code wiki / _hdl_build / nx_stderronly.nx
`nx_stderronly.nx` source

↩ module page · 1423 lines · 68114 B
1// nx_stderronly.nx -- THE SILENT-STDERR-GUARD DETECTOR.
2//
3// THE DEFECT. A guard that detects a fault, writes its refusal ONLY to the error channel, and then
4// leaves the enclosing status function on a SUCCESS path reaches its caller as SILENCE: the caller
5// reads a success code, sees nothing, and proceeds. Measured live 2026-08-20 in nx_clockjob, where a
6// refused write was indistinguishable from a successful one.
7//
8// SCOPE, STATED PLAINLY -- THIS IS SOURCE-SHAPE ANALYSIS, NOT RUNTIME.
9// It cannot observe which channel a message actually took at run time, because the estate has no
10// fd-capture primitive: a sibling proved that nx_job_run MERGES fd1 and fd2 (one refusing write
11// appeared exactly twice in a single capture), so a runtime channel test is currently unwritable.
12// That missing primitive is filed separately as nx_fdcapture. Everything below is decided from the
13// bytes of the source with comment bodies and string bodies masked out of the code view.
14// WHAT IT THEREFORE CANNOT SEE: a verdict carried through a flag variable that is returned later; a
15// refusal whose message is built across several lines; a condition spread over several lines; a
16// caller that already holds the failure code (a reason-printer); any refusal worded outside the
17// published vocabulary; anything at all at run time.
18//
19// THE SIGNAL IS A CONJUNCTION, AND EVERY CONJUNCT IS PUBLISHED AS ITS OWN BUCKET SO THE FUNNEL CAN BE
20// AUDITED RATHER THAN TRUSTED:
21//   1. the site is an fd-2 emission -- a write whose fd argument is the literal 2 OR a file-level
22//      const whose VALUE is 2 (THE SAME CONSTANT IN TWO SPELLINGS IS TWO CONSTANTS TO EVERY SCANNER:
23//      the estate writes both, so resolving by value is the only complete rule), OR a call to a
24//      same-file UNCONDITIONAL stderr helper
25//   2. it is NOT inside such a helper's own body   (a printer is not a guard)
26//   3. its innermost enclosing block is an `if` guard, not a function body / else / loop
27//   4. the emitted literal carries a REFUSAL token from the published vocabulary
28//   5. the guard block carries NO non-zero verdict (no non-zero return, no non-zero sys_exit)
29//   6. the enclosing function PROVES IT USES EXIT CODES -- it carries a non-zero verdict SOMEWHERE
30//   7. the guard block does no other work (no assignment, so it cannot be setting a failure flag)
31//
32// CONJUNCT 6 IS THE DISCRIMINATOR AND IT WAS EARNED, NOT GUESSED. Without it the rule fires on every
33// reason-printer in the estate (nx_gunzip.gu_reason, nx_refcorpus.rc_reason: a fan of
34// `if rc == -N { emit(...) }` lines whose CALLER already holds the failure code). Such a function has
35// no non-zero verdict anywhere, so it is not a status function at all, and its silence is correct by
36// design. A FUNCTION THAT NEVER RETURNS A NON-ZERO CODE IS NOT FAILING TO REPORT -- IT WAS NEVER THE
37// REPORTER.
38//
39// CONJUNCT 7 WAS EARNED THE SAME WAY: the corpus is full of `if x < 0 { write(fd2,"-"); x = 0 - x }`
40// number formatters and `if p2 == 0 { werr("T2 ...") }` selftest teeth whose verdict lives in a
41// counter. An assignment inside the block means the block is doing something besides complaining.
42//
43// THE VOCABULARY IS DATA, NOT A CONSTANT IN THE CODE: nishi-ops/stderronly.vocab, one token per line,
44// resolved on either host by gk_ops_path. When absent the built-in list is used and the verdict SAYS
45// SO, with the token count and the path it looked at, on every single run -- A BAR NOBODY CAN SEE IS
46// A BAR THAT WAS NEVER PUBLISHED. Its derivation: tokens that assert the operation was REFUSED or
47// could not proceed. Generic outcome words (FAIL, ERROR, BAD) are DELIBERATELY EXCLUDED, and that
48// exclusion is MEASURED rather than asserted -- `dist` reports how many extra sites the loose
49// vocabulary would admit and how many of those would reach SILENT, so a reader can check the
50// exclusion instead of believing it.
51//
52// usage:
53//   nx_stderronly [--dir D/] [--quiet] [--accept] [--nobaseline] [--baseline P] [--journal P]
54//                                                                                scan + name-set ratchet
55//   nx_stderronly dist [--dir D/] [--bucket N]                                    publish the distribution
56// `--baseline P` exists so a GATE can ratchet against /tmp instead of the estate's real baseline --
57// A GATE MUST NOT SHARE ITS FIXTURE WITH A PRODUCTION BEAT.
58// exit: 0 = no NEW silent guard since the baseline (or dist ok);  1 = a NEW one, named;  2 = REFUSED
59// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
60//
61// THIS ORGAN DELIBERATELY WRITES NOTHING TO FD 2. Every byte it emits goes to fd 1, so it can never
62// be its own subject, and its search literals live inside string bodies which the mask excludes from
63// the code view -- A DETECTOR THAT SCANS SOURCE WILL FIND ITS OWN FIXTURE AND ITS OWN HEADER FIRST
64// unless it is built so that it structurally cannot.
65import "nx_memplane_lib.nx"
66import "nx_gatekit_lib.nx"
67
68const SO_MAXF:    i64 = 32768        // corpus is ~18,600; a smaller cap would REFUSE, never truncate
69const SO_FBUF:    i64 = 4194304
70const SO_FNMAX:   i64 = 2048         // functions per file
71const SO_EMMAX:   i64 = 64           // unconditional stderr helpers per file
72const SO_CNMAX:   i64 = 512          // file-level consts whose value is 2
73const SO_W2MAX:   i64 = 8192         // fd-2 write positions per file
74const SO_SITEF:   i64 = 16384        // emission sites per file
75const SO_ENCLMAX: i64 = 64           // enclosing block levels walked outward from a site
76const SO_WLB:     i64 = 4194304      // per-bucket worklist buffer
77const SO_WLRES:   i64 = 4096         // headroom kept free so a row is never half-written
78const SO_MSG:     i64 = 65536
79const SO_KEYB:    i64 = 4194304
80const SO_VOCB:    i64 = 65536
81const SO_VOCMAX:  i64 = 256
82const SO_PATHB:   i64 = 4096
83
84const SO_NL:      i64 = 10
85const SO_SP:      i64 = 32
86const SO_TABCH:   i64 = 9
87const SO_CR:      i64 = 13
88const SO_QUOTE:   i64 = 34
89const SO_HASH:    i64 = 35
90const SO_BSLASH:  i64 = 92
91const SO_SLASH:   i64 = 47
92const SO_LBRACE:  i64 = 123
93const SO_RBRACE:  i64 = 125
94const SO_LPAREN:  i64 = 40
95const SO_RPAREN:  i64 = 41
96const SO_COMMA:   i64 = 44
97const SO_EQ:      i64 = 61
98const SO_BANG:    i64 = 33
99const SO_LT:      i64 = 60
100const SO_GT:      i64 = 62
101const SO_PLUS:    i64 = 43
102const SO_STAR:    i64 = 42
103const SO_PCT:     i64 = 37
104const SO_D0:      i64 = 48
105const SO_D9:      i64 = 57
106const SO_MINUS:   i64 = 45
107const SO_UPA:     i64 = 65
108const SO_UPZ:     i64 = 90
109const SO_LOA:     i64 = 97
110const SO_LOZ:     i64 = 122
111const SO_USCORE:  i64 = 95
112const SO_CASEGAP: i64 = 32
113const SO_BASE10:  i64 = 10
114const SO_FD2VAL:  i64 = 2            // the error channel; the whole subject of this organ
115
116const SO_MK_CODE: i64 = 0
117const SO_MK_CMT:  i64 = 1
118const SO_MK_STR:  i64 = 2
119
120// THE FUNNEL. Every emission site lands in exactly one bucket; the partition is printed with its sum.
121const SO_B_EMIT:     i64 = 0    // inside an unconditional stderr helper's own body -- a printer
122const SO_B_NOGUARD:  i64 = 1    // enclosing block is a function body / else / loop, not an `if`
123const SO_B_NOVOCAB:  i64 = 2    // guarded, but the literal carries no refusal token
124const SO_B_CARRIES:  i64 = 3    // guarded refusal, and the block carries a non-zero verdict  <-- GOOD
125const SO_B_NOSTATUS: i64 = 4    // enclosing function has no non-zero verdict anywhere -- reason-printer
126const SO_B_HASWORK:  i64 = 5    // block assigns something -- the verdict may live in a flag
127const SO_B_SILENT:   i64 = 6    // <-- THE SIGNAL
128const SO_B_UNKNOWN:  i64 = 7    // could not resolve the enclosing block / a cap was reached
129const SO_B_ELSEARM:  i64 = 8    // the block is one arm of an if/else message SELECTOR, not a refusal
130const SO_B_RETZERO:  i64 = 9    // the block returns/exits explicitly -- a chosen contract, not silence
131const SO_B_N:        i64 = 10
132
133const SO_MODE_644: i64 = 420
134// Each of these serves EXACTLY ONE purpose, because one constant serving two unrelated purposes can
135// never be tuned for either -- SO_I64B is the width of one i64 slot in a hand-sized mmap, SO_NULRES is
136// the terminator headroom kept free at the end of a read buffer, and they are equal only by accident.
