nx_swcompare_evidence.nx source
↩ module page · 1900 lines · 134622 B
1// nx_swcompare_evidence.nx -- the EVIDENCE layer under the SoftwareCompare matrices. Operator 2026-07-10:
2// "compare ... doesnt provide evidence for all the capabilities we claim and generate those autonomously".
3// For a <domain> this organ AUTONOMOUSLY produces two kinds of evidence and LIAR-KILLS a bare claim:
4// (1) GROUNDING -- for every claimed-present axis in <domain>.matrix, it OPENS the named organ source on
5// disk, finds the implementing symbol, and captures the ACTUAL source LINE + occurrence count. A claim
6// whose symbol is NOT in its named file = UNGROUNDED -> RED (mechanically catches a fabricated cell).
7// (2) EXECUTED PROOF -- it FORKS each gate in <domain>.gates (a real self-testing elf), captures its live
8// "pass=N/M ... GREEN" verdict + exit code. Not a stored number: the gate RUNS every time.
9// Modes: no-arg = console + liar-kill gate (exit 0/1); "json" = evidence JSON; "html" = the evidence page.
10// Liar-kill: every PRESENT/Yes/Best/Part axis grounded, EVERY declared gate GREEN (quorum -- see below), a
11// NEG-CONTROL bogus symbol NOT found. NOTE: no '#'/'!' in string literals (nx_cc trap) -> rgb() + emit those
12// bytes. license_tier: ORIGINAL
13//
14// 2026-07-30 QUORUM CORRECTION: this header used to read ">=1 executed gate GREEN", and the code matched it.
15// That was the defect, not a typo -- one green gate out of five stamped a whole domain PROVEN. The rule now
16// comes from the shared evidence law (nx_evidence_verdict.nx) so no future reader can re-loosen it locally.
17import "nx_syscalls.nx"
18import "nx_evidence_verdict.nx"
19import "nx_heavyio_lib.nx" // the estate-wide heavy-I/O concurrency bound (2026-09-03): the referee forks every gate of a domain, so it asks BEFORE it starts -- and a DEFER is its own ABSTAIN (exit 3), never a RED
20import "nx_sha256.nx"
21import "nx_artifact_root.nx"
22// THE TWO-TREE RESOLVER. MEASURED 2026-08-25: this organ built its matrix and gates paths from a single
23// hard-coded "knowledge/compare/" prefix, so the 40 domains that live ONLY in buildroot/knowledge/compare/
24// returned "matrix file missing -- fail loud" with present_axes=0 and verdict=RED WITHOUT EXAMINING ONE
25// ROW. A control pair proved the cause was the TREE and not the domain: typography (in both trees) graded
26// MEASURED-HONEST 9/9 while dcc and procgen (buildroot-only) failed identically from the same binary.
27import "nx_comparetree_lib.nx"
28import "nx_guarded_run.nx" // seq1789: bound every forked gate -- an instrument its subject can hang measures nothing
29// THE PROFILE VOCABULARY. This organ WRITES the stamp keys and nx_evprofile_lib READS them; importing
30// the same literals here is what makes that wire impossible to drift, rather than merely documented.
31import "nx_evprofile_lib.nx"
32// THE FORMAT OWNER. Until now this organ carried a SIXTH private copy of the "_ABSENT_:" prefix test,
33// inline in ev_scan. Adopting the lib is what makes the fourth symbol form a FORMAT rather than one
34// more local dialect -- and the whole reason nx_matrix_sym_lib exists is that five such copies once
35// drifted apart in five directions on the day a new suffix appeared.
36import "nx_matrix_sym_lib.nx"
37// THE ONE SYMBOL RULER (adopted 2026-09-01). See the doctrine block above ev_rule_line for the
38// measurement that forced it. The GENERATOR (nx_swcompare_matrix), the REGEN, the RANKER and the
39// WATCH-STATE lib were ALL already on this lib; this referee was the FIFTH WHEEL, still deciding
40// grounding with its own private substring -- a producer and a consumer each correct in isolation.
41import "nx_symdecl_lib.nx"
42const EV_MAGIC_8192: i64 = 8192
43const EV_MAGIC_4096: i64 = 4096
44const EV_MAGIC_4095: i64 = 4095
45const EV_MAGIC_604800: i64 = 604800
46const EV_MAGIC_8388608: i64 = 8388608
47const EV_MAGIC_1024: i64 = 1024
48const EV_MAGIC_65536: i64 = 65536
49const EV_MAGIC_2097152: i64 = 2097152
50const EV_MAGIC_16384: i64 = 16384
51const EV_MAGIC_12345: i64 = 12345
52// A forked gate has THREE outcomes, not two. Exit 3 is the shared gv_verdict SKIP: the gate declined to run
53// because a PRECONDITION it needs was absent (e.g. a host quiet enough to trust an emulator run), so it
54// examined nothing. That is "I could not look", NOT "the subject failed" -- the gates say so in their own
55// output ("SKIP is not a pass: it blocks any claim that this works, exactly as missing evidence blocks a GO
56// but never a NO-GO"), and nx_deploy_ready's contract agrees in writing: STALE/VACUOUS/UNPROVEN are evidence
57// DEBT and deliberately do NOT block. Folding SKIP into RED convicted a domain of a failure nobody measured
58// and turned an honest abstention into exactly the NO-GO the gate disclaims.
59const EV_RC_SKIP: i64 = 3
60const EV_RC_TIMEOUT: i64 = 124 // nx_guarded_run deadline: the REFEREE's kill, never the gate's own verdict
61// (A second seat reached the declared-argv defect in the same hour and landed it in ev_run below, with
62// the argv slots DERIVED from the declaration instead of a fixed cap. Four constants staged here for a
63// capped implementation were REMOVED rather than left: EV_ARGVCAP encoded exactly the guessed ceiling
64// that implementation refuses, and an unused constant carrying a rejected design is a landmine for the
65// next reader. Their version is the better one and it stands.)
66
67// ---- PROVENANCE ACCUMULATOR (D3). Declared at the TOP, above every reader: a function defined textually
68// before a static it reads does not resolve to that datum -- it reads a clobbered register. ----
69// WHY THIS EXISTS: the stamp used to record ok/epoch/grounded/gates and nothing else. So a verdict produced
70// where the gate binaries exist was byte-indistinguishable from one produced where they do not. MEASURED
71// 2026-07-30: zero of the declared medbilling and warden gate elfs resolve on the NAS (neither _offc/ nor
72// buildroot/_offc/); they exist only in the laptop tree. The PROVEN column was therefore backed by binaries
73// absent from the machine that serves the claim, and nothing in the format could reveal that.
74// THE FIX IS SELF-ENFORCING: the suite digest is only defined if EVERY declared gate elf could be read and
75// hashed at verdict time. A missing binary cannot be hashed, so it cannot be stamped. Provenance stops being
76// a promise and becomes a thing that either computes or does not.
77static ev_prov_acc: *u8
78static ev_prov_buf: *u8
79static ev_prov_declared: i64
80static ev_prov_present: i64
81static ev_bite_seen: i64
82
83// ---- THE GAP PROFILE (2026-08-31). Numbers this organ ALREADY COMPUTED AND THREW AWAY. ----
84// ev_scan classified four row states and PRINTED the LANDED label without counting it; ev_gates parsed
85// pass=N/M and folded GREEN without ever looking at M. So the stamp could say a board was RED and no
86// consumer could say WHY, and the two remedies that matter most -- WRITE a gate versus FIX a gate --
87// were indistinguishable from outside. A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE, AND A WORKLIST
88// WITHOUT ITS REASON IS STILL ONE STEP SHORT.
89// STATICS, NOT NEW ev_stamp PARAMETERS, DELIBERATELY: these are accumulated deep inside ev_scan and
90// ev_gates and read once by ev_stamp -- the identical shape as ev_prov_declared / ev_bite_seen above,
91// which is this file's own established idiom. It also means no function signature moves, so EVERY
92// INTERMEDIATE STATE of this multi-part edit compiles on a tree other seats are building from.
93// ev_p_v2 is the honesty guard: ev_stamp emits the profile keys ONLY if ev_scan actually ran and set
94// it. A ZERO-FILLED PROFILE IS A FABRICATED CONSTANT WEARING THE SHAPE OF A MEASUREMENT.
95static ev_p_v2: i64
96static ev_p_ungrounded: i64
97static ev_p_absent: i64
98static ev_p_absnamed: i64
99static ev_p_absbare: i64
100static ev_p_landed: i64
101static ev_p_vacuous: i64
102static ev_p_deadline: i64 // gates the REFEREE killed at its deadline before they printed a verdict (2026-09-02): abstained, never convicted
103static ev_p_mbytes: i64
104static ev_p_mcapped: i64
105static ev_p_mroot: i64
106static ev_p_gatesroot: i64
107static ev_p_cjg: i64
108static ev_p_cjp: i64
109static ev_p_cjq: i64
110static ev_p_cjn: i64
111// ---- v4: THE THIRD VERDICT STATE. Same static idiom as the block above, for the reason that block
112// already states -- no function signature moves, so EVERY INTERMEDIATE STATE of this edit compiles on a
113// tree other seats are building from right now.
114static ev_p_unproven: i64
115static ev_p_unpreason: i64
116
117// THE REASONS A VERDICT MAY BE UNPROVEN, AS TOKENS RATHER THAN A BARE FLAG. "I could not look" is only
118// actionable if it says WHICH thing it could not look at, and a single boolean would merge two remedies
119// into one number.
120// ONE OF THESE TWO IS LIVE AND THE OTHER IS RETIRED, AND SAYING SO IS THE POINT OF THIS PARAGRAPH.
121// EV_UNPR_UNREADABLE -- LIVE AND REACHABLE. The matrix is in neither compare tree, so not one conjunct
122// was evaluated against real data. Remedy: find or publish the board.
123// EV_UNPR_CAPPED -- RETIRED 2026-09-01, READ-ONLY LEGACY VOCABULARY. Nothing writes it any more. The
124// writer that did was removed as UNREACHABLE (ev_p_mcapped has one assignment, `= 0`, since the read
125// cap was deleted rather than raised -- see the removal note in main). The token is KEPT ONLY so a
126// stamp written by an older binary and still carrying `unproven_reason=read-capped` can be READ.
127// DO NOT REVIVE THIS TOKEN WITHOUT REVIVING A CAP TO GO WITH IT: a reason no producer can emit is a state
128// that reads as coverage and can never be shown to fire.
129const EV_UNPR_NONE: i64 = 0
130const EV_UNPR_UNREADABLE: i64 = 1
131const EV_UNPR_CAPPED: i64 = 2
132// EV_UNPR_ALLSKIP (2026-09-02) -- every declared gate ABSTAINED (missing precondition, or the referee's
133// own deadline killed it before it printed a verdict line), so NO gate was judged: there is no
134// execution evidence either way. NOT a failure and NOT a pass. Before this state existed a domain whose
135// only gate outran the deadline under a saturated box read `RED failing_conjunct=quorum` -- the
136// referee's kill published as the subject's defect -- and the deploy lane blocked on it fleet-wide.
137// nx_sota_status reads unproven=1 as UNPROVEN (evidence debt), never as dissent.
138const EV_UNPR_ALLSKIP: i64 = 3
139// EV_UNPR_NOGATE (2026-09-02) -- the domain's .gates map declares ZERO rows (or no map exists), so NOTHING
140// was executed: the ABSENCE of execution evidence, not a dissenting method. Measured on performersearch, which
141// opened with an honest zero-row map and published RED failing_conjunct=quorum; nx_sota_status then listed it
142// CLAIMED-BUT-RED and the deploy lane blocked on a board nobody had measured. Same third state, same guard.
143const EV_UNPR_NOGATE: i64 = 4
144
145func ev_unpr_name(r: i64) -> *u8 {
146 if r == EV_UNPR_UNREADABLE { return "matrix-unreadable" as *u8 }
147 if r == EV_UNPR_CAPPED { return "read-capped" as *u8 }
148 if r == EV_UNPR_ALLSKIP { return "every-gate-abstained" as *u8 }
149 if r == EV_UNPR_NOGATE { return "no-gate-declared" as *u8 }
150 return "none" as *u8
151}
152
153// ---- THE RULER CHANGE, MEASURED IN BOTH DIRECTIONS (2026-09-01). ----
154// Replacing the grounding ruler changes every published cell, so the change must carry its own
155// instrument or nobody can audit what it did. Both numbers are FREE: the old ruler is still RUN, as a
156// NAMED CONTROL, and the disagreement between the two IS the finding.
157// ev_p_substronly the OLD word-boundary substring grounded the row and THE ONE SYMBOL RULER does
158// not -- i.e. A PUBLISHED CAPABILITY THAT DOES NOT EXIST. Expect ungrounded to RISE
159// by exactly this much per board; that is the instrument getting honest, not a
160// regression, and every row is NAMED with the line that used to carry it.
161// ev_p_declonly the REVERSE direction: the one ruler grounds a row the substring missed (a
162// "func f(" symbol field, an organ-name existence claim whose basename is not a
163// literal inside it). Counted at its own site, because a partition that cannot
164// fail is not a reconciliation.
165// ev_p_noline present, but the LOCATOR could not name a supporting line, so the evidence line
166// fell back to the control's. NEVER SILENT: a fallback nobody counts is a lie.
167// ev_p_abstain -- THE RULER DECLINED TO JUDGE THIS ROW. Same static idiom as its neighbours, for the
168// reason the block above already states: no function signature moves, so every intermediate state of this
169// edit compiles on a tree other seats are building from right now.
170// IT IS A PARTITION MEMBER, NOT A SEPARATE AXIS: `present` was the EXACT identity grounded + ungrounded,
171// and a claimed axis that is neither breaks it. The residual is published (EVP_K_ABSTAIN in the stamp,
172// an ABSTAIN row on the mode-0 worklist, an `abstained` field in the JSON) so the identity becomes
173// present = grounded + ungrounded + abstain and can still FAIL. AN UNPUBLISHED RESIDUAL IS A LEAK, AND
174// AN ABSTENTION NOBODY READS IS A LIE NOBODY TOLD.
175static ev_p_abstain: i64
176// ev_p_abstain_watch -- THE SAME ABSTENTION, ON A ROW THAT IS A DECLARED GAP RATHER THAN A CLAIM.
177// A SEPARATE AXIS, NOT A PARTITION MEMBER, and that distinction IS the defect it closes.
178// MEASURED on the LIVE video stamp before this shipped: `grounded=15/19 ... abstain=5`, i.e.
179// 15 + 0 + 5 = 20 against present=19 -- A RESIDUAL OF EXACTLY ONE, on a board published ok=1
180// MEASURED-HONEST. The single abstain counter fired ABOVE the watch/non-watch branch while st[4]
181// (present) is only incremented on the NON-watch path, so an abstaining WATCH row was summed into an
182// identity it was never a member of, while ALSO being counted in absent_named.
183// A GAP ROW MUST NEVER ENTER A PARTITION OF THE CLAIMED AXES.
184// It overlaps absent_named exactly as ev_p_whref does, and A NEW BUCKET THAT OVERLAPS AN EXISTING
185// PARTITION MUST BE DECLARED A SEPARATE AXIS.
186static ev_p_abstain_watch: i64
187static ev_p_substronly: i64
188static ev_p_declonly: i64
189static ev_p_noline: i64
190
191// ---- THE WITHHELD-PROOF CLASS (2026-09-01), and the precondition test that keeps it honest. ----
192// THE DEFECT IT CLOSES, MEASURED ON phototwin: four rows whose mechanism SHIPPED and is gate-proven, but
193// whose CLAIM rests on a substrate profile nobody has ever measured, were retracted into watch-contract
194// form -- the only form the grammar had for "not proven". The referee then resolved those symbols, FOUND
195// them, and filed all four as LANDED, so the board read absent=0 landed=6 and fired FLIP-READY telling
196// the next seat these were the cheapest closures available. THE RETRACTION INSTRUCTED ITS OWN REVERSAL.
197// A BOARD THAT CANNOT SAY "SHIPPED BUT UNPROVEN" WILL HAVE ITS HONEST RETRACTIONS WRITTEN AS FALSE
198// ABSENCES, AND A FALSE ABSENCE IS RESOLVED BY THE VERY INSTRUMENT IT WAS MEANT TO INFORM.
199// The form is "_ABSENT_:<symbol>:<precondition-path>" -- see nx_matrix_sym_lib for why it is a SUBFORM.
200//
201// UNMET IS DECIDABLE AND CHEAP, and these are the two real shapes this class arrives in: the press
202// profile that does not exist at all, and the ledger that exists carrying a header and no rows.
203const EV_PRE_MET: i64 = 0
204const EV_PRE_ABSENT: i64 = 1
205const EV_PRE_NODATA: i64 = 2
206// "I COULD NOT LOOK" IS NOT "THE PRECONDITION IS UNMET", and it must not acquit a row's use of the
207// special form. A read that fills its reserve without finding a data line is UNPROVEN, never unmet.
208const EV_PRE_UNPROVEN: i64 = 3
209const EV_PRE_CAP: i64 = 65536
210const EV_PRE_PATH_CAP: i64 = 512
211const EV_PRE_HASH: i64 = 35
212const EV_PRE_TAB: i64 = 9
213const EV_PRE_SPACE: i64 = 32
214const EV_PRE_NL: i64 = 10
215// The symbol-field reserve, NAMED because the fourth form makes that field carry a path as well as a
216// symbol and the old hand-written 128 was one silent truncation away from mis-parsing the new form.
217const EV_SYM_CAP: i64 = 256
218
219// ev_p_withheld is a PARTITION MEMBER: absent = absent_bare + absent_named + withheld, and every gap row
220// increments exactly one of the three. ev_p_whref is a SEPARATE AXIS -- it overlaps both withheld and
221// absent_named, so folding it into that sum would break a reconciliation whose value is that it CAN fail.
