nx_stalecensus.nx source
↩ module page · 295 lines · 15759 B
1// nx_stalecensus.nx -- RESOLVE THE AMBIGUITY nx_stalesweep NAMES (2026-08-07).
2//
3// nx_stalesweep already measures stale MIRRORS by mtime and maintains
4// knowledge/status/stale_mirror.worklist. Its own header states the limit it cannot pass, and states it
5// honestly: "source-newer is AMBIGUOUS (pending upgrade vs uncommitted WIP), so the debt says TRIAGE and
6// explicitly forbids blanket-rebuild." That is correct AND it leaves every entry unactionable -- an
7// mtime says a dependency MOVED, never that codegen CHANGED, and never whether rebuilding is SAFE.
8//
9// This organ consumes that worklist and resolves each row to a verdict by the only instrument that can:
10// nx_stale_check rebuilds the target and byte-compares against the DEPLOYED elf, and its capability_check
11// refuses a rebuild that would DELETE shipped strings.
12//
13// *THE WORKLIST IS CONSUMED, NEVER RE-DERIVED. A second scan would drift from the one the clock already
14// maintains, and two censuses that disagree about the corpus are worse than either alone.
15//
16// WHY THE CAPABILITY SPLIT IS THE WHOLE POINT: hand-sampling 8 targets gave 6 safe / 2 CAPABILITY-LOSS
17// -- nx_verify's rebuild drops 19 of 64 shipped strings, and nx_render3d's rebuild is LARGER and still
18// loses 2. So a blanket rebuild of the flagged population would delete working features from roughly a
19// quarter of it, silently. 8 samples is enough to know the split is not uniform and nowhere near enough
20// to plan against; this produces the distribution.
21// *A SIZE INCREASE DOES NOT PROVE NOTHING WAS LOST -- only the string-level check decides.
22//
23// DETECT-ONLY, DELIBERATELY. It never promotes. nx_stale_check is the safe half of the deploy-drift loop
24// precisely because it never writes, and a census that promoted as it went could not be re-run to check
25// its own work. Promotion stays an explicit per-target operator step (/api/build + /api/promote with
26// expect_sha256), and CAP-LOSS rows must never be promoted at all until their source is recovered.
27//
28// ENVELOPE, declared in-band and never silent: bounded by an explicit max (REFUSES <= 0 -- no runaway
29// over a 1,500-row worklist), resumable by an explicit skip, and every per-target rebuild carries a
30// deadline because ONE hanging compile must not wedge the sweep.
31//
32// usage: nx_stalecensus <max> [skip] [timeout_ms] [worklist]
33// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
34import "nx_tool_run.nx"
35
36const SC_WORKLIST: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/status/stale_mirror.worklist"
37const SC_CHECKER: *u8 = "/volume1/homes/elderwesto/nishihost/nx_stale_check.elf"
38const SC_CWD: *u8 = "/volume1/homes/elderwesto/nishihost"
39const SC_CAP: i64 = 262144
40const SC_WLCAP: i64 = 4194304
41const SC_DEF_TMO: i64 = 240000
42// A SMALL target known to compile, used only to prove the lane is up. Deliberately not one of the
43// worklist's own rows -- a control drawn from the population under test is not a control.
44const SC_CONTROL: *u8 = "nx_footcheck"
45
46func scp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
47func sce(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(2,s,n); return 0 }
48func scn(v: i64) -> i64 {
49 var m: i64 = v
50 if m < 0 { scp("-" as *u8); m = 0 - m }
51 let t: *u8 = sys_mmap(32)
52 var k: i64 = 0
53 if m == 0 { t[0] = 48 as u8; k = 1 }
54 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
55 let b: *u8 = sys_mmap(32)
56 var i: i64 = 0
57 while i < k { b[i] = t[k-1-i]; i = i + 1 }
58 sys_write(1, b, k)
59 return 0
60}
61func sc_atoi(s: *u8) -> i64 {
62 var v: i64 = 0
63 var i: i64 = 0
64 while s[i] != (0 as u8) {
65 let c: i64 = s[i] as i64
66 if c < 48 { return 0 - 1 }
67 if c > 57 { return 0 - 1 }
68 v = v * 10 + (c - 48)
69 i = i + 1
70 }
71 if i == 0 { return 0 - 1 }
72 return v
73}
74
75// Classify nx_stale_check's leading token. UNPARSED is its OWN bucket on purpose --
76// *AN UNRECOGNISED VERDICT MUST NEVER FALL INTO A KNOWN ONE, because the bucket it lands in becomes the
77// number somebody plans a campaign against.
