nx_stale_check.nx source
↩ module page · 340 lines · 23176 B
1// nx_stale_check.nx -- SAFE detect-only companion to nx_restage: is a build tree's _offc/<target>.elf
2// current vs its source? Rebuilds <target> --build-only + byte-compares to the DEPLOYED elf. DETECT-ONLY
3// (never writes _offc) so it can never break a tool -- the safe half of the deploy-drift loop.
4// GUARDS the _cli/stub trap (LESSON 2026-07-17: a same-basename .nx can be a do-nothing SMOKE stub while
5// the real tool was built from <target>_cli.nx -- a naive byte-diff then FALSE-flags STALE and restaging
6// the stub breaks the tool): if the fresh elf is far SMALLER than the deployed one, reports AMBIGUOUS
7// (source likely wrong) rather than STALE.
8// nx_stale_check <target> [broot=buildroot]
9// -> CURRENT (byte-identical) | STALE (differ, comparable size) | AMBIGUOUS (fresh<<deployed = stub src)
10// | NOSOURCE | BUILDFAIL | NOELF
11// argv[1]=target [A-Za-z0-9_], argv[2]=broot. Exit 0 CURRENT | 1 STALE | 2 AMBIGUOUS/error | 3 usage.
12// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
13import "nx_tool_run.nx"
14import "nx_estate_path.nx"
15const K_MAGIC_262144: i64 = 262144
16const K_MAGIC_8388608: i64 = 8388608
17const K_MAGIC_4096: i64 = 4096
18
19func sp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
20func spe(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(2,s,n); return 0 }
21func snum(v: i64) -> i64 { let b: *u8=sys_mmap(28); var m: i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 }
22func s_cat(dst: *u8, off: i64, src: *u8) -> i64 { var o: i64=off; var j: i64=0; while src[j]!=(0 as u8){dst[o]=src[j];o=o+1;j=j+1} return o }
23func s_san(name: *u8) -> i64 {
24 var i: i64 = 0
25 while name[i] != (0 as u8) {
26 let c: i64 = name[i] as i64
27 var ok: i64 = 0
28 if c >= 48 { if c <= 57 { ok = 1 } }
29 if c >= 65 { if c <= 90 { ok = 1 } }
30 if c >= 97 { if c <= 122 { ok = 1 } }
31 if c == 95 { ok = 1 }
32 if ok == 0 { return 0 }
33 i = i + 1
34 if i >= 64 { return 0 }
35 }
36 if i == 0 { return 0 }
37 return 1
38}
39// read whole file into buf (cap); returns byte count or -1 if unreadable.
40func s_read(path: *u8, buf: *u8, cap: i64) -> i64 {
41 let fd: i64 = sys_openat_rd(path)
42 if fd < 0 { return 0 - 1 }
43 var n: i64 = 0
44 var go: i64 = 1
45 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap { go = 0 } }
46 sys_close(fd)
47 return n
48}
49func s_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
50
51// ---- CAPABILITY-PRESENCE (2026-07-31, debts 1785517485 / 1785518612 / 1785525614) ----
52// MECHANISES THE CHECK THE DIRECTION GUARD BELOW ALREADY PRESCRIBES BY HAND: "look for behaviour or
53// output strings its source cannot produce". That guard's signal is SIZE ONLY, and the warden proves
54// the blind spot: nx_law_warden rebuilds to 185172B vs a 161951B deployment, so `fn < dn` is FALSE,
55// it falls through to STALE, and it prescribes the rebuild -- while the DEPLOYED binary is the only
56// copy of gatedry/helperdup/scancap (L009/L010/L011), which exist in NO source in either tree.
57// A BINARY CAN GROW WHILE LOSING CAPABILITY, so size can never separate the two populations.
58// Both images are already resident (fb/fn, db/dn) so this costs no extra IO.
