 { nstale_orphan = nstale_orphan + 1 }
                              if sg_allows(c) == 0 { nwould_expire = nwould_expire + 1 }
                          }
                          if isexpire == 1 {
                              if out[SG_O_AGEDAYS] > cfg[SG_C_MAXAGE] {
                                if sg_allows(c) == 0 {
                                  // PROVE UNREFERENCED BEFORE YOU MOVE. This verb RENAMES a staged
                                  // artifact -- and tool_allowlist.conf can point a REGISTERED tool
                                  // straight at a <name>.sov.elf.new. nx_shipcheck counts 45 such rows
                                  // (stagedref), unchanged for five days. Renaming one of those turns a
                                  // live tool into exit 127 NOT-FOUND. The estate's rule is RETIRE =
                                  // MOVE + PROVE UNREFERENCED; the first cut of this verb did the MOVE
                                  // and skipped the PROVE, and only luck kept it from breaking a tool
                                  // (the single artifact it disarmed was referenced by its .elf, not its
                                  // .new -- verified, not assumed).
                                  // FAIL-CLOSED: an unreadable allowlist means nothing can be PROVEN
                                  // unreferenced, so nothing is disarmed. A stale artifact left armed is
                                  // the cheaper failure -- the promote guard already refuses it -- while
                                  // a tool broken by its own janitor is a live outage.
                                  var referenced: i64 = 1
                                  if allown > 0 { referenced = sg_contains(allowbuf, allown, nm, sg_strlen(nm)) }
                                  if referenced == 1 {
                                      nref_blocked = nref_blocked + 1
                                      sh_puts("  REFERENCED-NOT-DISARMED " as *u8); sh_puts(nm)
                                      sh_puts(" -- tool_allowlist.conf points a REGISTERED tool at this exact staged artifact; renaming it would make that tool exit 127\n" as *u8)
                                  }
                                  if referenced == 0 {
                                  if doapply == 0 {
                                      sh_puts("  WOULD-DISARM " as *u8); sh_puts(nm)
                                      sh_puts(" (age=" as *u8); sh_num(out[SG_O_AGEDAYS])
                                      sh_puts("d class=" as *u8); sh_puts(sg_class_name(c)); sh_puts(")\n" as *u8)
                                  }
                                  if doapply == 1 {
                                      var xo: i64 = sh_append_str(xp, 0, np)
                                      xo = sh_append_str(xp, xo, ".expired-" as *u8)
                                      sh_append_num(xp, xo, now)
                                      if sys_renameat(np, xp) == 0 {
                                          nexpired_applied = nexpired_applied + 1
                                          sh_puts("  DISARMED " as *u8); sh_puts(nm)
                                          sh_puts(" -> " as *u8); sh_puts(xp); sh_puts("\n" as *u8)
                                      }
                                  }
                                  }
                                }
                              }
                          }
                      }
                  }
              }
              off = off + dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
593
  if iscensus == 1 {
      sh_puts("NX-STAGHYG census root=" as *u8); sh_puts(root)
      sh_puts(" staged=" as *u8); sh_num(nstaged)
      sh_puts(" paired=" as *u8); sh_num(npaired)
      sh_puts(" staged-OLDER-than-live=" as *u8); sh_num(nolder)
      sh_puts(" staged-SMALLER-than-live=" as *u8); sh_num(nsmaller)
      sh_puts(" verdict=GREEN\n" as *u8)
      sys_exit(0); return 0
  }
603
  sh_puts("NX-STAGHYG scan root=" as *u8); sh_puts(root)
  sh_puts(" staged=" as *u8); sh_num(nstaged)
  sh_puts(" FORWARD=" as *u8); sh_num(cFWD)
  sh_puts(" ORPHAN=" as *u8); sh_num(cORPH)
  sh_puts(" BACKDATE=" as *u8); sh_num(cBACK)
  sh_puts(" EXPIRED=" as *u8); sh_num(cEXP)
  sh_puts(" SHRINK=" as *u8); sh_num(cSHR)
  sh_puts(" CAPLOSS=" as *u8); sh_num(cCAP)
  sh_puts(" NONE=" as *u8); sh_num(cNONE)
  sh_puts(" refused=" as *u8); sh_num(nrefused)
  let summed: i64 = cFWD + cORPH + cBACK + cEXP + cSHR + cCAP + cNONE
  sh_puts(" classes_sum=" as *u8); sh_num(summed)
  if summed != nstaged { sh_puts(" PARTITION-BROKEN" as *u8) }
  if summed == nstaged { sh_puts(" partition=OK" as *u8) }
  sh_puts(" paired=" as *u8); sh_num(npaired)
  sh_puts(" | OVERLAPPING FLAGS (do not sum): backdate=" as *u8); sh_num(fBACK)
  sh_puts(" expired=" as *u8); sh_num(fEXP)
  sh_puts(" shrink=" as *u8); sh_num(fSHR)
  sh_puts(" caploss=" as *u8); sh_num(fCAP)
  sh_puts(" | conf=" as *u8); sh_num(hadconf)
  sh_puts(" maxage=" as *u8); sh_num(cfg[SG_C_MAXAGE])
  sh_puts("d shrinktol=" as *u8); sh_num(cfg[SG_C_SHRINKTOL])
  sh_puts("permil caplosstol=" as *u8); sh_num(cfg[SG_C_CAPLOSS])
  sh_puts("permil" as *u8)
  sh_puts(" | BLIND SPOT (allowed, same size, content DIFFERS, zero capability delta = the mutation-class signature this guard CANNOT see): " as *u8); sh_num(nblindspot)
  sh_puts(" harmless_identical_restage=" as *u8); sh_num(nrestage)
  sh_puts(" | EXPIRY past " as *u8); sh_num(cfg[SG_C_MAXAGE])
  sh_puts("d: armed_and_stale=" as *u8); sh_num(nwould_expire)
  sh_puts(" stale_orphans_left_alone=" as *u8); sh_num(nstale_orphan)
  if isexpire == 1 {
      sh_puts(" disarmed=" as *u8); sh_num(nexpired_applied)
      sh_puts(" referenced_NOT_disarmed=" as *u8); sh_num(nref_blocked)
      sh_puts(" allowlist_rows_read=" as *u8); sh_num(allown)
      if allown <= 0 { sh_puts(" ALLOWLIST-UNREADABLE-SO-NOTHING-DISARMED" as *u8) }
  }
  sh_puts(" verdict=GREEN\n" as *u8)
  sys_exit(0)
  return 0
642}
nx_staghyg.nx source

`nx_staghyg.nx` source