78// 0 CURRENT | 1 STALE-SAFE | 2 CAP-LOSS | 3 AMBIGUOUS | 4 NOSOURCE | 5 NOELF | 6 BUILDFAIL | 7 UNPARSED
79// SCANS EVERY LINE, not just offset 0. MEASURED DEFECT, found by the control probe refusing a target
80// that resolves fine by hand: nx_stale_check writes its `cmp=<path>` diagnostic to STDERR and the
81// verdict to STDOUT, and this capture MERGES the two streams -- so on SUCCESS the buffer begins `cmp=`
82// and the verdict sits on line 2, while on BUILDFAIL it exits before printing cmp= and the verdict IS
83// at offset 0.
84// *SO CLASSIFYING POSITION 0 READ EVERY SUCCESS AS UNPARSED WHILE PARSING EVERY FAILURE CORRECTLY --
85// a bias that manufactures exactly the conclusion "nothing works", which is the most believable wrong
86// answer this census could have produced. It even fooled my own lane guard into blaming the build lane.
87// *A PARSER THAT FAILS ONLY ON SUCCESS REPORTS A HEALTHY SYSTEM AS A DEAD ONE.
88func sc_class(o: *u8, n: i64) -> i64 {
89 if n <= 0 { return 7 }
90 var ls: i64 = 0
91 while ls < n {
92 let a: i64 = o[ls] as i64
93 var b: i64 = 0
94 if ls + 1 < n { b = o[ls+1] as i64 }
95 var c: i64 = 0
96 if ls + 2 < n { c = o[ls+2] as i64 }
97 if a == 67 { if b == 85 { return 0 } }
98 if a == 67 { if b == 65 { return 2 } }
99 if a == 83 { if b == 84 { return 1 } }
100 if a == 65 { if b == 77 { return 3 } }
101 if a == 78 { if b == 79 { if c == 83 { return 4 } } }
102 if a == 78 { if b == 79 { if c == 69 { return 5 } } }
103 if a == 66 { if b == 85 { return 6 } }
104 // DEPLOYED-AHEAD -- an EIGHTH verdict I did not know existed until UNPARSED caught it. The
105 // deployed elf is LARGER than a fresh build, i.e. it carries code this source does not emit
106 // (nx_relate_daemon: fresh 499,170 vs deployed 605,752). nx_stale_check is scrupulous that this
107 // is a SIZE HEURISTIC, not a diagnosis -- a legitimate shrinking refactor lands here too -- so it
108 // withholds the remedy rather than naming one. Kept DISTINCT from CAP-LOSS on purpose: CAP-LOSS
109 // is string-level PROOF of loss, this is a direction of travel. Both are do-not-promote; merging
110 // them would launder a heuristic into evidence.
111 // *THIS IS WHY UNPARSED IS ITS OWN BUCKET: folding unknowns into a known one would have queued
112 // this organ for promotion and deleted 106KB of shipped code that no source can rebuild.
113 if a == 68 { if b == 69 { return 8 } }
114 var nlpos: i64 = 0 - 1
115 var q: i64 = ls
116 while q < n { if (o[q] as i64) == 10 { nlpos = q; q = n } else { q = q + 1 } }
117 if nlpos < 0 { return 7 }
118 ls = nlpos + 1
119 }
120 return 7
121}
122func sc_label(k: i64) -> i64 {
123 if k == 0 { scp("CURRENT " as *u8) }
124 if k == 1 { scp("STALE-SAFE " as *u8) }
125 if k == 2 { scp("CAP-LOSS " as *u8) }
126 if k == 3 { scp("AMBIGUOUS " as *u8) }
127 if k == 4 { scp("NOSOURCE " as *u8) }
128 if k == 5 { scp("NOELF " as *u8) }
129 if k == 6 { scp("BUILDFAIL " as *u8) }
130 if k == 7 { scp("UNPARSED " as *u8) }
131 if k == 8 { scp("DEPLOY-AHEAD" as *u8) }
132 return 0
133}
134
135func main(argc: i64, argv: *i64) -> i64 {
136 if argc < 2 { sce("usage: nx_stalecensus <max> [skip] [timeout_ms] [worklist]\n" as *u8); sys_exit(3); return 3 }
137 let maxn: i64 = sc_atoi(argv[1] as *u8)
138 if maxn <= 0 { sce("nx_stalecensus: REFUSES an unbounded census; pass max > 0\n" as *u8); sys_exit(3); return 3 }
139 var skip: i64 = 0
140 if argc >= 3 { skip = sc_atoi(argv[2] as *u8) }
141 if skip < 0 { skip = 0 }
142 var tmo: i64 = SC_DEF_TMO
143 if argc >= 4 { tmo = sc_atoi(argv[3] as *u8) }
144 if tmo <= 0 { tmo = SC_DEF_TMO }
145 var wl: *u8 = SC_WORKLIST
146 if argc >= 5 { wl = argv[4] as *u8 }
147 // CONTROL TARGET IS PER-RUN, and it has to be. MEASURED 2026-08-07: four censuses launched together
148 // (skip 145/180/215/250) all probed the SAME hardcoded control, collided on its per-target build
149 // lease, and THREE declared LANE-BLOCKED while my own builds were succeeding in the same seconds.