59const SC_MINRUN: i64 = 12 // shortest printable run treated as a capability string
60const SC_MAXSTR: i64 = 4000 // bounded work; coverage is DECLARED, never presented as complete (L011)
61const SC_SHOW: i64 = 3 // exemplar misses printed so a human can judge, not just a count
62const SC_ASCII_LO: i64 = 32
63const SC_ASCII_HI: i64 = 126
64const SC_EXIT_CAPLOSS: i64 = 4 // distinct from STALE(1)/AMBIGUOUS+DEPLOYED-AHEAD(2)/usage(3)
65func sc_print(c: i64) -> i64 { if c < SC_ASCII_LO { return 0 } if c > SC_ASCII_HI { return 0 } return 1 }
66func sc_has(hay: *u8, hn: i64, ndl: *u8, at: i64, len: i64) -> i64 {
67 if len <= 0 { return 1 }
68 if len > hn { return 0 }
69 var i: i64 = 0
70 while i + len <= hn {
71 var k: i64 = 0
72 var hit: i64 = 1
73 while k < len { if hay[i+k] != ndl[at+k] { hit = 0; k = len } else { k = k + 1 } }
74 if hit == 1 { return 1 }
75 i = i + 1
76 }
77 return 0
78}
79
80// ---- SOURCE ROOTS (2026-08-16, debt 1786924501) ----
81// THIS FILE ALREADY NAMES THIS META-DEFECT THREE TIMES FOR THE ELF SIDE and carries it unfixed on the
82// SOURCE side: seq1554 ("Probing ONE location made this guard answer BUILDFAIL for EVERY target"),
83// seq259 ("the whole daemon fleet used to return NOELF"), and seq1554-third-form, whose own words are
84// ★ONE ARTIFACT, SEVERAL NAMING CONVENTIONS, A PROBE THAT KNEW ONE. The source probe knew TWO roots.
85// CONSEQUENCE: NOSOURCE reads as a verdict about the TARGET when it is a fact about THIS PROBE, and a
86// guard that cannot find what it guards is not a guard -- this file says that too.
87// MEASURED, full population, corpus_complete=1 on every count: bin/ 20, hub/ 28, wiki/ 35 = 83 files
88// unreachable, among them nx_sites_daemon -- so this guard could not check the daemon serving every
89// site on the estate, whose binary sites.elf is 815,480 B on disk.
90// ★MATCH THE RESOLVER YOU REPORT ON: roots are taken from the shipping import.nx try_resolve_import
91// (mirrored in nx_campaign_verify), not invented. The original two are probed FIRST, so no target that
92// already resolved can change behaviour -- this can only turn a NOSOURCE into a found source.
93// sc_src LIVED HERE FOR ONE AFTERNOON AND IS NOW ep_src_path IN nx_estate_path.nx. Recorded rather
94// than silently deleted: the resolver MOVED, it did not vanish, and the next organ needing source
95// resolution should COMPOSE it -- a fourth private copy is the defect this note exists to stop.
96
97// A DUPLICATE sc_has LIVED HERE FOR ONE BUILD. This file already had sc_has 32 lines above, and the
98// compiler refused the program rather than let two bodies share one name. Recorded, not silently
99// deleted: check-before-build applies INSIDE a file, not only across the estate, and the incumbent was
100// closer than any organ I would have thought to search.
101// The classifier below composes that incumbent: sc_has(hay, hn, ndl, at, len).
102const SC_EXIT_NOT_ADMITTED: i64 = 5 // distinct from STALE(1)/AMBIGUOUS(2)/usage(3)/CAPLOSS(4)
103
104// ---- 2026-09-03: THE ROOT THAT WON IS ANNOUNCED ON STDOUT, NOT ONLY ON STDERR ----
105// This organ probes THREE deploy roots in a DECLARED order (see the dep block in main) and reported
106// which one answered only via `cmp=` on STDERR -- a channel callers routinely merge, discard, or never
107// read. So a caller holding the documented _offc CONTRACT could be handed a CURRENT/STALE computed
108// against the SERVING ROOT and have no way, on the channel it actually parses, to learn that the
109// subject had moved underneath it.
