code wiki / (root) / nx_swcompare_evidence_lib_t138.nx
`nx_swcompare_evidence_lib_t138.nx` source

↩ module page · 3027 lines · 204879 B
1// AUTO-EXTRACTED shared base (nx_oo_extract). license_tier: ORIGINAL  No hw writes (Rule 26).
2// functions: w,wc,wn,wj,wq,kv_s,kv_n,c_read,streq,starts,scopy,splitpipe,wnote,rp_base,rp_publish,rp_json,refs_pass
3import "nx_syscalls.nx"
4import "nx_symdecl_lib.nx"
5import "nx_market_ladder_lib.nx"
6import "nx_brand_tokens.nx"   // the estate's design-token SSOT -- sc_theme_pass composes it, never a second parser
7import "nx_lineconf_lib.nx"  // line-anchored conf reader, ONE owner -- never a private key=value parser
8import "nx_estate_path.nx"     // THE ONE probe order for a status artifact -- a stamp written from the serving root must resolve from CWD=buildroot (gauge_pass, gaps_pass)
9import "nx_imgattr_lib.nx"   // the ONE definition of how an attribute value and an img tag are written
10import "nx_evprofile_lib.nx" // THE ONE READER of the /compare evidence stamp -- evj_pass below PROJECTS
11import "nx_bench_receipt_lib.nx" // THE ONE READER of a <dom>.bench benchmark receipt -- bench_pass below RENDERS it (2026-09-01)
12import "nx_barfresh_lib.nx" // THE ONE bar-age ruler (2026-09-06) -- plan_pass renders each sotatarget with its sotabar month and freshness state
13import "nx_compare_growth_json.nx"
14import "nx_ladder_lib.nx"   // THE ONE ladder ruler (2026-09-06) -- plan_pass renders the targets, the rung-role table and the NOT DECLARED notice
15import "nx_gauge_lib.nx"       // THE ONE gauge-heartbeat ruler (codeeffectiveness CE9, 2026-09-06) -- gauge_pass below RENDERS a <dom>.gauge row with the SAME classifier the writing beat uses, so a stale gauge reads STALE and never zero
                           // it into api.json. Its closure adds NOTHING new to this lib: nx_lineconf_lib
                           // above already imports nx_estate_path, and nx_swcompare_matrix already
                           // imports both this base AND nx_evprofile_lib and compiles, so the two
                           // symbol sets are proven compatible rather than assumed so.
20func w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
21func wc(fd: i64, code: i64) -> i64 { let t: *u8 = sys_mmap(2); t[0] = code as u8; sys_write(fd, t, 1); return 0 }
22func wn(fd: i64, v: i64) -> i64 {
  var m: i64 = v; if m < 0 { w(fd, "-" as *u8); m = 0 - m }
  let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 } sys_write(fd, o, k); return 0
27}
28func wj(fd: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { let c: i64 = s[i] as i64
      if c == 34 { wc(fd, 92); wc(fd, 34) } else { if c == 92 { wc(fd, 92); wc(fd, 92) } else { if c < 32 { wc(fd, 32) } else { wc(fd, c) } } }
      i = i + 1 }
  return 0
34}
35func wq(fd: i64) -> i64 { wc(fd, 34); return 0 }
36func kv_s(fd: i64, key: *u8, val: *u8) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wq(fd); wj(fd, val); wq(fd); return 0 }
37func kv_n(fd: i64, key: *u8, v: i64) -> i64 { wq(fd); w(fd, key); wq(fd); wc(fd, 58); wn(fd, v); return 0 }
38func c_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
  var tot: i64 = 0
  while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
  sys_close(fd); return tot
43}
44func streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
45func starts(s: *u8, pfx: *u8) -> i64 { var i: i64 = 0; while pfx[i] != (0 as u8) { if s[i] != pfx[i] { return 0 } i = i + 1 } return 1 }
46func scopy(dst: *u8, doff: i64, src: *u8) -> i64 { var i: i64 = 0; while src[i] != (0 as u8) { dst[doff+i] = src[i]; i = i + 1 } return doff + i }
47func splitpipe(s: *u8, fld: *i64, maxf: i64) -> i64 {
  var c: i64 = 1; fld[0] = s as i64; var i: i64 = 0
  while s[i] != (0 as u8) { if s[i] == (124 as u8) { s[i] = 0 as u8; if c < maxf { fld[c] = (s as i64) + i + 1; c = c + 1 } } i = i + 1 }
  return c
51}
52func wnote(fd: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) {
      var emitted: i64 = 0
      if s[i] == (91 as u8) { if s[i+1] == (64 as u8) {
          var kl: i64 = 0
          while s[i+2+kl] != (0 as u8) { if s[i+2+kl] == (93 as u8) { break } kl = kl + 1 }
          if s[i+2+kl] == (93 as u8) { if kl > 0 {
              w(fd, "<a class='cite' href='" as *u8); wc(fd, 35); w(fd, "ref-" as *u8)
              var q: i64 = 0
              while q < kl { wc(fd, s[i+2+q] as i64); q = q + 1 }
              w(fd, "'>[" as *u8)
              q = 0
              while q < kl { wc(fd, s[i+2+q] as i64); q = q + 1 }
              w(fd, "]</a>" as *u8)
              i = i + 2 + kl + 1
              emitted = 1
          } }
      } }
      // ESCAPE THE TAG DELIMITERS, AND DELIBERATELY NOT '&'. Note prose is PROSE, so a '<' in it must
      // render as TEXT: emitted raw it injects a live element into the published page. MEASURED
      // 2026-08-26 -- a browser note reading "an <img> is an INLINE_BLOCK" emitted a real empty <img>,
      // which took that page to a11y-issues=1 and made its whole-page asset claim UNPROVABLE, because
      // the verifier counted an img tag whose src it could never resolve. One funnel, so both
      // generators and every domain are fixed at once.
      // '&' IS LEFT ALONE ON PURPOSE: 48 notes across the fleet (corpus_complete=1) carry intentional
      // entities such as &mdash;, and escaping it would publish those literally on all 48. That is the
      // imprecision chosen here, named rather than left for the next reader to rediscover.
      if emitted == 0 {
          let c: i64 = s[i] as i64
          if c == 60 { w(fd, "&lt;" as *u8) } else { if c == 62 { w(fd, "&gt;" as *u8) } else { wc(fd, c) } }
          i = i + 1
      }
  }
  return 0
87}
88// ---- RIVAL-CLAIM PROVENANCE (2026-09-05) ----------------------------------------------------------------
89// Every Yes, Best or Part code in a rival column is a CLAIM about someone else's product, and until this
90// pass those codes were feature-observation reads with nothing behind them: the refs gate proves every
91// declared reference is cited and every mark resolves, but nothing asked whether a row that grades a rival
92// cites anything at all. Measured while evaluating DanceXR against charsim: eleven rows of rival codes typed
93// from a vendor read, zero marks, indistinguishable on the page from a row backed by a pinned mirror.
94// ONE classifier here, read by both generators (the refs_pass precedent), so the split cannot drift:
95//   RV_NONE     every rival code is 0 -- the row claims nothing about a rival
96//   RV_CITED    at least one rival code is non-zero AND the note carries a reference mark ( [@key] )
97//   RV_UNCITED  at least one rival code is non-zero and the note carries no mark: an observation read
98// A mark proves a mirror exists and is pinned (the refs gate's job); it does not prove the mirror SUPPORTS
99// the code -- that residual is stated on the page, never hidden behind the badge.
100const RV_NONE: i64 = 0
101const RV_CITED: i64 = 1
102const RV_UNCITED: i64 = 2
103func rv_code(s: *u8) -> i64 {
  var v: i64 = 0
  var any: i64 = 0
  var i: i64 = 0
  while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1 } } i = i + 1 }
  if any == 0 { return 0 }
  return v
110}
111func rv_note_cited(note: *u8) -> i64 {
  var i: i64 = 0
  while note[i] != (0 as u8) { if note[i] == (91 as u8) { if note[i+1] == (64 as u8) { return 1 } } i = i + 1 }
  return 0
115}
116func rv_class(note: *u8, rf: *i64, rr: i64, stride: i64, ncol: i64) -> i64 {
  var claims: i64 = 0
  var cj: i64 = 0
  while cj < ncol { if rv_code(rf[rr*stride + 4 + cj] as *u8) != 0 { claims = claims + 1 } cj = cj + 1 }
  if claims == 0 { return RV_NONE }
  if rv_note_cited(note) == 1 { return RV_CITED }
  return RV_UNCITED
123}
124// the SOTA dialect grades with letters: B = Best, Y = Yes, ~ = Part are positive claims about a rival; N and blank are not.