150 // Exactly one won the race.
151 // *A SHARED CONTROL IS ITSELF A CONTENTION POINT: N concurrent runs probing one control serialise on
152 // it, and N-1 misread that contention as the very fault they were checking for. The guard was right
153 // about "something is holding the lane" and wrong about what -- it was holding it against itself.
154 // Give each concurrent run its own control and the probe measures the lane instead of the probe.
155 var ctl: *u8 = SC_CONTROL
156 if argc >= 6 { ctl = argv[5] as *u8 }
157
158 let box: *i64 = sys_mmap(16) as *i64
159 let raw: *u8 = sys_read_file(wl, box)
160 if raw == (0 as *u8) { sce("nx_stalecensus: cannot read worklist (run nx_stalesweep first)\n" as *u8); sys_exit(2); return 2 }
161 let rn: i64 = box[0]
162 if rn <= 0 { sce("nx_stalecensus: worklist is EMPTY -- refusing to report a census of nothing\n" as *u8); sys_exit(2); return 2 }
163
164 let out: *u8 = sys_mmap(SC_CAP)
165 let ol: *i64 = sys_mmap(16) as *i64
166 let tgt: *u8 = sys_mmap(512)
167 let av: *i64 = sys_mmap(64) as *i64
168
169 var idx: i64 = 0
170 var done: i64 = 0
171 var c0: i64 = 0
172 var c1: i64 = 0
173 var c2: i64 = 0
174 var c3: i64 = 0
175 var c4: i64 = 0
176 var c5: i64 = 0
177 var c6: i64 = 0
178 var c7: i64 = 0
179 var c8: i64 = 0
180
181 // ---- CONTROL PROBE: is the BUILD LANE usable at all, right now? ----
182 // nx_stale_check discards the builder's output on failure, so a canon-divergence refusal and a
183 // genuinely broken compile both surface as the bare token BUILDFAIL. Those have OPPOSITE remedies
184 // ("wait for the tree to settle" vs "this organ is broken"), and a census started during tree churn
185 // would report the entire corpus broken with total confidence.
186 // The lane is established by building a target KNOWN to compile, not by inferring from the subjects:
187 // *EVIDENCE THAT DOES NOT REPRODUCE ON THE CONTROL IS NOT EVIDENCE ABOUT THE SUBJECT.
188 // If the control resolves, every BUILDFAIL below is REAL and worth acting on. If it does not, the
189 // instrument is down and this refuses to publish rather than emit a distribution that is all noise.
190 av[0] = SC_CHECKER as i64
191 av[1] = ctl as i64
192 av[2] = 0
193 ol[0] = 0
194 tr_run_capture_cwd(SC_CHECKER, av, out, SC_CAP, ol, tmo, SC_CWD)
195 let ck: i64 = sc_class(out, ol[0])
196 var lane_ok: i64 = 0
197 if ck == 0 { lane_ok = 1 }
198 if ck == 1 { lane_ok = 1 }
199 if ck == 2 { lane_ok = 1 }
200 if ck == 8 { lane_ok = 1 }
201 if lane_ok == 0 {
202 scp("# LANE-BLOCKED: the control target " as *u8); scp(ctl)
203 scp(" did not resolve (build lane refusing -- canon divergence or a held lease).\n" as *u8)
204 scp("# REFUSING to census: every row would read BUILDFAIL and that would be a statement about the LANE, not the organs.\n" as *u8)
205 sys_exit(4)
206 return 4
207 }
208 scp("# lane OK (control " as *u8); scp(ctl); scp(" resolved) -- BUILDFAIL rows below are REAL\n" as *u8)
209 scp("# verdict target (worklist rows are <target>:<hours-stale>)\n" as *u8)
210 var p: i64 = 0
211 while p < rn {
212 // one row is `<target>:<hours>\n`; the target is everything before the FIRST colon, or before
213 // the newline when a row carries no colon. Scan once from p and stop at the newline.