137const SO_I64B:        i64 = 8      // bytes per i64 slot
138const SO_NULRES:      i64 = 8      // headroom left unread so a buffer can always be NUL-terminated
139const SO_ASPAN_SLOTS: i64 = 4      // so_argspan writes out[0]=open, out[1]=past-close; slack for growth
140const SO_ESCPAIR:     i64 = 2      // a backslash escape consumes the slash AND the byte it escapes
141// gk_dirscan's documented negative returns, named here so the branch reads as the condition it tests
142const SO_SCAN_ERR_CAP:  i64 = 2    // returned as -2: the corpus exceeded the name-table cap
143const SO_SCAN_ERR_PATH: i64 = 3    // returned as -3: a source path exceeded the name slot
144const SO_EXIT_REFUSED:  i64 = 2    // this organ REFUSED to judge; distinct from 1 = a NEW finding
145
146// Literals are bound ONCE and their lengths DERIVED. A hand-counted length beside a string literal is
147// a second copy of that literal's shape and the two drift silently.
148const SO_L_WRITE:  *u8 = "sys_write("
149const SO_L_EXIT:   *u8 = "sys_exit("
150const SO_L_RETURN: *u8 = "return "
151const SO_L_FUNC:   *u8 = "func "
152const SO_L_CONST:  *u8 = "const "
153const SO_L_IFSP:   *u8 = "if "
154const SO_L_IFP:    *u8 = "if("
155const SO_L_ELSE:   *u8 = "else"
156const SO_L_TOPLVL: *u8 = "<top-level>"
157const SO_JOURNAL:  *u8 = "knowledge/status/stderronly.log"
158const SO_L_KWIF:     *u8 = "if"
159const SO_L_KWWHILE:  *u8 = "while"
160const SO_L_KWRETURN: *u8 = "return"
161
162func so_isid(c: i64) -> i64 {
  if c >= SO_LOA { if c <= SO_LOZ { return 1 } }
  if c >= SO_UPA { if c <= SO_UPZ { return 1 } }
  if c >= SO_D0 { if c <= SO_D9 { return 1 } }
  if c == SO_USCORE { return 1 }
  return 0
168}
169
170func so_isdig(c: i64) -> i64 {
  if c >= SO_D0 { if c <= SO_D9 { return 1 } }
  return 0
173}
174
175func so_lower(c: i64) -> i64 {
  if c >= SO_UPA { if c <= SO_UPZ { return c + SO_CASEGAP } }
  return c
178}
179
180// literal match at p, bounded by n
181func so_at(buf: *u8, p: i64, n: i64, lit: *u8) -> i64 {
  if p < 0 { return 0 }
  let l: i64 = mp_len(lit)
  if p + l > n { return 0 }
  var i: i64 = 0
  while i < l { if buf[p + i] != lit[i] { return 0 } i = i + 1 }
  return 1
188}
189
190// do the `ln` bytes at buf[p..] equal the `ln` bytes at buf[q..]?
191func so_same(buf: *u8, p: i64, q: i64, ln: i64, n: i64) -> i64 {
  if p + ln > n { return 0 }
  var i: i64 = 0
  while i < ln { if buf[p + i] != buf[q + i] { return 0 } i = i + 1 }
  return 1
196}
197
198// MASK PASS. mk[i] says what buf[i] IS: code, comment body, or string body. Both quote characters stay
199// CODE so brace/paren matching still sees the statement structure. This is the whole reason this organ
200// cannot accuse its own header (a comment) or its own search literals (strings).
201// RETURNS the number of literals that reached end-of-file without a closing quote. A dialect where a
202// string may contain a LITERAL NEWLINE (this one does: `az_err("usage: ...<newline>" as *u8)` and
203// `_yt_w("<newline>" as *u8)` are both live in the corpus) means a newline CANNOT terminate a literal
204// -- v1 assumed it could, and the closing quote on the next line then read as an OPENING quote, which
205// shifted every mask after it and sent 9 real sites to UNKNOWN. An UNTERMINATED literal is a different
206// thing entirely and must make the whole file UNKNOWN, because from that point the code view is fiction.
207func so_mask(buf: *u8, n: i64, mk: *u8) -> i64 {
  var unterm: i64 = 0
  var z: i64 = 0
  while z < n { mk[z] = SO_MK_CODE as u8; z = z + 1 }
  var i: i64 = 0
  while i < n {
      let c: i64 = buf[i] as i64
      var adv: i64 = 1
      if c == SO_SLASH {
          var isc: i64 = 0
          if i + 1 < n { if (buf[i + 1] as i64) == SO_SLASH { isc = 1 } }
          if isc == 1 {
              var j: i64 = i
              var f: i64 = 0
              while f == 0 {
                  if j >= n { f = 1 } else {
                      if (buf[j] as i64) == SO_NL { f = 1 } else { mk[j] = SO_MK_CMT as u8; j = j + 1 }
                  }
              }
              adv = j - i
          }
      }
      if c == SO_QUOTE {
          var k: i64 = i + 1
          var f2: i64 = 0
          while f2 == 0 {
              if k >= n { unterm = unterm + 1; f2 = 1 } else {
                  let d: i64 = buf[k] as i64
                  if d == SO_BSLASH {
                      mk[k] = SO_MK_STR as u8
                      if k + 1 < n { mk[k + 1] = SO_MK_STR as u8 }
                      k = k + SO_ESCPAIR
                  } else {
                      if d == SO_QUOTE { k = k + 1; f2 = 1 } else { mk[k] = SO_MK_STR as u8; k = k + 1 }
                  }
              }
          }
          adv = k - i
      }
      if adv < 1 { adv = 1 }
      i = i + adv
  }
  return unterm
250}
251
252// find `lit` in [s,e) at positions whose mask equals `want`; -1 if absent
253func so_find(buf: *u8, mk: *u8, s: i64, e: i64, lit: *u8, want: i64) -> i64 {
  var i: i64 = s
  var res: i64 = 0 - 1
  var f: i64 = 0
  while f == 0 {
      if i >= e { f = 1 } else {
          if (mk[i] as i64) == want { if so_at(buf, i, e, lit) == 1 { res = i; f = 1 } }
          if f == 0 { i = i + 1 }
      }
  }
  return res
264}
265
266// case-folded find of `lit` (length ll) in [s,e) at STRING-body positions -- the vocabulary probe
267func so_ifind(buf: *u8, mk: *u8, s: i64, e: i64, lit: *u8, ll: i64) -> i64 {
  var i: i64 = s
  var res: i64 = 0 - 1
  var f: i64 = 0
  while f == 0 {
      if i + ll > e { f = 1 } else {
          if (mk[i] as i64) == SO_MK_STR {
              var k: i64 = 0
              var same: i64 = 1
              while k < ll {
                  if so_lower(buf[i + k] as i64) != so_lower(lit[k] as i64) { same = 0; k = ll } else { k = k + 1 }
              }
              if same == 1 { res = i; f = 1 }
          }
          if f == 0 { i = i + 1 }
      }
  }
  return res
285}
286
287// forward brace match from an opening `{` at `open`; -1 if unbalanced
288func so_bmatch(buf: *u8, mk: *u8, open: i64, n: i64) -> i64 {
  var d: i64 = 0
  var i: i64 = open
  var res: i64 = 0 - 1
  var f: i64 = 0
  while f == 0 {
      if i >= n { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE {
              let c: i64 = buf[i] as i64
              if c == SO_LBRACE { d = d + 1 }
              if c == SO_RBRACE { d = d - 1; if d == 0 { res = i; f = 1 } }
          }
          if f == 0 { i = i + 1 }
      }
  }
  return res
304}
305
306// innermost enclosing `{` for position p, searching back no further than lo; -1 if unresolved
307func so_encl(buf: *u8, mk: *u8, p: i64, lo: i64) -> i64 {
  var d: i64 = 0
  var i: i64 = p - 1
  var res: i64 = 0 - 1
  var f: i64 = 0
  while f == 0 {
      if i < lo { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE {
              let c: i64 = buf[i] as i64
              if c == SO_RBRACE { d = d + 1 }
              if c == SO_LBRACE { if d == 0 { res = i; f = 1 } else { d = d - 1 } }
          }
          if f == 0 { i = i - 1 }
      }
  }
  return res
323}
324
325// Does [s,e) carry a NON-ZERO verdict? `return 0` and `sys_exit(0)` do not; a bare `return` does not;
326// anything non-literal is treated AS IF it carried one, because this rule must be wrong in the
327// direction of staying silent.
328func so_carries(buf: *u8, mk: *u8, s: i64, e: i64) -> i64 {
  var i: i64 = s
  var res: i64 = 0
  var f: i64 = 0
  while f == 0 {
      if i >= e { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE {
              var hit: i64 = 0
              var q: i64 = 0 - 1
              if so_at(buf, i, e, SO_L_EXIT) == 1 { hit = 1; q = i + mp_len(SO_L_EXIT) }
              if hit == 0 {
                  if so_at(buf, i, e, SO_L_RETURN) == 1 {
                      var bnd: i64 = 1
                      if i > s { if so_isid(buf[i - 1] as i64) == 1 { bnd = 0 } }
                      if bnd == 1 { hit = 1; q = i + mp_len(SO_L_RETURN) }
                  }
              }
              if hit == 1 {
                  var r: i64 = q
                  var fs: i64 = 0
                  while fs == 0 {
                      if r >= e { fs = 1 } else {
                          if (buf[r] as i64) == SO_SP { r = r + 1 } else { fs = 1 }
                      }
                  }
                  if r < e {
                      let c: i64 = buf[r] as i64
                      if so_isdig(c) == 1 {
                          if c == SO_D0 {
                              // `0` alone is success; `0 - N` is a negative verdict
                              var t: i64 = r + 1
                              var ft: i64 = 0
                              while ft == 0 {
                                  if t >= e { ft = 1 } else {
                                      if (buf[t] as i64) == SO_SP { t = t + 1 } else { ft = 1 }
                                  }
                              }
                              if t < e { if (buf[t] as i64) == SO_MINUS { res = 1; f = 1 } }
                          } else { res = 1; f = 1 }
                      }
                      // an identifier or an expression cannot be proven zero -> treat as carrying
                      if so_isdig(c) == 0 { if so_isid(c) == 1 { res = 1; f = 1 } }
                  }
              }
          }
          if f == 0 { i = i + 1 }
      }
  }
  return res
377}
378
379// Is there an ASSIGNMENT in [s,e)? `==`, `!=`, `<=`, `>=` and the compound forms are comparisons or
380// updates, not the plain assignment this asks about.
