code wiki / (root) / nx_store_janitor_gate.nx
`nx_store_janitor_gate.nx` source

↩ module page · 239 lines · 12792 B
1// nx_store_janitor_gate.nx -- THE JANITOR GATE: the seg-store's most destructive standing beat (it moves
2// files nobody can reach, on every plane, every beat) had NO gate. Born 2026-08-18 from two live incidents
3// in two days: nx_store_janitor swept a segment being BORN (files land before the manifest line, id above the
4// manifest max), then its race repair restored only the .docs -- comparewatch-seg-1786828803 (08-16/17) and
5// debt-seg-1787064612 (08-18) both read as "lossy load"/SHORTFALL to every reader, and one seat's debt row was
6// overwritten during the hand repair. Subject: ./nx_store_janitor.elf (argv[1] overrides the path so a STAGED
7// build can be bitten before promote). Fixture assembled at RUNTIME under /tmp/janitor_gate/ (a detector that
8// scans source would find its own fixture) and rebuilt from scratch on every run (idempotent by construction).
9// Teeth, each printed with its values: superseded segment moved (the sweep still sweeps -- the anti-vacuity
10// tooth), birth in flight left alone, live segment untouched, heal restores EVERY sidecar, heal never clobbers a
11// live file, empty manifest REFUSES and touches nothing. RED against the pre-08-18 binary by construction (it
12// moves the birth and knows no heal verb); GREEN only when both fixes are in the forked binary.
13// license_tier: ORIGINAL   No hw writes (Rule 26).
14import "nx_gate_verdict.nx"
15import "nx_tool_run.nx"
16
17const JG_OUT: i64 = 65536
18const JG_PATH: i64 = 512
19const JG_STAT: i64 = 256
20const JG_STAT_SIZE_OFF: i64 = 48
21const JG_AV: i64 = 64
22const JG_I64: i64 = 8
23const JG_EXIT_REFUSED: i64 = 3    // nx_store_janitor's own REFUSED exit code (its header contract)
24// fixture strings are LOCALS in main and threaded as parameters -- a const *u8 indexed by position is the
25// banked CONST[i] landmine (nx_store_janitor_beat header), so none is declared here
26
27func jg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
28func jg_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } return p }
29// file size via fstatat, -1 if absent
30func jg_size(path: *u8) -> i64 {
  let st: *u8 = sys_mmap(JG_STAT)
  if sys_fstatat(path, st) != 0 { sys_munmap(st, JG_STAT); return 0 - 1 }
  let p: *i64 = (st as i64 + JG_STAT_SIZE_OFF) as *i64
  let v: i64 = p[0]
  sys_munmap(st, JG_STAT)
  return v
37}
38func jg_exists(path: *u8) -> i64 { if jg_size(path) >= 0 { return 1 } return 0 }
39func jg_w(path: *u8, content: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, MODE_0644)
  if fd < 0 { return 0 - 1 }
  let n: i64 = jg_slen(content)
  if n > 0 { sys_write(fd, content, n) }
  sys_close(fd)
  return 0
46}
47func jg_has(hay: *u8, hn: i64, needle: *u8) -> i64 {
  var i: i64 = 0
  let nl: i64 = jg_slen(needle)
  if nl == 0 { return 0 }
  while i + nl <= hn {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nl { if hay[i+j] != needle[j] { ok = 0; j = nl } else { j = j + 1 } }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
59}
60// fixture file paths: <root>/jg-seg-<id>.<ext> and <root>/retired/jg-seg-<id>.<ext>