110// * AN INSTRUMENT THAT ANSWERS ABOUT A DIFFERENT SUBJECT THAN THE CALLER ASKED ABOUT IS WORSE THAN
111// ONE THAT REFUSES -- and silently widening the scope is exactly how that happens.
112// STRICTLY ADDITIVE BY CONSTRUCTION: this prints on a SEPARATE line AFTER the verdict token line, so
113// every caller parsing position 0 for CURRENT/STALE/NOELF/... is byte-unaffected, no verdict word is
114// renamed, and no exit code changes. The _offc-scoped caller keeps its old answer AND gains the fact
115// it was previously missing (offc_present), rather than having its contract quietly redefined.
116// rootwon: 0 none | 1 _offc/<t>.elf | 2 ../<t>.elf | 3 ../<t> (extensionless, guard-supervised daemon)
117// scope=OFFC the _offc contract was satisfied -- the historical meaning
118// scope=NOELF-IN-THIS-ROOT _offc/ has nothing; the compare used a serving-root copy instead
119// scope=NOELF-ANYWHERE no probed root holds it -- the only case that is truly "no deployed elf"
120func sc_root(rootwon: i64, offc: i64, dep: *u8) -> i64 {
121 sp(" root=" as *u8); snum(rootwon)
122 sp(" path=" as *u8)
123 if rootwon == 0 { sp("(none)" as *u8) } else { sp(dep) }
124 sp(" offc_present=" as *u8); snum(offc)
125 sp(" roots_probed=3" as *u8)
126 if offc == 1 { sp(" scope=OFFC" as *u8) } else {
127 if rootwon == 0 { sp(" scope=NOELF-ANYWHERE" as *u8) } else { sp(" scope=NOELF-IN-THIS-ROOT" as *u8) }
128 }
129 sp("\n" as *u8)
130 return 0
131}
132
133func main(argc: i64, argv: *i64) -> i64 {
134 if argc < 2 { spe("usage: nx_stale_check <target> [buildroot]\n" as *u8); sys_exit(3); return 3 }
135 let target: *u8 = argv[1] as *u8
136 var broot: *u8 = "buildroot" as *u8
137 if argc >= 3 { broot = argv[2] as *u8 }
138 if s_san(target) == 0 { spe("nx_stale_check: REFUSED bad target\n" as *u8); sys_exit(3); return 3 }
139 // NAME THE PATH ACTUALLY TRIED (sibling fix, same hour, same defect as nx_compare_regen and nx_restage).
140 // CORRECTED IMMEDIATELY AFTER: the first cut of this line said "argv[1] is the BUILD ROOT", copied
141 // verbatim from nx_compare_regen where that IS true. HERE argv[1] is the TARGET and argv[2] is the
142 // build root -- applying a sibling's fix without re-reading THIS organ's own argv contract produced a
143 // message that is wrong in exactly the way the fix existed to prevent.
144 if sys_chdir(broot) != 0 { spe("nx_stale_check: cannot chdir " as *u8); spe(broot); spe(" (argv[2] is the build root; argv[1] is the target)\n" as *u8); sys_exit(2); return 2 }
145
146 // source present? runtime/<t>.nx or runtime/_hdl_build/<t>.nx
147 // COMPOSED, NOT RE-IMPLEMENTED (2026-08-17). This organ carried its own six-root probe and
148 // nx_catalog carried an identical one -- TWO GUARDS FOR ONE INVARIANT IS THE DEFECT, so both now
149 // call the single resolver in nx_estate_path.nx, which also gives CWD-independence for free.