381func so_assigns(buf: *u8, mk: *u8, s: i64, e: i64) -> i64 {
  var i: i64 = s
  var res: i64 = 0
  var f: i64 = 0
  while f == 0 {
      if i >= e { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE {
              if (buf[i] as i64) == SO_EQ {
                  var ok: i64 = 1
                  if i + 1 < e { if (buf[i + 1] as i64) == SO_EQ { ok = 0 } }
                  if i > s {
                      let pv: i64 = buf[i - 1] as i64
                      if pv == SO_EQ { ok = 0 }
                      if pv == SO_BANG { ok = 0 }
                      if pv == SO_LT { ok = 0 }
                      if pv == SO_GT { ok = 0 }
                      if pv == SO_PLUS { ok = 0 }
                      if pv == SO_MINUS { ok = 0 }
                      if pv == SO_STAR { ok = 0 }
                      if pv == SO_SLASH { ok = 0 }
                      if pv == SO_PCT { ok = 0 }
                  }
                  if ok == 1 { res = 1; f = 1 }
              }
          }
          if f == 0 { i = i + 1 }
      }
  }
  return res
410}
411
412// Is the block opened at `op` an `if` guard? Look at the code on the line BEFORE the brace and take
413// the LAST of `if`/`else` -- otherwise the else-half of `if x { } else { }` reads as a guard.
414func so_isguard(buf: *u8, mk: *u8, op: i64, lo: i64) -> i64 {
  var b: i64 = op
  var f: i64 = 0
  while f == 0 {
      if b <= lo { f = 1 } else {
          if (buf[b - 1] as i64) == SO_NL { f = 1 } else { b = b - 1 }
      }
  }
  var lastif: i64 = 0 - 1
  var lastelse: i64 = 0 - 1
  var i: i64 = b
  while i < op {
      if (mk[i] as i64) == SO_MK_CODE {
          var isif: i64 = 0
          if so_at(buf, i, op, SO_L_IFSP) == 1 { isif = 1 }
          if so_at(buf, i, op, SO_L_IFP) == 1 { isif = 1 }
          if isif == 1 {
              var bnd: i64 = 1
              if i > b { if so_isid(buf[i - 1] as i64) == 1 { bnd = 0 } }
              if bnd == 1 { lastif = i }
          }
          if so_at(buf, i, op, SO_L_ELSE) == 1 { lastelse = i }
      }
      i = i + 1
  }
  if lastif < 0 { return 0 }
  if lastelse > lastif { return 0 }
  return 1
442}
443
444// Is the next CODE token after the block's closing brace the keyword `else`? An `if { } else { }`
445// pair is a message SELECTOR, not a refusal decision -- both arms run on the same already-decided
446// path, so neither arm owes a verdict. MEASURED: this class supplied 3 of the first 9 raw hits
447// (nx_mkdirp's EEXIST-vs-not-created wording choice, and two selftest PASS/FAIL arms).
448func so_elsefollows(buf: *u8, mk: *u8, cl: i64, n: i64) -> i64 {
  var i: i64 = cl + 1
  var res: i64 = 0
  var f: i64 = 0
  while f == 0 {
      if i >= n { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE {
              let c: i64 = buf[i] as i64
              var ws: i64 = 0
              if c == SO_SP { ws = 1 }
              if c == SO_NL { ws = 1 }
              if c == SO_TABCH { ws = 1 }
              if c == SO_CR { ws = 1 }
              if ws == 0 {
                  if so_at(buf, i, n, SO_L_ELSE) == 1 { res = 1 }
                  f = 1
              }
          }
          if f == 0 { i = i + 1 }
      }
  }
  return res
470}
471
472// The argument span of the call starting at `site`: out[0] = its `(`, out[1] = one past its `)`.
473// THE VOCABULARY MUST BE READ FROM THE EMISSION'S OWN ARGUMENTS, NEVER FROM THE LINE. Measured: two
474// of the first nine raw hits were an `if g == 1 { lg("PASS ...") } else { lg("FAIL ... refused") }`
475// written on ONE line, where the refusal word belonged to the OTHER arm entirely.
476func so_argspan(buf: *u8, mk: *u8, site: i64, n: i64, out: *i64) -> i64 {
  var i: i64 = site
  var op: i64 = 0 - 1
  var f: i64 = 0
  while f == 0 {
      if i >= n { f = 1 } else {
          if (mk[i] as i64) == SO_MK_CODE { if (buf[i] as i64) == SO_LPAREN { op = i; f = 1 } }
          if f == 0 { if (buf[i] as i64) == SO_NL { f = 1 } }
          if f == 0 { i = i + 1 }
      }
  }
  if op < 0 { return 0 }
  var d: i64 = 0
  var j: i64 = op
  var cp: i64 = 0 - 1
  var f2: i64 = 0
  while f2 == 0 {
      if j >= n { f2 = 1 } else {
          if (mk[j] as i64) == SO_MK_CODE {
              let c: i64 = buf[j] as i64
              if c == SO_LPAREN { d = d + 1 }
              if c == SO_RPAREN { d = d - 1; if d == 0 { cp = j; f2 = 1 } }
          }
          if f2 == 0 { j = j + 1 }
      }
  }
  if cp < 0 { return 0 }
  out[0] = op
  out[1] = cp + 1
  return 1
506}
507
508// Does [s,e) contain a call that is NOT an fd-2 emission? A block that also CALLS something is doing
509// work beyond complaining, and that call is very often the verdict mechanism itself -- MEASURED on
510// nx_parse.parse_shift, whose diagnostic block ends in nx_diag_note_error(), the compiler's actual
511// error accounting. `isemit` marks the start byte of every emission site in this file.
512func so_othercall(buf: *u8, mk: *u8, isemit: *u8, s: i64, e: i64) -> i64 {
  var i: i64 = s
  var res: i64 = 0
  var f: i64 = 0
  while f == 0 {
      if i >= e { f = 1 } else {
          var adv: i64 = 1
          if (mk[i] as i64) == SO_MK_CODE { if so_isid(buf[i] as i64) == 1 {
              var prevok: i64 = 1
              if i > 0 { if so_isid(buf[i - 1] as i64) == 1 { prevok = 0 } }
              if prevok == 1 {
                  var j: i64 = i
                  var f3: i64 = 0
                  while f3 == 0 {
                      if j >= e { f3 = 1 } else { if so_isid(buf[j] as i64) == 1 { j = j + 1 } else { f3 = 1 } }
                  }
                  let idl: i64 = j - i
                  var iscall: i64 = 0
                  if j < e { if (buf[j] as i64) == SO_LPAREN { iscall = 1 } }
                  if iscall == 1 {
                      var known: i64 = 0
                      if (isemit[i] as i64) == 1 { known = 1 }
                      if known == 0 { if idl == mp_len(SO_L_KWIF) { if so_at(buf, i, e, SO_L_KWIF) == 1 { known = 1 } } }
                      if known == 0 { if idl == mp_len(SO_L_KWWHILE) { if so_at(buf, i, e, SO_L_KWWHILE) == 1 { known = 1 } } }
                      if known == 0 { if idl == mp_len(SO_L_KWRETURN) { if so_at(buf, i, e, SO_L_KWRETURN) == 1 { known = 1 } } }
                      if known == 0 { res = 1; f = 1 }
                  }
                  if idl > 1 { adv = idl }
              }
          } }
          if f == 0 { if adv < 1 { adv = 1 } i = i + adv }
      }
  }
  return res
546}
547
548func so_lineno(buf: *u8, p: i64) -> i64 {
  var i: i64 = 0
  var ln: i64 = 1
  while i < p { if (buf[i] as i64) == SO_NL { ln = ln + 1 } i = i + 1 }
  return ln
553}
554
555// THE VOCABULARY, built into a buffer as newline-separated tokens so the conf path and the built-in
556// path share ONE parser and cannot drift.
557func so_vocab_builtin(vb: *u8) -> i64 {
  var o: i64 = 0
  o = mp_cat(vb, o, "REFUSED\n" as *u8)
  o = mp_cat(vb, o, "refusing\n" as *u8)
  o = mp_cat(vb, o, "refuses\n" as *u8)
  o = mp_cat(vb, o, "cannot\n" as *u8)
  o = mp_cat(vb, o, "unable to\n" as *u8)
  o = mp_cat(vb, o, "usage:\n" as *u8)
  o = mp_cat(vb, o, "denied\n" as *u8)
  o = mp_cat(vb, o, "not permitted\n" as *u8)
  o = mp_cat(vb, o, "must be\n" as *u8)
  o = mp_cat(vb, o, "invalid\n" as *u8)
  o = mp_cat(vb, o, "rejected\n" as *u8)
  return o
571}
572
573// The DELIBERATELY EXCLUDED generic outcome words, kept so the exclusion can be MEASURED.