61func jg_live(dst: *u8, pfx: *u8, id: *u8, ext: *u8) -> i64 {
  var o: i64 = jg_cat(dst, 0, pfx)
  o = jg_cat(dst, o, "seg-" as *u8)
  o = jg_cat(dst, o, id)
  o = jg_cat(dst, o, ext)
  dst[o] = 0 as u8
  return o
68}
69func jg_retired(dst: *u8, ret: *u8, id: *u8, ext: *u8) -> i64 {
  var o: i64 = jg_cat(dst, 0, ret)
  o = jg_cat(dst, o, "/jg-seg-" as *u8)
  o = jg_cat(dst, o, id)
  o = jg_cat(dst, o, ext)
  dst[o] = 0 as u8
  return o
76}
77// count how many of the four segment files of <id> exist in the live dir (loc=0) or retired/ (loc=1)
78func jg_count4(pfx: *u8, ret: *u8, id: *u8, loc: i64) -> i64 {
  let p: *u8 = sys_mmap(JG_PATH)
  var n: i64 = 0
  let exts: *i64 = sys_mmap(JG_AV) as *i64
  exts[0] = ".docs" as *u8 as i64
  exts[1] = ".idx" as *u8 as i64
  exts[2] = ".pos" as *u8 as i64
  exts[3] = ".imp" as *u8 as i64
  var i: i64 = 0
  while i < 4 {
      if loc == 0 { jg_live(p, pfx, id, exts[i] as *u8) } else { jg_retired(p, ret, id, exts[i] as *u8) }
      n = n + jg_exists(p)
      i = i + 1
  }
  sys_munmap(p, JG_PATH)
  return n
94}
95// unlink both locations of all four files of <id> (idempotent setup)
96func jg_clear(pfx: *u8, ret: *u8, id: *u8) -> i64 {
  let p: *u8 = sys_mmap(JG_PATH)
  let exts: *i64 = sys_mmap(JG_AV) as *i64
  exts[0] = ".docs" as *u8 as i64
  exts[1] = ".idx" as *u8 as i64
  exts[2] = ".pos" as *u8 as i64
  exts[3] = ".imp" as *u8 as i64
  var i: i64 = 0
  while i < 4 {
      jg_live(p, pfx, id, exts[i] as *u8); sys_unlinkat(p)
      jg_retired(p, ret, id, exts[i] as *u8); sys_unlinkat(p)
      i = i + 1
  }
  sys_munmap(p, JG_PATH)
  return 0
111}
112// write all four files of <id> into live (loc=0) or retired (loc=1)
113func jg_make4(pfx: *u8, ret: *u8, id: *u8, loc: i64, body: *u8) -> i64 {
  let p: *u8 = sys_mmap(JG_PATH)
  let exts: *i64 = sys_mmap(JG_AV) as *i64
  exts[0] = ".docs" as *u8 as i64
  exts[1] = ".idx" as *u8 as i64
  exts[2] = ".pos" as *u8 as i64
  exts[3] = ".imp" as *u8 as i64
  var i: i64 = 0
  while i < 4 {
      if loc == 0 { jg_live(p, pfx, id, exts[i] as *u8) } else { jg_retired(p, ret, id, exts[i] as *u8) }
      jg_w(p, body)
      i = i + 1
  }
  sys_munmap(p, JG_PATH)
  return 0
128}
129// fork the janitor: <elf> <prefix> <verb>; returns rc, out/olen filled
130func jg_run(elf: *u8, pfx: *u8, verb: *u8, out: *u8, olen: *i64) -> i64 {
  let av: *i64 = sys_mmap(JG_AV) as *i64
  av[0] = elf as i64
  av[1] = pfx as i64
  av[2] = verb as i64
  av[3] = 0
  olen[0] = 0
  let rc: i64 = tr_run_capture(elf, av, out, JG_OUT - 1, olen)
  sys_munmap(av as *u8, JG_AV)
  return rc
140}
141
142func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_store_janitor_gate -- birth-in-flight rule, whole-segment heal, refuse-on-unknown-live-set" as *u8)
  let root: *u8 = "/tmp/janitor_gate" as *u8
  let ret: *u8 = "/tmp/janitor_gate/retired" as *u8
  let pfx: *u8 = "/tmp/janitor_gate/jg-" as *u8
  let mani: *u8 = "/tmp/janitor_gate/jg-manifest.txt" as *u8
  var elf: *u8 = "./nx_store_janitor.elf" as *u8
  if argc >= 2 { elf = argv[1] as *u8 }
  gv_puts("  subject: " as *u8); gv_puts(elf); gv_puts("\n" as *u8)