222static ev_p_withheld: i64
223static ev_p_whref: i64
224
225// ---- THE RETRACTION DENOMINATOR (2026-09-01). THE NUMBER THAT MAKES A LAUNDERED ROW VISIBLE. ----
226// MEASURED ON THE LIVE BINARY: take a board that is RED on `grounded` and rewrite ONLY the symbol field
227// of its ungrounded rows from `sym` to `_ABSENT_:sym`. loadgov went verdict=RED -> MEASURED-HONEST,
228// ungrounded 2 -> 0, all-grounded 0 -> 1, for +18 BYTES, ZERO CODE AND ZERO CAPABILITY. The mechanism is
229// this organ's own classifier: a plain symbol not found increments st[2] (ungrounded, which fails the
230// verdict), while the SAME symbol wearing the watch prefix increments st[3]/absnamed (a declared gap,
231// verdict-neutral BY DESIGN AND IT MUST STAY THAT WAY -- a board that names its gaps is the most honest
232// artifact on this estate, and punishing gaps would push every seat to hide them instead of declare them).
233//
234// WHY THERE IS NO DETECTOR HERE, AND WHY THAT IS THE ANSWER RATHER THAN A MISSING FEATURE.
235// A retraction and an honest new gap make the IDENTICAL measurable assertion about the world -- "this
236// symbol is not declared in this organ" -- so WITHIN ONE CENSUS they are indistinguishable. Every proxy
237// for the difference was tested against the full corpus (96 boards, both compare trees, 888 gap rows,
238// coverage_complete=1 corpus_complete=1) and every one was REFUSED ON ITS OWN EVIDENCE:
239// (1) "an _ABSENT_ row still claiming nishiExceed=1 is incoherent" -- REFUTED BY THE GENERATOR ITSELF.
240// nx_swcompare_matrix computes the published mark as `if present == 1 { if exc == 1 { nish = 2 } }`,
241// so a gap row scores nish=0: THE EXCEED BADGE IS ALREADY SUPPRESSED until the symbol lands, and
242// liar_exbound already treats the flag as an upper BOUND on measured exceeds. The flag on a gap row
243// publishes nothing false; it is the declared ambition of the contract. 36 of 888 gap rows carry
244// exceed=1 across 17 boards, so enforcing it would have turned 17 boards RED for naming what they
245// intend to lead on -- the precise outcome rule one forbids.
246// (2) "a gap row whose note asserts delivery is self-contradicting" -- REFUTED BY ITS FALSE POSITIVES.
247// A shipped/proven/landed probe flags 68 of 888 gap rows and 588 PERMIL OF THOSE HITS ARE THE
248// ANTONYM: in a gap note the token is overwhelmingly `ABSENT-PROVEN` / `PROVEN ABSENT` -- the
249// corpus_complete absence proofs, i.e. the most rigorous rows on the fleet -- or a `landed` naming
250// a NEIGHBOURING capability. A vocabulary probe over a dominant opposite sense is saturated, and
251// this one indicts the estate's best work. Same family as jitter, cache and intrinsic.
252// (3) "require a minimum claimed share of a board's own axes" -- REFUTED BY RULE ONE. The lowest board
253// is devguardrails at 0 PERMIL (6 rows, 6 gaps, claiming nothing), then smallos 250 and livingdocs
254// 285. A claimed-share floor is a gap penalty wearing a ratio and it lands hardest on exactly the
255// boards that name the most work.
256//
257// SO THIS SHIPS THE MEASUREMENT INSTEAD OF A PROXY, AND IT DECIDES NOTHING. The two events are one
258// observation in a single census but they have OPPOSITE SIGNATURES ACROSS TWO, and the signature is pure
259// per-board arithmetic that needs no per-row history at all -- which is the thing the estate keeps
260// concluding cannot be built:
261// retraction ......... axes CONSTANT, claimed FALLS, gaps RISES
262// honest new gap ..... axes RISES, claimed HOLDS, gaps RISES
263// Today only `present` is recorded anywhere, so those two are the same observation and the detector is
264// unbuildable BY CONSTRUCTION. ev_p_axes is st[0], the board's total declared rows -- COMPUTED ON EVERY
265// RUN SINCE THIS ORGAN EXISTED AND THROWN AWAY AT THE DOOR.
266// A DENOMINATOR THAT IS NEVER RECORDED MAKES ITS OWN NUMERATOR UNREADABLE.
267// ev_p_claimed is SYNTACTIC (a row whose symbol field is not a gap form), so it moves by exactly -1 per
268// laundered row whether or not that symbol was ever findable; that independence from `found` is what
269// makes it a clean signal rather than a second opinion about grounding.
270// ev_p_gapexc is the population from (1), kept as a NAMED count and NOT as a conjunct, so the next reader
271// inherits the refutation WITH ITS NUMBER instead of re-proposing the tooth. NAMED FOR WHAT IT MEASURES,
272// NEVER FOR A REMEDY IT HAS NOT EARNED.
273// FAILURE DIRECTION, ESTABLISHED BEFORE THIS WAS WRITTEN: all three are counters on the text and JSON
274// surfaces only. They enter no liar-kill conjunct, so this change CANNOT move any board's verdict in
275// either direction, and a board that names honest gaps is untouched.
276// TAKEN 2026-09-01, AND THE DEBT THIS PARAGRAPH RECORDED IS PAID. It used to read "OWED AND DELIBERATELY
277// NOT TAKEN HERE: the stamp keys", which was correct at the time and became a FALSE STANDING CLAIM the
278// moment the keys landed -- exactly the drift this file keeps paying for, so the note is rewritten rather
279// than left to be read as an open action.
280// EVP_K_AXES and EVP_K_CLAIMED were minted in nx_evprofile_lib (which OWNS the EVP_K_ literals; minting
281// one locally would recreate the duplicate-literal defect that import exists to prevent) and both are now
282// WRITTEN TO THE STAMP by ev_stamp, inside the ev_p_v2 honesty guard, appended at the tail.
283// THESE THREE COUNTERS THEREFORE REACH A MACHINE NOW, WHICH IS THE WHOLE POINT: a cross-census watcher
284// can separate a RETRACTION (axes constant, claimed falls) from an HONEST NEW GAP (axes rises, claimed
285// holds). They still enter NO liar-kill conjunct, so this remains verdict-neutral in both directions.
286static ev_p_axes: i64
287static ev_p_claimed: i64
288static ev_p_gapexc: i64
289
290// ---- NON-VACUITY (D4, closes seq1344). Count the declared gates that have been PROVEN ABLE TO FAIL. ----
291// nx_gate_bite writes knowledge/status/bite_<gate>.verdict with killed=1 after mutating the gate's subject
292// source, rebuilding, and observing the gate go RED. A gate with no such record has not been shown to
293// detect anything, and clause 4 of the evidence law refuses to count it. This is the writer whose absence
294// pinned the honesty ratio at a structural zero.
295func ev_bite_fold(elf: *u8) -> i64 {
296 var n: i64 = 0
297 while elf[n] != (0 as u8) { n = n + 1 }
298 var s: i64 = 0
299 var i: i64 = 0
300 while i < n { if elf[i] == (47 as u8) { s = i + 1 } i = i + 1 }
301 var e: i64 = n
302 if n >= 4 { if elf[n-4] == (46 as u8) { e = n - 4 } }
303 if e <= s { return 0 }
304 let p: *u8 = sys_mmap(256)
305 var o: i64 = 0
306 let pre: *u8 = "knowledge/status/bite_"
307 var q: i64 = 0
308 while pre[q] != (0 as u8) { p[o] = pre[q]; o = o + 1; q = q + 1 }
309 var k: i64 = s
310 while k < e { p[o] = elf[k]; o = o + 1; k = k + 1 }
311 let sfx: *u8 = ".verdict"
312 q = 0
313 while sfx[q] != (0 as u8) { p[o] = sfx[q]; o = o + 1; q = q + 1 }
314 p[o] = 0 as u8
315 let b: *u8 = sys_mmap(512)
316 let bn: i64 = ev_read(p, b, 511)
317 if bn <= 0 { return 0 }
318 let off: i64 = ev_find_line(b, bn, "killed=1" as *u8, sys_mmap(16) as *i64)
319 if off < 0 { return 0 }
320 // ★A BITE RECORD EXPIRES ON THE SAME TTL AS EVERYTHING ELSE. This organ was counting killed=1 forever,
321 // regardless of the record's epoch -- which is D2 (a verdict that outlives its evidence) rebuilt one
322 // layer down, inside the very apparatus built to kill D2. A gate proven able to fail six months ago,
323 // against source that has since changed, has NOT been proven able to fail today. The record carries an
324 // epoch precisely so it can be refused; refusing it is what makes writing it meaningful.
325 let ep: i64 = ev_num_after(b, bn, "epoch=" as *u8, 6)
326 if ep <= 0 { return 0 }
327 let now: i64 = sys_now_realtime_sec()
328 if now < ep { return 0 }
329 if now - ep > ev_ttl_sec() { return 0 }
330 ev_bite_seen = ev_bite_seen + 1
331 return 1
332}
333
334// Parse the integer following `key`. Local to this organ's stamp/record dialect.
335func ev_num_after(buf: *u8, n: i64, key: *u8, kl: i64) -> i64 {
336 var i: i64 = 0
337 while i <= n - kl {
338 var j: i64 = 0
339 var m: i64 = 1
340 while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } }
341 if m == 1 {
342 var p: i64 = i + kl
343 var v: i64 = 0
344 var got: i64 = 0
345 while p < n { let c: i64 = buf[p] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; p = p + 1 } else { p = n } } else { p = n } }
346 if got == 1 { return v }
347 return 0 - 1
348 }
349 i = i + 1
350 }
351 return 0 - 1
352}
353
354// The evidence TTL, from the SAME config the status surface reads (rule 17). One policy, every consumer --
355// a second copy of the number is how two surfaces come to disagree about what "fresh" means.
356func ev_ttl_sec() -> i64 {
357 let b: *u8 = sys_mmap(EV_MAGIC_4096)
358 let n: i64 = ev_read("knowledge/evidence_policy.conf" as *u8, b, EV_MAGIC_4095)
359 if n <= 0 { return EV_MAGIC_604800 }
360 let v: i64 = ev_num_after(b, n, "ttl_sec=" as *u8, 8)
361 if v <= 0 { return EV_MAGIC_604800 }
362 return v
363}
364
365// ---- ARTIFACT ROOT RESOLUTION -> now the SHARED lib nx_artifact_root.nx (seq1385). ----
366// This organ carried its own copy while the class was being characterised. It is now known to be
367// ecosystem-wide -- the sibling's seq1339 is the same defect seen from the other end -- so the
368// implementation lives in ONE place and this is a thin delegate. Rule 15: a second copy of a resolver is
369// precisely how two hosts drift apart again.
370func ev_resolve(inp: *u8, out: *u8) -> i64 { return ar_resolve(inp, out) }
371
372// Fold one gate elf into the suite digest. Byte-wise ADD (not XOR): order-independent, so gate order in the
373// .gates file cannot change the digest, but a duplicated elf does not silently cancel itself out.
374func ev_prov_fold(elf: *u8) -> i64 {
375 if (ev_prov_acc as i64) == 0 { ev_prov_acc = sys_mmap(32) }
376 if (ev_prov_buf as i64) == 0 { ev_prov_buf = sys_mmap(EV_MAGIC_8388608) }
377 ev_prov_declared = ev_prov_declared + 1
378 let n: i64 = ev_read(elf, ev_prov_buf, EV_MAGIC_8388608)
379 if n <= 0 { return 0 }
380 let d: *u8 = sys_mmap(32)
381 sha256_digest(ev_prov_buf, n, d)
382 var j: i64 = 0
383 while j < 32 { ev_prov_acc[j] = ((ev_prov_acc[j] as i64) + (d[j] as i64)) as u8; j = j + 1 }
384 ev_prov_present = ev_prov_present + 1
385 return 1
386}
387
388func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
389func wc(fd: i64, code: i64) -> i64 { let t: *u8 = sys_mmap(2); t[0] = code as u8; sys_write(fd, t, 1); return 0 }
390func wn(fd: i64, v: i64) -> i64 {
391 var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
392 let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
393 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
394 let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
395}
396func wj(fd: i64, s: *u8) -> i64 {
397 var i: i64 = 0
398 while s[i] != (0 as u8) { let c: i64 = s[i] as i64
399 if c == 34 { wc(fd, 92); wc(fd, 34) } else { if c == 92 { wc(fd, 92); wc(fd, 92) } else { if c < 32 { wc(fd, 32) } else { wc(fd, c) } } }
400 i = i + 1 }
401 return 0
402}
403func wq(fd: i64) -> i64 { wc(fd, 34); return 0 }
404func kv_s(fd: i64, key: *u8, val: *u8) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wq(fd); wj(fd, val); wq(fd); return 0 }
405func kv_n(fd: i64, key: *u8, v: i64) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wn(fd, v); return 0 }
406func streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
407func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
408
409func ev_read(path: *u8, buf: *u8, cap: i64) -> i64 {
410 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
411 var tot: i64 = 0
412 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
413 sys_close(fd); return tot
414}
415
416// find `needle` in buf[0..n); return the byte offset of the START of the LINE containing the FIRST hit, or -1.
417// also writes the total occurrence count to *cnt.
418func ev_ident_ch(c: i64) -> i64 {
419 if c >= 48 { if c <= 57 { return 1 } }
420 if c >= 65 { if c <= 90 { return 1 } }
421 if c >= 97 { if c <= 122 { return 1 } }
422 if c == 95 { return 1 }
423 return 0
424}
425
426func ev_find_line(buf: *u8, n: i64, needle: *u8, cnt: *i64) -> i64 {
427 let nl: i64 = slen(needle)
428 var first: i64 = 0 - 1
429 var occ: i64 = 0
430 var i: i64 = 0
431 while i + nl <= n {
432 var k: i64 = 0
433 var hit: i64 = 1
434 while k < nl { if buf[i + k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
435 if hit == 1 {
436 // WORD BOUNDARY, NOT SUBSTRING. A claim citing bidxv2 was being satisfied by the DEAD
437 // function bidxv2_unused (zero callers), and the domain still folded all-grounded=1 and
438 // MEASURED-HONEST. The _unused suffix is the strongest in-repo signal that code is NOT
439 // wired, and the old substring test read it as proof that it IS. The same rule now also
440 // rejects _old / _deprecated / _v1 renames and prefix collisions, e.g. a claim citing
441 // gs_thumb must not be grounded by gs_thumbnail_legacy. Found 2026-08-01 one step before
442 // an oracle row would have been signed onto the dead claim.
443 if i > 0 { if ev_ident_ch(buf[i - 1] as i64) == 1 { hit = 0 } }
444 if i + nl < n { if ev_ident_ch(buf[i + nl] as i64) == 1 { hit = 0 } }
445 }
446 if hit == 1 {
447 occ = occ + 1
448 if first < 0 {
449 var ls: i64 = i
450 while ls > 0 { if buf[ls - 1] == (10 as u8) { ls = 0 - ls; ls = 0 - ls; break } ls = ls - 1 }
451 if ls < 0 { ls = 0 }
452 first = ls
453 }
454 i = i + nl
455 } else { i = i + 1 }
456 }
457 cnt[0] = occ
458 return first
459}
460
461// copy the line starting at off (up to newline / cap) into dst, trimming leading whitespace; returns length.
462func ev_line_at(buf: *u8, n: i64, off: i64, dst: *u8, cap: i64) -> i64 {
463 var p: i64 = off
464 while p < n { let c: i64 = buf[p] as i64; if c == 32 { p = p + 1 } else { if c == 9 { p = p + 1 } else { break } } }
465 var t: i64 = 0
466 while p < n { if buf[p] == (10 as u8) { break } if t < cap - 1 { dst[t] = buf[p]; t = t + 1 } p = p + 1 }
467 dst[t] = 0 as u8
468 return t
469}
470
471// ================================================================================================
472// A COMMENT MUST NOT GROUND A CLAIM (2026-09-01).
473//
474// ev_find_line above is a WORD-BOUNDARY SUBSTRING over the raw organ source -- comments, string
475// literals and call sites included. A SCANNER THAT DOES NOT SKIP COMMENTS MEASURES THE DOCUMENTATION,
476// NOT THE CODE. MEASURED: gt_drape_mesh returns matches=1 over 23,412 files (corpus_complete=1) and
477// that ONE hit is nx_garment_twin.nx line 11 -- a COMMENT reading "(gt_drape_mesh), declared, not
478// implied". The referee reported that row [LANDED] and fired LANDED-UNFLIPPED, instructing the next
479// seat to publish a capability that does not exist. The prose DESCRIBING the contract was read as the
480// contract, and the flip worklist is exactly where a seat looks for the cheapest closure on a board.
481//
482// THE FIX IS NOT A SECOND COMMENT-STRIPPER, AND NO STRIPPER IS NEEDED. nx_symdecl_lib IS the estate's
483// ONE SYMBOL RULER, and its own header records why it exists: three private rulers once disagreed in
484// public about the same rows. Its declaration rule requires the symbol at COLUMN 0 after `func ` /
485// `const ` / `struct ` / `static `, so a comment line can NEVER satisfy it -- prose is excluded BY
486// CONSTRUCTION, not by a lexer that would itself have to be string-aware to stop a "https:" literal
487// swallowing the rest of its line. It also carries the rule-BY-SHAPE census (decl / jsdecl / exists /
488// marker / data) that stops a naive declaration rule turning ~200 true marker and data cells into
489// MISSING -- the wrong-direction error that census was written to prevent.
490//
491// TWO GUARDS FOR ONE INVARIANT IS THE DUPLICATE-RULER DEFECT, so ev_find_line is DEMOTED, never
492// deleted: it is now a NAMED CONTROL whose only remaining job is to measure what the old rule carried.
493// ================================================================================================
494
495// THE LOCATOR, NEVER THE DECIDER. `found` is decided by sd_present_buf and by nothing in here. This
496// walks the lines and returns the START of the first line on which THE SAME RULE fires, so the
497// published "Evidence (source line)" is the declaration itself rather than an earlier comment that
498// merely names it. It composes the lib's own PURE predicates one line at a time -- no second rule and
499// no allocation in the loop. Returns -1 when no line satisfies the rule, and the caller COUNTS that.