574func so_vocab_loose(vb: *u8) -> i64 {
  var o: i64 = 0
  o = mp_cat(vb, o, "FAIL\n" as *u8)
  o = mp_cat(vb, o, "ERROR\n" as *u8)
  o = mp_cat(vb, o, "BAD \n" as *u8)
  return o
580}
581
582// index newline-separated tokens; blank lines and lines starting with the comment sigil are skipped
583func so_vindex(vb: *u8, n: i64, off: *i64, len: *i64, cap: i64) -> i64 {
  var cnt: i64 = 0
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      var f: i64 = 0
      while f == 0 {
          if e >= n { f = 1 } else { if (vb[e] as i64) == SO_NL { f = 1 } else { e = e + 1 } }
      }
      var take: i64 = 1
      if e <= p { take = 0 }
      if take == 1 { if (vb[p] as i64) == SO_HASH { take = 0 } }
      if take == 1 { if cnt >= cap { take = 0 } }
      if take == 1 {
          var el: i64 = e
          var f2: i64 = 0
          while f2 == 0 {
              if el <= p { f2 = 1 } else {
                  let lc: i64 = vb[el - 1] as i64
                  var trim: i64 = 0
                  if lc == SO_TABCH { trim = 1 }
                  if lc == SO_CR { trim = 1 }
                  if trim == 1 { el = el - 1 } else { f2 = 1 }
              }
          }
          if el > p { off[cnt] = p; len[cnt] = el - p; cnt = cnt + 1 }
      }
      p = e + 1
  }
  return cnt
613}
614
615// does the emission at [s,eol) carry any vocabulary token inside a string body?
616func so_hasvocab(buf: *u8, mk: *u8, s: i64, eol: i64, vb: *u8, off: *i64, len: *i64, vn: i64) -> i64 {
  var v: i64 = 0
  var res: i64 = 0
  while v < vn {
      let lit: *u8 = ((vb as i64) + off[v]) as *u8
      if so_ifind(buf, mk, s, eol, lit, len[v]) >= 0 { res = 1; v = vn } else { v = v + 1 }
  }
  return res
624}
625
626// FAIL-SOFT durable run record, appended once per scan. THE POINT OF THIS ORGAN IS THAT A REFUSAL
627// MUST NOT REACH ITS CALLER AS SILENCE, and a beat discards stdout: without this line a RED run on the
628// clock would print its finding to nobody and the only evidence would be a baseline file that did not
629// change. Shipping that would be the very defect this organ detects, wearing my name.
630// One writer, one file (a registry row pointing at a log with several writers measures a race, not a
631// subject). A write failure NEVER touches the verdict -- no permission, no record, no problem.
632// GROWTH: one line per daily run, ~110 bytes, so the estate's established status-journal budget
633// (procchurn.jrnl 1048576 bytes / 20000 lines, via nx_sizeguard) is decades away. That budget is
634// ADOPTED from its closest analogue rather than invented here.
635func so_journal(path: *u8, corpus: i64, sites: i64, silent: i64, unknown: i64, nadd: i64, green: i64) -> i64 {
  let fd: i64 = sys_openat_append(path, SO_MODE_644)
  if fd < 0 { return 0 }
  let ln: *u8 = sys_mmap(SO_MSG)
  var o: i64 = mp_catn(ln, 0, sys_now_realtime_sec())
  ln[o] = SO_TABCH as u8; o = o + 1
  o = mp_cat(ln, o, "stderronly\tcorpus=" as *u8)
  o = mp_catn(ln, o, corpus)
  o = mp_cat(ln, o, " sites=" as *u8)
  o = mp_catn(ln, o, sites)
  o = mp_cat(ln, o, " silent=" as *u8)
  o = mp_catn(ln, o, silent)
  o = mp_cat(ln, o, " unknown=" as *u8)
  o = mp_catn(ln, o, unknown)
  o = mp_cat(ln, o, " new=" as *u8)
  o = mp_catn(ln, o, nadd)
  o = mp_cat(ln, o, " verdict=" as *u8)
  if green == 1 { o = mp_cat(ln, o, "GREEN" as *u8) } else { o = mp_cat(ln, o, "RED" as *u8) }
  ln[o] = SO_NL as u8; o = o + 1
  mp_write_all(fd, ln, o)
  sys_close(fd)
  return 0
657}
658
659func main(argc: i64, argv: *i64) -> i64 {
  var dir: *u8 = 0 as *u8
  var dirset: i64 = 0
  var quiet: i64 = 0
  var accept: i64 = 0
  var nobase: i64 = 0
  var distmode: i64 = 0
  var wantb: i64 = 0 - 1
  // A GATE MUST NOT SHARE ITS FIXTURE WITH A PRODUCTION BEAT. Without this the only way to exercise
  // the ratchet in both directions would be to write the estate's real baseline from a test.
  var basearg: *u8 = 0 as *u8
  var baseset: i64 = 0
  var jpath: *u8 = SO_JOURNAL
  var jset: i64 = 0
  var a: i64 = 1
  while a < argc {
      let s: *u8 = argv[a] as *u8
      if mp_streq(s, "dist" as *u8) == 1 { distmode = 1 }
      if mp_streq(s, "--dir" as *u8) == 1 { if a + 1 < argc { dir = argv[a + 1] as *u8; dirset = 1; a = a + 1 } }
      if mp_streq(s, "--quiet" as *u8) == 1 { quiet = 1 }
      if mp_streq(s, "--accept" as *u8) == 1 { accept = 1 }
      if mp_streq(s, "--nobaseline" as *u8) == 1 { nobase = 1 }
      if mp_streq(s, "--baseline" as *u8) == 1 { if a + 1 < argc { basearg = argv[a + 1] as *u8; baseset = 1; a = a + 1 } }
      if mp_streq(s, "--journal" as *u8) == 1 { if a + 1 < argc { jpath = argv[a + 1] as *u8; jset = 1; a = a + 1 } }
      if mp_streq(s, "--bucket" as *u8) == 1 {
          if a + 1 < argc {
              let bs: *u8 = argv[a + 1] as *u8
              var bv: i64 = 0
              var bi: i64 = 0
              while bs[bi] != (0 as u8) { bv = bv * SO_BASE10 + ((bs[bi] as i64) - SO_D0); bi = bi + 1 }
              wantb = bv
              a = a + 1
          }
      }
      a = a + 1
  }
695
  // ⛔A TEST-SCOPED RATCHET IMPLIES A TEST-SCOPED JOURNAL, BY CONSTRUCTION AND NOT BY REMEMBERING.
  // MEASURED 2026-08-20, against myself: `--baseline` exists SOLELY so a gate can ratchet in /tmp, and
  // my own gate duly used it -- and then the three ratchet teeth wrote their FIXTURE runs
  // (`corpus=1 sites=2 silent=1`) straight into the production journal, because the journal path was a
  // separate flag the gate had no argv slot left to pass. A GATE MUST NOT SHARE ITS FIXTURE WITH A
  // PRODUCTION BEAT -- I quoted that law in this organ's own gate header while breaking it three lines
  // of argv away. Coupling the two here makes the mistake unavailable rather than merely discouraged;
  // an explicit `--journal` still wins, so nothing is taken away.