125// ONE claim rule per dialect, ONE note rule for both, so the two generators cannot split on what counts as a claim.
126func rv_grade_claims(g: *u8) -> i64 { if g[0] == (66 as u8) { return 1 } if g[0] == (89 as u8) { return 1 } if g[0] == (126 as u8) { return 1 } return 0 }
127func rv_class_grades(note: *u8, rf: *i64, rr: i64, stride: i64, first: i64, count: i64) -> i64 {
  var claims: i64 = 0
  var cj: i64 = 0
  while cj < count { if rv_grade_claims(rf[rr*stride + first + cj] as *u8) == 1 { claims = claims + 1 } cj = cj + 1 }
  if claims == 0 { return RV_NONE }
  if rv_note_cited(note) == 1 { return RV_CITED }
  return RV_UNCITED
134}
135func rv_name(c: i64) -> *u8 {
  if c == RV_CITED { return "CITED" as *u8 }
  if c == RV_UNCITED { return "UNCITED" as *u8 }
  return "NONE" as *u8
139}
140
141func rp_base(p: *u8) -> *u8 {
  var i: i64 = 0
  var last: i64 = 0
  while p[i] != (0 as u8) { if p[i] == (47 as u8) { last = i + 1 } i = i + 1 }
  return ((p as i64) + last) as *u8
146}
147func rp_publish(mir: *u8, dom: *u8) -> i64 {
  let src: *u8 = sys_mmap(700)
  var so: i64 = scopy(src, 0, "../" as *u8)
  so = scopy(src, so, mir); src[so] = 0 as u8
  let ln: *i64 = sys_mmap(16) as *i64
  let body: *u8 = sys_read_file(src, ln)
  if (body as i64) == 0 { return 0 }
  if ln[0] <= 0 { return 0 }
  let dir: *u8 = sys_mmap(700)
  var dd: i64 = scopy(dir, 0, "../sites/nishifamily/compare/" as *u8)
  dd = scopy(dir, dd, dom); dd = scopy(dir, dd, "/refs" as *u8); dir[dd] = 0 as u8
  sys_mkdir(dir, MODE_0755)
  let fin: *u8 = sys_mmap(700)
  var fo: i64 = scopy(fin, 0, dir); fo = scopy(fin, fo, "/" as *u8); fo = scopy(fin, fo, rp_base(mir)); fin[fo] = 0 as u8
  let tmp: *u8 = sys_mmap(700)
  var to2: i64 = scopy(tmp, 0, fin); to2 = scopy(tmp, to2, ".tmp" as *u8); tmp[to2] = 0 as u8
  let fd: i64 = sys_openat_wr(tmp, MODE_0644)
  if fd < 0 { sys_free_file(body, ln[0]); return 0 }
  let wrote: i64 = sys_write(fd, body, ln[0])
  sys_close(fd)
  sys_free_file(body, ln[0])
  if wrote != ln[0] { return 0 }
  if sys_renameat(tmp, fin) < 0 { return 0 }
  return 1
171}
172
173// ---- THE REDISTRIBUTION GATE, ADDED 2026-08-25 ----
174// rp_publish above copies a stored third-party mirror into the PUBLIC docroot, and rp_html then links
175// it as "read in our library". THAT IS REDISTRIBUTION OF SOMEONE ELSE'S WORK, and until today nothing
176// on that path asked whether the licence permits it -- on 80 of the 84 domains carrying a .refs file.
177// The .refs `class` field is a SOURCE-TYPE vocabulary (published-paper, vendor-doc, dataset...), never
178// a rights vocabulary, so it could not have answered the question even in principle.
179//
180// RIGHTS ARE DATA (knowledge/refs_redistribute.conf), never code: clearing a class costs a row edit
181// AFTER someone reads a licence, not a rebuild. The encoding matches nx_licgate_lib and nx_acquire_lib
182// (0 NO / 1 REVIEW / 2 YES) so the three rulers cannot disagree about direction.
183const RP_NO: i64 = 0
184const RP_REVIEW: i64 = 1
185const RP_YES: i64 = 2
186const RP_KEYCAP: i64 = 128
187
188// AN ABSENT ROW IS A REFUSAL, NOT A PERMISSION. lcf_int_of returns LCF_MISS (negative) for a missing
189// key, so a class nobody has adjudicated -- including a brand-new vocabulary word arriving in a future
190// .refs file -- can never show up as an accidental YES. Silence is never permission.
191func rp_may_republish(cls: *u8) -> i64 {
  let key: *u8 = sys_mmap(RP_KEYCAP)
  var k: i64 = scopy(key, 0, "class_" as *u8)
  k = scopy(key, k, cls); key[k] = 0 as u8
  let v: i64 = lcf_int_of("knowledge/refs_redistribute.conf" as *u8, key)
  if v < 0 { return RP_NO }
  if v > RP_YES { return RP_NO }
  return v
199}
200
201// THE GATE IN FRONT OF THE COPIER.
202// arm=0 (today) is MEASURE-ONLY: behaviour is byte-identical to before, so no published page changes
203// and no link disappears. That is the ONLY way to land this without silently stripping a link from 80
204// domains in a single regen. arm=1 ENFORCES, and flipping it is an OPERATOR decision about a public
205// surface -- the conf says so in its own words.
206// A missing or non-numeric arm row reads LCF_MISS (negative), which is not 1, so a corrupted conf
207// fails toward TODAY'S behaviour rather than toward an unannounced fleet-wide link removal. That is
208// deliberately the opposite default from rp_may_republish: an unreadable POLICY must not silently
209// change a public surface, while an unadjudicated CLASS must never grant a right.