150 let s1: *u8 = sys_mmap(256)
151 if ep_src_path(s1, target) == 0 { sp("NOSOURCE " as *u8); sp(target); sp(" (not under runtime/ _hdl_build/ bin/ hub/ wiki/ or kernel/)\n" as *u8); sys_exit(2); return 2 }
152
153 // build --build-only -> /tmp/<t>.sov.elf
154 let av: *i64 = sys_mmap(64) as *i64
155 av[0] = "_offc/nx_sov_build_run.elf" as i64
156 av[1] = target as i64
157 av[2] = "--build-only" as i64
158 av[3] = 0
159 let cap: i64 = K_MAGIC_262144
160 let out: *u8 = sys_mmap(cap)
161 let ol: *i64 = sys_mmap(16) as *i64
162 let rc: i64 = tr_run_capture("_offc/nx_sov_build_run.elf" as *u8, av, out, cap, ol)
163 let fresh: *u8 = sys_mmap(256); var of: i64 = s_cat(fresh, 0, "/tmp/" as *u8); of = s_cat(fresh, of, target); of = s_cat(fresh, of, ".sov.elf" as *u8); fresh[of] = 0 as u8
164 // seq1554 FIX -- the SAME matched-pair resolution the deployed-elf lookup below already does.
165 // The build lane emits to buildroot/_build/<t>.sov.elf on this host, not /tmp (the /api/build
166 // failure diag probes BOTH). Probing ONE location made this guard answer BUILDFAIL for EVERY
167 // target, so the instrument that gates a risky promote was DEAD -- and its error read like a
168 // verdict rather than an abstention. A guard that cannot find what it guards is not a guard.
169 if s_exists(fresh) == 0 { var of2: i64 = s_cat(fresh, 0, "_build/" as *u8); of2 = s_cat(fresh, of2, target); of2 = s_cat(fresh, of2, ".sov.elf" as *u8); fresh[of2] = 0 as u8 }
170 // THE BUILDER ALREADY SAID WHY, AND THIS GUARD THREW IT AWAY. `out` holds the builder's captured
171 // output right here, and the failure path printed a bare BUILDFAIL -- so a HOST TOO BUSY TO COMPILE
172 // was indistinguishable from SOURCE THAT DOES NOT COMPILE, and a reader takes the alarming one.
173 // MEASURED 2026-08-26: this returned BUILDFAIL for nx_restage while /api/build had compiled that exact
174 // source minutes earlier -- the host was simply above its admission ceiling. This file's own comments
175 // already record the same class twice ("its error read like a verdict rather than an abstention";
176 // "a NOELF misread as BUILDFAIL is exactly how debt seq120 sat wrong for 2 days"), so the lesson was
177 // banked and the reason was still discarded. Print what the builder said, and SEPARATE the two states.
178 if rc != 0 {
179 // Marker lengths are DERIVED from the literals via the incumbent s_cat (which walks to NUL and
180 // returns the new offset), never written as a number beside the string: a hand-counted length is a
181 // second copy of that literal's shape, and the two drift the moment someone edits the wording.
182 let mk: *u8 = sys_mmap(128)
183 let m1: *u8 = "REFUSED-BUILD-ADMIT"
184 let m2: *u8 = "VERDICT=QUEUE"
185 let m3: *u8 = "BUILD-ADMIT"
186 var admit: i64 = 0
187 if sc_has(out, ol[0], m1, 0, s_cat(mk, 0, m1)) == 1 { admit = 1 }
188 if sc_has(out, ol[0], m2, 0, s_cat(mk, 0, m2)) == 1 { admit = 1 }
189 if sc_has(out, ol[0], m3, 0, s_cat(mk, 0, m3)) == 1 { admit = 1 }
190 if admit == 1 {
191 sp("BUILD-NOT-ADMITTED " as *u8); sp(target)
192 sp(" -- the HOST declined to compile (load/IO admission). This guard COULD NOT LOOK.\n" as *u8)
193 sp(" This is NOT a statement about the source, and NOT a licence to promote: capability loss\n" as *u8)
194 sp(" is UNMEASURED, which for a promote guard must read as refuse-to-clear, never as clear.\n" as *u8)
195 sp(" builder said: " as *u8); sys_write(1, out, ol[0]); sp("\n" as *u8)
196 sys_exit(SC_EXIT_NOT_ADMITTED); return SC_EXIT_NOT_ADMITTED
197 }
198 sp("BUILDFAIL " as *u8); sp(target); sp(" -- the source did NOT compile (admission was not the cause)\n" as *u8)
199 sp(" builder said: " as *u8); sys_write(1, out, ol[0]); sp("\n" as *u8)
200 sys_exit(2); return 2
201 }
202
203 let dep: *u8 = sys_mmap(256); var od: i64 = s_cat(dep, 0, "_offc/" as *u8); od = s_cat(dep, od, target); od = s_cat(dep, od, ".elf" as *u8); dep[od] = 0 as u8
204 // THE DECLARED PROBE ORDER, RECORDED AS IT IS WALKED (see sc_root above for the vocabulary).