  if baseset == 1 { if jset == 0 {
      let jd: *u8 = sys_mmap(SO_PATHB)
      var jo: i64 = mp_cat(jd, 0, basearg)
      jo = mp_cat(jd, jo, ".journal" as *u8)
      jd[jo] = 0 as u8
      jpath = jd
  } }
711
  let msg:   *u8 = sys_mmap(SO_MSG)
  let names: *u8 = sys_mmap(SO_MAXF * MP_SLOT)
  let fbuf:  *u8 = sys_mmap(SO_FBUF)
  let mk:    *u8 = sys_mmap(SO_FBUF)
  let keyb:  *u8 = sys_mmap(SO_KEYB)
  let dk:    *u8 = sys_mmap(SO_KEYB)
  let vb:    *u8 = sys_mmap(SO_VOCB)
  let lb:    *u8 = sys_mmap(SO_VOCB)
  let vpath: *u8 = sys_mmap(SO_PATHB)
  let bpath: *u8 = sys_mmap(SO_PATHB)
  let voff:  *i64 = sys_mmap(SO_VOCMAX * SO_I64B) as *i64
  let vlen:  *i64 = sys_mmap(SO_VOCMAX * SO_I64B) as *i64
  let loff:  *i64 = sys_mmap(SO_VOCMAX * SO_I64B) as *i64
  let llen:  *i64 = sys_mmap(SO_VOCMAX * SO_I64B) as *i64
  let fn_bs: *i64 = sys_mmap(SO_FNMAX * SO_I64B) as *i64
  let fn_be: *i64 = sys_mmap(SO_FNMAX * SO_I64B) as *i64
  let fn_ns: *i64 = sys_mmap(SO_FNMAX * SO_I64B) as *i64
  let fn_nl: *i64 = sys_mmap(SO_FNMAX * SO_I64B) as *i64
  let fn_st: *i64 = sys_mmap(SO_FNMAX * SO_I64B) as *i64
  let em_ix: *i64 = sys_mmap(SO_EMMAX * SO_I64B) as *i64
  let em_die: *i64 = sys_mmap(SO_EMMAX * SO_I64B) as *i64
  let cn_off: *i64 = sys_mmap(SO_CNMAX * SO_I64B) as *i64
  let cn_len: *i64 = sys_mmap(SO_CNMAX * SO_I64B) as *i64
  let w2p:   *i64 = sys_mmap(SO_W2MAX * SO_I64B) as *i64
  let isemit: *u8 = sys_mmap(SO_FBUF)
  let sitep: *i64 = sys_mmap(SO_SITEF * SO_I64B) as *i64
  let siteh: *i64 = sys_mmap(SO_SITEF * SO_I64B) as *i64
  let aspan: *i64 = sys_mmap(SO_ASPAN_SLOTS * SO_I64B) as *i64
  let wl:    *i64 = sys_mmap(SO_B_N * SO_I64B) as *i64
  let wo:    *i64 = sys_mmap(SO_B_N * SO_I64B) as *i64
  let bkt:   *i64 = sys_mmap(SO_B_N * SO_I64B) as *i64
  var bi2: i64 = 0
  while bi2 < SO_B_N { wl[bi2] = sys_mmap(SO_WLB) as i64; wo[bi2] = 0; bkt[bi2] = 0; bi2 = bi2 + 1 }
  var m: i64 = 0
746
  let LWRITE: i64 = mp_len(SO_L_WRITE)
  let LFUNC:  i64 = mp_len(SO_L_FUNC)
  let LCONST: i64 = mp_len(SO_L_CONST)
750
  // ---- the bar, resolved now and printed on every run ----
  var vsrc_conf: i64 = 0
  var vn: i64 = 0
  if gk_ops_path(vpath, "stderronly.vocab" as *u8) == 1 {
      let vread: i64 = mp_readf(vpath, vb, SO_VOCB - SO_NULRES)
      if vread > 0 { vsrc_conf = 1; vn = so_vindex(vb, vread, voff, vlen, SO_VOCMAX) }
  }
  if vsrc_conf == 0 {
      let vbn: i64 = so_vocab_builtin(vb)
      vn = so_vindex(vb, vbn, voff, vlen, SO_VOCMAX)
  }
  let lbn: i64 = so_vocab_loose(lb)
  let ln2: i64 = so_vindex(lb, lbn, loff, llen, SO_VOCMAX)
764
  // ---- the corpus ----
  var cnt: i64 = 0
  if dirset == 0 { cnt = gk_corpus_scan(names, MP_SLOT, SO_MAXF) }
  if dirset == 1 { cnt = gk_dirscan(dir, 0 as *u8, names, MP_SLOT, SO_MAXF, 0) }
  if cnt == (0 - SO_SCAN_ERR_CAP) {
      m = mp_cat(msg, 0, "nx_stderronly: REFUSED -- corpus exceeds SO_MAXF; a truncated scan is not a scan.\n" as *u8)
      mp_say(msg, m)
      return SO_EXIT_REFUSED
  }
  if cnt == (0 - SO_SCAN_ERR_PATH) {
      m = mp_cat(msg, 0, "nx_stderronly: REFUSED -- a source path exceeds the name slot.\n" as *u8)
      mp_say(msg, m)
      return SO_EXIT_REFUSED
  }
  if cnt <= 0 {
      m = mp_cat(msg, 0, "nx_stderronly: REFUSED -- could not scan the source tree.\n" as *u8)
      mp_say(msg, m)
      return SO_EXIT_REFUSED
  }
784
  var files_read: i64 = 0
  var files_oversize: i64 = 0
  var files_fnovf: i64 = 0
  var files_emovf: i64 = 0
  var files_cnovf: i64 = 0
  var files_w2ovf: i64 = 0
  var files_sitovf: i64 = 0
  var files_unterm: i64 = 0
  var sites_total: i64 = 0
  var sites_capped: i64 = 0
  var wl_dropped: i64 = 0
  var keys_dropped: i64 = 0
  var loose_extra: i64 = 0
  var loose_extra_silent: i64 = 0
  var ko: i64 = 0
800
  var fi: i64 = 0
  while fi < cnt {
      let nm: *u8 = mp_nameptr(names, fi)
      let n: i64 = mp_readf(nm, fbuf, SO_FBUF)
      if n > 0 {
          files_read = files_read + 1
          var usable: i64 = 1
          if n >= SO_FBUF {
              // NO SILENT CAPS: a file that could not be read whole is REPORTED, never scanned as
              // if it were whole -- a truncated scan invents both false negatives and false positives
              files_oversize = files_oversize + 1
              usable = 0
              bkt[SO_B_UNKNOWN] = bkt[SO_B_UNKNOWN] + 1
              let ub: *u8 = (wl[SO_B_UNKNOWN]) as *u8
              var uo: i64 = wo[SO_B_UNKNOWN]
              if uo < SO_WLB - SO_WLRES {
                  uo = mp_cat(ub, uo, "  UNKNOWN file-exceeds-read-buffer " as *u8)
                  uo = mp_cat(ub, uo, nm)
                  ub[uo] = SO_NL as u8; uo = uo + 1
                  wo[SO_B_UNKNOWN] = uo
              } else { wl_dropped = wl_dropped + 1 }
          }
          if usable == 1 {
              if so_mask(fbuf, n, mk) > 0 {
                  // the code view is fiction from the unterminated quote onward -- REFUSE to judge
                  files_unterm = files_unterm + 1
                  usable = 0
                  sites_total = sites_total + 1
                  bkt[SO_B_UNKNOWN] = bkt[SO_B_UNKNOWN] + 1
                  let ub3: *u8 = (wl[SO_B_UNKNOWN]) as *u8
                  var uo3: i64 = wo[SO_B_UNKNOWN]
                  if uo3 < SO_WLB - SO_WLRES {
                      uo3 = mp_cat(ub3, uo3, "  UNKNOWN unterminated-string-literal " as *u8)
                      uo3 = mp_cat(ub3, uo3, nm)
                      ub3[uo3] = SO_NL as u8; uo3 = uo3 + 1
                      wo[SO_B_UNKNOWN] = uo3
                  } else { wl_dropped = wl_dropped + 1 }
              }
          }
          if usable == 1 {
841
              // ---- PASS 1: file-level consts whose VALUE is 2 ----
              var cnn: i64 = 0
              var covf: i64 = 0
              var ci: i64 = 0
              while ci < n {
                  var isline: i64 = 0
                  if ci == 0 { isline = 1 }
                  if ci > 0 { if (fbuf[ci - 1] as i64) == SO_NL { isline = 1 } }
                  if isline == 1 { if (mk[ci] as i64) == SO_MK_CODE { if so_at(fbuf, ci, n, SO_L_CONST) == 1 {
                      let ns: i64 = ci + LCONST
                      var ne: i64 = ns
                      var f: i64 = 0
                      while f == 0 {
                          if ne >= n { f = 1 } else { if so_isid(fbuf[ne] as i64) == 1 { ne = ne + 1 } else { f = 1 } }
                      }
                      var q: i64 = ne
                      var eqp: i64 = 0 - 1
                      var f2: i64 = 0
                      while f2 == 0 {
                          if q >= n { f2 = 1 } else {
                              let c2: i64 = fbuf[q] as i64
                              if c2 == SO_NL { f2 = 1 }
                              if f2 == 0 { if c2 == SO_EQ { eqp = q; f2 = 1 } }
                              if f2 == 0 { q = q + 1 }
                          }
                      }
                      if eqp > 0 {
                          var r: i64 = eqp + 1
                          var f3: i64 = 0
                          while f3 == 0 {
                              if r >= n { f3 = 1 } else { if (fbuf[r] as i64) == SO_SP { r = r + 1 } else { f3 = 1 } }
                          }
                          var val: i64 = 0
                          var nd: i64 = 0
                          var f4: i64 = 0
                          while f4 == 0 {
                              if r >= n { f4 = 1 } else {
                                  let c3: i64 = fbuf[r] as i64
                                  if so_isdig(c3) == 1 { val = val * SO_BASE10 + (c3 - SO_D0); nd = nd + 1; r = r + 1 } else { f4 = 1 }
                              }
                          }
                          if nd > 0 { if val == SO_FD2VAL {
                              if cnn < SO_CNMAX { cn_off[cnn] = ns; cn_len[cnn] = ne - ns; cnn = cnn + 1 } else { covf = 1 }
                          } }
                      }
                  } } }
                  ci = ci + 1
              }
              if covf == 1 { files_cnovf = files_cnovf + 1 }
891
              // ---- PASS 2: every fd-2 write position, resolved ONCE ----
              var w2n: i64 = 0
              var wovf: i64 = 0
              var wi: i64 = 0
              while wi < n {
                  var wadv: i64 = 1
                  if (mk[wi] as i64) == SO_MK_CODE { if so_at(fbuf, wi, n, SO_L_WRITE) == 1 {
                      let ap: i64 = wi + LWRITE
                      var isfd2: i64 = 0
                      if ap < n { if (fbuf[ap] as i64) == (SO_D0 + SO_FD2VAL) {
                          if ap + 1 < n {
                              let cx: i64 = fbuf[ap + 1] as i64
                              if cx == SO_COMMA { isfd2 = 1 }
                              if cx == SO_SP { isfd2 = 1 }
                          }
                      } }
                      if isfd2 == 0 {
                          var cj: i64 = 0
                          while cj < cnn {
                              if so_same(fbuf, ap, cn_off[cj], cn_len[cj], n) == 1 {
                                  var bnd2: i64 = 1
                                  if ap + cn_len[cj] < n { if so_isid(fbuf[ap + cn_len[cj]] as i64) == 1 { bnd2 = 0 } }
                                  if bnd2 == 1 { isfd2 = 1; cj = cnn } else { cj = cj + 1 }
                              } else { cj = cj + 1 }
                          }
                      }
                      if isfd2 == 1 {