210func rp_publish_gated(mir: *u8, dom: *u8, cls: *u8) -> i64 {
  let arm: i64 = lcf_int_of("knowledge/refs_redistribute.conf" as *u8, "arm" as *u8)
  if arm == 1 {
      if rp_may_republish(cls) != RP_YES { return 0 }
  }
  return rp_publish(mir, dom)
216}
217
218func rp_json(fld: *i64, count: i64) -> i64 {
  if count == 0 { wc(1, 44); wq(1); w(1, "refs" as *u8); wq(1); wc(1, 58); wc(1, 91) } else { wc(1, 44) }
  wc(1, 123)
  kv_s(1, "key" as *u8, fld[1] as *u8); wc(1, 44)
  kv_s(1, "cite" as *u8, fld[2] as *u8); wc(1, 44)
  kv_s(1, "url" as *u8, fld[3] as *u8); wc(1, 44)
  kv_s(1, "mirror" as *u8, fld[4] as *u8); wc(1, 44)
  kv_s(1, "pin" as *u8, fld[5] as *u8); wc(1, 44)
  kv_s(1, "accessed" as *u8, fld[6] as *u8); wc(1, 44)
  kv_s(1, "class" as *u8, fld[7] as *u8); wc(1, 44)
  kv_s(1, "grounds" as *u8, fld[8] as *u8)
  wc(1, 125)
  return 0
231}
232// ---- rp_html LIFTED INTO THE BASE 2026-08-23 (lane L). It was a byte-identical copy in BOTH generators
233// while refs_pass here called it as a dangling callback, so nothing else could import this lib (a gate
234// composing watch_pass failed to link on rp_html). One copy now; the only per-generator difference --
235// the section header prose -- travels as the hdr argument. ----
236func rp_html(fld: *i64, count: i64, dom: *u8, hdr: *u8) -> i64 {
  if count == 0 { w(1, hdr) }
  w(1, "<li id='ref-" as *u8); w(1, fld[1] as *u8); w(1, "'><span class='rkey'>[" as *u8); w(1, fld[1] as *u8); w(1, "]</span> " as *u8)
  w(1, fld[2] as *u8)
  w(1, " <span class='rlinks'><a href='" as *u8); w(1, fld[3] as *u8); w(1, "'>publisher</a>" as *u8)
  if streq(fld[4] as *u8, "-" as *u8) == 0 {
      if rp_publish_gated(fld[4] as *u8, dom, fld[7] as *u8) == 1 {
          w(1, " &middot; <a href='/compare/" as *u8); w(1, dom); w(1, "/refs/" as *u8); w(1, rp_base(fld[4] as *u8)); w(1, "'><b>read in our library</b></a> <code>" as *u8); w(1, fld[4] as *u8); w(1, "</code>" as *u8)
      } else {
          w(1, " &middot; mirror <code>" as *u8); w(1, fld[4] as *u8); w(1, "</code>" as *u8)
      }
  }
  if streq(fld[5] as *u8, "-" as *u8) == 0 { w(1, " &middot; pin <code>" as *u8); w(1, fld[5] as *u8); w(1, "</code>" as *u8) }
  if streq(fld[6] as *u8, "-" as *u8) == 0 { w(1, " &middot; accessed " as *u8); w(1, fld[6] as *u8) }
  w(1, " &middot; <span class='rgrade'>" as *u8); w(1, fld[7] as *u8); w(1, "</span></span>" as *u8)
  w(1, "<span class='rg'>Grounds: " as *u8); w(1, fld[8] as *u8); w(1, "</span></li>\n" as *u8)
  return 0
253}
254func refs_pass(path: *u8, bufz: *u8, capz: i64, mode: i64, dom: *u8, hdr: *u8) -> i64 {
  // SAME CAP, SAME REMOVAL (2026-08-28, debt 1787937117): the HTML refs render was called with the
  // 20479-byte plan buffer while the api.json render got a larger one, so on any board whose .refs
  // exceeds 20479 the page and the JSON disagreed about how many references exist -- 7 of them
  // measured, aesthetictwin worst at 37446. Size from the file, never from the caller.
  var fsz: i64 = 0
  let szfd: i64 = sys_openat_rd(path)
  if szfd < 0 { return 0 }
  fsz = sys_lseek(szfd, 0, 2)
  sys_close(szfd)
  if fsz <= 0 { return 0 }
  let buf: *u8 = sys_mmap(fsz + 1)
  let n: i64 = c_read(path, buf, fsz)
  if n <= 0 { return 0 }
  buf[n] = 0 as u8
  let fld: *i64 = sys_mmap(200) as *i64
  var count: i64 = 0
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (10 as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      var skip: i64 = 0
      if line[0] == (0 as u8) { skip = 1 }
      if line[0] == (35 as u8) { skip = 1 }
      if skip == 0 {
          let nf: i64 = splitpipe(line, fld, 12)
          if streq(fld[0] as *u8, "ref" as *u8) == 1 { if nf >= 9 {
              if mode == 1 { rp_html(fld, count, dom, hdr) }
              if mode == 2 { rp_json(fld, count) }
              count = count + 1
          } }
      }
  }
  if count > 0 { if mode == 1 { w(1, "</ol>\n" as *u8) } else { if mode == 2 { wc(1, 93) } } }
  return count
292}
293
294// ---- PLAN RENDERING, LIFTED INTO THE BASE 2026-08-22 (rung DG5) ------------------------------------
295// WHY THIS MOVED. plan_pass lived INSIDE nx_swcompare_matrix, so a domain whose page is emitted by the
296// SOTA generator had its .plan admitted as data and then NEVER RENDERED. Proven with full coverage
297// (matches=0, files=11, corpus_complete=1): the tool plane's own computed build order was invisible on
298// its own page, which is why nx_compare_rank looked like it had nothing to say there.
299// This follows the refs_pass precedent exactly -- ONE renderer in the base, BOTH generators call it --
300// so the two surfaces cannot drift into two different plan dialects. A second copy in the sota generator
301// would have been the duplicate-ruler defect, and it would have drifted on the first row kind either
302// generator added.
303// dstate and wlow come WITH it, not after it: NishiLang resolves identifiers in TEXTUAL ORDER, so a lib
304// function cannot call a helper defined later in the importing program. A partial lift does not compile.
305const SWL_DSTATE_CAP: i64 = 20480   // .debtstate sidecar read buffer. The NUL slot is DERIVED (CAP - 1)
                                  // rather than a second hand-counted constant beside it: two numbers
                                  // describing one buffer drift silently and the parser then reads the
                                  // wrong window while still compiling.
309
310// Print what the DEBT PLANE says about an id: open, eaten, or not filed in this scope at all. The state
311// file is `id<TAB>state` per line, refreshed by the regen before any page is emitted.
312func dstate(fd: i64, id: *u8, ds: *u8, dn: i64) -> i64 {
  if dn <= 0 { return 0 }
  var i: i64 = 0
  while i < dn {
      var e: i64 = i
      while e < dn { if ds[e] == (10 as u8) { break } e = e + 1 }
      var k: i64 = 0
      var ok: i64 = 1
      var stop: i64 = 0
      while stop == 0 {
          if i + k >= e { stop = 1 } else {
              let c: i64 = ds[i+k] as i64
              if c == 9 { stop = 1 } else {
                  let ic: i64 = id[k] as i64
                  if ic == 0 { ok = 0; stop = 1 } else { if ic != c { ok = 0; stop = 1 } else { k = k + 1 } }
              }
          }
      }
      if ok == 1 { if (id[k] as i64) == 0 {
          var s: i64 = i + k
          if s < e { if ds[s] == (9 as u8) { s = s + 1 } }
          w(fd, "<span class='pstate'>" as *u8)
          var q: i64 = s
          while q < e { wc(fd, ds[q] as i64); q = q + 1 }
          w(fd, "</span>" as *u8)
          return 1
      } }
      i = e + 1
  }
  // NOT "not filed". The lookup is scoped to THIS domain, so a debt filed under another scope is
  // absent here while being perfectly real in the plane. Saying "not filed" publishes a false negative
  // about a colleague's open work.
  w(fd, "<span class='pstate note'>not in this scope</span>" as *u8)
  return 0
346}
347// lowercase into a search-key attribute; single AND double quotes neutralised so they cannot close it.
348// wlow writes a lowercase SEARCH TOKEN into a single-quoted data- attribute. It already neutralised
349// both quote characters, which is why the gallery's data-t survived the caption apostrophe that
350// destroyed its sibling alt on the same tag -- HALF A LAW, APPLIED IN ONE ATTRIBUTE AND NOT THE OTHER.
351// It still passed the three markup-significant bytes through raw, so the same hole stood open for any
352// caption carrying an ampersand or an angle bracket. It now hands its result to the ONE attribute
353// escaper rather than carrying a second, weaker copy of that decision (2026-08-26).
354// The bare character codes are gone with it: they are the IA_ identities now.
355func wlow(fd: i64, s: *u8) -> i64 {
  let n: i64 = ia_slen(s)
  let low: *u8 = sys_mmap(n + 1)
  var i: i64 = 0
  while i < n {
      var c: i64 = s[i] as i64
      if c >= IA_UPPER_A { if c <= IA_UPPER_Z { c = c + IA_CASE_DELTA } }
      if c == IA_SQ { c = IA_SP }
      if c == IA_DQ { c = IA_SP }
      low[i] = c as u8
      i = i + 1
  }
  low[n] = 0 as u8
  let need: i64 = n * IA_MAX_EXPANSION + IA_SEP_AND_NUL
  let b: *u8 = sys_mmap(need)
  let tr: *i64 = sys_mmap(IA_SLOT_BYTES) as *i64
  ia_esc_attr(b, 0, low, need, tr)
  w(fd, b)
  return 0
374}
375// ---- LADDER TO SOTA helpers (2026-09-06), defined BEFORE plan_pass because NishiLang resolves in textual order ----
376// Both take SPANS precomputed before the walk: plan_pass's walk NUL-terminates lines and splitpipe zeroes pipes in place,
377// so a field re-parsed at render time on an already-walked line would read one truncated field. The bytes of the fields
378// themselves are untouched, so a span captured first is still readable when its consumer row arrives later in the file.