  if gv_need("janitor-elf-present" as *u8, jg_exists(elf), ctr) == 0 {
      return gv_verdict("storejanitor" as *u8, ctr, "subject binary absent; pass its path as argv[1]" as *u8)
  }
155
  // ---- SETUP, idempotent: rebuild the fixture plane from scratch every run
  sys_mkdir(root, MODE_0755)
  sys_mkdir(ret, MODE_0755)
  jg_clear(pfx, ret, "99" as *u8); jg_clear(pfx, ret, "100" as *u8); jg_clear(pfx, ret, "101" as *u8); jg_clear(pfx, ret, "102" as *u8)
  sys_unlinkat(mani)
  jg_w(mani, "seg-100\nseg-101\n" as *u8)
  jg_make4(pfx, ret, "99" as *u8, 0, "superseded generation\n" as *u8)     // below max, unlisted  -> must be MOVED
  jg_make4(pfx, ret, "100" as *u8, 0, "live" as *u8)                       // listed               -> untouched
  let p: *u8 = sys_mmap(JG_PATH)
  jg_live(p, pfx, "101" as *u8, ".docs" as *u8); jg_w(p, "live record whose index was swept\n" as *u8)
  jg_retired(p, ret, "101" as *u8, ".idx" as *u8); jg_w(p, "idx" as *u8)   // listed, sidecars in retired/
  jg_retired(p, ret, "101" as *u8, ".pos" as *u8); jg_w(p, "pos" as *u8)   // (the 08-16/08-18 damage shape)
  jg_retired(p, ret, "101" as *u8, ".imp" as *u8); jg_w(p, "imp" as *u8)
  jg_retired(p, ret, "100" as *u8, ".idx" as *u8); jg_w(p, "decoy" as *u8) // a stale twin of a LIVE file: heal must NOT clobber
  jg_make4(pfx, ret, "102" as *u8, 0, "birth in flight\n" as *u8)          // above max, unlisted  -> must be LEFT ALONE
  // assert the fixture reached its intended state before asserting outcomes (a fixture that never
  // reached the condition would pass every tooth vacuously)
  let fix_ok: i64 = ((jg_count4(pfx, ret, "99" as *u8, 0) == 4) as i64) & ((jg_count4(pfx, ret, "100" as *u8, 0) == 4) as i64) & ((jg_count4(pfx, ret, "101" as *u8, 1) == 3) as i64) & ((jg_count4(pfx, ret, "102" as *u8, 0) == 4) as i64)
  if gv_need("fixture-assembled" as *u8, fix_ok, ctr) == 0 {
      return gv_verdict("storejanitor" as *u8, ctr, "could not assemble /tmp/janitor_gate fixture" as *u8)
  }
177
  // ---- RUN 1: apply
  let out: *u8 = sys_mmap(JG_OUT)
  let olen: *i64 = sys_mmap(JG_I64) as *i64
  let rc1: i64 = jg_run(elf, pfx, "apply" as *u8, out, olen)
  gv_puts("  apply rc=" as *u8); gv_num(rc1); gv_puts(" out=" as *u8); sys_write(1, out, olen[0])
  let l99: i64 = jg_count4(pfx, ret, "99" as *u8, 0)
  let r99: i64 = jg_count4(pfx, ret, "99" as *u8, 1)
  let l100: i64 = jg_count4(pfx, ret, "100" as *u8, 0)
  let l102: i64 = jg_count4(pfx, ret, "102" as *u8, 0)
  gv_puts("  values: seg99 live=" as *u8); gv_num(l99); gv_puts(" retired=" as *u8); gv_num(r99)
  gv_puts(" seg100 live=" as *u8); gv_num(l100)
  gv_puts(" seg102 live=" as *u8); gv_num(l102); gv_puts("\n" as *u8)
  let moved_ok: i64 = ((l99 == 0) as i64) & ((r99 == 4) as i64) & (jg_has(out, olen[0], "MOVED=4" as *u8))
  gv_check("superseded-below-max-moved-to-retired-all-four-files" as *u8, moved_ok, ctr)
  let birth_ok: i64 = ((l102 == 4) as i64) & (jg_has(out, olen[0], "inflight_files=4" as *u8))
  gv_check("birth-in-flight-above-max-left-alone-and-counted" as *u8, birth_ok, ctr)
  gv_check("live-segment-untouched-by-apply" as *u8, (l100 == 4) as i64, ctr)