                          if w2n < SO_W2MAX { w2p[w2n] = wi; w2n = w2n + 1 } else { wovf = 1 }
                      }
                      wadv = LWRITE
                  } }
                  wi = wi + wadv
              }
              if wovf == 1 { files_w2ovf = files_w2ovf + 1 }
926
              // ---- PASS 3: function table (extent + is-it-a-status-function) ----
              var fnn: i64 = 0
              var ovf: i64 = 0
              var gi: i64 = 0
              while gi < n {
                  var isline2: i64 = 0
                  if gi == 0 { isline2 = 1 }
                  if gi > 0 { if (fbuf[gi - 1] as i64) == SO_NL { isline2 = 1 } }
                  if isline2 == 1 { if (mk[gi] as i64) == SO_MK_CODE { if so_at(fbuf, gi, n, SO_L_FUNC) == 1 {
                      let ns2: i64 = gi + LFUNC
                      var ne2: i64 = ns2
                      var f5: i64 = 0
                      while f5 == 0 {
                          if ne2 >= n { f5 = 1 } else { if so_isid(fbuf[ne2] as i64) == 1 { ne2 = ne2 + 1 } else { f5 = 1 } }
                      }
                      var ob: i64 = 0 - 1
                      var q2: i64 = ne2
                      var f6: i64 = 0
                      while f6 == 0 {
                          if q2 >= n { f6 = 1 } else {
                              if (mk[q2] as i64) == SO_MK_CODE { if (fbuf[q2] as i64) == SO_LBRACE { ob = q2; f6 = 1 } }
                              if f6 == 0 { q2 = q2 + 1 }
                          }
                      }
                      if ob > 0 {
                          let ce: i64 = so_bmatch(fbuf, mk, ob, n)
                          if ce > 0 {
                              if fnn < SO_FNMAX {
                                  fn_ns[fnn] = ns2
                                  fn_nl[fnn] = ne2 - ns2
                                  fn_bs[fnn] = ob
                                  fn_be[fnn] = ce
                                  fn_st[fnn] = so_carries(fbuf, mk, ob, ce)
                                  fnn = fnn + 1
                              } else { ovf = 1 }
                              gi = ce
                          }
                      }
                  } } }
                  gi = gi + 1
              }
              if ovf == 1 { files_fnovf = files_fnovf + 1 }
969
              // ---- PASS 4: unconditional stderr helpers -- they emit to fd 2 and never branch ----
              var emn: i64 = 0
              var eovf: i64 = 0
              var fj: i64 = 0
              while fj < fnn {
                  var w2 : i64 = 0
                  var wk: i64 = 0
                  while wk < w2n {
                      if w2p[wk] > fn_bs[fj] { if w2p[wk] < fn_be[fj] { w2 = 1; wk = w2n } }
                      if wk < w2n { wk = wk + 1 }
                  }
                  if w2 == 1 {
                      var branches: i64 = 0
                      if so_find(fbuf, mk, fn_bs[fj], fn_be[fj], SO_L_IFSP, SO_MK_CODE) >= 0 { branches = 1 }
                      if so_find(fbuf, mk, fn_bs[fj], fn_be[fj], SO_L_IFP, SO_MK_CODE) >= 0 { branches = 1 }
                      if branches == 0 {
                          if emn < SO_EMMAX {
                              em_ix[emn] = fj
                              // A HELPER THAT TERMINATES CARRIES THE VERDICT FOR EVERY CALLER.
                              // MEASURED: nx_syscalls.nxa_die writes to fd 2 and then sys_exit(12),
                              // so its three call sites in sys_mmap read as silent guards while the
                              // process is in fact dying with a non-zero code.
                              em_die[emn] = fn_st[fj]
                              emn = emn + 1
                          } else { eovf = 1 }
                      }
                  }
                  fj = fj + 1
              }
              if eovf == 1 { files_emovf = files_emovf + 1 }
1000
              // ---- PASS 5a: enumerate emission sites (positions only) ----
              var zi: i64 = 0
              while zi < n { isemit[zi] = 0 as u8; zi = zi + 1 }
              var sn: i64 = 0
              var sovf: i64 = 0
              var i: i64 = 0
              while i < n {
                  var adv: i64 = 1
                  var site: i64 = 0 - 1
                  var shl: i64 = 0 - 1
                  if (mk[i] as i64) == SO_MK_CODE {
                      var wq: i64 = 0
                      while wq < w2n {
                          if w2p[wq] == i { site = i; wq = w2n } else { wq = wq + 1 }
                      }
                      if site >= 0 { adv = LWRITE }
                      if site < 0 { if emn > 0 { if so_isid(fbuf[i] as i64) == 1 {
                          var prevok: i64 = 1
                          if i > 0 { if so_isid(fbuf[i - 1] as i64) == 1 { prevok = 0 } }
                          if prevok == 1 {
                              var j2: i64 = i
                              var f8: i64 = 0
                              while f8 == 0 {
                                  if j2 >= n { f8 = 1 } else { if so_isid(fbuf[j2] as i64) == 1 { j2 = j2 + 1 } else { f8 = 1 } }
                              }
                              let idl: i64 = j2 - i
                              var iscall: i64 = 0
                              if j2 < n { if (fbuf[j2] as i64) == SO_LPAREN { iscall = 1 } }
                              var isdef: i64 = 0
                              if i >= LFUNC { if so_at(fbuf, i - LFUNC, n, SO_L_FUNC) == 1 { isdef = 1 } }
                              if iscall == 1 { if isdef == 0 {
                                  var ej: i64 = 0
                                  while ej < emn {
                                      let fx: i64 = em_ix[ej]
                                      var hit2: i64 = 0
                                      if fn_nl[fx] == idl { if so_same(fbuf, i, fn_ns[fx], idl, n) == 1 { hit2 = 1 } }
                                      if hit2 == 1 { site = i; shl = ej; ej = emn } else { ej = ej + 1 }
                                  }
                              } }
                              if idl > 1 { adv = idl }
                          }
                      } } }
                  }
                  if site >= 0 {
                      if sn < SO_SITEF {
                          sitep[sn] = site
                          siteh[sn] = shl
                          isemit[site] = 1 as u8
                          sn = sn + 1
                      } else { sovf = 1 }
                  }
                  if adv < 1 { adv = 1 }
                  i = i + adv
              }
              if sovf == 1 {
                  // a per-file cap reached is REPORTED as UNKNOWN, never dropped: an unscanned site
                  // corrupts the answer in BOTH directions
                  files_sitovf = files_sitovf + 1
                  sites_total = sites_total + 1
                  sites_capped = sites_capped + 1
                  bkt[SO_B_UNKNOWN] = bkt[SO_B_UNKNOWN] + 1
                  let ub2: *u8 = (wl[SO_B_UNKNOWN]) as *u8
                  var uo2: i64 = wo[SO_B_UNKNOWN]
                  if uo2 < SO_WLB - SO_WLRES {
                      uo2 = mp_cat(ub2, uo2, "  UNKNOWN per-file-site-cap-reached " as *u8)
                      uo2 = mp_cat(ub2, uo2, nm)
                      ub2[uo2] = SO_NL as u8; uo2 = uo2 + 1
                      wo[SO_B_UNKNOWN] = uo2
                  } else { wl_dropped = wl_dropped + 1 }
              }
1071
              // ---- PASS 5b: classify every site through the published funnel ----
              var si: i64 = 0
              while si < sn {
                  let site: i64 = sitep[si]
                  let shl: i64 = siteh[si]
                  sites_total = sites_total + 1
                  var owner: i64 = 0 - 1
                  var fk: i64 = 0
                  while fk < fnn {
                      if site > fn_bs[fk] { if site < fn_be[fk] { owner = fk } }
                      fk = fk + 1
                  }
                  var inhelper: i64 = 0
                  var ek: i64 = 0
                  while ek < emn { if em_ix[ek] == owner { inhelper = 1; ek = emn } else { ek = ek + 1 } }
1087
                  var lo: i64 = 0
                  if owner >= 0 { lo = fn_bs[owner] }
                  let op: i64 = so_encl(fbuf, mk, site, lo)
1091
                  var b: i64 = SO_B_UNKNOWN
                  if inhelper == 1 { b = SO_B_EMIT }
                  if inhelper == 0 { if op >= 0 {
                      let cl: i64 = so_bmatch(fbuf, mk, op, n)
                      if cl > 0 {
                          if so_isguard(fbuf, mk, op, lo) == 0 { b = SO_B_NOGUARD }
                          if b == SO_B_UNKNOWN { if so_elsefollows(fbuf, mk, cl, n) == 1 { b = SO_B_ELSEARM } }
                          if b == SO_B_UNKNOWN {
                              if so_argspan(fbuf, mk, site, n, aspan) == 1 {
                                  let hv: i64 = so_hasvocab(fbuf, mk, aspan[0], aspan[1], vb, voff, vlen, vn)
1102
                                  // DOES ANY ENCLOSING BLOCK STRICTLY INSIDE THE FUNCTION CARRY THE
                                  // VERDICT AFTER THE SITE? MEASURED on nx_pub_lib.pl_adopt, where an
                                  // inner reader-cap message sits inside an outer block that refuses.
                                  // The function body itself is NOT walked -- that would clear every
                                  // guard in any function that returns non-zero anywhere later.