205 // offc_present is captured HERE, before any widening, so the _offc contract's own answer survives
206 // intact even when a later root is what actually gets compared.
207 var rootwon: i64 = 0
208 var offc_present: i64 = 0
209 if s_exists(dep) == 1 { rootwon = 1; offc_present = 1 }
210 // seq259 FIX: a GUARD-SUPERVISED DAEMON deploys to the nishihost ROOT, not the buildroot _offc/
211 // toolchain dir -- so the whole daemon fleet used to return NOELF and this detector SILENTLY
212 // ABSTAINED (and a NOELF misread as BUILDFAIL is exactly how debt seq120 sat wrong for 2 days).
213 // Try _offc/ first, then ../<t>.elf (nishihost root); the compared path is REPORTED on stderr.
214 if s_exists(dep) == 0 { var od2: i64 = s_cat(dep, 0, "../" as *u8); od2 = s_cat(dep, od2, target); od2 = s_cat(dep, od2, ".elf" as *u8); dep[od2] = 0 as u8; if s_exists(dep) == 1 { rootwon = 2 } }
215 // seq1554 THIRD FORM: guard-supervised daemons are deployed to the nishihost root WITHOUT the
216 // .elf suffix (measured: the live supervisor is `nishihost/nx_hostctl`, no extension, alongside
217 // nx_hostctl.prev / .old). Probing only the two SUFFIXED forms made this detector abstain NOELF
218 // on exactly the fleet whose promotes are most dangerous. Same meta-defect as the notation miss
219 // that hid the .193 launcher: ONE ARTIFACT, SEVERAL NAMING CONVENTIONS, a probe that knew one.
220 if s_exists(dep) == 0 { var od3: i64 = s_cat(dep, 0, "../" as *u8); od3 = s_cat(dep, od3, target); dep[od3] = 0 as u8; if s_exists(dep) == 1 { rootwon = 3 } }
221
222 let fcap: i64 = K_MAGIC_8388608 // 8MB per elf
223 let fb: *u8 = sys_mmap(fcap)
224 let db: *u8 = sys_mmap(fcap)
225 let fn: i64 = s_read(fresh, fb, fcap)
226 let dn: i64 = s_read(dep, db, fcap)
227 if fn < 0 { sp("BUILDFAIL " as *u8); sp(target); sp(" (no fresh elf at /tmp/" as *u8); sp(target); sp(".sov.elf NOR _build/" as *u8); sp(target); sp(".sov.elf)\n" as *u8); sys_exit(2); return 2 }
228 if dn < 0 {
229 // MESSAGE TRUTH: THREE roots are probed and this line named TWO of them, so every reader was
230 // told LESS coverage than the organ actually has -- the understating direction, which is the
231 // one nobody audits. The unnamed third is the extensionless serving root, where the
232 // guard-supervised daemons live: precisely the fleet whose promotes are most dangerous.