500func ev_rule_line(b: *u8, n: i64, rule: i64, ident: *u8, raw: *u8) -> i64 {
501 if rule == SD_RULE_EXISTS { return 0 }
502 var i: i64 = 0
503 while i < n {
504 var e: i64 = i
505 while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
506 let ln: i64 = e - i
507 if ln > 0 {
508 let p: *u8 = ((b as i64) + i) as *u8
509 var hit: i64 = 0
510 if rule == SD_RULE_DECL { hit = sd_declared_buf(p, ln, ident) }
511 if rule == SD_RULE_JSDECL { hit = sd_js_declared_buf(p, ln, ident) }
512 if rule == SD_RULE_MARKER {
513 hit = sd_substring_control(p, ln, ident)
514 if hit == 0 { hit = sd_substring_control(p, ln, raw) }
515 }
516 if rule == SD_RULE_DATA { hit = sd_substring_control(p, ln, raw) }
517 if hit == 1 { return i }
518 }
519 i = e + 1
520 }
521 return 0 - 1
522}
523
524// find the first occurrence of needle in ob[0..on); parse the integer right after it.
525// returns the value (or -1 if needle/digits absent); endpos[0] = byte after the digits (-1 if no hit).
526// RENAMED 2026-07-31 (debt 1785518763). This was ALSO called ev_num_after, colliding
527// with the (buf, n, key, kl: i64) variant defined above: same name, same arity,
528// INCOMPATIBLE 4th parameter (i64 key-length there, *i64 out-pointer here). nx_cc
529// accepted the redefinition silently and the FIRST definition won, so every call site
530// below passed the mmap'd `ep` POINTER into `kl: i64`, making the loop guard
531// `i <= n - kl` compare against a huge address so it NEVER executed and the function
532// returned -1 unconditionally -- ev_parse_pass could never match pass=/passed/PASS=/FAIL=
533// and reported a ZERO tally for EVERY gate, silently. Distinct behaviour, distinct name.
534func ev_num_after_endpos(ob: *u8, on: i64, needle: *u8, endpos: *i64) -> i64 {
535 let nl: i64 = slen(needle)
536 var i: i64 = 0
537 while i + nl <= on {
538 var k: i64 = 0
539 var hit: i64 = 1
540 while k < nl { if ob[i + k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
541 if hit == 1 {
542 var bi: i64 = i + nl
543 var v: i64 = 0
544 var any: i64 = 0
545 var go: i64 = 1
546 while go == 1 {
547 if bi >= on { go = 0 } else {
548 let c: i64 = ob[bi] as i64
549 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; bi = bi + 1 } else { go = 0 } } else { go = 0 }
550 }
551 }
552 endpos[0] = bi
553 if any == 1 { return v }
554 return 0 - 1
555 }
556 i = i + 1
557 }
558 endpos[0] = 0 - 1
559 return 0 - 1
560}
561
562// parse a gate's pass tally from its captured output. Handles the fleet's real formats:
563// "pass=N/M" (nx_project) "passed N/M" (provenance) "PASS=N FAIL=K" (audit/orchestrate)
564// writes N to outn, M to outm (M = N when no denominator is printed).
565func ev_parse_pass(ob: *u8, on: i64, outn: *i64, outm: *i64) -> i64 {
566 outn[0] = 0
567 outm[0] = 0
568 let ep: *i64 = sys_mmap(16) as *i64
569 var v: i64 = ev_num_after_endpos(ob, on, "pass=" as *u8, ep)
570 if v < 0 { v = ev_num_after_endpos(ob, on, "passed " as *u8, ep) }
571 if v >= 0 {
572 outn[0] = v
573 outm[0] = v
574 if ep[0] >= 0 { if ep[0] < on { if ob[ep[0]] == (47 as u8) {
575 var bi: i64 = ep[0] + 1
576 var m2: i64 = 0
577 var any2: i64 = 0
578 var go2: i64 = 1
579 while go2 == 1 {
580 if bi >= on { go2 = 0 } else {
581 let c2: i64 = ob[bi] as i64
582 if c2 >= 48 { if c2 <= 57 { m2 = m2 * 10 + (c2 - 48); any2 = 1; bi = bi + 1 } else { go2 = 0 } } else { go2 = 0 }
583 }
584 }
585 if any2 == 1 { outm[0] = m2 }
586 } } }
587 return 1
588 }
589 let v2: i64 = ev_num_after_endpos(ob, on, "PASS=" as *u8, ep)
590 if v2 >= 0 {
591 outn[0] = v2
592 outm[0] = v2
593 let f2: i64 = ev_num_after_endpos(ob, on, "FAIL=" as *u8, ep)
594 if f2 >= 0 { outm[0] = v2 + f2 }
595 return 1
596 }
597 return 0
598}
599
600// ---- seq1789: THE GATE DEADLINE IS DATA (rule 11/17), not a literal buried in the runner --------------
601// The default is deliberately GENEROUS. This bound exists to turn INFINITY into a finite answer, not to
602// police slow gates: a domain gate legitimately walks tens of thousands of files (the librarian audit
603// scans 16,672), and a tight bound would manufacture false TIMEOUTs -- the same lie as a false GREEN with
604// the sign flipped. Override per host with a single integer (milliseconds) in the conf below; a value
605// under the floor, an unreadable file, or a file with no digits all fall back to the compiled default,
606// because a misconfigured deadline must never be MORE permissive than the one shipped.
607const EV_GR_DEADLINE_MS: i64 = 120000
608const EV_GR_DEADLINE_MIN: i64 = 1000
609const EV_GR_DEADLINE_CONF: *u8 = "knowledge/status/evidence_gate_deadline.conf"
610
611func ev_gate_deadline_ms() -> i64 {
612 let fd: i64 = sys_openat_rd(EV_GR_DEADLINE_CONF)
613 if fd < 0 { return EV_GR_DEADLINE_MS }
614 let b: *u8 = sys_mmap(64)
615 let n: i64 = sys_read(fd, b, 63)
616 sys_close(fd)
617 if n <= 0 { return EV_GR_DEADLINE_MS }
618 var v: i64 = 0
619 var seen: i64 = 0
620 var i: i64 = 0
621 while i < n {
622 let c: i64 = b[i] as i64
623 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); seen = 1 } }
624 if c == 10 { i = n } else { i = i + 1 }
625 }
626 if seen == 0 { return EV_GR_DEADLINE_MS }
627 if v < EV_GR_DEADLINE_MIN { return EV_GR_DEADLINE_MS }
628 return v
629}
630
631// ---- PER-GATE DEADLINE OVERRIDE (added 2026-08-01) ----------------------------------------------
632// The global deadline exists to turn INFINITY into a finite answer, and this file already says a tight
633// bound "would manufacture false TIMEOUTs -- the same lie as a false GREEN with the sign flipped".
634// That is exactly what was happening: nx_vcodec_bgop_bench sweeps qp10-40 with a full decode-parity
635// check and legitimately needs HOURS, so against the 420s host deadline it reported exit=124 and its
636// whole domain read RED -- while the bench was demonstrably producing correct output (par=0).
637// A single global number cannot serve both a 2-second KAT and a 2-hour sweep, so the budget is now
638// PER GATE: knowledge/status/evidence_gate_deadline_overrides.conf holds "<elf-basename> <ms>" rows.
639// Absent file, absent row, or a value below the floor -> the global deadline, unchanged. This can only
640// ever LENGTHEN a specific named gate's rope; it cannot shorten or disable the bound for anything.
641const EV_GR_OVR_CONF: *u8 = "knowledge/status/evidence_gate_deadline_overrides.conf"
642
643// basename of a path (after the last '/')
644func ev_basename(pth: *u8) -> *u8 {
645 var n: i64 = 0
646 while pth[n] != (0 as u8) { n = n + 1 }
647 var b: i64 = 0
648 var i: i64 = 0
649 while i < n { if pth[i] == (47 as u8) { b = i + 1 } i = i + 1 }
650 return ((pth as i64) + b) as *u8
651}
652
653func ev_gate_deadline_for(elf: *u8) -> i64 {
654 let base: i64 = ev_gate_deadline_ms()
655 let fd: i64 = sys_openat_rd(EV_GR_OVR_CONF)
656 if fd < 0 { return base }
657 let cap: i64 = EV_MAGIC_8192
658 let b: *u8 = sys_mmap(cap)
659 let n: i64 = sys_read(fd, b, cap - 1)
660 sys_close(fd)
661 if n <= 0 { return base }
662 let want: *u8 = ev_basename(elf)
663 var wl: i64 = 0
664 while want[wl] != (0 as u8) { wl = wl + 1 }
665 var i: i64 = 0
666 while i < n {
667 var e: i64 = i
668 while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
669 if b[i] != (35 as u8) {
670 // does the line start with the basename followed by a space or tab?
671 var m: i64 = 1
672 var k: i64 = 0
673 while k < wl { if i + k >= e { m = 0; k = wl } else { if b[i + k] != want[k] { m = 0; k = wl } else { k = k + 1 } } }
674 if m == 1 {
675 var q: i64 = i + wl
676 if q < e {
677 if b[q] == (32 as u8) { m = 1 } else { if b[q] == (9 as u8) { m = 1 } else { m = 0 } }
678 } else { m = 0 }
679 if m == 1 {
680 var v: i64 = 0
681 var seen: i64 = 0
682 while q < e {
683 let c: i64 = b[q] as i64
684 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); seen = 1 } }
685 q = q + 1
686 }
687 if seen == 1 { if v >= EV_GR_DEADLINE_MIN { return v } }
688 return base
689 }
690 }
691 }
692 i = e + 1
693 }
694 return base
695}
696
697// fork the elf (argless if av0 only), redirect child stdout+stderr to outpath; return exit code, 128+sig,
698// or 124 when the gate breached its deadline and was SIGKILLed.
699func ev_run(elf: *u8, outpath: *u8, extra: *u8) -> i64 {
700 // ★RESOLVE THE GATE BINARY BEFORE EXECVE. ev_resolve has delegated to ar_resolve since round 4, but only
701 // for SOURCES -- the gate EXECUTION path still ran the .gates first field exactly as written. On the NAS,
702 // where promote installs binaries FLAT at the serving root, a row naming `_offc/nx_medbill_nsa_gate.elf`
703 // therefore died with 127, and the board published the domain as CLAIMED-BUT-RED, which it calls
704 // "worse than claim-only".
705 // ★★MEASURED 2026-07-30, and this is the whole point: nx_bite_sweep resolves the SAME .gates rows through
706 // ar_resolve and RAN those gates and KILLED MUTANTS with them, in the same minute this reader was calling
707 // them missing. Two readers of one declaration disagreed, and the one reporting ABSENCE was the broken
708 // one -- absence is exactly what an unresolved path looks like. Four domains were being defamed by a
709 // path bug while their gates were provably alive.
710 // Fixed at the CHOKEPOINT, not the call sites: every caller of ev_run gets it, no signature churn.
711 // ar_resolve leaves out == input and returns 0 when it cannot resolve, so an genuinely absent binary
712 // still fails as 127 naming what was actually asked for.
713 let eres: *u8 = sys_mmap(EV_MAGIC_1024)
714 var eelf: *u8 = elf
715 if ev_resolve(elf, eres) == 1 { eelf = eres }
716 // ★★★seq1789: BOUNDED. This forked each gate and then sys_wait4(pid, stp, 0) -- a BLOCKING wait with no
717 // deadline -- so ONE hung gate hung the whole domain read, forever. Measured 2026-07-30: nx_orchestrate_gate
718 // wedged (a seg-store handle opened per RACI row and never closed), and `nx_swcompare_evidence librarian`
719 // never returned at all. The symptom presented as an MCP transport error, so the instrument's own failure
720 // was read as the network's -- three domains looked fine and one looked like flaky infrastructure.
721 // LAW: AN INSTRUMENT ITS SUBJECT CAN HANG MEASURES NOTHING -- not the hung subject, and not the healthy
722 // ones queued behind it. A measurement tool must bound every subject it runs, because the whole point is
723 // that the subject is UNTRUSTED; "the gate will terminate" is the assumption under test.
724 // No new mechanism: nx_guarded_run has been the ecosystem's hang-proof exec since 2026-06-10 (WNOHANG poll
725 // + SIGKILL, since SIGTERM does not reap these). This was an ADOPTION gap, not a missing primitive -- the
726 // same shape as the memory-floor guard earlier today. A timeout now surfaces as its OWN exit code (124),
727 // distinct from 127 (binary absent) and 1 (gate genuinely RED), so the three are never again confused.
728 let ofd: i64 = sys_openat_wr(outpath, 0x1a4)
729 // ---- THE DECLARED ARGV, FINALLY READ (2026-08-26) ----
730 // The .gates schema has documented `<elf>|<argv|->|<label>|<source>` since the first such file was
731 // written, and this function ignored field 1 entirely, building a fixed one-element argv. So a row that
732 // declared arguments was honoured by the SCHEMA and dropped by the CODE -- the documented call that
733 // lies. Nobody hit it because every existing row passes "-", which made the gap invisible rather than
734 // absent: any harness needing a corpus path (a WPT runner, a bench over a named dataset) simply could
735 // not be wired as executed evidence, and the reason was unreadable from either the data or the output.
736 // "-" or empty means no arguments, so every existing row keeps its exact behaviour.
737 var xn: i64 = 0
738 if (extra as i64) != 0 { while extra[xn] != (0 as u8) { xn = xn + 1 } }
739 var use_extra: i64 = 0
740 if xn > 0 { if streq(extra, "-" as *u8) == 0 { use_extra = 1 } }
741 // Slots are DERIVED from the declaration -- argv[0] + one per token + the NULL -- never a fixed cap.
742 // A cap here would be a ceiling that has to be guessed, and guessing it wrong truncates a gate's
743 // arguments in silence, which is the same class of defect this whole change exists to remove.
744 var slots: i64 = 2
745 if use_extra == 1 {
746 var ci: i64 = 0
747 while ci < xn { if extra[ci] == (32 as u8) { slots = slots + 1 } ci = ci + 1 }
748 slots = slots + 1
749 }
750 let argv: *i64 = sys_mmap(slots * 8) as *i64
751 argv[0] = eelf as i64
752 var na: i64 = 1
753 if use_extra == 1 {
754 // Split in a PRIVATE copy: the caller's buffer is the parsed .gates line and must survive intact.
755 let xb: *u8 = sys_mmap(xn + 1)
756 var k: i64 = 0
757 while k < xn { xb[k] = extra[k]; k = k + 1 }
758 xb[xn] = 0 as u8
759 var xi: i64 = 0
760 while xi < xn {
761 while xi < xn { if xb[xi] != (32 as u8) { break } xi = xi + 1 }
762 if xi >= xn { break }
763 argv[na] = ((xb as i64) + xi) as i64
764 na = na + 1
765 while xi < xn { if xb[xi] == (32 as u8) { break } xi = xi + 1 }
766 if xi < xn { xb[xi] = 0 as u8; xi = xi + 1 }
767 }
768 }
769 argv[na] = 0
770 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
771 let rc: i64 = nx_guarded_run(eelf, argv, envp, ev_gate_deadline_for(eelf), ofd, ofd)
772 if ofd >= 0 { sys_close(ofd) }
773 return rc
774}
775
776// ---- parse one .matrix line into fields[0..8] (label|organ|symbol|exceed|c1..c4|note); return field count ----
777// Is the precondition named by a withheld row PROVABLY UNMET? Returns one of the EV_PRE_* states.
778// It resolves the path through the SAME resolver the organ sources use, so "knowledge/x.tsv" means the
779// same file here as everywhere else in this organ instead of whatever the caller's cwd happens to be.
780// A DATA LINE IS ANY LINE THAT IS NEITHER BLANK NOR A COMMENT. A binary body therefore counts as data on
781// its very first byte, which is exactly right: a press profile that EXISTS is a precondition MET.
782func ev_precondition(path: *u8, buf: *u8, cap: i64) -> i64 {
783 let res: *u8 = sys_mmap(EV_PRE_PATH_CAP)
784 ev_resolve(path, res)
785 let n: i64 = ev_read(res, buf, cap)
786 if n <= 0 { return EV_PRE_ABSENT }
787 var i: i64 = 0
788 var data: i64 = 0
789 var go: i64 = 1
790 while go == 1 {
791 if i >= n { go = 0 } else {
792 var e: i64 = i
793 while e < n { if (buf[e] as i64) == EV_PRE_NL { break } e = e + 1 }
794 var s: i64 = i
795 var scan: i64 = 1
796 while scan == 1 {
797 if s >= e { scan = 0 } else {
798 let c: i64 = buf[s] as i64
799 if c == EV_PRE_SPACE { s = s + 1 } else { if c == EV_PRE_TAB { s = s + 1 } else { scan = 0 } }
800 }
801 }
802 // The answer is RECORDED BEFORE the loop is left, and the exit rides its own flag rather than
803 // being written into the cursor -- a loop that breaks by clobbering its own cursor cannot also
804 // report where it stopped, and that idiom has erased the answer four times in this estate.
805 if s < e { if (buf[s] as i64) != EV_PRE_HASH { data = 1; go = 0 } }
806 i = e + 1
807 }
808 }
809 if data == 1 { return EV_PRE_MET }
810 // NO SILENT CAP. If the read filled its reserve then what was examined is a PREFIX, and "no data line
811 // in the prefix" is not "no data line". Say UNPROVEN and let the caller refuse rather than acquit.
812 if n >= cap { return EV_PRE_UNPROVEN }
813 return EV_PRE_NODATA
814}
815
816func ev_split(line: *u8, ln: i64, fs: *i64, fe: *i64, maxf: i64) -> i64 {
817 var nf: i64 = 0
818 var s: i64 = 0
819 var i: i64 = 0
820 while i <= ln {
821 if i == ln { if nf < maxf { fs[nf] = s; fe[nf] = i; nf = nf + 1 } i = i + 1 }
822 else { if line[i] == (124 as u8) { if nf < maxf { fs[nf] = s; fe[nf] = i; nf = nf + 1 } s = i + 1; i = i + 1 } else { i = i + 1 } }
823 }
824 return nf
825}
826func ev_fcopy(line: *u8, s: i64, e: i64, dst: *u8, cap: i64) -> i64 {
827 var t: i64 = 0
828 var p: i64 = s
829 while p < e { if t < cap - 1 { dst[t] = line[p]; t = t + 1 } p = p + 1 }
830 dst[t] = 0 as u8
831 return t
832}
833
834// counters returned in st: 0=axes 1=grounded 2=ungrounded 3=absent 4=present_claims
835func ev_scan(domain: *u8, mode: i64, st: *i64) -> i64 {
836 // Load the matrix from THE TREE THE PAGE IS PUBLISHED FROM -- the PUBLISHED order, buildroot first.