379// the month and freshness state of the sotabar row whose id is `id`, printed after the target's "dated by <id>"
380func swl_bar_state(fd: i64, buf: *u8, bidoff: *i64, bidlen: *i64, bym: *i64, bst: *i64, nb: i64, id: *u8) -> i64 {
  var i: i64 = 0
  while i < nb {
      if ld_span_is(buf, bidoff[i], bidlen[i], id) == 1 {
          w(fd, " = " as *u8)
          if bym[i] == BF_NONE { w(fd, "MALFORMED MONTH" as *u8) } else {
              let ymb: *u8 = sys_mmap(12)
              bf_ym_write(ymb, 0, bym[i])
              w(fd, ymb)
          }
          w(fd, " " as *u8); w(fd, bf_state_name(bst[i]))
          return 1
      }
      i = i + 1
  }
  w(fd, " = NO SUCH SOTABAR ROW, UNDATED" as *u8)
  return 0
397}
398// the deps field of the rung row whose id is `id` (what the rung stands on), or a dash
399func swl_rung_deps(fd: i64, buf: *u8, ridoff: *i64, ridlen: *i64, rdoff: *i64, rdlen: *i64, nr: i64, id: *u8) -> i64 {
  var i: i64 = 0
  while i < nr {
      if ld_span_is(buf, ridoff[i], ridlen[i], id) == 1 {
          if rdlen[i] > 0 { sys_write(fd, (buf as i64 + rdoff[i]) as *u8, rdlen[i]) } else { w(fd, "-" as *u8) }
          return 1
      }
      i = i + 1
  }
  w(fd, "-" as *u8)
  return 0
410}
411// A release date comes from a complete positive decimal epoch, never filtered digits.
412const SWL_RELEASE_I64_MAX: i64 = 9223372036854775807
413func swl_release_epoch(s: *u8) -> i64 {
  if (s as i64) == 0 { return 0 }
  if s[0] == (0 as u8) { return 0 }
  var v: i64 = 0
  var i: i64 = 0
  while s[i] != (0 as u8) {
      let c: i64 = s[i] as i64
      if c < 48 { return 0 }
      if c > 57 { return 0 }
      let d: i64 = c - 48
      if v > (SWL_RELEASE_I64_MAX - d) / 10 { return 0 }
      v = v * 10 + d
      i = i + 1
  }
  return v
428}
429// Equal timestamps preserve append-order corrections; older rows cannot replace newer ones.
430func swl_release_candidate(epoch: *u8, kind: *u8, entry: *u8, current: i64, now: i64) -> i64 {
  if (kind as i64) == 0 { return 0 }
  if (entry as i64) == 0 { return 0 }
  if entry[0] == (0 as u8) { return 0 }
  if streq(kind, "land" as *u8) != 1 { return 0 }
  let candidate: i64 = swl_release_epoch(epoch)
  if candidate <= 0 { return 0 }
  if candidate < current { return 0 }
  if candidate > now { return 0 }
  return candidate
440}
441
442// Explicit heading ownership: old render APIs delegate level 2; grouped consumers select level 3.
443// attrs is a caller-owned static HTML attribute literal, never source data.
444func sc_heading_level(level: i64) -> i64 { if level<1 { return 2 }; if level>6 { return 2 }; return level }
445func sc_heading_open(fd: i64, level: i64, attrs: *u8) -> i64 {
  w(fd, "<h" as *u8); wn(fd, sc_heading_level(level)); w(fd, attrs); w(fd, ">" as *u8); return 0
447}
448func sc_heading_close(fd: i64, level: i64) -> i64 {
  w(fd, "</h" as *u8); wn(fd, sc_heading_level(level)); w(fd, ">" as *u8); return 0
450}
451
452// Shared plan tables retain their semantics inside a named keyboard-scroll region.
453func sc_plan_table_open(fd: i64, label: *u8) -> i64 {
  w(fd, "<div class='table-scroll plan-table-scroll' role='region' tabindex='0' aria-label='" as *u8); w(fd, label); w(fd, "'><table class='pl'>" as *u8); return 0
455}
456func sc_plan_table_close(fd: i64) -> i64 { w(fd, "</tbody></table></div>" as *u8); return 0 }
457
458func plan_pass(path: *u8, bufz: *u8, capz: i64, phase: i64) -> i64 { return plan_pass_heading(path, bufz, capz, phase, 2) }
459// Only rendered rows change the active table; ignored metadata cannot split a table.
460func sc_plan_row_table(phase: i64, kind: *u8, fields: i64) -> i64 {
  if phase == 1 {
      if streq(kind, "biz" as *u8) == 1 { if fields >= 5 { return 3 } }
      if streq(kind, "ladder" as *u8) == 1 { if fields >= 6 { return 4 } }
      if streq(kind, "pos" as *u8) == 1 { if fields >= 2 { return 0 } }
      if streq(kind, "goal" as *u8) == 1 { if fields >= 2 { return 0 } }
      if streq(kind, "answer" as *u8) == 1 { if fields >= 4 { return 0 } }
      if streq(kind, "evidence_snapshot" as *u8) == 1 { if fields == 5 { return 0 } }
      if streq(kind, "bar" as *u8) == 1 { if fields >= 6 { return 0 } }
      if streq(kind, "unit" as *u8) == 1 { if fields >= 2 { return 0 } }
  }
  if phase == 2 {
      if streq(kind, "rung" as *u8) == 1 { if fields >= 8 { return 1 } }
      if streq(kind, "ms" as *u8) == 1 { if fields >= 5 { return 2 } }
      if streq(kind, "rungrole" as *u8) == 1 { if fields >= 5 { return 6 } }
      if streq(kind, "sotatarget" as *u8) == 1 { if fields >= 6 { return 0 } }
  }
  if phase == 3 {
      if streq(kind, "debt" as *u8) == 1 { if fields >= 5 { return 1 } }
      if streq(kind, "risk" as *u8) == 1 { if fields >= 4 { return 2 } }
      if streq(kind, "log" as *u8) == 1 { if fields >= 5 { return 5 } }
  }
  return 0 - 1
483}
484
485func plan_pass_heading(path: *u8, bufz: *u8, capz: i64, phase: i64, heading_level: i64) -> i64 {
  // THE 20479-BYTE CAP IS REMOVED, NOT RAISED (2026-08-28, debt 1787937117). The caller handed us a
  // guessed buffer whose cap silently short-read every .plan over 20479 bytes -- 8 of 93 measured,
  // browser worst at 63614 -- publishing a PREFIX whose lost rows are always the NEWEST, announced
  // nowhere. A ceiling that has to be guessed is a defect generator in both directions, and for a FILE
  // read there is no guess to make: size the buffer from the file itself (lseek END), like sys_read_file.
  // bufz/capz are kept only so every existing call site still compiles; they are deliberately unused.
  var fsz: i64 = 0
  let szfd: i64 = sys_openat_rd(path)
  if szfd < 0 { return 0 }
  fsz = sys_lseek(szfd, 0, 2)
  sys_close(szfd)
  if fsz <= 0 { return 0 }
  let buf: *u8 = sys_mmap(fsz + 1)
  let n: i64 = c_read(path, buf, fsz)
  if n <= 0 { return 0 }
  buf[n] = 0 as u8
  let fld: *i64 = sys_mmap(200) as *i64
  // the plane's view of each debt id, refreshed by the regen before this page was emitted.