233 sp("NOELF " as *u8); sp(target); sp(" (no deployed elf at _offc/" as *u8); sp(target); sp(".elf NOR nishihost-root " as *u8); sp(target); sp(".elf NOR extensionless nishihost-root " as *u8); sp(target); sp(")\n" as *u8)
234 sc_root(rootwon, offc_present, dep)
235 sys_exit(2); return 2
236 }
237 spe("cmp=" as *u8); spe(dep); spe("\n" as *u8)
238
239 // byte-identical?
240 var same: i64 = 1
241 if fn != dn { same = 0 } else {
242 var i: i64 = 0
243 while i < fn { if fb[i] != db[i] { same = 0; i = fn } else { i = i + 1 } }
244 }
245 if same == 1 { sp("CURRENT " as *u8); sp(target); sp(" (" as *u8); snum(fn); sp("B match)\n" as *u8); sc_root(rootwon, offc_present, dep); sys_exit(0); return 0 }
246
247 // STUB-TRAP GUARD: fresh far smaller than deployed => the same-basename source is likely a stub,
248 // the real tool was built from a differently-named source. Report AMBIGUOUS not STALE.
249 if fn * 2 < dn { if fn < K_MAGIC_4096 {
250 sp("AMBIGUOUS " as *u8); sp(target); sp(" (fresh " as *u8); snum(fn); sp("B << deployed " as *u8); snum(dn); sp("B: runtime/" as *u8); sp(target); sp(".nx is likely a STUB; real source elsewhere e.g. " as *u8); sp(target); sp("_cli.nx -- do NOT restage from this target)\n" as *u8)
251 sys_exit(2); return 2
252 } }
253
254 // ★DIRECTION GUARD (added 2026-07-26; debt seq1008 + F1145). THE DEFECT THIS CURES:
255 // a byte-compare detects that source and deployment DISAGREE but is structurally blind to WHICH
256 // ONE IS AHEAD -- and the old code called every disagreement STALE, whose remedy text says
257 // "rebuild+restage". For a binary that is AHEAD of its source (a shipped feature whose source was
258 // lost) that remedy DESTROYS the feature. That is not hypothetical: nx_page_verify shipped an
259 // our-domain auto-connect-override whose source was absent from BOTH trees; a fresh build was
260 // ~2KB SMALLER than the deployment, far outside the stub guard (fn*2 < dn is false at ~572KB vs
261 // ~575KB), so this organ would have said STALE and prescribed the exact action that silently
262 // deletes the override -- turning every our-domain verification into a :443 coin flip.
263 // SIGNAL: fresh SMALLER than deployed => the deployment carries code this source does not emit.
264 // HONEST FLOOR (law L011): size direction is a HEURISTIC, not proof -- a refactor can legitimately
265 // shrink a binary. So this REFUSES TO PRESCRIBE rather than claiming a diagnosis: it withholds the
266 // dangerous remedy and names the check a human must run. Under-claiming here is the safe error;
267 // over-claiming is how the feature got deleted.
268 // u2605CAPABILITY-PRESENCE GATE -- runs BEFORE the size heuristic, because CONTENT EVIDENCE BEATS A
269 // SIZE GUESS. Scans printable runs in the DEPLOYED image and asks whether each survives into the
270 // FRESH build. This is the mechanised form of the manual step the DIRECTION GUARD below asks a
271 // human to perform, and it catches the case size cannot: fresh BIGGER yet capability-poorer.