837 // Adjudicated 2026-09-01; the census and the reasoning are in nx_comparetree_lib. Until then this
838 // call used the unqualified PRIMARY-first resolver, so on all 45 boards that exist in BOTH trees
839 // the referee graded knowledge/compare/ while nx_compare_regen rendered buildroot/knowledge/compare/
840 // -- GRADING ONE DOCUMENT AND PUBLISHING ANOTHER, which is a defect in the referee and not in any
841 // board it judged. Byte proof the two are different documents: deploy 6,327 graded vs 6,618
842 // published; media 7,816 vs 8,268.
843 //
844 // EXPECT THE HONEST NUMBERS TO GET WORSE HERE, AND DO NOT READ THAT AS A REGRESSION. The buildroot
845 // matrices carry 939 named _ABSENT_ build contracts against PRIMARY's 20, so both ungrounded rows
846 // and NAMED gaps rise while bare gaps fall. A count that moves because the instrument started
847 // reading the real document is the instrument becoming honest.
848 // THE CEILING IS GONE, NOT RAISED (2026-09-01). This used to reserve EV_MAGIC_65536 and hand that
849 // same number to the resolver as a read cap. ct_compare_readall_published composes sys_read_file,
850 // which sizes its buffer from the file itself (lseek END) and CANNOT short-read, so the referee
851 // now grades the WHOLE document on every board and there is no number here to get wrong. The
852 // buffer is one mapping of (matrix bytes + 16), owned for the life of this one-shot process --
853 // SMALLER than the old fixed 64 KiB reserve on 94 of the 96 boards stamped today, and 2,445 B
854 // larger on the largest. It is dwarfed either way by the EV_MAGIC_2097152 organ-source cache
855 // below, so removing the cap does not move this organ's footprint in any measurable direction.
856 let mwhich: *i64 = sys_mmap(16) as *i64
857 let mnp: *i64 = sys_mmap(16) as *i64
858 let mbuf: *u8 = ct_compare_readall_published(domain, ".matrix" as *u8, mnp, mwhich)
859 let mn: i64 = mnp[0]
860 // NAME THE DOCUMENT YOU GRADED. The two compare trees are NOT copies -- every shared domain differs
861 // and the buildroot copy is the larger one every time -- so a verdict that cannot say WHICH file it
862 // read is not a verdict about the published board. mwhich is already computed by the resolver and
863 // was being discarded right here.
864 ev_p_mroot = mwhich[0]
865 ev_p_mbytes = mn
866 // THE ANNOUNCEMENT WAS HONEST AND NOTHING CONSUMED IT, WHICH MADE IT A SILENT TRUNCATION ANYWAY.
867 // mcapped was set, stamped and printed on the page, and it appeared in NO verdict conjunct -- so
868 // charsim published verdict=MEASURED-HONEST and "grounded 25/25 | unsupported 0" off a 65,536-byte
869 // PREFIX of a 67,965-byte board. The 2,429 dropped bytes were FIVE rows, and two of them were the
870 // ones that mattered most: that board's HAIR LIAR-KILL row (a PRESENT axis whose whole purpose is
871 // to stop the page claiming groom parity) and its ACCEPTANCE watch row (the single mechanism
872 // enforcing three-party completion on that board). THE TWO SYMBOL NAMES ARE DELIBERATELY NOT
873 // SPELLED HERE: ev_find_line does not strip comments, so an identifier written in prose is a live
874 // grounding site -- a detector that scans source will ground a claim on its own documentation.
875 // A DISCLOSURE NO VERDICT READS IS NOT A DISCLOSURE -- THE CAP HAD TO GO, NOT GET A BIGGER NUMBER.
876 //
877 // mcapped IS KEPT AND IS NOW STRUCTURALLY 0 (rule 19: nx_evprofile_lib parses this key, and
878 // nx_sota_status and the emitted page read it). IT IS NO LONGER A LIVE MEASUREMENT AND MUST NOT BE
879 // READ AS ONE: with no cap there is no brim to touch, and a read that fails outright exits on the
880 // line below rather than reporting a partial. An always-zero field reads as evidence, so the fact
881 // that it is now a structural constant is stated here instead of left for a reader to infer from a
882 // column that never moves. A future reader that wants "did the referee see the whole document"
883 // already has it: mbytes now IS the file's size on disk.
884 ev_p_mcapped = 0
885 if mn <= 0 { w(1, "EVIDENCE: matrix file missing in BOTH compare trees -- fail loud\n" as *u8); return 1 }
886
887 // organ source cache buffer (reused per row)
888 let src: *u8 = sys_mmap(EV_MAGIC_2097152)
889 let line: *u8 = sys_mmap(EV_MAGIC_1024)
890 let flabel: *u8 = sys_mmap(256)
891 let forgan: *u8 = sys_mmap(256)
892 let fsym: *u8 = sys_mmap(EV_SYM_CAP)
893 // The precondition path lifted out of a withheld symbol field, and the reserve its file is read into.
894 let fpre: *u8 = sys_mmap(EV_PRE_PATH_CAP)
895 let prebuf: *u8 = sys_mmap(EV_PRE_CAP)
896 let fc1: *u8 = sys_mmap(16)
897 let codeline: *u8 = sys_mmap(EV_MAGIC_1024)
898 let fs: *i64 = sys_mmap(8 * 32) as *i64
899 let fe: *i64 = sys_mmap(8 * 32) as *i64
900 let cnt: *i64 = sys_mmap(16) as *i64
901 // THE ONE RULER'S OUTPUTS, ALLOCATED ONCE OUTSIDE THE ROW LOOP. rl receives the rule the lib
902 // CHOSE (decl / jsdecl / exists / marker / data) -- a rule NAMED in the output is what lets a
903 // reader see WHAT was measured rather than only the verdict. ident is the symbol after the lib's
904 // own "func "/"(" strip. ctlline holds the line the DEMOTED control was grounding on, so the
905 // REASON travels with the count on every substring-only row instead of being recomputed later.
906 let rl: *i64 = sys_mmap(16) as *i64
907 let ident: *u8 = sys_mmap(EV_SYM_CAP + 8)
908 let ctlline: *u8 = sys_mmap(EV_MAGIC_1024)
909
910 st[0] = 0; st[1] = 0; st[2] = 0; st[3] = 0; st[4] = 0
911 ev_p_absnamed = 0; ev_p_absbare = 0; ev_p_landed = 0; ev_p_withheld = 0; ev_p_whref = 0
912 ev_p_substronly = 0; ev_p_declonly = 0; ev_p_noline = 0; ev_p_abstain = 0; ev_p_abstain_watch = 0
913 ev_p_axes = 0; ev_p_claimed = 0; ev_p_gapexc = 0
914
915 if mode == 1 { w(1, ",\n " as *u8); wc(1, 34); w(1, "axes" as *u8); wc(1, 34); wc(1, 58); w(1, "[\n" as *u8) }
916 if mode == 2 {
917 w(1, "<h2 style='font-size:clamp(1.05rem,2.5vw,1.25rem);margin:24px 0 10px'>Per-axis grounding (real source lines)</h2>\n" as *u8)
918 w(1, "<p class='meth'>Each capability we mark present is <b>grounded</b>: the evidence organ opens the named Nishi organ on disk, finds the implementing symbol, and shows the <b>actual source line</b> proving it (with an occurrence count). A claim whose symbol is absent from its file fails the build — so this table cannot contain an ungrounded “Yes”.</p>\n" as *u8)
919 w(1, "<div class='wrap'><table><thead><tr><th>Capability</th><th>Organ</th><th>Symbol</th><th>Occurrences</th><th>Evidence (source line)</th></tr></thead><tbody>\n" as *u8)
920 }
921
922 var first_json: i64 = 1
923 var i: i64 = 0
924 while i < mn {
925 var e: i64 = i
926 while e < mn { if mbuf[e] == (10 as u8) { break } e = e + 1 }
927 let ll: i64 = e - i
928 if ll > 0 {
929 if mbuf[i] != (35 as u8) { if mbuf[i] != (64 as u8) {
930 // copy the line
931 var t: i64 = 0
932 while t < ll { if t < 1023 { line[t] = mbuf[i + t] } t = t + 1 }
933 line[ll] = 0 as u8
934 let nf: i64 = ev_split(line, ll, fs, fe, 32)
935 if nf >= 9 {
936 ev_fcopy(line, fs[0], fe[0], flabel, 256)
937 ev_fcopy(line, fs[1], fe[1], forgan, 256)
938 ev_fcopy(line, fs[2], fe[2], fsym, 128)
939 ev_fcopy(line, fs[3], fe[3], fc1, 16)
940 st[0] = st[0] + 1
941 var absent: i64 = 0
942 if streq(fsym, "_ABSENT_" as *u8) == 1 { absent = 1 }
943 // WATCH ROWS. The matrix format documents a THIRD symbol form, _ABSENT_:<future_symbol>,
944 // which NAMES the build contract for a gap. The GENERATOR (nx_swcompare_matrix) measures
945 // that symbol on every emit and flips the published cell when the workstream ships it.
946 // This referee only knew the BARE form, so it read the entire watch string as if it were
947 // a symbol, failed to find it, and reported a LANDED contract as an UNGROUNDED CLAIM.
948 // MEASURED 2026-08-15: all 11 of mangagen's watch rows read UNGROUNDED and forced the
949 // domain RED on all-grounded=0, while mp_page_emit was present at nx_manga_page.nx:177
950 // (grep coverage_complete=1) with its gate passing 9/9 END-TO-END on the promoted elf.
951 // A PRODUCER AND A CONSUMER EACH CORRECT IN ISOLATION CAN STILL DISAGREE ON THE WIRE --
952 // and the disagreement is invisible because both sides look right when read alone.
953 // A gap whose contract has NOT landed is a DECLARED GAP, never an ungrounded claim: the
954 // two mean opposite things, only one of them is a defect, and a bucket named for how the
955 // reader failed rather than for what the subject is merges them into a single number.
956 // THE FORMAT COMES FROM ITS OWNER NOW. The hand-rolled prefix loop that stood here was
957 // the SIXTH private copy of this test, and it was also subtly wrong: it compared nine
958 // bytes without stopping at the NUL, so a short symbol read past the end of its own
959 // field. msym_is_watch_z is the same decision made once. PROVEN EQUIVALENT ON THE WHOLE
960 // POPULATION before adoption: the one case where the two differ is a stray "_ABSENT_:"
961 // with nothing after it, and a literal sweep of the published compare tree found none --
962 // matches=0 bytes=1475761 files=568 coverage_complete=1 corpus_complete=1.
963 var watch: i64 = 0
964 var withheld: i64 = 0
965 fpre[0] = 0 as u8
966 if absent == 0 {
967 if msym_is_watch_z(fsym) == 1 {
968 watch = 1
969 // THE FOURTH FORM, SPLIT BEFORE THE PREFIX IS STRIPPED, because the separator
970 // index the lib returns is an index into the WHOLE field.
971 let sep: i64 = msym_withheld_sep_z(fsym)
972 if sep > 0 {
973 withheld = 1
974 var pi: i64 = 0
975 while fsym[sep + 1 + pi] != (0 as u8) {
976 if pi < EV_PRE_PATH_CAP - 1 { fpre[pi] = fsym[sep + 1 + pi] }
977 pi = pi + 1
978 }
979 if pi > EV_PRE_PATH_CAP - 1 { pi = EV_PRE_PATH_CAP - 1 }
980 fpre[pi] = 0 as u8
981 fsym[sep] = 0 as u8
982 }
983 var wi: i64 = 0
984 while fsym[wi + MSYM_WATCH_LEN] != (0 as u8) { fsym[wi] = fsym[wi + MSYM_WATCH_LEN]; wi = wi + 1 }
985 fsym[wi] = 0 as u8
986 }
987 }
988 // THE TOP-LEVEL PARTITION, COUNTED AT THE ONE SITE WHERE BOTH FLAGS ARE FINAL.
989 // Reads the FLAGS, never the string: fsym has already had its prefix stripped above,
990 // and the prefix test itself happens exactly once, inside nx_matrix_sym_lib, which is
991 // the whole reason that lib owns the format. fc1 is field 3 (nishiExceed) and is not
992 // mutated anywhere between its ev_fcopy and here, so it is safe to read at this site.
993 // A LANDED watch row is gap-FORM but counted PRESENT, so it is deliberately NOT folded
994 // into claimed; it gets its own summand in the printed reconciliation below.
995 var isgap: i64 = absent
996 if watch == 1 { isgap = 1 }
997 if isgap == 0 { ev_p_claimed = ev_p_claimed + 1 }
998 if isgap == 1 { if streq(fc1, "1" as *u8) == 1 { ev_p_gapexc = ev_p_gapexc + 1 } }
999 if absent == 1 {
1000 st[3] = st[3] + 1
1001 // A BARE _ABSENT_ NAMES NO CONTRACT, and that is a different defect from a gap
1002 // that does. Counted separately so `absent` stops being one number covering two
1003 // remedies, and NAMED on the worklist, because a count without a worklist is not
1004 // actionable and the reason is already in hand at measure time.
1005 ev_p_absbare = ev_p_absbare + 1
1006 if mode == 0 { w(1, " UNNAMED-GAP domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, "\n" as *u8) }
1007 } else {
1008 // ground it: read organ, find the symbol line. Resolve first -- a source living
1009 // under a different artifact root is NOT an ungrounded claim, and reporting it as
1010 // one is how 9 of 9 real warden axes read UNGROUNDED on the NAS while every symbol
1011 // was present in the tree the whole time.
1012 let fres: *u8 = sys_mmap(512)
1013 ev_resolve(forgan, fres)
1014 let sn: i64 = ev_read(fres, src, EV_MAGIC_2097152)
1015 var found: i64 = 0
1016 var ctl: i64 = 0
1017 // THE RULER'S OWN ABSTENTION, KEPT AS ITS OWN VARIABLE AND NEVER FOLDED INTO
1018 // `found`. A JS-dialect row whose symbol is not a JS declaration is one this
1019 // declaration ruler HAS NO COMPETENCE OVER (nx_symdecl_lib states the mechanism):
1020 // it is neither grounded nor ungrounded, and recording it as either is a claim we
1021 // cannot make. A BUCKET NAMED FOR HOW THE READER FAILED, RATHER THAN FOR WHAT THE
1022 // SUBJECT IS, MERGES A REAL FAILURE WITH A HEALTHY PASS.
1023 var abstained: i64 = 0
1024 cnt[0] = 0
1025 codeline[0] = 0 as u8
1026 ctlline[0] = 0 as u8
1027 rl[0] = 0
1028 if sn > 0 {
1029 // THE DEMOTED CONTROL RUNS FIRST AND DECIDES NOTHING. It still supplies the
1030 // OCCURRENCE COUNT this page has always published (identifier occurrences in
1031 // the whole file -- unchanged meaning, so no consumer's field moves under it),
1032 // and it is the ONLY way to count what the old rule was carrying.
1033 let coff: i64 = ev_find_line(src, sn, fsym, cnt)
1034 if coff >= 0 { ctl = 1; ev_line_at(src, sn, coff, ctlline, 240) }
1035 // AND THE ONE SYMBOL RULER DECIDES. The same function the generator, the
1036 // regen, the ranker and the watch-state lib already call, so this referee can
1037 // no longer disagree with the page it is refereeing.
1038 // THE THREE-STATE ENTRY POINT. This referee is the ONE caller that takes
1039 // SD_ABSTAIN; every other caller keeps two-state sd_present_buf, which folds
1040 // abstain to 0 -- so no published cell moves anywhere else in the fleet and
1041 // the generator's behaviour is byte-identical under this change.
1042 let pres: i64 = sd_present_or_abstain_buf(src, sn, forgan, fsym, rl)
1043 if pres == SD_ABSTAIN { abstained = 1 }
1044 if pres == 1 {
1045 found = 1
1046 sd_rule_for(forgan, fsym, ident)
1047 let off: i64 = ev_rule_line(src, sn, rl[0], ident, fsym)
1048 if off >= 0 { ev_line_at(src, sn, off, codeline, 240) } else {
1049 // NEVER SILENT. The locator mirrors the decider's rule, so a miss here
1050 // is a shape the two read differently: it is COUNTED, the control's
1051 // line is shown so the row stays readable, and the number says how
1052 // often it happened. A fallback nobody counts is a lie.
1053 ev_p_noline = ev_p_noline + 1
1054 if coff >= 0 { ev_line_at(src, sn, coff, codeline, 240) }
1055 }
1056 }
1057 // THE TWO DIRECTIONS OF THE RULER CHANGE, EACH COUNTED AT ITS OWN SITE.
1058 // AN ABSTENTION IS NEITHER DIRECTION OF THE RULER CHANGE. It is not a row the
1059 // new ruler REFUSES, it is a row the new ruler DECLINES TO JUDGE, so it is
1060 // excluded from the SUBSTRING-ONLY worklist and NAMED on a line of its own.
1061 // Folding it in would hand a board owner 9 rows to "fix" that have nothing
1062 // wrong with them: a count without a worklist is not actionable, and a
1063 // worklist carrying the wrong rows is worse than no worklist at all.
1064 if ctl == 1 { if found == 0 { if abstained == 0 {
1065 ev_p_substronly = ev_p_substronly + 1
1066 if mode == 0 {
1067 w(1, " SUBSTRING-ONLY domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel)
1068 w(1, " sym=" as *u8); w(1, fsym); w(1, " organ=" as *u8); w(1, forgan)
1069 w(1, " rule=" as *u8); w(1, sd_rule_name(rl[0]))
1070 w(1, " -- the OLD substring grounded this row and the ONE SYMBOL RULER does NOT. The line that was carrying it: " as *u8)
1071 w(1, ctlline); w(1, "\n" as *u8)
1072 }
1073 } } }
1074 // THE ABSTENTION, NAMED, WITH ITS REASON AND ITS SUBJECT. "I COULD NOT LOOK"
1075 // is only actionable if it says WHICH thing it could not look at, and the
1076 // remedy here is NOT a board edit: it is that this axis needs a ruler that
1077 // reads the client dialect, or a row that names something we declare.