  // Derived from the plan path so the two files cannot drift apart by name.
  let dsbuf: *u8 = sys_mmap(SWL_DSTATE_CAP)
  var dsn: i64 = 0
  if phase == 3 {
      let dsp: *u8 = sys_mmap(600)
      var dq: i64 = 0
      while path[dq] != (0 as u8) { dsp[dq] = path[dq]; dq = dq + 1 }
      var cut: i64 = dq
      while cut > 0 { if dsp[cut] == (46 as u8) { break } cut = cut - 1 }
      if cut > 0 { dq = cut }
      dq = scopy(dsp, dq, ".debtstate" as *u8)
      dsp[dq] = 0 as u8
      dsn = c_read(dsp, dsbuf, SWL_DSTATE_CAP - 1)
      if dsn < 0 { dsn = 0 }
  }
  var active_table: i64 = 0
  var log_heading_seen: i64 = 0
  var in_rung: i64 = 0
  var in_ms: i64 = 0
  var in_biz: i64 = 0
  var in_lad: i64 = 0
  var in_log: i64 = 0
  var release_epoch: i64 = 0
  let release_now: i64 = sys_now_realtime_sec()
  var release_entry: *u8 = 0 as *u8
  var release_rung: *u8 = 0 as *u8
  // LADDER TO SOTA (2026-09-06): classify the sotabar/barscan and sotatarget/rungrole rows ONCE, before the walk below
  // NUL-terminates lines and zeroes pipes in place, and bank the spans the render helpers read (see swl_bar_state).
  let bfnb: i64 = bf_count_rows(buf, n, BF_BAR_TAG)
  let bfoff: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let bfym: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let bfst: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let bfseen: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let bfc: *i64 = sys_mmap(BF_C_N * 8) as *i64
  let bfcur: i64 = bf_now_ym()
  bf_classify(buf, n, bfcur, bfoff, bfym, bfst, bfseen, bfc)
  let bidoff: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let bidlen: *i64 = sys_mmap((bfnb + 1) * 8) as *i64
  let sfo: *i64 = sys_mmap(8) as *i64
  var sbi: i64 = 0
  while sbi < bfnb { let sbe: i64 = bf_line_end(buf, n, bfoff[sbi]); bidlen[sbi] = bf_field(buf, bfoff[sbi], sbe, BF_F_BAR_ID, sfo); bidoff[sbi] = sfo[0]; sbi = sbi + 1 }
  let ldnt: i64 = bf_count_rows(buf, n, LD_TARGET_TAG)
  let ldnr: i64 = bf_count_rows(buf, n, LD_RUNG_TAG)
  let ldc: *i64 = sys_mmap(LD_N_COUNT * 8) as *i64
  let ldtoff: *i64 = sys_mmap((ldnt + 1) * 8) as *i64
  let ldtcls: *i64 = sys_mmap((ldnt + 1) * 8) as *i64
  let ldtst: *i64 = sys_mmap((ldnt + 1) * 8) as *i64
  let ldroff: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let ldrrole: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let ldrtgt: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let ldrst: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  ld_classify(buf, n, ldtoff, ldtcls, ldtst, ldroff, ldrrole, ldrtgt, ldrst, ldc)
  let ldv: i64 = ld_verdict(ldc)
  let ridoff: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let ridlen: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let rdoff: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  let rdlen: *i64 = sys_mmap((ldnr + 1) * 8) as *i64
  var sri: i64 = 0
  while sri < ldnr { let sre: i64 = bf_line_end(buf, n, ldroff[sri]); ridlen[sri] = bf_field(buf, ldroff[sri], sre, LD_F_R_ID, sfo); ridoff[sri] = sfo[0]; rdlen[sri] = bf_field(buf, ldroff[sri], sre, LD_F_R_DEPS, sfo); rdoff[sri] = sfo[0]; sri = sri + 1 }
  var in_tgt: i64 = 0
  var in_role: i64 = 0
  if phase == 1 { w(1, "<div class='exec-grid'>\n" as *u8) }
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (10 as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      var skip: i64 = 0
      if line[0] == (0 as u8) { skip = 1 }
      if line[0] == (35 as u8) { skip = 1 }
      if skip == 0 {
          let nf: i64 = splitpipe(line, fld, 20)
          let kind: *u8 = fld[0] as *u8
          let next_table: i64 = sc_plan_row_table(phase, kind, nf)
          if next_table >= 0 { if next_table != active_table {
              if active_table != 0 { sc_plan_table_close(1); w(1, "\n" as *u8) }
              in_rung = 0; in_ms = 0; in_biz = 0; in_lad = 0; in_log = 0; in_role = 0
              active_table = next_table
          } }
          if phase == 1 {
              if streq(kind, "log" as *u8) == 1 { if nf == 5 {
                  let candidate: i64 = swl_release_candidate(fld[1] as *u8, fld[3] as *u8, fld[4] as *u8, release_epoch, release_now)
                  if candidate > 0 {
                      release_epoch = candidate
                      release_rung = fld[2] as *u8
                      release_entry = fld[4] as *u8
                  }
              } }
              if streq(kind, "pos" as *u8) == 1 { if nf >= 2 { w(1, "<p class='lead'><b>Where we are.</b> " as *u8); wnote(1, fld[1] as *u8); w(1, "</p>\n" as *u8) } }
              if streq(kind, "goal" as *u8) == 1 { if nf >= 2 { w(1, "<p class='lead'><b>Where we need to go.</b> " as *u8); wnote(1, fld[1] as *u8); w(1, "</p>\n" as *u8) } }
              if streq(kind, "evidence_snapshot" as *u8) == 1 { if nf == 5 {
                  if streq(fld[1] as *u8,"1" as *u8)==1 { efs_render(fld[3] as *u8,fld[4] as *u8,heading_level,1) } else { w(1,"<p>Evidence snapshot unavailable: unsupported row version.</p>" as *u8) }
              } }
              if streq(kind, "answer" as *u8) == 1 { if nf >= 4 {
                  w(1, "<div class='answer'><b>" as *u8); w(1, fld[1] as *u8); w(1, ": " as *u8); w(1, fld[2] as *u8); w(1, ".</b> " as *u8); wnote(1, fld[3] as *u8); w(1, "</div>\n" as *u8) } }
              if streq(kind, "bar" as *u8) == 1 { if nf >= 6 {
                  w(1, "<p class='lead'><b>Research bar.</b> <a href='" as *u8); w(1, fld[2] as *u8); w(1, "'>" as *u8); w(1, fld[1] as *u8); w(1, "</a> is measured on " as *u8); w(1, fld[3] as *u8)
                  w(1, ". Theirs: <b>" as *u8); wnote(1, fld[4] as *u8); w(1, "</b>. Ours: " as *u8); wnote(1, fld[5] as *u8); w(1, ".</p>\n" as *u8) } }
              if streq(kind, "unit" as *u8) == 1 { if nf >= 2 { w(1, "<div class='meth'><b>The unit.</b> " as *u8); w(1, fld[1] as *u8); w(1, "</div>\n" as *u8) } }
              // biz|axis|position|figures|decision -- the BUSINESS CASE row kind (investment, opportunity
              // cost, market, competitive position, go-to-market, buy-vs-build). Rendered as one table in
              // the executive layer; biz rows belong LAST in a plan's phase-1 block so the table closes clean.
              if streq(kind, "biz" as *u8) == 1 { if nf >= 5 {
                  if in_biz == 0 { sc_heading_open(1, heading_level, "" as *u8); w(1, "Business case" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); sc_plan_table_open(1, "Business case" as *u8); w(1, "<thead><tr><th>Axis</th><th>Position</th><th>Figures</th><th>Decision</th></tr></thead><tbody>\n" as *u8); in_biz = 1 }
                  w(1, "<tr><td><b>" as *u8); w(1, fld[1] as *u8); w(1, "</b></td><td>" as *u8); wnote(1, fld[2] as *u8)
                  w(1, "</td><td class='ct'>" as *u8); wnote(1, fld[3] as *u8); w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8); w(1, "</td></tr>\n" as *u8) } }
              // ladder|level|best_in_class|have|grow|verdict -- the MARKET-ENTRY LADDER row kind (2026-08-24): per level
              // (hobbyist to research leader) what best-in-class looks like from the mirrored record, what the estate measures
              // today, what must grow, and the ENTER or HOLD or GROW-FIRST verdict. Rendered as one table after the business
              // case; ladder rows belong LAST in a plan's phase-1 block. The verdict is DATA here; ml_entry_verdict computes it.