214 var colon: i64 = 0 - 1
215 var nl: i64 = 0 - 1
216 var q: i64 = p
217 while q < rn {
218 let ch2: i64 = raw[q] as i64
219 if ch2 == 58 { if colon < 0 { colon = q } }
220 if ch2 == 10 { nl = q; q = rn }
221 q = q + 1
222 }
223 if nl < 0 { nl = rn }
224 var nend: i64 = nl
225 if colon >= 0 { if colon < nl { nend = colon } }
226 let tlen: i64 = nend - p
227 if tlen > 0 { if tlen < 500 {
228 idx = idx + 1
229 var run: i64 = 1
230 if idx <= skip { run = 0 }
231 if done >= maxn { run = 0 }
232 if run == 1 {
233 var i3: i64 = 0
234 while i3 < tlen { tgt[i3] = raw[p+i3]; i3 = i3 + 1 }
235 tgt[tlen] = 0 as u8
236 av[0] = SC_CHECKER as i64
237 av[1] = tgt as i64
238 av[2] = 0
239 ol[0] = 0
240 tr_run_capture_cwd(SC_CHECKER, av, out, SC_CAP, ol, tmo, SC_CWD)
241 let k: i64 = sc_class(out, ol[0])
242 if k == 0 { c0 = c0 + 1 }
243 if k == 1 { c1 = c1 + 1 }
244 if k == 2 { c2 = c2 + 1 }
245 if k == 3 { c3 = c3 + 1 }
246 if k == 4 { c4 = c4 + 1 }
247 if k == 5 { c5 = c5 + 1 }
248 if k == 6 { c6 = c6 + 1 }
249 if k == 7 { c7 = c7 + 1 }
250 if k == 8 { c8 = c8 + 1 }
251 sc_label(k)
252 scp(tgt)
253 scp("\n" as *u8)
254 done = done + 1
255 // *REFUSE TO PUBLISH A CENSUS TAKEN THROUGH A BLOCKED INSTRUMENT.
256 // nx_stale_check DISCARDS the builder's output on failure, so a canon-divergence refusal
257 // and a genuinely broken compile arrive as the SAME token: BUILDFAIL. Those have opposite
258 // remedies -- one means "wait for the tree to settle", the other means "this organ is
259 // broken" -- and a run started during tree churn would report the entire corpus as broken
260 // with total confidence. Three consecutive failures from a cold start is the lane, not the
261 // organs: abort loudly rather than emit a distribution that is all noise.
262 // The condition is "did ANYTHING resolve", not "were they all BUILDFAIL" -- measured: a
263 // blocked lane returned BUILDFAIL, BUILDFAIL, UNPARSED, and an all-BUILDFAIL test would
264 // have sailed straight past it. The census exists to produce CURRENT / STALE-SAFE /
265 // CAP-LOSS; if three consecutive targets yield NONE of those, the instrument is not
266 // working and every further row is noise.
267 // (SUPERSEDED -- lane health is now established by the CONTROL PROBE before this loop.
268 // The heuristic that lived here inferred "the lane is broken" from the SUBJECTS' OWN
269 // failures, so three genuinely-broken organs would have produced a confident false
270 // diagnosis. MEASURED THE SAME SESSION: nx_gen_gateway BUILDFAILed while a control
271 // target built fine, i.e. the failure was REAL and the heuristic would have blamed the
272 // lane for it. *A GUARD THAT INFERS THE INSTRUMENT IS BROKEN FROM THE SUBJECT'S FAILURES
273 // NEEDS A CONTROL, NOT A THRESHOLD -- evidence that does not reproduce on the control is
274 // not evidence about the subject.)
275 }
276 } }
277 p = nl + 1
278 }
279
280 scp("# stalecensus checked=" as *u8); scn(done)
281 scp(" of worklist_rows=" as *u8); scn(idx)
282 scp(" skip=" as *u8); scn(skip)
283 scp(" | CURRENT=" as *u8); scn(c0)
284 scp(" STALE-SAFE=" as *u8); scn(c1)
285 scp(" CAP-LOSS=" as *u8); scn(c2)
286 scp(" AMBIGUOUS=" as *u8); scn(c3)
287 scp(" NOSOURCE=" as *u8); scn(c4)
288 scp(" NOELF=" as *u8); scn(c5)
289 scp(" BUILDFAIL=" as *u8); scn(c6)
290 scp(" UNPARSED=" as *u8); scn(c7)
291 scp(" DEPLOYED-AHEAD=" as *u8); scn(c8)
292 scp("\n# DETECT-ONLY. STALE-SAFE is the promotable set (/api/build then /api/promote expect_sha256=).\n" as *u8)
293 scp("# CAP-LOSS must NOT be promoted -- its source is BEHIND the deployed elf and rebuilding DELETES shipped strings.\n" as *u8)
294 return 0
295}