1078 if abstained == 1 {
1079 // THE PARTITION SPLIT (2026-09-01), AND THIS SITE BEING ABOVE THE WATCH BRANCH WAS THE WHOLE DEFECT.
1080 // st[4] (`present`) is incremented ONLY on the NON-watch path below, so an
1081 // abstaining WATCH row was counted in abstain AND in absent_named and in
1082 // NEITHER side of present = grounded + ungrounded + abstain.
1083 // MEASURED on the live video stamp: `grounded=15/19 ... abstain=5`, i.e.
1084 // 15+0+5=20 against present=19 -- a residual of EXACTLY ONE, on a board
1085 // published ok=1 MEASURED-HONEST. One offending row: the only abstention
1086 // carrying x0 and an empty control line, i.e. a watch contract whose symbol
1087 // the demoted control could not find either.
1088 // THE REMEDY IS THE COUNTER, NOT THE READER, AND BOTH ALTERNATIVES WERE
1089 // REJECTED ON THIS FILE'S OWN LAW. Counting an abstaining watch row into
1090 // `present` so the sum closes would put a GAP ROW INSIDE THE PARTITION OF
1091 // CLAIMED AXES -- inflating the very denominator the liar-kill `present>=5`
1092 // floor is measured against -- and ev_scan already forbids it in its own
1093 // words: a watch row that has not landed IS NOT A PRESENT AXIS. Widening the
1094 // reader to absorb the difference is the same error from the other side: it
1095 // HIDES the leak instead of closing it, and an unpublished residual is a leak.
1096 // So the gap-form abstention goes to its OWN AXIS. It stays in absent_named
1097 // (the conservative reading -- a landing the ruler could not JUDGE is not a
1098 // landing), it is still NAMED on the worklist below with its form, and
1099 // nothing is lost; it simply stops sitting inside a partition it was never a
1100 // member of. The identity now closes EXACTLY on every board.
1101 if watch == 1 { ev_p_abstain_watch = ev_p_abstain_watch + 1 } else { ev_p_abstain = ev_p_abstain + 1 }
1102 if mode == 0 {
1103 w(1, " ABSTAIN domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel)
1104 // THE FORM TRAVELS WITH THE ABSTENTION. The two kinds printed
1105 // IDENTICALLY while needing OPPOSITE work: a claimed-axis abstention
1106 // wants a ruler that reads the client dialect, a watch-gap abstention
1107 // wants its contract re-pointed or a ruler that can judge the landing.
1108 // They also now land in different counters, so a worklist that could not
1109 // say which form it was describing would not reconcile with either.
1110 w(1, " form=" as *u8)
1111 if watch == 1 { w(1, "watch-gap" as *u8) } else { w(1, "claimed-axis" as *u8) }
1112 w(1, " sym=" as *u8); w(1, fsym); w(1, " organ=" as *u8); w(1, forgan)
1113 w(1, " rule=" as *u8); w(1, sd_rule_name(rl[0]))
1114 w(1, " reason=" as *u8); w(1, sd_abstain_name())
1115 w(1, " -- NOT JUDGED, and NOT counted as ungrounded: a declaration ruler cannot decide whether a CALLED platform API ships. The line the demoted control was carrying it on: " as *u8)
1116 w(1, ctlline); w(1, "\n" as *u8)
1117 }
1118 }
1119 if ctl == 0 { if found == 1 { ev_p_declonly = ev_p_declonly + 1 } }
1120 }
1121 // A watch row that has NOT landed is counted with the declared gaps and is NOT a
1122 // present axis -- claiming it as present is what would let a contract inflate the
1123 // very number it exists to hold honest. A watch row that HAS landed is an ordinary
1124 // grounded axis, which is exactly what the generator already shows on the page.
1125 if watch == 1 {
1126 // LANDED was PRINTED here and never COUNTED -- the flip worklist (a pure data
1127 // edit, the cheapest closure available on any board) was computed on every run
1128 // and thrown away. absnamed is incremented at its own site rather than derived
1129 // as absent-minus-bare, so `absent == absnamed + absbare` is a real
1130 // reconciliation of two independent counters and not an identity that cannot
1131 // fail. A PARTITION IS A CLAIM: CHECK THAT THE PARTS SUM.
1132 if withheld == 1 {
1133 // A WITHHELD ROW IS AN OPEN GAP IN EVERY CASE: never present, never grounded,
1134 // never landed -- so it can never fire FLIP-READY, which is the exact failure
1135 // this class exists to end. It is counted in absent like any other gap.
1136 st[3] = st[3] + 1
1137 if found == 0 {
1138 // YOU CANNOT WITHHOLD THE PROOF OF A MECHANISM THAT HAS NOT SHIPPED. This
1139 // is an ordinary unlanded contract wearing the wrong form, so it is counted
1140 // as exactly that -- the form buys it nothing -- and it is NAMED.
1141 ev_p_absnamed = ev_p_absnamed + 1
1142 ev_p_whref = ev_p_whref + 1
1143 if mode == 0 { w(1, " WITHHELD-UNSHIPPED domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " -- that symbol is NOT in its organ, so this is a plain watch contract and the precondition suffix claims nothing\n" as *u8) }
1144 } else {
1145 ev_p_withheld = ev_p_withheld + 1
1146 let prv: i64 = ev_precondition(fpre, prebuf, EV_PRE_CAP)
1147 if prv == EV_PRE_ABSENT { if mode == 0 { w(1, " WITHHELD domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " pre=" as *u8); w(1, fpre); w(1, " reason=PRECONDITION-FILE-ABSENT\n" as *u8) } }
1148 if prv == EV_PRE_NODATA { if mode == 0 { w(1, " WITHHELD domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " pre=" as *u8); w(1, fpre); w(1, " reason=PRECONDITION-FILE-HAS-NO-DATA-ROWS\n" as *u8) } }
1149 // THE ANTI-GAMING TOOTH. A SATISFIED PRECONDITION MEANS THE EXCUSE HAS
1150 // EXPIRED: the row is refused HERE, by name, rather than quietly honoured,
1151 // so the form can never sit on a board as a permanent silence button.
1152 if prv == EV_PRE_MET {
1153 ev_p_whref = ev_p_whref + 1
1154 if mode == 0 { w(1, " WITHHELD-REFUSED domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " pre=" as *u8); w(1, fpre); w(1, " -- that path HOLDS DATA, so the precondition is MET: re-adjudicate this row, it may not stay withheld\n" as *u8) }
1155 }
1156 if prv == EV_PRE_UNPROVEN {
1157 ev_p_whref = ev_p_whref + 1
1158 if mode == 0 { w(1, " WITHHELD-UNPROVEN domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " pre=" as *u8); w(1, fpre); w(1, " -- the referee filled its read reserve without reaching the end of that file, and I COULD NOT LOOK is not THE PRECONDITION IS UNMET\n" as *u8) }
1159 }
1160 }
1161 } else {
1162 if found == 1 { st[4] = st[4] + 1; st[1] = st[1] + 1; ev_p_landed = ev_p_landed + 1 }
1163 else { st[3] = st[3] + 1; ev_p_absnamed = ev_p_absnamed + 1 }
1164 if found == 1 { if mode == 0 { w(1, " LANDED-UNFLIPPED domain=" as *u8); w(1, domain); w(1, " axis=" as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, "\n" as *u8) } }
1165 }
1166 } else {
1167 st[4] = st[4] + 1
1168 // AN ABSTAINED ROW IS A CLAIMED AXIS THAT WAS NOT JUDGED. It STAYS in
1169 // `present` -- it IS a published claim, and dropping it would shrink the
1170 // denominator the generator's liar-kill floor is measured against, silently
1171 // changing which boards publish. It enters NEITHER grounded nor ungrounded,
1172 // so `present` stops being the exact identity grounded+ungrounded and becomes
1173 // grounded + ungrounded + abstain. THE RESIDUAL IS STAMPED (EVP_K_ABSTAIN), so
1174 // that partition can still FAIL instead of quietly absorbing the difference.
1175 if abstained == 0 {
1176 if found == 1 { st[1] = st[1] + 1 } else { st[2] = st[2] + 1 }
1177 }
1178 }
1179 if mode == 0 {
1180 w(1, " [" as *u8)
1181 // WITHHELD IS TESTED FIRST PRECISELY BECAUSE ITS SYMBOL IS FOUND: keying this
1182 // label on `found` would print LANDED over the one class that exists to say
1183 // SHIPPED BUT NOT PROVEN, which is the defect this whole change closes.
1184 // ABSTAIN IS TESTED BEFORE `found` FOR THE SAME REASON WITHHELD IS: keying
1185 // the label on `found` alone would print UNGROUNDED over a row nothing has
1186 // judged, which is the precise conflation this state exists to end.
1187 if withheld == 1 { w(1, "WITHHELD " as *u8) } else {
1188 if abstained == 1 { w(1, "ABSTAIN " as *u8) } else {
1189 if found == 1 { if watch == 1 { w(1, "LANDED " as *u8) } else { w(1, "GROUNDED " as *u8) } } else { if watch == 1 { w(1, "GAP-WATCH " as *u8) } else { w(1, "UNGROUNDED" as *u8) } } } }
1190 w(1, "] " as *u8); w(1, flabel); w(1, " sym=" as *u8); w(1, fsym); w(1, " x" as *u8); wn(1, cnt[0])
1191 w(1, " @ " as *u8); w(1, forgan); w(1, "\n" as *u8)
1192 }
1193 if mode == 1 {
1194 if first_json == 0 { w(1, ",\n" as *u8) }
1195 first_json = 0
1196 w(1, " {" as *u8)
1197 kv_s(1, "axis" as *u8, flabel); wc(1, 44)
1198 kv_s(1, "organ" as *u8, forgan); wc(1, 44)
1199 kv_s(1, "symbol" as *u8, fsym); wc(1, 44)
1200 kv_n(1, "grounded" as *u8, found); wc(1, 44)
1201 // ADDITIVE per rule 19: a v1 reader ignores this field and keeps the value it
1202 // already had. It is REQUIRED, not decorative -- an abstained row publishes
1203 // grounded:0, which a machine reader would otherwise take as UNGROUNDED, which
1204 // is exactly the conflation this state exists to end. Adding a field is safe;
1205 // changing what `grounded` means under a consumer would not be.
1206 kv_n(1, "abstained" as *u8, abstained); wc(1, 44)
1207 kv_n(1, "occurrences" as *u8, cnt[0]); wc(1, 44)
1208 kv_s(1, "evidence_line" as *u8, codeline)
1209 w(1, "}" as *u8)
1210 }
1211 if mode == 2 {
1212 w(1, "<tr><td class='cat'>" as *u8); w(1, flabel); w(1, "</td><td class='note'>" as *u8); w(1, forgan)
1213 w(1, "</td><td><code>" as *u8); w(1, fsym); w(1, "</code></td><td class='b" as *u8)
1214 // A WITHHELD ROW MUST NOT RENDER GREEN. Its symbol IS in the organ -- that is the
1215 // whole point of the class -- so keying this cell on `found` alone would paint an
1216 // unsupported claim in exactly the colour of a proven one.
1217 if withheld == 1 { w(1, " n'>" as *u8) } else { if found == 1 { w(1, " y'>" as *u8) } else { w(1, " n'>" as *u8) } }
1218 wn(1, cnt[0]); w(1, "</td><td class='note'><code>" as *u8)
1219 // HTML-escape < > & in the source line
1220 var ci: i64 = 0
1221 while codeline[ci] != (0 as u8) {
1222 let c: i64 = codeline[ci] as i64
1223 if c == 60 { w(1, "<" as *u8) } else { if c == 62 { w(1, ">" as *u8) } else { if c == 38 { w(1, "&" as *u8) } else { wc(1, c) } } }
1224 ci = ci + 1
1225 }
1226 w(1, "</code></td></tr>\n" as *u8)
1227 }
1228 }
1229 }
1230 } }
1231 }
1232 i = e + 1
1233 }
1234 if mode == 1 { w(1, "\n ]" as *u8) }
1235 if mode == 2 { w(1, "</tbody></table></div>\n" as *u8) }
1236 // ev_p_v2 is set HERE and nowhere else: it means "ev_scan reached its end over a readable matrix",
1237 // which is the only condition under which these numbers are a measurement rather than a default.
1238 // ev_stamp refuses to write a single profile key without it.
1239 ev_p_ungrounded = st[2]
1240 ev_p_absent = st[3]
1241 // THE DENOMINATOR, SET WHERE EVERY OTHER PROFILE NUMBER IS SET AND UNDER THE SAME HONESTY GUARD:
1242 // ev_p_v2 on the next line is what tells every reader these are a measurement and not a zero default.
1243 ev_p_axes = st[0]
1244 ev_p_v2 = 1
1245 return 0
1246}
1247
1248// run the executable gates; returns green count, writes ran count to *ran
1249func ev_gates(domain: *u8, mode: i64, ran: *i64, st_out: *i64) -> i64 {
1250 // The gates map resolves across BOTH trees for the same reason the matrix does -- this was the SECOND
1251 // site of the identical single-prefix construction inside this one file.
1252 // RE-MEASURED 2026-09-01, AND THE 2026-08-25 NOTE THAT STOOD HERE IS NOW FALSE IN BOTH HALVES. It
1253 // read "ALL 46 .gates maps live in the PRIMARY tree and buildroot holds ZERO of them ... this half is
1254 // INERT right now". Today's census (corpus_complete=1 on both sides) is PRIMARY 60 . SECONDARY 5, so
1255 // the fallback is NOT inert: it is the only reason aesthetictwin, capregistry and performance resolve
1256 // a gates map at all, and their stamps prove it by reading gatesroot=BUILDROOT. The day the note
1257 // predicted arrived, and nothing announced it -- which is why the count is re-derived here rather
1258 // than quoted.
1259 //
1260 // THIS CLASS KEEPS THE AUTHORED ORDER, AND THAT IS AN ADJUDICATION, NOT AN OMISSION. The .matrix call
1261 // above moved to the PUBLISHED order because a page renders a matrix. NOTHING RENDERS A .gates
1262 // DOCUMENT: it is an input to this referee, which forks the gate elfs it names, so "grade what is
1263 // published" has no subject here. The class's home is the 58 maps that exist ONLY in PRIMARY, and
1264 // flipping it would change exactly two domains (gen, synthroom) on no evidence. A BLANKET FLIP OF THE
1265 // RESOLVER WOULD HAVE MOVED THIS SITE TOO, AND WOULD HAVE BEEN WRONG.
1266 // The split remains the real tell: dcc and folkgames declare EXECUTED PROOFS in knowledge/compare/
1267 // while their matrices live ONLY in buildroot -- two halves of one domain in two different trees.
1268 let gbuf: *u8 = sys_mmap(EV_MAGIC_16384)
1269 let gwhich: *i64 = sys_mmap(16) as *i64
1270 let gn: i64 = ct_compare_read_authored(domain, ".gates" as *u8, gbuf, EV_MAGIC_16384, gwhich)
1271 // Recorded BEFORE the early return below, so a domain with no gates map stamps gatesroot=NONE
1272 // rather than leaving the field to a default that reads like a measurement.
1273 ev_p_gatesroot = gwhich[0]
1274 ev_p_vacuous = 0
1275 ev_p_deadline = 0
1276 ran[0] = 0
1277 ran[1] = 0 // gates that ABSTAINED (exit EV_RC_SKIP): counted, never convicted
1278 var green: i64 = 0
1279 if gn <= 0 { return 0 }
1280
1281 let line: *u8 = sys_mmap(EV_MAGIC_1024)
1282 let felf: *u8 = sys_mmap(256)
1283 let frel: *u8 = sys_mmap(512)
1284 let fargv: *u8 = sys_mmap(512) // field 1: the DECLARED argv, documented since this schema was written
1285 let flabel: *u8 = sys_mmap(256)
1286 let outp: *u8 = sys_mmap(256)
1287 let ob: *u8 = sys_mmap(EV_MAGIC_65536)
1288 let fs: *i64 = sys_mmap(8 * 8) as *i64
1289 let fe: *i64 = sys_mmap(8 * 8) as *i64
1290 let cnt: *i64 = sys_mmap(16) as *i64
1291
1292 if mode == 2 {
1293 w(1, "<h2 style='font-size:clamp(1.05rem,2.5vw,1.25rem);margin:24px 0 10px'>Executed proofs (gates forked live)</h2>\n" as *u8)
1294 w(1, "<p class='meth'>These are not stored numbers. For each proof the evidence organ <b>forks the real gate elf</b> and captures its verdict on this run — the same self-test that gates the build. A red or crashed gate fails this page.</p>\n" as *u8)
1295 }
1296 if mode == 1 { w(1, ",\n " as *u8); wc(1, 34); w(1, "executed" as *u8); wc(1, 34); wc(1, 58); w(1, "[\n" as *u8) }
1297
1298 var uniq: i64 = EV_MAGIC_12345
1299 var first_json: i64 = 1
1300 var i: i64 = 0
1301 while i < gn {
1302 var e: i64 = i
1303 while e < gn { if gbuf[e] == (10 as u8) { break } e = e + 1 }
1304 let ll: i64 = e - i
1305 if ll > 0 { if gbuf[i] != (35 as u8) {
1306 var t: i64 = 0
1307 while t < ll { if t < 1023 { line[t] = gbuf[i + t] } t = t + 1 }
1308 line[ll] = 0 as u8
1309 let nf: i64 = ev_split(line, ll, fs, fe, 8)
1310 if nf >= 3 {
1311 ev_fcopy(line, fs[0], fe[0], felf, 256)
1312 ev_fcopy(line, fs[1], fe[1], fargv, 512)
1313 ev_fcopy(line, fs[2], fe[2], flabel, 256)
1314 ev_resolve(felf, frel) // find the artifact on THIS host before judging it missing
1315 ev_prov_fold(frel) // hash the binary we are about to trust, where we are trusting it
1316 ev_bite_fold(frel) // and check it has been proven able to FAIL
1317 var oo: i64 = 0
1318 let op: *u8 = "/tmp/ev_"
1319 var oi: i64 = 0
1320 while op[oi] != (0 as u8) { outp[oo] = op[oi]; oo = oo + 1; oi = oi + 1 }
1321 oo = oo + 0
1322 // 2026-09-02: this capture path was /tmp/ev_<uniq>.out with uniq counting 12345,12352,...