              if streq(kind, "ladder" as *u8) == 1 { if nf >= 6 {
                  if in_lad == 0 { sc_heading_open(1, heading_level, "" as *u8); w(1, "Market-entry ladder" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); sc_plan_table_open(1, "Market-entry ladder" as *u8); w(1, "<thead><tr><th>Level</th><th>Best in class (Aug 2026)</th><th>What we have</th><th>What must grow</th><th>Verdict</th></tr></thead><tbody>\n" as *u8); in_lad = 1 }
                  w(1, "<tr><td><b>" as *u8); w(1, fld[1] as *u8); w(1, "</b></td><td>" as *u8); wnote(1, fld[2] as *u8)
                  w(1, "</td><td>" as *u8); wnote(1, fld[3] as *u8); w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8)
                  w(1, "</td><td class='ct'>" as *u8); wnote(1, fld[5] as *u8)
                  // the COMPUTED verdict beside the authored one (nx_market_ladder_lib, the one ruler the CLI uses)
                  if nf >= 7 { ml_render_computed_html(1, path, fld[6] as *u8) }
                  w(1, "</td></tr>\n" as *u8) } }
          }
          if phase == 3 {
              if streq(kind, "debt" as *u8) == 1 { if nf >= 5 {
                  if in_rung == 0 { sc_heading_open(1, heading_level, "" as *u8); w(1, "Debt register" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); sc_plan_table_open(1, "Debt register" as *u8); w(1, "<thead><tr><th>Id</th><th class='r'>Sev</th><th>What it is</th><th>Unblock</th></tr></thead><tbody>\n" as *u8); in_rung = 1 }
                  w(1, "<tr><td class='ct'>" as *u8); w(1, fld[1] as *u8)
                  // STATE COMES FROM THE PLANE, NEVER FROM THIS ROW. An id the plane does not know is a
                  // page-local note wearing the shape of a filed debt, and saying so is the honest move.
                  dstate(1, fld[1] as *u8, dsbuf, dsn)
                  w(1, "</td><td class='r'>" as *u8); w(1, fld[2] as *u8)
                  w(1, "</td><td>" as *u8); wnote(1, fld[3] as *u8); w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8); w(1, "</td></tr>\n" as *u8) } }
              if streq(kind, "risk" as *u8) == 1 { if nf >= 4 {
                  if in_ms == 0 { sc_heading_open(1, heading_level, "" as *u8); w(1, "Risk register" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); sc_plan_table_open(1, "Risk register" as *u8); w(1, "<thead><tr><th>Risk</th><th>Likelihood x impact</th><th>Mitigation</th></tr></thead><tbody>\n" as *u8); in_ms = 1 }
                  w(1, "<tr><td>" as *u8); wnote(1, fld[1] as *u8); w(1, "</td><td class='ct'>" as *u8); w(1, fld[2] as *u8)
                  w(1, "</td><td>" as *u8); wnote(1, fld[3] as *u8); w(1, "</td></tr>\n" as *u8) } }
              // log|<epoch>|<rung>|<kind>|<text> -- THE WORKED PLAN ON THE BOARD (operator 2026-09-02: a crash must
              // leave a ledger here, not a transcript to mine). Every leg appends what it measured, landed,
              // retracted, learned and left queued, per rung; rendered newest-last, each row linking to its rung.
              if streq(kind, "log" as *u8) == 1 { if nf >= 5 {
                  if in_log == 0 { if log_heading_seen == 0 { sc_heading_open(1, heading_level, " id='worklog'" as *u8); w(1, "Release history and work log" as *u8); sc_heading_close(1, heading_level); w(1, "\n<div class='meth'><b>The worked plan, on the board.</b> Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.</div>\n" as *u8); log_heading_seen = 1 } else { sc_heading_open(1, heading_level, "" as *u8); w(1, "Release history continued" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8) } sc_plan_table_open(1, "Release history and work log" as *u8); w(1, "<thead><tr><th>When</th><th>Rung</th><th>Kind</th><th>Entry</th></tr></thead><tbody>\n" as *u8); in_log = 1 }
                  let lep: *u8 = fld[1] as *u8
                  var lv: i64 = 0
                  var li: i64 = 0
                  while lep[li] != (0 as u8) { let lc: i64 = lep[li] as i64; if lc >= 48 { if lc <= 57 { lv = lv*10 + (lc-48) } } li = li + 1 }
                  let ldb: *u8 = sys_mmap(32)
                  let ldn: i64 = bd_ymd(lv, ldb, 0)
                  ldb[ldn] = 0 as u8
                  w(1, "<tr><td class='ct'>" as *u8); w(1, ldb); w(1, "</td><td class='ct'><a href='#" as *u8); wlow(1, fld[2] as *u8); w(1, "'>" as *u8); w(1, fld[2] as *u8)
                  w(1, "</a></td><td class='ct'>" as *u8); w(1, fld[3] as *u8); w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8); w(1, "</td></tr>\n" as *u8) } }
          }
          if phase == 2 {
              if streq(kind, "rung" as *u8) == 1 { if nf >= 8 {
                  if in_rung == 0 { sc_plan_table_open(1, "Capability roadmap" as *u8); w(1, "<thead><tr><th>Rung</th><th>Closes with</th><th>Definition of done (pre-declared)</th><th>Executor</th><th class='r'>Est.</th></tr></thead><tbody>\n" as *u8); in_rung = 1 }
                  w(1, "<tr id='" as *u8); wlow(1, fld[1] as *u8); w(1, "'><td><b>" as *u8); w(1, fld[2] as *u8); w(1, "</b> (" as *u8); w(1, fld[1] as *u8); w(1, ")" as *u8)
                  if streq(fld[7] as *u8, "-" as *u8) == 0 { w(1, "<br><span class='ct'>after " as *u8); w(1, fld[7] as *u8); w(1, "</span>" as *u8) }
                  w(1, "</td><td class='ct'>" as *u8); w(1, fld[3] as *u8); w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8)
                  w(1, "</td><td><span class='ex'>" as *u8); w(1, fld[5] as *u8); w(1, "</span></td><td class='r'>" as *u8); w(1, fld[6] as *u8); w(1, " u</td></tr>\n" as *u8) } }
              // LADDER TO SOTA (2026-09-06): the dated targets, judged by the bar-age ruler, then the rung-role table.
              // sotatarget and rungrole rows belong AFTER the rung and ms rows in a plan so the ladder renders beneath them.