                                  var carr: i64 = so_carries(fbuf, mk, site, cl)
                                  if carr == 0 {
                                      var cur: i64 = op
                                      var lv: i64 = 0
                                      var fo: i64 = 0
                                      while fo == 0 {
                                          if lv >= SO_ENCLMAX { fo = 1 } else {
                                              let pr: i64 = so_encl(fbuf, mk, cur, lo)
                                              if pr < 0 { fo = 1 } else {
                                                  if pr <= lo { fo = 1 } else {
                                                      let pc: i64 = so_bmatch(fbuf, mk, pr, n)
                                                      if pc < 0 { fo = 1 } else {
                                                          if so_carries(fbuf, mk, site, pc) == 1 { carr = 1; fo = 1 }
                                                          cur = pr
                                                      }
                                                  }
                                              }
                                              lv = lv + 1
                                          }
                                      }
                                  }
                                  if carr == 0 { if shl >= 0 { if em_die[shl] == 1 { carr = 1 } } }
1130
                                  var st: i64 = 0
                                  if owner >= 0 { st = fn_st[owner] }
                                  var hasret: i64 = 0
                                  if so_find(fbuf, mk, site, cl, SO_L_EXIT, SO_MK_CODE) >= 0 { hasret = 1 }
                                  if so_find(fbuf, mk, site, cl, SO_L_RETURN, SO_MK_CODE) >= 0 { hasret = 1 }
                                  var work: i64 = 0
                                  if so_assigns(fbuf, mk, op, cl) == 1 { work = 1 }
                                  if work == 0 { if so_othercall(fbuf, mk, isemit, op, cl) == 1 { work = 1 } }
1139
                                  if hv == 1 {
                                      if carr == 1 { b = SO_B_CARRIES }
                                      if b == SO_B_UNKNOWN { if st == 0 { b = SO_B_NOSTATUS } }
                                      if b == SO_B_UNKNOWN { if hasret == 1 { b = SO_B_RETZERO } }
                                      if b == SO_B_UNKNOWN { if work == 1 { b = SO_B_HASWORK } }
                                      if b == SO_B_UNKNOWN { b = SO_B_SILENT }
                                  }
                                  if hv == 0 {
                                      b = SO_B_NOVOCAB
                                      // MEASURE the exclusion instead of asserting it: would the
                                      // generic outcome words have promoted this site to SILENT?
                                      if so_hasvocab(fbuf, mk, aspan[0], aspan[1], lb, loff, llen, ln2) == 1 {
                                          loose_extra = loose_extra + 1
                                          if carr == 0 { if st == 1 { if hasret == 0 { if work == 0 { loose_extra_silent = loose_extra_silent + 1 } } } }
                                      }
                                  }
                              }
                          }
                      }
                  } }
1160
                  bkt[b] = bkt[b] + 1
                  let wb: *u8 = (wl[b]) as *u8
                  var w: i64 = wo[b]
                  if w < SO_WLB - SO_WLRES {
                      w = mp_cat(wb, w, "  " as *u8)
                      w = mp_cat(wb, w, nm)
                      w = mp_cat(wb, w, ":" as *u8)
                      w = mp_catn(wb, w, so_lineno(fbuf, site))
                      w = mp_cat(wb, w, "  func=" as *u8)
                      if owner >= 0 {
                          var k4: i64 = 0
                          while k4 < fn_nl[owner] { wb[w] = fbuf[fn_ns[owner] + k4]; w = w + 1; k4 = k4 + 1 }
                      } else { w = mp_cat(wb, w, SO_L_TOPLVL) }
                      wb[w] = SO_NL as u8; w = w + 1
                      wo[b] = w
                  } else { wl_dropped = wl_dropped + 1 }
1177
                  if b == SO_B_SILENT {
                      // the ratchet key is path#func -- STABLE across line shifts, so a reformat
                      // cannot manufacture a phantom regression
                      if ko < SO_KEYB - SO_WLRES {
                          ko = mp_cat(keyb, ko, nm)
                          keyb[ko] = SO_HASH as u8; ko = ko + 1
                          if owner >= 0 {
                              var k5: i64 = 0
                              while k5 < fn_nl[owner] { keyb[ko] = fbuf[fn_ns[owner] + k5]; ko = ko + 1; k5 = k5 + 1 }
                          } else { ko = mp_cat(keyb, ko, SO_L_TOPLVL) }
                          keyb[ko] = SO_NL as u8; ko = ko + 1
                      } else { keys_dropped = keys_dropped + 1 }
                  }
                  si = si + 1
              }
          }
      }
      fi = fi + 1
  }
1197
  // ---- dedupe the ratchet keys (one function can hold several silent sites) ----
  var dko: i64 = 0
  var p2: i64 = 0
  while p2 < ko {
      var e2: i64 = p2
      var fa: i64 = 0
      while fa == 0 {
          if e2 >= ko { fa = 1 } else { if (keyb[e2] as i64) == SO_NL { fa = 1 } else { e2 = e2 + 1 } }
      }
      if e2 > p2 {
          var dup: i64 = 0
          var q3: i64 = 0
          while q3 < dko {
              var e3: i64 = q3
              var fb: i64 = 0
              while fb == 0 {
                  if e3 >= dko { fb = 1 } else { if (dk[e3] as i64) == SO_NL { fb = 1 } else { e3 = e3 + 1 } }
              }
              if e3 - q3 == e2 - p2 {
                  var same4: i64 = 1
                  var z2: i64 = 0
                  while z2 < e2 - p2 { if dk[q3 + z2] != keyb[p2 + z2] { same4 = 0; z2 = e2 - p2 } else { z2 = z2 + 1 } }
                  if same4 == 1 { dup = 1; q3 = dko }
              }
              if q3 < dko { q3 = e3 + 1 }
          }
          if dup == 0 {
              var z3: i64 = 0
              while z3 < e2 - p2 { dk[dko] = keyb[p2 + z3]; dko = dko + 1; z3 = z3 + 1 }
              dk[dko] = SO_NL as u8; dko = dko + 1
          }
      }
      p2 = e2 + 1
  }
  var kc: i64 = 0
  var kp: i64 = 0
  while kp < dko { if (dk[kp] as i64) == SO_NL { kc = kc + 1 } kp = kp + 1 }
1235
  // ---- THE ENVELOPE AND THE BAR, PRINTED BEFORE ANY VERDICT ----
  m = mp_cat(msg, 0, "nx_stderronly  corpus=" as *u8)
  m = mp_catn(msg, m, cnt)
  if dirset == 0 { m = mp_cat(msg, m, " files (WHOLE compile corpus)" as *u8) }
  if dirset == 1 { m = mp_cat(msg, m, " files (NARROWED by --dir; NOT the whole tree)" as *u8) }
  m = mp_cat(msg, m, " read=" as *u8)
  m = mp_catn(msg, m, files_read)
  m = mp_cat(msg, m, "\n  BAR vocab=" as *u8)
  if vsrc_conf == 1 { m = mp_cat(msg, m, "CONF " as *u8); m = mp_cat(msg, m, vpath) }
  if vsrc_conf == 0 { m = mp_cat(msg, m, "BUILTIN (conf absent at " as *u8); m = mp_cat(msg, m, vpath); m = mp_cat(msg, m, ")" as *u8) }
  m = mp_cat(msg, m, " tokens=" as *u8)
  m = mp_catn(msg, m, vn)
  m = mp_cat(msg, m, "\n  RULE SILENT = fd2-emission AND not-in-a-stderr-helper AND inside-an-if-guard AND not-an-if-else-selector-arm AND refusal-token-in-its-OWN-args AND no-nonzero-verdict-in-this-or-any-enclosing-block-after-the-site AND helper-does-not-terminate AND enclosing-func-carries-a-nonzero-verdict-somewhere AND block-has-no-return-or-exit-at-all AND block-assigns-nothing AND block-calls-nothing-but-emissions\n" as *u8)
  mp_say(msg, m)
1250
  var sum: i64 = 0
  var bq: i64 = 0
  while bq < SO_B_N { sum = sum + bkt[bq]; bq = bq + 1 }
1254
  if distmode == 1 {
      m = mp_cat(msg, 0, "  sites_total=" as *u8)
      m = mp_catn(msg, m, sites_total)
      m = mp_cat(msg, m, "\n  [0] in-stderr-helper-body            = " as *u8); m = mp_catn(msg, m, bkt[SO_B_EMIT])
      m = mp_cat(msg, m, "\n  [1] not-in-an-if-guard               = " as *u8); m = mp_catn(msg, m, bkt[SO_B_NOGUARD])
      m = mp_cat(msg, m, "\n  [8] if-else-selector-arm             = " as *u8); m = mp_catn(msg, m, bkt[SO_B_ELSEARM])