1323 // from the SAME seed in every run, so two referees running at once (one per domain -- the
1324 // normal shape of an evidence campaign) wrote their gates' output over each other and the
1325 // loser read an EMPTY or foreign capture as its own gate: exit=0 pass=0/0 RED on a probe
1326 // that, run alone, prints GREEN 1/1 (measured on doctor / nx_probe_ctor; the same artifact
1327 // produced a false VACUOUS on swarm). Qualify the path by domain and wall-clock
1328 // microseconds so concurrent runs cannot share a capture file.
1329 var di: i64 = 0
1330 while domain[di] != (0 as u8) { outp[oo] = domain[di]; oo = oo + 1; di = di + 1 }
1331 outp[oo] = 95 as u8; oo = oo + 1
1332 var tus: i64 = sys_now_us()
1333 if tus <= 0 { tus = 1 }
1334 let tt: *u8 = sys_mmap(24); var tk: i64 = 0
1335 while tus > 0 { tt[tk] = (48 + (tus % 10)) as u8; tus = tus / 10; tk = tk + 1 }
1336 var tq: i64 = tk - 1
1337 while tq >= 0 { outp[oo] = tt[tq]; oo = oo + 1; tq = tq - 1 }
1338 outp[oo] = 95 as u8; oo = oo + 1
1339 var m: i64 = uniq
1340 let tb: *u8 = sys_mmap(24); var k: i64 = 0
1341 while m > 0 { tb[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
1342 var q: i64 = k - 1
1343 while q >= 0 { outp[oo] = tb[q]; oo = oo + 1; q = q - 1 }
1344 let oe: *u8 = ".out"
1345 var ei: i64 = 0
1346 while oe[ei] != (0 as u8) { outp[oo] = oe[ei]; oo = oo + 1; ei = ei + 1 }
1347 outp[oo] = 0 as u8
1348 uniq = uniq + 7
1349
1350 let rc: i64 = ev_run(frel, outp, fargv)
1351 let on: i64 = ev_read(outp, ob, EV_MAGIC_65536)
1352 let pnb: *i64 = sys_mmap(16) as *i64
1353 let pmb: *i64 = sys_mmap(16) as *i64
1354 ev_parse_pass(ob, on, pnb, pmb)
1355 let pass_n: i64 = pnb[0]
1356 let pass_m: i64 = pmb[0]
1357 cnt[0] = 0
1358 let greenoff: i64 = ev_find_line(ob, on, "GREEN" as *u8, cnt)
1359 var is_green: i64 = 0
1360 if greenoff >= 0 { if rc == 0 { is_green = 1 } }
1361 // 2026-09-02: exit 124 is the referee's OWN kill (the nx_guarded_run deadline in ev_run), not
1362 // a verdict the gate produced. When the gate had ALREADY printed its canonical N/N GREEN line
1363 // before the kill -- measured under load 30 on 8 CPUs: swarm tend 11/11 and videocodec
1364 // SIMD-SAD 11/11 both read RED at exit=124 -- the subject passed and only the process
1365 // lingered past the deadline. Convicting it read a saturated box as a broken codec. The
1366 // positional verdict line is the gate's own testimony; the exit code here is the referee's.
1367 // Announced per gate as SLOW-GREEN so a reader can see the deadline was hit, never hidden.
1368 var is_slow_green: i64 = 0
1369 if rc == EV_RC_TIMEOUT { if greenoff >= 0 { if pass_m > 0 { if pass_n == pass_m { is_green = 1; is_slow_green = 1 } } } }
1370 var is_skip: i64 = 0
1371 if rc == EV_RC_SKIP { is_skip = 1 }
1372 // 2026-09-02: exit 124 with NO verdict line is the REFEREE's own kill, not the gate's verdict.
1373 // Under a saturated box (load 25-35 on 8 CPUs) nx_v128_gate and nx_swarm_tend_gate both
1374 // outran the 420 s deadline before printing a line, and the domain published RED
1375 // failing_conjunct=quorum -- the referee's deadline reported as the subject's defect. The
1376 // gate examined nothing that we could read, so it ABSTAINS (counted in skipped=, excluded
1377 // from the judged quorum) and is ANNOUNCED with the deadline it breached; it can never be
1378 // read as GREEN, and a gate that keeps breaching is visible on every run, not silently RED.
1379 if rc == EV_RC_TIMEOUT { if is_green == 0 {
1380 is_skip = 1
1381 ev_p_deadline = ev_p_deadline + 1
1382 if mode == 0 { w(1, " DEADLINE-UNMEASURED domain=" as *u8); w(1, domain); w(1, " proof=" as *u8); w(1, flabel); w(1, " elf=" as *u8); w(1, felf); w(1, " deadline_ms=" as *u8); wn(1, ev_gate_deadline_for(frel)); w(1, " (the referee killed it before a verdict line: ABSTAINED, not convicted; raise its row in knowledge/status/evidence_gate_deadline_overrides.conf only from a MEASURED runtime)\n" as *u8) }
1383 } }
1384 ran[0] = ran[0] + 1
1385 if is_skip == 1 { ran[1] = ran[1] + 1 }
1386 if is_green == 1 { green = green + 1 }
1387 // A GREEN ON A ZERO DENOMINATOR. ev_parse_pass already extracted M and this caller folded
1388 // GREEN without ever looking at it, so a gate printing GREEN at pass=0/0 counted exactly
1389 // like one that passed 87 teeth. REPORTED, NOT CONVICTED: a gate with real teeth and a
1390 // broken counter and a gate with no teeth at all are indistinguishable from outside, and
1391 // THAT INDISTINGUISHABILITY IS THE FINDING -- silently turning it into a RED would be an
1392 // unvalidated tightening of a fleet-wide bar, decided on no evidence.
1393 if is_green == 1 { if pass_m == 0 {
1394 ev_p_vacuous = ev_p_vacuous + 1
1395 if mode == 0 { w(1, " VACUOUS-GATE domain=" as *u8); w(1, domain); w(1, " proof=" as *u8); w(1, flabel); w(1, " (GREEN at pass=0/0)\n" as *u8) }
1396 } }
1397
1398 if mode == 0 {
1399 w(1, " [" as *u8)
1400 if is_green == 1 { w(1, "GREEN " as *u8) } else { if is_skip == 1 { w(1, "SKIP " as *u8) } else { w(1, "RED " as *u8) } }
1401 w(1, "] exit=" as *u8); wn(1, rc); if is_slow_green == 1 { w(1, " SLOW-GREEN(full N/N verdict printed before the referee deadline)" as *u8) }
1402 w(1, " pass=" as *u8); wn(1, pass_n); w(1, "/" as *u8); wn(1, pass_m); w(1, " " as *u8); w(1, flabel); w(1, "\n" as *u8)
1403 }
1404 if mode == 1 {
1405 if first_json == 0 { w(1, ",\n" as *u8) }
1406 first_json = 0
1407 w(1, " {" as *u8)
1408 kv_s(1, "proof" as *u8, flabel); wc(1, 44)
1409 kv_s(1, "elf" as *u8, felf); wc(1, 44)
1410 kv_n(1, "exit" as *u8, rc); wc(1, 44)
1411 kv_n(1, "pass" as *u8, pass_n); wc(1, 44)
1412 kv_n(1, "of" as *u8, pass_m); wc(1, 44)
1413 kv_n(1, "green" as *u8, is_green)
1414 w(1, "}" as *u8)
1415 }
1416 if mode == 2 {
1417 w(1, "<div class='verdict'><b>" as *u8)
1418 if is_green == 1 { w(1, "GREEN" as *u8) } else { if is_skip == 1 { w(1, "SKIP" as *u8) } else { w(1, "RED" as *u8) } }
1419 w(1, "</b> — forked <code>" as *u8); w(1, felf); w(1, "</code> → pass=" as *u8); wn(1, pass_n); w(1, "/" as *u8); wn(1, pass_m)
1420 w(1, ", exit " as *u8); wn(1, rc); w(1, ". " as *u8); w(1, flabel); w(1, "</div>\n" as *u8)
1421 }
1422 st_out[0] = pass_n
1423 st_out[1] = pass_m
1424 }
1425 } }
1426 i = e + 1
1427 }
1428 if mode == 1 { w(1, "\n ]" as *u8) }
1429 return green
1430}
1431
1432// STAMP the verdict to knowledge/status/evstamp_<domain>.verdict so nx_sota_status reads PROVEN fast + live
1433// (the deep verdict costs ~20s/domain -- too slow to inline on every status call; this materializes it).
1434// THE RECONCILIATION VERDICT, IN ONE PLACE, FOR ALL THREE PARTITIONS THIS ORGAN PRINTS.
1435// A PARTITION IS A CLAIM, AND ITS ENTIRE VALUE IS THAT IT CAN FAIL -- so it has to SAY SO when it does.
1436// Before this the sums were printed beside their totals with NO verdict at all, which made every mismatch
1437// SILENT: measured live, video printed `grounded+ungrounded=15 vs present=19` while publishing ok=1
1438// MEASURED-HONEST, and it disagreed with itself in print on all four abstaining boards without one reader
1439// noticing. TWO NUMBERS THAT HAPPEN TO DIFFER ARE NOT A CHECK -- THEY ARE A COINCIDENCE THE READER IS
1440// INVITED TO NOTICE, AND NOBODY DID.
1441// ONE COMPARISON, THREE CALL SITES: a partition rendered identically everywhere cannot be right in one
1442// place and wrong in another, which is the duplicate-ruler defect this estate keeps paying for.
1443func ev_recon_mark(sum: i64, tot: i64) -> *u8 {
1444 if sum == tot { return "[OK]" as *u8 }
1445 return "[LEAK]" as *u8
1446}
1447
1448func ev_stamp(domain: *u8, ok: i64, grounded: i64, present: i64, green: i64, ran: i64, skipped: i64) -> i64 {
1449 // ONE COPY OF THE PATH. evp_path is the same function every reader of this stamp calls, so the file
1450 // this organ WRITES and the file consumers LOOK FOR are the same string by construction instead of by
1451 // two hand-rolled concatenations happening to agree. Same prefix, same suffix, byte-identical output.
1452 let path: *u8 = sys_mmap(256)
1453 evp_path(path, domain)
1454 let fd: i64 = sys_openat_wr(path, 0x1a4)
1455 if fd < 0 { return 0 - 1 }
1456 w(fd, "ok=" as *u8); wn(fd, ok); w(fd, " epoch=" as *u8); wn(fd, sys_now_realtime_sec())
1457 w(fd, " grounded=" as *u8); wn(fd, grounded); w(fd, "/" as *u8); wn(fd, present)
1458 w(fd, " gates=" as *u8); wn(fd, green); w(fd, "/" as *u8); wn(fd, ran)
1459 // ADDITIVE per rule 19: v1 readers ignore this field; a reader that wants to degrade a partially
1460 // observed domain to UNPROVEN can now do so from the stamp instead of guessing from green/ran.
1461 w(fd, " skipped=" as *u8); wn(fd, skipped)
1462 // ---- v2 PROVENANCE (additive per rule 19: v1 readers ignore these; the new reader REQUIRES them) ----
1463 // declared/hashed says how many gate binaries were actually present to be hashed. When they differ, the
1464 // suite digest is undefined and no reader may treat this stamp as proof -- that is the whole point.
1465 w(fd, " declared=" as *u8); wn(fd, ev_prov_declared); w(fd, " hashed=" as *u8); wn(fd, ev_prov_present)
1466 w(fd, " redseen=" as *u8); wn(fd, ev_bite_seen)
1467 // ---- v3 GAP PROFILE. STRICTLY ADDITIVE, AND INSERTED AT EXACTLY THIS POSITION ON PURPOSE (rule 19):
1468 // every v1/v2 key above keeps its name, its order and its value, and dig= stays the newline-terminated
1469 // tail, so nx_sota_status and nx_domain_admit_lib parse byte-for-byte as they did before. The keys are
1470 // the SAME literals nx_evprofile_lib reads back; there is exactly one copy of each.
1471 // GUARDED BY ev_p_v2: if ev_scan did not reach its end over a readable matrix, NOT ONE profile key is
1472 // written, every reader correctly sees a v1 stamp, and it abstains. AN AXIS THAT CANNOT SEE MUST
1473 // ABSTAIN, NOT ACQUIT -- and a zero written here would acquit.
1474 if ev_p_v2 == 1 {
1475 w(fd, EVP_K_UNGROUNDED); wn(fd, ev_p_ungrounded)
1476 w(fd, EVP_K_ABSENT); wn(fd, ev_p_absent)
1477 w(fd, EVP_K_ABSNAMED); wn(fd, ev_p_absnamed)
1478 w(fd, EVP_K_ABSBARE); wn(fd, ev_p_absbare)
1479 w(fd, EVP_K_LANDED); wn(fd, ev_p_landed)
1480 w(fd, EVP_K_VACUOUS); wn(fd, ev_p_vacuous)
1481 // conj: grounded / present / quorum / negcontrol, in that fixed order, uppercase = the conjunct
1482 // held. GPqN says "no gate ran"; gPQN says "a published claim is unsupported". Same verdict word,
1483 // opposite work. The character codes are G/g P/p Q/q N/n.
1484 w(fd, EVP_K_CONJ)
1485 wc(fd, evp_conj_char(ev_p_cjg, 71, 103))
1486 wc(fd, evp_conj_char(ev_p_cjp, 80, 112))
1487 wc(fd, evp_conj_char(ev_p_cjq, 81, 113))
1488 wc(fd, evp_conj_char(ev_p_cjn, 78, 110))
1489 w(fd, EVP_K_MROOT); w(fd, evp_tree_name(ev_p_mroot))
1490 w(fd, EVP_K_MBYTES); wn(fd, ev_p_mbytes)
1491 w(fd, EVP_K_MCAP); wn(fd, ev_p_mcapped)
1492 w(fd, EVP_K_GATESROOT); w(fd, evp_tree_name(ev_p_gatesroot))
1493 // ---- v3 TAIL: THE WITHHELD-PROOF CLASS. Appended AFTER every existing key on purpose (rule 19),
1494 // so nx_sota_status and nx_domain_admit_lib parse byte-for-byte as they did and dig= is still the
1495 // newline-terminated end of the line. Both counters ride the same ev_p_v2 honesty guard as the
1496 // rest of the profile: if ev_scan did not reach its end, not one of these keys is written at all.
1497 w(fd, EVP_K_WITHHELD); wn(fd, ev_p_withheld)
1498 w(fd, EVP_K_WHREF); wn(fd, ev_p_whref)
1499 // ---- v5 TAIL: THE RULER'S OWN ABSTENTION. Written INSIDE the ev_p_v2 guard with the rest of the
1500 // profile, because it is a COUNT PRODUCED BY ev_scan: a zero written when ev_scan never reached its
1501 // end would ACQUIT, which is the same reason every profile key above is guarded. Appended after
1502 // every existing key so the line's tail is unchanged -- dig= is still the newline-terminated end,
1503 // and no key above contains the string "abstain", so evp_find's unanchored probes stay byte-stable.
1504 // WITH THIS KEY THE PARTITION IS CHECKABLE FROM THE STAMP ITSELF:
1505 // present = grounded + ungrounded + abstain
1506 // A PARTITION IS A CLAIM, AND ITS VALUE IS THAT IT CAN FAIL. Without this key the abstained rows
1507 // would be an unexplained residual in an identity that used to be exact -- a leak, not a measurement.
1508 w(fd, EVP_K_ABSTAIN); wn(fd, ev_p_abstain)
1509 // ---- v6 TAIL: THE COMPOSITION DENOMINATOR, AND THE WATCH-FORM ABSTENTION. ----
1510 // WHY THESE THREE ARE HERE AT ALL: all three were ALREADY COMPUTED on every run and reached NO
1511 // STAMP, so the numbers existed and no machine could read them. ev_p_axes in particular has been
1512 // computed since this organ existed and thrown away at the door, and A DENOMINATOR THAT IS NEVER
1513 // RECORDED MAKES ITS OWN NUMERATOR UNREADABLE.
1514 // WHAT THEY BUY: the estate's cheapest published dishonesty is an 18-byte edit rewriting an
1515 // ungrounded row's symbol field into the watch form (measured on team: 6732 -> 6750 B, RED ->
1516 // MEASURED-HONEST, ungrounded 2 -> 0, zero code and zero capability). A retraction and an honest
1517 // new gap are the SAME observation within one census and have OPPOSITE SIGNATURES across two:
1518 // retraction ..... axes CONSTANT, claimed FALLS honest gap ..... axes RISES, claimed HOLDS
1519 // With only `present` on the wire that discriminator is unbuildable BY CONSTRUCTION. With these it
1520 // is per-board arithmetic over two stamps and needs no per-row history at all.
1521 // INSIDE THE ev_p_v2 GUARD WITH THE REST OF THE PROFILE, for the reason every key above is: these
1522 // are counts ev_scan PRODUCES, and a zero written when ev_scan never reached its end would ACQUIT.
1523 // axes=0 would be the worst of them -- it asserts a board with no rows at all.
1524 // APPENDED AFTER EVERY EXISTING KEY, so the line's tail is unchanged and dig= is still the
1525 // newline-terminated end. No key above contains "axes" or "claimed", and " abstain=" cannot match
1526 // inside " abstain_watch=" because every key literal carries its trailing '=' and the byte after
1527 // "abstain" there is an underscore -- so every unanchored evp_find probe stays byte-stable.
1528 // THE STAMP NOW CARRIES BOTH TOP-LEVEL PARTITIONS AND EACH ONE CAN FAIL FROM THE ARTIFACT ALONE:
1529 // axes = claimed + absent + landed
1530 // present = grounded + ungrounded + abstain
1531 // abstain_watch is a SEPARATE AXIS overlapping absent_named -- never a summand of either sum.