              if streq(kind, "sotatarget" as *u8) == 1 { if nf >= 6 {
                  if in_tgt == 0 { sc_heading_open(1, heading_level, " id='ladder'" as *u8); w(1, "Ladder to SOTA" as *u8); sc_heading_close(1, heading_level); w(1, "\n<div class='meth'><b>Two dated targets, and every rung's role toward them.</b> Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.</div>\n" as *u8); in_tgt = 1 }
                  w(1, "<div class='answer'><b>" as *u8); w(1, fld[2] as *u8); w(1, " (" as *u8); w(1, fld[1] as *u8); w(1, "), dated by " as *u8); w(1, fld[3] as *u8)
                  swl_bar_state(1, buf, bidoff, bidlen, bfym, bfst, bfnb, fld[3] as *u8)
                  w(1, ".</b> " as *u8); wnote(1, fld[4] as *u8)
                  w(1, " <span class='ct'>ref " as *u8); w(1, fld[5] as *u8); w(1, "</span></div>\n" as *u8) } }
              if streq(kind, "rungrole" as *u8) == 1 { if nf >= 5 {
                  if in_tgt == 0 { sc_heading_open(1, heading_level, " id='ladder'" as *u8); w(1, "Ladder to SOTA" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); in_tgt = 1 }
                  if in_role == 0 { sc_plan_table_open(1, "Rung roles and prerequisites" as *u8); w(1, "<thead><tr><th>Rung</th><th>Role</th><th>Toward</th><th>Stands on</th><th>Why</th></tr></thead><tbody>\n" as *u8); in_role = 1 }
                  w(1, "<tr><td class='ct'><a href='#" as *u8); wlow(1, fld[1] as *u8); w(1, "'>" as *u8); w(1, fld[1] as *u8); w(1, "</a></td><td class='ct'>" as *u8); w(1, fld[2] as *u8); w(1, "</td><td class='ct'>" as *u8); w(1, fld[3] as *u8); w(1, "</td><td class='ct'>" as *u8)
                  swl_rung_deps(1, buf, ridoff, ridlen, rdoff, rdlen, ldnr, fld[1] as *u8)
                  w(1, "</td><td>" as *u8); wnote(1, fld[4] as *u8); w(1, "</td></tr>\n" as *u8) } }
              if streq(kind, "ms" as *u8) == 1 { if nf >= 5 {
                  if in_ms == 0 { sc_heading_open(1, heading_level, "" as *u8); w(1, "Milestones" as *u8); sc_heading_close(1, heading_level); w(1, "\n" as *u8); sc_plan_table_open(1, "Milestones" as *u8); w(1, "<thead><tr><th>Milestone</th><th>Rungs</th><th class='r'>Cumulative</th></tr></thead><tbody>\n" as *u8); in_ms = 1 }
                  w(1, "<tr><td><b>" as *u8); w(1, fld[1] as *u8); w(1, "</b> &middot; " as *u8); w(1, fld[2] as *u8); w(1, "</td><td class='ct'>" as *u8); w(1, fld[4] as *u8)
                  w(1, "</td><td class='r'>" as *u8); w(1, fld[3] as *u8); w(1, " u</td></tr>\n" as *u8) } }
          }
      }
  }
  if active_table != 0 { sc_plan_table_close(1); w(1, "\n" as *u8) }
  if phase == 1 {
      w(1, "<section class='meth' id='release-summary'>" as *u8); sc_heading_open(1, heading_level, "" as *u8); w(1, "Latest recorded release" as *u8); sc_heading_close(1, heading_level)
      if release_epoch > 0 {
          let date: *u8 = sys_mmap(32)
          let date_len: i64 = bd_ymd(release_epoch, date, 0)
          date[date_len] = 0 as u8
          w(1, "<p><b>" as *u8); w(1, date); w(1, "</b> &middot; " as *u8)
          wnote(1, release_rung); w(1, "</p><p>" as *u8); wnote(1, release_entry)
          w(1, "</p><p><a href='#worklog'>Release history and work log</a></p>" as *u8)
      } else {
          w(1, "<p>No valid dated release entry is recorded for this domain.</p>" as *u8)
      }
      w(1, "<p>Release entries describe recorded changes; they do not establish that every capability passed evaluation.</p></section>\n</div>\n" as *u8)
  }
  if phase == 2 {
      // THE TWO VERDICTS, FROM THE RULERS, ON EVERY PAGE WITH A PLAN (2026-09-06). A board that has not declared its
      // ladder is TOLD so on its own page: an undeclared target is exactly how a seat climbed toward a 2014 bar for a day.
      w(1, "<div class='meth' id='ladderverdict'><b>Ladder verdict.</b> " as *u8)
      if ldv == LD_EXIT_NOLADDER {
          w(1, "<b>NOT DECLARED.</b> This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down." as *u8)
      } else {
          w(1, "targets " as *u8); wn(1, ldc[LD_N_TARGETS]); w(1, " (best in class " as *u8); wn(1, ldc[LD_N_BIC]); w(1, ", frontier " as *u8); wn(1, ldc[LD_N_FRONTIER]); w(1, ", undated " as *u8); wn(1, ldc[LD_N_UNDATED])
          w(1, "); rungs " as *u8); wn(1, ldc[LD_N_RUNGS]); w(1, ", placed " as *u8); wn(1, ldc[LD_N_PLACED]); w(1, " (substrate " as *u8); wn(1, ldc[LD_N_SUBSTRATE]); w(1, ", arm " as *u8); wn(1, ldc[LD_N_ARM]); w(1, ", contender " as *u8); wn(1, ldc[LD_N_CONTENDER]); w(1, ", superseded " as *u8); wn(1, ldc[LD_N_SUPERSEDED]); w(1, "), unplaced " as *u8); wn(1, ldc[LD_N_UNPLACED]); w(1, "; verdict <b>" as *u8); w(1, ld_verdict_name(ldv)); w(1, "</b>" as *u8)
          if ldv == LD_EXIT_PARTIAL { w(1, " -- half-declared: the ranker refuses this board until every target is dated and every rung has a role" as *u8) }
      }
      w(1, " Bars: " as *u8); wn(1, bfc[BF_C_BARS]); w(1, " (fresh " as *u8); wn(1, bfc[BF_C_FRESH]); w(1, ", attested " as *u8); wn(1, bfc[BF_C_ATTESTED]); w(1, ", stale " as *u8); wn(1, bfc[BF_C_STALE]); w(1, ", unattested " as *u8); wn(1, bfc[BF_C_UNATTESTED]); w(1, "), verdict <b>" as *u8); w(1, bf_verdict_name(bf_verdict(bfc))); w(1, "</b> against the current month " as *u8)
      let cymb: *u8 = sys_mmap(12)
      bf_ym_write(cymb, 0, bfcur)
      w(1, cymb); w(1, ".</div>\n" as *u8)
  }
  return 1
713}
714// ---- WATCH CONTRACTS, MEASURED, FOR EVERY PAGE KIND (2026-08-23, lane L) ----
715// A sota-class page renders <dom>.sota (hand-graded cells) while the ranker reads <dom>.matrix, so a
716// sota domain that also carries a .matrix NEVER FLIPPED on the page when a watch symbol landed
717// (measured on /compare/lang: LN2 landed, the regen republished the page at an IDENTICAL byte size).
718// watch_pass renders the .matrix's symbol rows with their status MEASURED by the one ruler
719// (nx_symdecl_lib sd_declared) -- the same function the matrix generator, the ranker and the regen's
720// comparewatch plane use -- so the page, the plane and the ranker cannot disagree by construction.
721// Writes to fd (a gate captures it through a file), mode 1 = HTML section, mode 2 = JSON array value.
722// An absent .matrix writes NOTHING and returns 0 (a byte-identical emit for every domain without one).
723// Returns the number of symbol rows rendered; the partition it prints must sum to that number.
724const WP_ST_LANDED: i64 = 1
725const WP_ST_WATCHING: i64 = 2
726const WP_ST_PRESENT: i64 = 3
727const WP_ST_MISSING: i64 = 4
728const WP_ST_ABSENT: i64 = 5
729func wp_status_text(st: i64) -> *u8 {
  if st == WP_ST_LANDED { return "LANDED" as *u8 }
  if st == WP_ST_WATCHING { return "WATCHING" as *u8 }
  if st == WP_ST_PRESENT { return "PRESENT" as *u8 }
  if st == WP_ST_MISSING { return "MISSING" as *u8 }
  return "ABSENT" as *u8
735}
736func wp_status_class(st: i64) -> *u8 {
  if st == WP_ST_LANDED { return "me" as *u8 }
  if st == WP_ST_PRESENT { return "me" as *u8 }
  if st == WP_ST_WATCHING { return "pa" as *u8 }
  return "ab" as *u8
741}
742// classify ONE matrix row: organ + symbol field -> status. Measured, never read from the spelling.