272 let fo: *i64 = sys_mmap(SC_SHOW * 8) as *i64
273 let flen: *i64 = sys_mmap(SC_SHOW * 8) as *i64
274 var checked: i64 = 0
275 var missed: i64 = 0
276 var shown: i64 = 0
277 var p: i64 = 0
278 while p < dn {
279 if sc_print(db[p] as i64) == 0 { p = p + 1 } else {
280 var e: i64 = p
281 var go: i64 = 1
282 while go == 1 { if e < dn { if sc_print(db[e] as i64) == 1 { e = e + 1 } else { go = 0 } } else { go = 0 } }
283 let rl: i64 = e - p
284 if rl >= SC_MINRUN { if checked < SC_MAXSTR {
285 checked = checked + 1
286 if sc_has(fb, fn, db, p, rl) == 0 {
287 missed = missed + 1
288 if shown < SC_SHOW { fo[shown] = p; flen[shown] = rl; shown = shown + 1 }
289 }
290 } }
291 p = e
292 }
293 }
294 var ccomp: i64 = 1
295 if checked >= SC_MAXSTR { ccomp = 0 }
296 if missed > 0 {
297 sp("CAPABILITY-LOSS " as *u8); sp(target); sp(" (fresh " as *u8); snum(fn); sp("B vs deployed " as *u8); snum(dn)
298 sp("B; " as *u8); snum(missed); sp(" of " as *u8); snum(checked)
299 sp(" deployed strings are ABSENT from the rebuild -- REBUILDING WOULD DELETE SHIPPED CAPABILITY)
300" as *u8)
301 sp(" DO NOT RESTAGE. Recover the source for what is listed below, rebuild, then confirm CURRENT.
302" as *u8)
303 var q: i64 = 0
304 while q < shown {
305 sp(" MISSING-FROM-REBUILD: " as *u8)
306 sys_write(1, (db as i64 + fo[q]) as *u8, flen[q])
307 sp("
308" as *u8)
309 q = q + 1
310 }
311 // the envelope rides ON the number, never beside it (L011 self-ceiling)
312 sp(" strings_checked=" as *u8); snum(checked); sp(" cap=" as *u8); snum(SC_MAXSTR)
313 sp(" minrun=" as *u8); snum(SC_MINRUN)
314 sp(" coverage_complete=" as *u8); snum(ccomp); sp("
315" as *u8)
316 sys_exit(SC_EXIT_CAPLOSS); return SC_EXIT_CAPLOSS
317 }
318
319 if fn < dn {
320 sp("DEPLOYED-AHEAD " as *u8); sp(target)
321 sp(" (fresh " as *u8); snum(fn); sp("B < deployed " as *u8); snum(dn)
322 sp("B: the DEPLOYED binary carries code this source does not emit)\n" as *u8)
323 sp(" DO NOT REBUILD/RESTAGE YET -- a rebuild would DELETE whatever the deployment has and\n" as *u8)
324 sp(" source does not. First find what is missing: run the live binary and look for behaviour\n" as *u8)
325 sp(" or output strings its source cannot produce (that is how seq1008 was caught), and check\n" as *u8)
326 sp(" knowledge/registry/ for a conf whose header names this organ as a consumer.\n" as *u8)
327 sp(" If the gap is real: RECOVER the source first, rebuild, then confirm CURRENT.\n" as *u8)
328 sp(" HEURISTIC: size direction only. A legitimate shrinking refactor also lands here -- this\n" as *u8)
329 sp(" withholds the remedy, it does not diagnose. Confirm before acting either way.\n" as *u8)
330 // THE ROOT MATTERS MOST HERE. This verdict's remedy, if taken wrongly, DELETES SHIPPED
331 // CAPABILITY -- so a reader must be able to see, on the channel it parses, WHICH deployed
332 // artifact the fresh build was measured against before acting on a direction claim.
333 sc_root(rootwon, offc_present, dep)
334 sys_exit(2); return 2
335 }
336
337 sp("STALE " as *u8); sp(target); sp(" (fresh " as *u8); snum(fn); sp("B != deployed " as *u8); snum(dn); sp("B; source is AHEAD or same-size-divergent; rebuild+restage via nx_restage " as *u8); sp(target); sp(", then VERIFY output)" as *u8); sp(" capability_check=OK strings_checked=" as *u8); snum(checked); sp(" coverage_complete=" as *u8); snum(ccomp); sp("\n" as *u8)
338 sc_root(rootwon, offc_present, dep)
339 sys_exit(1); return 1
340}