1532 w(fd, EVP_K_AXES); wn(fd, ev_p_axes)
1533 w(fd, EVP_K_CLAIMED); wn(fd, ev_p_claimed)
1534 w(fd, EVP_K_ABSTAIN_WATCH); wn(fd, ev_p_abstain_watch)
1535 }
1536 // ---- v4 TAIL: THE THIRD VERDICT STATE, WRITTEN UNCONDITIONALLY AND DELIBERATELY OUTSIDE THE ev_p_v2
1537 // GUARD. That placement IS the point: the first reason a verdict can be UNPROVEN is that ev_scan never
1538 // reached its end over a readable matrix, and that is exactly the case in which not one profile key is
1539 // written. Putting these two inside the guard would silence the state precisely when it fires.
1540 // Appended after every v1/v2/v3 key and BEFORE host=/dig=, so the line's tail is unchanged: dig= is
1541 // still the newline-terminated end, and nx_sota_status's unanchored probes (ok= epoch= gates=
1542 // declared= skipped= redseen= host= dig=) are byte-stable -- no new key contains any of them.
1543 w(fd, EVP_K_UNPROVEN); wn(fd, ev_p_unproven)
1544 w(fd, EVP_K_UNPREASON); w(fd, ev_unpr_name(ev_p_unpreason))
1545 w(fd, " host=" as *u8); ev_write_host(fd)
1546 w(fd, " dig=" as *u8); ev_write_dig(fd)
1547 w(fd, "\n" as *u8)
1548 sys_close(fd)
1549 return 0
1550}
1551
1552// WHERE this verdict was produced. A stamp that cannot name its own machine is a rumour about a machine.
1553func ev_write_host(fd: i64) -> i64 {
1554 let hb: *u8 = sys_mmap(256)
1555 let n: i64 = ev_read("/etc/hostname" as *u8, hb, 255)
1556 if n <= 0 { w(fd, "UNKNOWN" as *u8); return 0 }
1557 var k: i64 = 0
1558 while k < n { if hb[k] == (10 as u8) { break } if hb[k] == (32 as u8) { break } k = k + 1 }
1559 if k <= 0 { w(fd, "UNKNOWN" as *u8); return 0 }
1560 sys_write(fd, hb, k)
1561 return 0
1562}
1563
1564// WHAT was executed, as a hex digest over every gate binary. Emitted as ABSENT unless every declared gate
1565// was present and hashed -- a partial digest would be worse than none, because it would look like proof.
1566func ev_write_dig(fd: i64) -> i64 {
1567 if ev_prov_declared <= 0 { w(fd, "ABSENT" as *u8); return 0 }
1568 if ev_prov_present != ev_prov_declared { w(fd, "ABSENT" as *u8); return 0 }
1569 let hex: *u8 = "0123456789abcdef"
1570 let out: *u8 = sys_mmap(72)
1571 var j: i64 = 0
1572 while j < 32 {
1573 let b: i64 = ev_prov_acc[j] as i64
1574 out[j*2] = hex[(b >> 4) & 15]
1575 out[j*2+1] = hex[b & 15]
1576 j = j + 1
1577 }
1578 sys_write(fd, out, 64)
1579 return 0
1580}
1581
1582func main(argc: i64, argv: *i64) -> i64 {
1583 if argc < 2 { w(1, "usage: nx_swcompare_evidence <domain> [json|html]\n" as *u8); sys_exit(2); return 2 }
1584 let domain: *u8 = argv[1] as *u8
1585 var mode: i64 = 0
1586 if argc >= 3 { if streq(argv[2] as *u8, "json" as *u8) == 1 { mode = 1 } if streq(argv[2] as *u8, "html" as *u8) == 1 { mode = 2 } }
1587
1588 // HEAVY-I/O BOUND (2026-09-03): the referee forks every declared gate of a domain, so it asks the estate-wide
1589 // concurrency bound BEFORE it starts. A DEFER is the referee's own ABSTAIN (EV_RC_SKIP, exit 3): could not grade
1590 // this pass -- never a RED, which would convict a domain for the box being busy. Announced on stderr so the json
1591 // and html bodies stay well-formed. UNOBSERVABLE proceeds, announced.
1592 let hio: *i64 = sys_mmap(32) as *i64
1593 let hv: i64 = hio_admit(hio)
1594 hio_announce(2, hv, hio)
1595 if hv == HIO_DEFER { w(2, "SWCOMPARE-EVIDENCE DEFERRED: heavy-I/O bound reached; the referee abstains this pass\n" as *u8); sys_exit(EV_RC_SKIP); return EV_RC_SKIP }
1596 if mode == 2 {
1597 w(1, "<" as *u8); wc(1, 33); w(1, "DOCTYPE html>\n<html lang=\"en\"><head><meta charset='utf-8'><meta name='viewport' content='width=device-width, initial-scale=1'>\n" as *u8)
1598 w(1, "<title>Nishi Compare -- Evidence: " as *u8); w(1, domain); w(1, "</title>\n<style>\n" as *u8)
1599 w(1, ":root{--nx-color-bg:rgb(255,255,255);--nx-color-fg:rgb(22,22,34);--nx-color-accent:rgb(42,77,143);--bg:var(--nx-color-bg);--fg:var(--nx-color-fg);--ac:var(--nx-color-accent);--y:rgb(26,127,55);--n:rgb(179,38,30);--line:rgb(227,227,234);--soft:rgb(246,247,251)}\n" as *u8)
1600 w(1, "*{box-sizing:border-box}body{background:var(--bg);font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:1080px;margin:0 auto;padding:0 clamp(14px,4vw,20px) 5vh;color:var(--fg);line-height:1.6;font-size:clamp(15px,0.6vw + 13px,17px)}\n" as *u8)
1601 w(1, "h1{font-size:clamp(1.6rem,4vw,2rem);margin:0 0 4px;background:linear-gradient(90deg,var(--ac),rgb(130,80,223));-webkit-background-clip:text;background-clip:text;-webkit-text-fill-color:transparent;color:transparent}.sub{color:rgb(102,102,102);font-size:clamp(.95rem,2vw,1.05rem)}.crumb{font-size:.85rem;margin-bottom:18px}a{color:var(--ac)}\n" as *u8)
1602 w(1, ".skip-link{position:absolute;left:-999px;top:0;background:var(--ac);color:rgb(255,255,255);padding:12px 16px;z-index:9;border-radius:0 0 8px 0}.skip-link:focus{left:0}\n" as *u8)
1603 w(1, ".hd{background:linear-gradient(90deg,var(--ac),rgb(9,58,136));border-radius:0 0 12px 12px;margin:0 0 20px}.hd nav{display:flex;gap:8px;flex-wrap:wrap;padding:8px 14px}.hd a{color:rgb(255,255,255);text-decoration:none;padding:10px 12px;border-radius:8px;font-weight:600;min-height:44px;display:inline-flex;align-items:center}\n" as *u8)
1604 w(1, ".meth{background:var(--soft);border:1px solid var(--line);border-radius:12px;padding:14px 18px;margin:16px 0;font-size:.9rem}.wrap{overflow-x:auto;border:1px solid var(--line);border-radius:12px;box-shadow:0 1px 3px rgba(16,20,28,0.08)}table{border-collapse:collapse;width:100%;min-width:820px;font-size:.9rem}\n" as *u8)
1605 w(1, "th,td{padding:9px 12px;text-align:left;border-bottom:1px solid var(--line);vertical-align:top}thead th{background:var(--soft);font-weight:600}.cat{font-weight:600}.note{color:rgb(119,119,119);font-size:.82rem}td.b{text-align:center;font-weight:600}td.b.y{color:var(--y)}td.b.n{color:var(--n)}code{font-size:.82rem;white-space:pre-wrap;word-break:break-word}\n" as *u8)
1606 w(1, ".verdict{background:var(--soft);border-left:4px solid var(--y);padding:12px 18px;border-radius:0 10px 10px 0;margin:12px 0}.foot{margin-top:28px;color:rgb(136,136,136);font-size:.78rem;border-top:1px solid var(--line);padding-top:14px}\n" as *u8)
1607 w(1, ":focus-visible{outline:3px solid var(--ac);outline-offset:2px}main>*{animation:rise .5s ease both}@keyframes rise{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:none}}@media(prefers-reduced-motion:reduce){main>*{animation:none}}\n" as *u8)
1608 w(1, "@media(prefers-color-scheme:dark){:root{--nx-color-bg:rgb(15,15,20);--nx-color-fg:rgb(230,230,238);--line:rgb(38,38,47);--soft:rgb(23,23,31)}}\n" as *u8)
1609 w(1, "</style></head><body>\n" as *u8)
1610 w(1, "<a class='skip-link' href='" as *u8); wc(1, 35); w(1, "main'>Skip to content</a><header class='hd'><nav><a href='/'>Nishi Family</a><a href='/compare'>Compare</a></nav></header><main id='main'>\n" as *u8)
1611 w(1, "<p class='crumb'><a href='/'>Nishi Family</a> › <a href='/compare'>Compare</a> › Evidence: " as *u8); w(1, domain); w(1, "</p>\n" as *u8)
1612 w(1, "<h1>Evidence — " as *u8); w(1, domain); w(1, "</h1>\n<p class='sub'>Every capability we claim, grounded in real source and proven by a live-forked gate. Autonomously generated by nx_swcompare_evidence.</p>\n" as *u8)
1613 }
1614 if mode == 1 { w(1, "{" as *u8); kv_n(1, "v" as *u8, 1); wc(1, 44); kv_s(1, "domain" as *u8, domain); wc(1, 44); kv_s(1, "kind" as *u8, "evidence" as *u8) }
1615 if mode == 0 { w(1, "=== NX-SWCOMPARE-EVIDENCE domain=" as *u8); w(1, domain); w(1, " (grounding + executed proofs) ===\n" as *u8) }
1616
1617 let gst: *i64 = sys_mmap(16) as *i64
1618 let ran: *i64 = sys_mmap(16) as *i64
1619 let green: i64 = ev_gates(domain, mode, ran, gst)
1620
1621 let st: *i64 = sys_mmap(64) as *i64
1622 ev_scan(domain, mode, st)
1623
1624 // NEG-CONTROL: a bogus symbol must NOT be found in a real organ (proves grounding discriminates)
1625 let src: *u8 = sys_mmap(EV_MAGIC_2097152)
1626 let cnt: *i64 = sys_mmap(16) as *i64
1627 let negp: *u8 = sys_mmap(512)
1628 ev_resolve("runtime/nx_project.nx" as *u8, negp)
1629 let neg_n: i64 = ev_read(negp, src, EV_MAGIC_2097152)
1630 var neg_found: i64 = 0
1631 // THE NEG-CONTROL MUST TEST THE SHIPPING DECISION, NOT THE RETIRED ONE. It ran through
1632 // ev_find_line -- the ruler this organ no longer grounds with -- so from 2026-09-01 it would have
1633 // been proving the discrimination of a code path the verdict no longer depends on. A control
1634 // aimed at a demoted ruler is a green that says nothing about the ruler actually in the path.
1635 let negrl: *i64 = sys_mmap(16) as *i64
1636 if neg_n > 0 { if sd_present_buf(src, neg_n, "runtime/nx_project.nx" as *u8, "ZZ_NOT_A_REAL_SYMBOL_QQ" as *u8, negrl) == 1 { neg_found = 1 } }
1637
1638 let liar_grounded: i64 = (st[2] == 0) as i64
1639 let liar_present: i64 = (st[4] >= 5) as i64
1640 // QUORUM (fixed 2026-07-30, was the headline defect). This read `if ran[0] > 0 { liar_green = (green >= 1) }`
1641 // -- ONE green gate out of any number stamped the whole domain PROVEN, so four RED gates were invisible to
1642 // the number we published. MEASURED consequence: medbilling sat in the PROVEN column on that rule.
1643 // The law is ev_quorum_ok: every declared gate ran, and every one was green.
1644 // The old `ran[0] == 0 -> liar_green = 1` default is ALSO removed deliberately: grounding proves a claim
1645 // maps to real source, it does not prove the code works. A domain with no executed gate has no execution
1646 // evidence, and must not be stampable as PROVEN on an empty conjunction.
1647 // JUDGED excludes the gates that ABSTAINED. A skip is not a dissent, and convicting on one makes the
1648 // SAFEST available gate outcome the most damaging one -- the exact inversion this estate fixed on the
1649 // resource axis ("an axis that cannot see must abstain, not acquit"); this is its mirror, a reader that
1650 // must not CONVICT on an abstention either.
1651 // The empty-set guard is UNCHANGED and load-bearing: ev_quorum_ok returns 0 on a zero denominator, so a
1652 // domain whose every declared gate skipped still has NO execution evidence and cannot be stamped honest.
1653 let judged: i64 = ran[0] - ran[1]
1654 let liar_green: i64 = ev_quorum_ok(green, judged, judged)
1655 let liar_neg: i64 = (neg_found == 0) as i64
1656 // CARRY THE CONJUNCTS TO THE STAMP. They were computed here, folded into one bit, and discarded --
1657 // so every downstream reader of a RED had to guess which of four things went wrong, and the two
1658 // most common causes (no gate declared at all, versus a gate that ran and failed) read identically.
1659 ev_p_cjg = liar_grounded
1660 ev_p_cjp = liar_present
1661 ev_p_cjq = liar_green
1662 ev_p_cjn = liar_neg
1663
1664 if mode == 2 {
1665 w(1, "<div class='meth'><b>Liar-kill.</b> ungrounded claims=" as *u8); wn(1, st[2])
1666 w(1, " (must be 0) · grounded=" as *u8); wn(1, st[1]); w(1, "/" as *u8); wn(1, st[4])
1667 w(1, " present axes · executed gates GREEN=" as *u8); wn(1, green); w(1, "/" as *u8); wn(1, ran[0])
1668 w(1, " · neg-control bogus symbol found=" as *u8); wn(1, neg_found); w(1, " (must be 0).</div>\n" as *u8)
1669 w(1, "<p class='foot'>Generated by nx_swcompare_evidence — grounding reads real organ source on disk; executed proofs fork the real gate elf on every render. Zero JS, zero trackers, sovereign.</p>\n" as *u8)
1670 w(1, "</main></body></html>\n" as *u8)
1671 sys_exit(0); return 0
1672 }
1673 if mode == 1 {
1674 wc(1, 44); w(1, "\n " as *u8)
1675 kv_n(1, "present_axes" as *u8, st[4]); wc(1, 44)
1676 kv_n(1, "grounded" as *u8, st[1]); wc(1, 44)
1677 kv_n(1, "ungrounded" as *u8, st[2]); wc(1, 44)
1678 kv_n(1, "gates_green" as *u8, green); wc(1, 44)
1679 kv_n(1, "gates_ran" as *u8, ran[0]); wc(1, 44)
1680 kv_n(1, "gates_skipped" as *u8, ran[1])
1681 w(1, "\n}\n" as *u8)
1682 sys_exit(0); return 0
1683 }
1684
1685 w(1, " TALLY: present_axes=" as *u8); wn(1, st[4]); w(1, " grounded=" as *u8); wn(1, st[1]); w(1, " ungrounded=" as *u8); wn(1, st[2])
1686 w(1, " absent=" as *u8); wn(1, st[3]); w(1, " gates_green=" as *u8); wn(1, green); w(1, "/" as *u8); wn(1, ran[0])
1687 w(1, " gates_skipped=" as *u8); wn(1, ran[1]); w(1, " gates_judged=" as *u8); wn(1, judged); w(1, "\n" as *u8)
1688 // THE PROFILE, ON THE TEXT SURFACE TOO, WITH ITS PARTITIONS RECONCILED IN PRINT. Two counters of the
1689 // same population are a free audit.
1690 // THE TWO IDENTITIES THAT USED TO BE SPELLED OUT IN THIS COMMENT ARE DELIBERATELY GONE, AND REMOVING
1691 // THEM IS THE FIX RATHER THAN REWORDING THEM. Both had drifted, in the flattering direction, and
1692 // nothing could tell: it still claimed `present == grounded+ungrounded` after the ruler learned to
1693 // ABSTAIN, and `absent == absent_named+absent_bare` after the withheld class became a third member --
1694 // the CODE had moved on from the second and not the first, and the PROSE from neither.
1695 // A COMMENT THAT RECITES AN IDENTITY IS A SECOND RULER MADE OF PROSE: it drifts silently, no gate can
1696 // read it, and it drifts toward UNDERSTATEMENT, which is the direction nobody audits.
1697 // Each RECONCILE line below now prints its own sum, its own total and its own [OK]/[LEAK] mark, so the
1698 // reconciliation IS its own summary and cannot fall out of date with itself. ADDING A PARTITION MEANS
1699 // ADDING A LINE, NEVER EDITING THIS PARAGRAPH.
1700 w(1, " PROFILE: ungrounded=" as *u8); wn(1, ev_p_ungrounded)
1701 w(1, " absent=" as *u8); wn(1, ev_p_absent)
1702 w(1, " absent_named=" as *u8); wn(1, ev_p_absnamed)
1703 w(1, " absent_bare=" as *u8); wn(1, ev_p_absbare)
1704 w(1, " landed=" as *u8); wn(1, ev_p_landed)
1705 w(1, " withheld=" as *u8); wn(1, ev_p_withheld)
1706 w(1, " withheld_refused=" as *u8); wn(1, ev_p_whref)
1707 w(1, " vacuous=" as *u8); wn(1, ev_p_vacuous)
1708 w(1, " deadline=" as *u8); wn(1, ev_p_deadline)
1709 // THE RULER-CHANGE COLUMNS. substr_only is the count of cells this board was publishing on a
1710 // NON-DECLARATION occurrence -- a comment, a call site, a string literal -- and it is the number
1711 // this change exists to make visible. Every one is NAMED above with the line that carried it, so
1712 // the count arrives with its worklist and its reason instead of one step short of both.
1713 w(1, " substr_only=" as *u8); wn(1, ev_p_substronly)
1714 w(1, " decl_only=" as *u8); wn(1, ev_p_declonly)
1715 w(1, " noline=" as *u8); wn(1, ev_p_noline)
1716 w(1, " mroot=" as *u8); w(1, evp_tree_name(ev_p_mroot))
1717 w(1, " mbytes=" as *u8); wn(1, ev_p_mbytes)
1718 w(1, " mcapped=" as *u8); wn(1, ev_p_mcapped)
1719 w(1, " gatesroot=" as *u8); w(1, evp_tree_name(ev_p_gatesroot))
1720 // ---- THE PRINTED IDENTITY IS NOW THE PARTITION ACTUALLY MAINTAINED, AND IT CAN SAY NO. ----
1721 // IT COULD DO NEITHER BEFORE. It asserted `grounded+ungrounded vs present`, an identity that STOPPED
1722 // BEING EXACT the day the ruler learned to ABSTAIN, and it printed the two numbers side by side with
1723 // NO VERDICT -- so a mismatch was SILENT. MEASURED live: video printed `grounded+ungrounded=15 vs
1724 // present=19` while that same run stamped ok=1 and published MEASURED-HONEST, and it disagreed with
1725 // itself in print on ALL FOUR abstaining boards, two of them declared honest.