      m = mp_cat(msg, m, "\n  [2] guarded-no-refusal-word          = " as *u8); m = mp_catn(msg, m, bkt[SO_B_NOVOCAB])
      m = mp_cat(msg, m, "\n  [3] guarded-refusal-CARRIES-verdict  = " as *u8); m = mp_catn(msg, m, bkt[SO_B_CARRIES])
      m = mp_cat(msg, m, "\n  [4] enclosing-func-not-a-status-func = " as *u8); m = mp_catn(msg, m, bkt[SO_B_NOSTATUS])
      m = mp_cat(msg, m, "\n  [9] block-returns-or-exits-explicitly= " as *u8); m = mp_catn(msg, m, bkt[SO_B_RETZERO])
      m = mp_cat(msg, m, "\n  [5] block-does-other-work            = " as *u8); m = mp_catn(msg, m, bkt[SO_B_HASWORK])
      m = mp_cat(msg, m, "\n  [6] SILENT                           = " as *u8); m = mp_catn(msg, m, bkt[SO_B_SILENT])
      m = mp_cat(msg, m, "\n  [7] UNKNOWN                          = " as *u8); m = mp_catn(msg, m, bkt[SO_B_UNKNOWN])
      m = mp_cat(msg, m, "\n  PARTITION sum=" as *u8); m = mp_catn(msg, m, sum)
      m = mp_cat(msg, m, " vs sites_total=" as *u8); m = mp_catn(msg, m, sites_total)
      if sum == sites_total { m = mp_cat(msg, m, " RECONCILES" as *u8) } else { m = mp_cat(msg, m, " DOES-NOT-RECONCILE" as *u8) }
      m = mp_cat(msg, m, "\n  distinct silent functions (ratchet keys) = " as *u8)
      m = mp_catn(msg, m, kc)
      m = mp_cat(msg, m, "\n  EXCLUSION MEASURED: admitting the generic outcome words FAIL/ERROR/BAD would add " as *u8)
      m = mp_catn(msg, m, loose_extra)
      m = mp_cat(msg, m, " guarded sites, of which " as *u8)
      m = mp_catn(msg, m, loose_extra_silent)
      m = mp_cat(msg, m, " would reach SILENT -- that is why they are excluded, and it is a measurement, not an assertion.\n  caps: files_oversize=" as *u8)
      m = mp_catn(msg, m, files_oversize)
      m = mp_cat(msg, m, " func_table_overflow_files=" as *u8); m = mp_catn(msg, m, files_fnovf)
      m = mp_cat(msg, m, " helper_table_overflow_files=" as *u8); m = mp_catn(msg, m, files_emovf)
      m = mp_cat(msg, m, " const_table_overflow_files=" as *u8); m = mp_catn(msg, m, files_cnovf)
      m = mp_cat(msg, m, " fd2_table_overflow_files=" as *u8); m = mp_catn(msg, m, files_w2ovf)
      m = mp_cat(msg, m, " site_table_overflow_files=" as *u8); m = mp_catn(msg, m, files_sitovf)
      m = mp_cat(msg, m, " unterminated_literal_files=" as *u8); m = mp_catn(msg, m, files_unterm)
      m = mp_cat(msg, m, " sites_beyond_cap=" as *u8); m = mp_catn(msg, m, sites_capped)
      m = mp_cat(msg, m, " worklist_rows_dropped=" as *u8); m = mp_catn(msg, m, wl_dropped)
      m = mp_cat(msg, m, " ratchet_keys_dropped=" as *u8); m = mp_catn(msg, m, keys_dropped)
      m = mp_cat(msg, m, "\n" as *u8)
      mp_say(msg, m)
      if wantb >= 0 { if wantb < SO_B_N {
          m = mp_cat(msg, 0, "  ---- FULL worklist for bucket " as *u8)
          m = mp_catn(msg, m, wantb)
          m = mp_cat(msg, m, ", " as *u8)
          m = mp_catn(msg, m, bkt[wantb])
          m = mp_cat(msg, m, " rows ----\n" as *u8)
          mp_say(msg, m)
          mp_write_all(1, (wl[wantb]) as *u8, wo[wantb])
      } }
      if wantb < 0 {
          m = mp_cat(msg, 0, "  ---- FULL worklist SILENT ----\n" as *u8)
          mp_say(msg, m)
          mp_write_all(1, (wl[SO_B_SILENT]) as *u8, wo[SO_B_SILENT])
          m = mp_cat(msg, 0, "  ---- FULL worklist UNKNOWN ----\n" as *u8)
          mp_say(msg, m)
          mp_write_all(1, (wl[SO_B_UNKNOWN]) as *u8, wo[SO_B_UNKNOWN])
          m = mp_cat(msg, 0, "  every other bucket has a FULL worklist too: re-run with --bucket N\n" as *u8)
          mp_say(msg, m)
      }
      return 0
  }
1311
  // ---- scan mode: the name-set ratchet ----
  if quiet == 0 {
      m = mp_cat(msg, 0, "  ---- SILENT-STDERR-GUARD worklist, " as *u8)
      m = mp_catn(msg, m, bkt[SO_B_SILENT])
      m = mp_cat(msg, m, " sites ----\n" as *u8)
      mp_say(msg, m)
      mp_write_all(1, (wl[SO_B_SILENT]) as *u8, wo[SO_B_SILENT])
      if bkt[SO_B_UNKNOWN] > 0 {
          m = mp_cat(msg, 0, "  ---- UNKNOWN, its own bucket and its own worklist ----\n" as *u8)
          mp_say(msg, m)
          mp_write_all(1, (wl[SO_B_UNKNOWN]) as *u8, wo[SO_B_UNKNOWN])
      }
  }
1325
  var rc: i64 = 0
  var nadd: i64 = 0
  var bn: i64 = 0
  let bb: *u8 = sys_mmap(SO_KEYB)
  var haveb: i64 = 0
  if nobase == 0 {
      if baseset == 1 {
          let bo: i64 = mp_cat(bpath, 0, basearg)
          bpath[bo] = 0 as u8
          haveb = 1
          bn = mp_readf(bpath, bb, SO_KEYB - SO_NULRES)
      }
      if baseset == 0 {
          if gk_ops_path(bpath, "stderronly.baseline" as *u8) == 1 { haveb = 1; bn = mp_readf(bpath, bb, SO_KEYB - SO_NULRES) }
      }
  }
  if bn > 0 {
      var p4: i64 = 0
      while p4 < dko {
          var e4: i64 = p4
          var fc: i64 = 0
          while fc == 0 {
              if e4 >= dko { fc = 1 } else { if (dk[e4] as i64) == SO_NL { fc = 1 } else { e4 = e4 + 1 } }
          }
          if e4 > p4 {
              var seen: i64 = 0
              var q5: i64 = 0
              while q5 < bn {
                  var e5: i64 = q5
                  var fdd: i64 = 0
                  while fdd == 0 {
                      if e5 >= bn { fdd = 1 } else { if (bb[e5] as i64) == SO_NL { fdd = 1 } else { e5 = e5 + 1 } }
                  }
                  if e5 - q5 == e4 - p4 {
                      var same5: i64 = 1
                      var z5: i64 = 0
                      while z5 < e4 - p4 { if bb[q5 + z5] != dk[p4 + z5] { same5 = 0; z5 = e4 - p4 } else { z5 = z5 + 1 } }
                      if same5 == 1 { seen = 1; q5 = bn }
                  }
                  if q5 < bn { q5 = e5 + 1 }
              }
              if seen == 0 {
                  nadd = nadd + 1
                  m = mp_cat(msg, 0, "  NEW-SILENT-STDERR-GUARD " as *u8)
                  var z6: i64 = 0
                  while z6 < e4 - p4 { msg[m] = dk[p4 + z6]; m = m + 1; z6 = z6 + 1 }
                  m = mp_cat(msg, m, "\n" as *u8)
                  mp_say(msg, m)
              }
          }
          p4 = e4 + 1
      }
  }
1379
  m = mp_cat(msg, 0, "nx_stderronly: " as *u8)
  m = mp_catn(msg, m, files_read)
  m = mp_cat(msg, m, " sources, " as *u8)
  m = mp_catn(msg, m, sites_total)
  m = mp_cat(msg, m, " fd2 emission sites, " as *u8)
  m = mp_catn(msg, m, bkt[SO_B_SILENT])
  m = mp_cat(msg, m, " SILENT in " as *u8)
  m = mp_catn(msg, m, kc)
  m = mp_cat(msg, m, " functions, UNKNOWN=" as *u8)
  m = mp_catn(msg, m, bkt[SO_B_UNKNOWN])
  if sum != sites_total { m = mp_cat(msg, m, "  PARTITION-DOES-NOT-RECONCILE" as *u8) }
  if wl_dropped > 0 { m = mp_cat(msg, m, "  worklist_rows_dropped=" as *u8); m = mp_catn(msg, m, wl_dropped) }
  if keys_dropped > 0 { m = mp_cat(msg, m, "  ratchet_keys_dropped=" as *u8); m = mp_catn(msg, m, keys_dropped) }
  if bn <= 0 { m = mp_cat(msg, m, "  no baseline yet -- recording the current set" as *u8) }
  if bn > 0 {
      if nadd > 0 { m = mp_cat(msg, m, "  RED " as *u8); m = mp_catn(msg, m, nadd); m = mp_cat(msg, m, " NEW" as *u8); rc = 1 }
      if nadd == 0 { m = mp_cat(msg, m, "  GREEN no new silent guard since the baseline" as *u8) }
  }
  m = mp_cat(msg, m, "\n" as *u8)
  mp_say(msg, m)
1400
  var green: i64 = 1
  if rc != 0 { green = 0 }
  so_journal(jpath, cnt, sites_total, bkt[SO_B_SILENT], bkt[SO_B_UNKNOWN], nadd, green)
1404
  if nobase == 0 { if haveb == 1 {
      var writeit: i64 = 0
      if nadd == 0 { writeit = 1 }
      if accept == 1 { writeit = 1 }
      if writeit == 1 {
          // the baseline ALWAYS carries a header, so a clean tree and an unarmed ratchet are
          // DIFFERENT FILES -- a zero-byte baseline reads back as "no baseline yet" and would
          // disarm the ratchet at exactly the moment the tree became clean
          let hdr: *u8 = sys_mmap(SO_MSG)
          var ho: i64 = mp_cat(hdr, 0, "# nx_stderronly baseline -- silent-stderr-guard keys, path" as *u8)
          hdr[ho] = SO_HASH as u8; ho = ho + 1
          ho = mp_cat(hdr, ho, "func\n" as *u8)
          let wf: i64 = sys_openat_wr(bpath, SO_MODE_644)
          if wf >= 0 { mp_write_all(wf, hdr, ho); mp_write_all(wf, dk, dko); sys_close(wf) }
          if accept == 1 { if nadd > 0 { rc = 0 } }
      }
  } }
  return rc
1423}
nx_stderronly.nx source

`nx_stderronly.nx` source