  let quiet_ok: i64 = ((rc1 == 0) as i64) & ((1 - jg_has(out, olen[0], "LOST-LIVE" as *u8)) as i64)
  gv_check("apply-exit-0-and-no-live-segment-lost" as *u8, quiet_ok, ctr)
  // the discriminating pair as one bite: fires on the superseded (moved), silent on the birth (kept)
  var birth_moved: i64 = 0
  if l102 < 4 { birth_moved = 1 }
  var sup_moved: i64 = 0
  if l99 == 0 { sup_moved = 1 }
  gv_bite("neg-control-sweep-discriminates-superseded-from-birth" as *u8, sup_moved, birth_moved, ctr)
203
  // ---- RUN 2: heal
  let rc2: i64 = jg_run(elf, pfx, "heal" as *u8, out, olen)
  gv_puts("  heal rc=" as *u8); gv_num(rc2); gv_puts(" out=" as *u8); sys_write(1, out, olen[0])
  let l101: i64 = jg_count4(pfx, ret, "101" as *u8, 0)
  let r101: i64 = jg_count4(pfx, ret, "101" as *u8, 1)
  jg_live(p, pfx, "100" as *u8, ".idx" as *u8)
  let sz100idx: i64 = jg_size(p)
  jg_retired(p, ret, "100" as *u8, ".idx" as *u8)
  let decoy: i64 = jg_exists(p)
  gv_puts("  values: seg101 live=" as *u8); gv_num(l101); gv_puts(" retired=" as *u8); gv_num(r101)
  gv_puts(" seg100.idx bytes=" as *u8); gv_num(sz100idx); gv_puts(" decoy-still-retired=" as *u8); gv_num(decoy); gv_puts("\n" as *u8)
  let heal_ok: i64 = ((l101 == 4) as i64) & ((r101 == 0) as i64) & (jg_has(out, olen[0], "healed=3" as *u8)) & ((rc2 == 0) as i64)
  gv_check("heal-restores-every-sidecar-of-a-live-segment" as *u8, heal_ok, ctr)
  // live 100.idx holds "live" (4 bytes); the retired decoy holds "decoy" (5). Unchanged size + decoy still there = no clobber.
  let noclob: i64 = ((sz100idx == 4) as i64) & ((decoy == 1) as i64)
  gv_check("heal-never-clobbers-a-present-live-file" as *u8, noclob, ctr)
220
  // ---- RUN 3: neg-control -- an EMPTY manifest is an unknown live set: refuse, touch nothing.
  // Measured as a DELTA (live counts before == after) so this tooth judges only "moved nothing", whatever
  // state the earlier teeth left the fixture in.
  let l100a: i64 = jg_count4(pfx, ret, "100" as *u8, 0)
  let l101a: i64 = jg_count4(pfx, ret, "101" as *u8, 0)
  let l102a: i64 = jg_count4(pfx, ret, "102" as *u8, 0)
  jg_w(mani, "" as *u8)
  let rc3: i64 = jg_run(elf, pfx, "apply" as *u8, out, olen)
  gv_puts("  empty-manifest apply rc=" as *u8); gv_num(rc3); gv_puts(" out=" as *u8); sys_write(1, out, olen[0])
  let l100b: i64 = jg_count4(pfx, ret, "100" as *u8, 0)
  let l101b: i64 = jg_count4(pfx, ret, "101" as *u8, 0)
  let l102b: i64 = jg_count4(pfx, ret, "102" as *u8, 0)
  gv_puts("  values: live files before=" as *u8); gv_num(l100a + l101a + l102a); gv_puts(" after=" as *u8); gv_num(l100b + l101b + l102b); gv_puts("
234" as *u8)
  let refuse_ok: i64 = ((rc3 == JG_EXIT_REFUSED) as i64) & (jg_has(out, olen[0], "REFUSED" as *u8)) & ((l100b == l100a) as i64) & ((l101b == l101a) as i64) & ((l102b == l102a) as i64) & ((l100a + l101a + l102a > 0) as i64)
  gv_check("neg-control-empty-manifest-refuses-and-moves-nothing" as *u8, refuse_ok, ctr)
237
  return gv_verdict("storejanitor" as *u8, ctr, "each tooth above states itself; the subject is the binary named on the subject line" as *u8)
239}
nx_store_janitor_gate.nx source

`nx_store_janitor_gate.nx` source