1726 // A RECONCILIATION WHOSE WHOLE VALUE IS THAT IT CAN FAIL MUST SAY SO ON THE RUN WHERE IT DOES.
1727 // THE SUM IS CORRECTED RATHER THAN THE READER WIDENED: abstain is a real member of this partition
1728 // (an abstained CLAIMED axis is still a published claim and stays in `present`), so it belongs in the
1729 // sum. Dropping it from the denominator instead would have shrunk the number the liar-kill floor is
1730 // measured against and silently changed which boards publish.
1731 // IT NAMES A LEAK AND DELIBERATELY DOES NOT CONVICT ON ONE: a broken sum here is an INSTRUMENT defect,
1732 // not a dishonest board, and failing a verdict on it would turn boards RED for a bug in this organ.
1733 // The four liar conjuncts are not weakened, not reordered and not added to.
1734 w(1, "\n RECONCILE: grounded+ungrounded+abstain=" as *u8); wn(1, st[1] + ev_p_ungrounded + ev_p_abstain)
1735 w(1, " vs present=" as *u8); wn(1, st[4])
1736 w(1, " " as *u8); w(1, ev_recon_mark(st[1] + ev_p_ungrounded + ev_p_abstain, st[4]))
1737 w(1, " . absent_named+absent_bare+withheld=" as *u8); wn(1, ev_p_absnamed + ev_p_absbare + ev_p_withheld)
1738 w(1, " vs absent=" as *u8); wn(1, ev_p_absent)
1739 w(1, " " as *u8); w(1, ev_recon_mark(ev_p_absnamed + ev_p_absbare + ev_p_withheld, ev_p_absent))
1740 // THE ABSTENTION THAT IS NOT IN EITHER SUM, PRINTED BESIDE THEM SO IT CANNOT LOOK LIKE AN OMISSION.
1741 // A SEPARATE AXIS SHOWN NEXT TO THE PARTITIONS IT OVERLAPS IS HOW A READER SEES THAT IT WAS EXCLUDED
1742 // ON PURPOSE RATHER THAN FORGOTTEN.
1743 w(1, " . abstain_watch=" as *u8); wn(1, ev_p_abstain_watch)
1744 w(1, " (separate axis, inside absent_named, in NEITHER sum)" as *u8)
1745 w(1, "\n" as *u8)
1746 // THE TOP-LEVEL PARTITION, PRINTED RATHER THAN ASSERTED, because a reconciliation whose value is that
1747 // it CAN fail has to be visible on the run where it does. axes = claimed + declared_gaps + landed.
1748 // claimed is the number a RETRACTION moves: rewriting one ungrounded row into the watch form lowers it
1749 // by exactly one while axes does not move at all, so the composition of the board changes in print on
1750 // the very run where the verdict word improves. THE 18-BYTE EDIT IS NO LONGER INVISIBLE. It still does
1751 // not FAIL the board, and that is deliberate -- see the retraction-denominator block above.
1752 w(1, " COMPOSITION: axes=" as *u8); wn(1, ev_p_axes)
1753 w(1, " claimed=" as *u8); wn(1, ev_p_claimed)
1754 w(1, " declared_gaps=" as *u8); wn(1, ev_p_absent)
1755 w(1, " landed_watch=" as *u8); wn(1, ev_p_landed)
1756 w(1, " . claimed+gaps+landed=" as *u8); wn(1, ev_p_claimed + ev_p_absent + ev_p_landed)
1757 // THE THIRD PARTITION WAS COMPUTED AND NEVER COMPARED. The sum was printed here; `axes` was printed
1758 // four fields earlier; NOTHING EVER PUT THEM SIDE BY SIDE -- so the one identity that makes a laundered
1759 // row arithmetically visible could not fail in print. It closes BY CONSTRUCTION (every classified row
1760 // increments exactly one of claimed / absent / landed), which is precisely why a [LEAK] here means a
1761 // counting bug in THIS ORGAN and is worth seeing on the run where it happens.
1762 w(1, " vs axes=" as *u8); wn(1, ev_p_axes)
1763 w(1, " " as *u8); w(1, ev_recon_mark(ev_p_claimed + ev_p_absent + ev_p_landed, ev_p_axes))
1764 w(1, " gap_rows_flagged_exceed=" as *u8); wn(1, ev_p_gapexc)
1765 w(1, "\n" as *u8)
1766 w(1, " LIAR-KILL: all-grounded=" as *u8); wn(1, liar_grounded); w(1, " present>=5=" as *u8); wn(1, liar_present)
1767 w(1, " gate-green=" as *u8); wn(1, liar_green); w(1, " neg-control=" as *u8); wn(1, liar_neg); w(1, "\n" as *u8)
1768 // ---- THE THIRD VERDICT STATE (2026-09-01). "I COULD NOT LOOK" IS NOT "IT IS BROKEN". ----
1769 // WHAT THIS FIXES. The verdict was a BOOLEAN over the four liar-kill conjuncts, so a board this
1770 // referee could not fully READ still published one of exactly two answers. charsim is the measured
1771 // cost: 67,965 B of matrix graded through a 65,536 B reserve, with mcapped=1 computed, STAMPED and
1772 // even DISCLOSED on the published page -- and ok=1 published anyway. Its own arithmetic closes on the
1773 // omission (the page says 50 capabilities; the referee classified 25 present + 20 gaps = 45), and the
1774 // five rows past the cap include that board's own liar-kill row and its OPERATOR-ACCEPTANCE row.
1775 // THE CEILING WAS MEASURED, PRINTED, AND THEN DROPPED AT THE ONE PLACE IT DECIDED ANYTHING.
1776 //
1777 // WHY TRUNCATION KILLS ONLY THE GREEN, AND THE ORDER THAT FOLLOWS FROM IT. This estate's own law:
1778 // PRESENCE NEEDS ONE WITNESS; ABSENCE NEEDS EXHAUSTIVE COVERAGE. A RED here is a POSITIVE finding --
1779 // an ungrounded claim was FOUND, a gate RAN and failed, the neg-control LEAKED -- and a positive
1780 // finding on a prefix is still a true finding. MEASURED-HONEST is the opposite shape: it asserts the
1781 // ABSENCE of any unsupported claim, and an absence claim over a corpus we did not finish reading is
1782 // not established. So the conjuncts are evaluated FIRST and a genuine RED still wins; only a would-be
1783 // GREEN is downgraded. That makes this strictly narrower than "mcapped fails the verdict": NO BOARD
1784 // THAT IS RED TODAY CHANGES VERDICT, and graphics (ok=0 mcapped=1, a real quorum failure) correctly
1785 // stays RED instead of being laundered into an abstention by its own truncation.
1786 //
1787 // AND THE UNREADABLE CASE OUTRANKS EVERYTHING, because there the conjuncts are not a measurement at
1788 // all. When the matrix is missing from BOTH compare trees, ev_scan returns early, st[] is still the
1789 // zero-filled mmap, and liar_grounded computes (0 == 0) == 1 -- THE GROUNDED CONJUNCT PASSES ON A
1790 // DOCUMENT NOBODY READ. Such a board failed only the `present>=5` clause, so it published as "too
1791 // thin to grade" when the truth was "there is no board here". A conjunct evaluated over a zero-filled
1792 // buffer is a FABRICATED CONSTANT WEARING THE SHAPE OF A MEASUREMENT.
1793 //
1794 // THE FOUR LIAR CONJUNCTS ARE NOT WEAKENED, NOT REORDERED AND NOT ADDED TO. Open gaps, withheld rows,
1795 // landed-unflipped rows and never-bitten gates deliberately still do NOT fail this verdict: a board
1796 // that NAMES its gaps is the most honest thing on the estate, and making gaps fail would punish
1797 // exactly the boards doing the right thing. This adds one state; it does not move the bar.
1798 let conj_ok: i64 = liar_grounded & liar_present & liar_green & liar_neg
1799 ev_p_unproven = 0
1800 ev_p_unpreason = EV_UNPR_NONE
1801 // ---- THE CAPPED LEG IS REMOVED, NOT DISABLED (2026-09-01). IT COULD NOT FIRE. ----
1802 // The clause that stood here was `if conj_ok == 1 { if ev_p_mcapped == 1 { ... EV_UNPR_CAPPED } }`,
1803 // and ev_p_mcapped has EXACTLY ONE ASSIGNMENT anywhere -- `ev_p_mcapped = 0`, in ev_scan.
1804 // RE-DERIVED RATHER THAN INHERITED: a literal sweep of both runtime trees returned matches=5
1805 // files=23429 coverage_complete=1 corpus_complete=1 -- one declaration, that one assignment, one stamp
1806 // write, one print, and this dead read. The cap it guarded was REMOVED rather than reported when
1807 // ev_scan adopted ct_compare_readall_published (which composes sys_read_file, sizes its buffer from
1808 // the file itself and CANNOT short-read), so there is no brim left to touch and the branch was
1809 // unreachable BY CONSTRUCTION. `unproven=0` on all 96 live stamps therefore read as "no board is
1810 // unprovable" when what it meant was "one of the two reasons CANNOT OCCUR, and the other has not".
1811 // A GREEN THAT HAS NEVER HAD A CORRESPONDING RED IS NOT PROTECTION, AND A DEAD LEG IS WORSE THAN AN
1812 // ABSENT ONE BECAUSE ITS EXISTENCE IS COUNTED AS COVERAGE WHILE ITS VERDICT IS NEVER COLLECTED.
1813 // NEUTRALITY HERE IS ARITHMETIC, NOT AN ASSERTION: the removed clause could fire only when
1814 // ev_p_mcapped == 1, which never holds, so no board's ev_p_unproven, ok=, verdict word or exit code
1815 // moves by one bit. THIS REMOVAL CANNOT CHANGE A SINGLE PUBLISHED VERDICT.
1816 // WHAT IS KEPT, AND WHY. ` mcapped=` STAYS ON THE WIRE (rule 19: nx_evprofile_lib parses it into
1817 // EVP_F_MCAPPED, and nx_sota_status and the emitted page read it), and EV_UNPR_CAPPED keeps its arm in
1818 // ev_unpr_name so a stamp written by an older binary and still carrying `unproven_reason=read-capped`
1819 // stays readable. THAT TOKEN IS NOW READ-ONLY LEGACY VOCABULARY, NOT A LIVE STATE, and it is named as
1820 // such here so the next reader does not mistake a spelling for a mechanism.
1821 // WHAT REMAINS IS REACHABLE, AND WAS EXERCISED RATHER THAN REASONED ABOUT: the matrix-unreadable leg
1822 // fires whenever ev_scan cannot read the board in EITHER compare tree, and it was run against the live
1823 // binary to WITNESS the RED before this change shipped.
1824 if ev_p_v2 == 0 {
1825 ev_p_unproven = 1
1826 ev_p_unpreason = EV_UNPR_UNREADABLE
1827 }
1828 // EVERY DECLARED GATE ABSTAINED (2026-09-02). judged == 0 with gates declared means no gate was
1829 // JUDGED: each one abstained on a precondition or was killed by this referee's deadline before it
1830 // printed a verdict. That is the absence of execution evidence, not evidence of failure, so it takes
1831 // the third state -- and ONLY when every other conjunct held, so a genuine RED (an ungrounded claim,
1832 // a thin board, a neg-control leak) still wins exactly as the block above promises. The empty-set
1833 // law is untouched: ev_quorum_ok still refuses a zero denominator, so this can never publish GREEN.
1834 if ev_p_unproven == 0 { if ran[0] > 0 { if judged == 0 { if liar_grounded == 1 { if liar_present == 1 { if liar_neg == 1 {
1835 ev_p_unproven = 1
1836 ev_p_unpreason = EV_UNPR_ALLSKIP
1837 } } } } } }
1838 // NO GATE DECLARED (2026-09-02). ran[0] == 0: the .gates map carries no row, or there is no map. That is the
1839 // ABSENCE of execution evidence, not a dissenting method, yet it published RED failing_conjunct=quorum and the
1840 // deploy lane blocked on a board nobody had measured (performersearch, an honest zero-row map). Same third
1841 // state, same guard: only when every other conjunct held, so a thin or ungrounded board still reads RED first.
1842 // ev_quorum_ok still refuses the zero denominator, so this can never publish GREEN; the remedy is a .gates row.
1843 if ev_p_unproven == 0 { if ran[0] == 0 { if liar_grounded == 1 { if liar_present == 1 { if liar_neg == 1 {
1844 ev_p_unproven = 1
1845 ev_p_unpreason = EV_UNPR_NOGATE
1846 } } } } }
1847 // ok= KEEPS ITS EXACT v1 MEANING -- "this board is MEASURED-HONEST" -- and an UNPROVEN board is not.
1848 // It is NOT widened to a third value: nx_sota_status.ss_stamp_load reads `if ok != 1 { dissent }` and
1849 // ev_verdict returns EV_RED on dissent BEFORE any other clause, so a new ok= value would be read as
1850 // RED by that organ regardless. The third state therefore travels in its OWN key, where a reader can
1851 // act on it, and ok= stays a boolean failing in the CONSERVATIVE direction: a board we could not fully
1852 // read never publishes a green. THE COST IS NAMED, NOT HIDDEN -- until ss_stamp_load learns that key,
1853 // an honest UNPROVEN reads as RED to that ONE consumer: wrong in the direction of MORE blocking, never
1854 // less, on a deploy lane already RED on 4 domains. The one-line remedy is in that organ, not this one.
1855 var ok: i64 = conj_ok
1856 if ev_p_unproven == 1 { ok = 0 }
1857 ev_stamp(domain, ok, st[1], st[4], green, ran[0], ran[1]) // materialize the verdict for the fast status surface
1858 w(1, "NX-SWCOMPARE-EVIDENCE domain=" as *u8); w(1, domain); w(1, " verdict=" as *u8)
1859 if ev_p_unproven == 1 {
1860 w(1, "UNPROVEN reason=" as *u8); w(1, ev_unpr_name(ev_p_unpreason))
1861 // ONE REASON, ONE MESSAGE. The arm removed here explained the read-capped state that the block
1862 // above deleted as unreachable, and AN EXPLANATION FOR A STATE THAT CANNOT OCCUR IS THE SAME DEAD
1863 // COVERAGE WEARING PROSE -- it reads to the next maintainer as a handled case. If a read cap is
1864 // ever reintroduced, the state and its message come back TOGETHER, at the site that reintroduces
1865 // the cap, which is the only place that can know what the new bound is.
1866 if ev_p_unpreason == EV_UNPR_ALLSKIP {
1867 w(1, " -- every declared gate ABSTAINED (" as *u8); wn(1, ran[1]); w(1, " of " as *u8); wn(1, ran[0])
1868 w(1, ": a missing precondition, or killed at this referee's deadline before a verdict line -- see the DEADLINE-UNMEASURED lines above), so no gate was judged. NOT a failure and NOT a pass: evidence DEBT. Remedy: supply the precondition, or raise that gate's row in knowledge/status/evidence_gate_deadline_overrides.conf from a MEASURED runtime, then re-run.\n" as *u8)
1869 sys_exit(3); return 3
1870 }
1871 if ev_p_unpreason == EV_UNPR_NOGATE {
1872 w(1, " -- the .gates map declares NO gate row (or no map exists), so nothing was executed. NOT a failure and NOT a pass: evidence DEBT. Remedy: land a rung with a gate RUN through /api/gate_run and add its row to knowledge/compare/<domain>.gates, then re-run.\n" as *u8)
1873 sys_exit(3); return 3
1874 }
1875 w(1, " -- the matrix is absent from BOTH compare trees, so no conjunct was evaluated against real data. NOT a failure: nothing was established either way. Remedy: find or publish the board.\n" as *u8)
1876 sys_exit(3); return 3
1877 }
1878 if ok == 1 {
1879 // A partial observation must not be published in the same words as a complete one: naming the
1880 // abstentions here is what stops "we could only run one of three" from reading as "all three pass".
1881 if ran[1] > 0 {
1882 w(1, "MEASURED-HONEST-PARTIAL (every claim grounded + every gate that COULD run was GREEN; " as *u8)
1883 wn(1, ran[1])
1884 w(1, " gate(s) ABSTAINED on a missing precondition -- evidence DEBT, not dissent, and deliberately not a block)\n" as *u8)
1885 sys_exit(0); return 0
1886 }
1887 w(1, "MEASURED-HONEST (every claim grounded + gate GREEN)\n" as *u8); sys_exit(0); return 0
1888 }
1889 // NAME THE FAILING CONJUNCT. This line was a DISJUNCTION -- "an ungrounded claim, dead gate, or
1890 // neg-control leak" -- so every reader guessed the most alarming of the three, and the two most
1891 // common causes (no gate is declared at all, versus a declared gate that ran and failed) read
1892 // identically while needing opposite work. A COMPOUND ASSERTION THAT WILL NOT NAME ITS FAILING
1893 // CONJUNCT IS A FALSE-ALARM GENERATOR -- THE READER ALWAYS GUESSES THE ALARMING THIRD.
1894 w(1, "RED failing_conjunct=" as *u8)
1895 if liar_grounded == 0 { w(1, "grounded -- a published claim's symbol is ABSENT from the organ its own row names" as *u8) } else {
1896 if liar_present == 0 { w(1, "present -- fewer than 5 measured axes; this board is too thin to grade" as *u8) } else {
1897 if liar_green == 0 { w(1, "quorum -- no declared gate ran, or one that ran was not GREEN: WRITE a .gates map, or FIX the gate it names" as *u8) } else {
1898 w(1, "negcontrol -- a bogus symbol was FOUND; grounding is not discriminating" as *u8) } } }
1899 w(1, "\n" as *u8); sys_exit(1); return 1
1900}