743func wp_classify(organ: *u8, sym: *u8, rule_out: *i64) -> i64 {
  rule_out[0] = 0
  if streq(sym, "_ABSENT_" as *u8) == 1 { return WP_ST_ABSENT }
  if starts(sym, "_ABSENT_:" as *u8) == 1 {
      if sd_present(organ, (sym as i64 + 9) as *u8, rule_out) == 1 { return WP_ST_LANDED }
      return WP_ST_WATCHING
  }
  if sd_present(organ, sym, rule_out) == 1 { return WP_ST_PRESENT }
  return WP_ST_MISSING
752}
753func watch_pass(mpath: *u8, fd: i64, mode: i64) -> i64 {
  let ln: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(mpath, ln)
  if (b as i64) == 0 { return 0 }
  let n: i64 = ln[0]
  if n <= 0 { if mode == 2 { wc(fd, 91); wc(fd, 93) } return 0 }
  // field capacity derived from the widest row (pipes + 1), never a fixed count
  var maxf: i64 = 2
  var pc: i64 = 0
  var i: i64 = 0
  while i < n { if b[i] == (124 as u8) { pc = pc + 1 } if b[i] == (10 as u8) { if pc + 1 > maxf { maxf = pc + 1 } pc = 0 } i = i + 1 }
  if pc + 1 > maxf { maxf = pc + 1 }
  let fld: *i64 = sys_mmap((maxf + 1) * 8) as *i64
  let rl: *i64 = sys_mmap(16) as *i64
  var rows: i64 = 0
  var c_landed: i64 = 0
  var c_watching: i64 = 0
  var c_present: i64 = 0
  var c_missing: i64 = 0
  var c_absent: i64 = 0
  var opened: i64 = 0
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
      b[e] = 0 as u8
      let line: *u8 = (b as i64 + p) as *u8
      p = e + 1
      var skip: i64 = 0
      if line[0] == (0 as u8) { skip = 1 }
      if line[0] == (35 as u8) { skip = 1 }
      if line[0] == (64 as u8) { skip = 1 }
      if skip == 0 {
          let nf: i64 = splitpipe(line, fld, maxf)
          if nf >= 4 {
              let label: *u8 = fld[0] as *u8
              let organ: *u8 = fld[1] as *u8
              let sym: *u8 = fld[2] as *u8
              let note: *u8 = fld[nf - 1] as *u8
              if sym[0] != (0 as u8) {
                  let st: i64 = wp_classify(organ, sym, rl)
                  if st == WP_ST_LANDED { c_landed = c_landed + 1 }
                  if st == WP_ST_WATCHING { c_watching = c_watching + 1 }
                  if st == WP_ST_PRESENT { c_present = c_present + 1 }
                  if st == WP_ST_MISSING { c_missing = c_missing + 1 }
                  if st == WP_ST_ABSENT { c_absent = c_absent + 1 }
                  var symtext: *u8 = sym
                  if starts(sym, "_ABSENT_:" as *u8) == 1 { symtext = (sym as i64 + 9) as *u8 }
                  if mode == 1 {
                      if opened == 0 {
                          w(fd, "<h2 class='ghead' id='watch'>Watch contracts (measured)</h2>\n<div class='meth'><b>Not a claim, a measurement.</b> Each row names an organ and a symbol; the status is re-measured on every publish by the one ruler the ranker and the hive plane use, and the rule it applied is printed beside it: <b>decl</b> a top-level declaration in a NishiLang organ (a comment or a call site does not count), <b>jsdecl</b> a JS declaration form, <b>exists</b> the organ itself (the symbol is its name), <b>marker</b> a literal the organ carries, <b>data</b> a token in a data file. LANDED / PRESENT = measured present, WATCHING = the named contract is still open, MISSING = the row names something its organ does not carry, ABSENT = no contract named.</div>\n" as *u8); sc_plan_table_open(fd, "Watch contracts" as *u8); w(fd, "<thead><tr><th>Axis</th><th>Organ</th><th>Symbol</th><th>Status</th><th>Note</th></tr></thead><tbody>\n" as *u8)
                          opened = 1
                      }
                      w(fd, "<tr><td><b>" as *u8); w(fd, label); w(fd, "</b></td><td class='ct'>" as *u8); w(fd, organ)
                      w(fd, "</td><td class='ct'>" as *u8); w(fd, symtext); w(fd, "</td><td><span class='st " as *u8); w(fd, wp_status_class(st)); w(fd, "'>" as *u8); w(fd, wp_status_text(st))
                      w(fd, "</span>" as *u8)
                      if rl[0] > 0 { w(fd, " <span class='ct'>" as *u8); w(fd, sd_rule_name(rl[0])); w(fd, "</span>" as *u8) }
                      w(fd, "</td><td>" as *u8); wnote(fd, note); w(fd, "</td></tr>\n" as *u8)
                  }
                  if mode == 2 {
                      if opened == 0 { wc(fd, 91); opened = 1 } else { wc(fd, 44) }
                      wc(fd, 123)
                      kv_s(fd, "label" as *u8, label); wc(fd, 44)
                      kv_s(fd, "organ" as *u8, organ); wc(fd, 44)
                      kv_s(fd, "symbol" as *u8, symtext); wc(fd, 44)
                      kv_s(fd, "status" as *u8, wp_status_text(st)); wc(fd, 44)
                      kv_s(fd, "rule" as *u8, sd_rule_name(rl[0])); wc(fd, 44)
                      kv_s(fd, "note" as *u8, note)
                      wc(fd, 125)
                  }
                  rows = rows + 1
              }
          }
      }
  }
  if mode == 1 { if opened == 1 {
      sc_plan_table_close(fd); w(fd, "\n<p class='foot'>watch rows=" as *u8); wn(fd, rows)
      w(fd, " landed=" as *u8); wn(fd, c_landed); w(fd, " watching=" as *u8); wn(fd, c_watching)
      w(fd, " present=" as *u8); wn(fd, c_present); w(fd, " missing=" as *u8); wn(fd, c_missing)
      w(fd, " absent=" as *u8); wn(fd, c_absent); w(fd, " (partition sums)</p>\n" as *u8)
  } }
  if mode == 2 { if opened == 1 { wc(fd, 93) } else { wc(fd, 91); wc(fd, 93) } }
  sys_free_file(b, n)
  return rows
837}
838
839// ---- PERSON / PRODUCT / PLACE, MEASURED (operator 2026-08-24: "all our compares should have [UI analysis]
840// and august 2026 researched sota ... to tell us how to build a better site than our competitors ... person
841// via privacy and superior cx, product ... design and longevity and features, place ... ease of navigation
842// and ability to accomplish the desired task"). ONE renderer in the base, both generators call it -- the
843// refs_pass / watch_pass precedent. Reads knowledge/compare/<dom>.pppstate, the artefact nx_ppp_probe writes
844// after running ONE ruler on OUR live surface AND on every rival's live front door named in <dom>.ppp:
845//   ppp|<col>|<label>|<url>|<json>       last line = "# asof=... surfaces=N probed=K ruler=nx_ppp_probe"
846// The page prints per-axis permil AND the raw counts beside it, so the derivation can be argued with, and the
847// direction of the gap per rival is computed HERE from the numbers -- never typed by a seat. A domain with no
848// .pppstate prints a NAMED absence (the worklist: every compare carries this layer; a page not yet measured
849// says so in its own words). Self-contained scoped <style> so it renders in BOTH generators regardless of
850// their page CSS; colours reference the page theme vars with rgb() fallbacks. -1 = unobserved (scores zero
851// for that rule, never acquitted).
852const PL_MAXROWS: i64 = 32
853// first integer value of "<key>": at or after `from`; -999 = key absent (distinct from a real -1 unobserved)
854func pl_jint(buf: *u8, n: i64, from: i64, key: *u8) -> i64 {
  var klen: i64 = 0
  while key[klen] != (0 as u8) { klen = klen + 1 }
  var i: i64 = from
  var at: i64 = 0 - 1
  while i + klen <= n {
      var k: i64 = 0
      var m: i64 = 1
      while k < klen { if buf[i + k] != key[k] { m = 0; k = klen } else { k = k + 1 } }
      if m == 1 { at = i; i = n } else { i = i + 1 }
  }
  if at < 0 { return 0 - 999 }
  var j: i64 = at + klen
  var neg: i64 = 0
  if j < n { if buf[j] == (45 as u8) { neg = 1; j = j + 1 } }
  var v: i64 = 0
  var got: i64 = 0
  while j < n {
      let c: i64 = buf[j] as i64
      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); got = 1; j = j + 1 } else { j = n } } else { j = n }
  }
  if got == 0 { return 0 - 999 }
  if neg == 1 { return 0 - v }
  return v
878}
879// offset of the literal `name` inside buf, or 0 (name is chosen to be unique in the row json)
880func pl_off(buf: *u8, n: i64, name: *u8) -> i64 {
  var nl: i64 = 0
  while name[nl] != (0 as u8) { nl = nl + 1 }
  var i: i64 = 0
  while i + nl <= n {
      var k: i64 = 0
      var m: i64 = 1
      while k < nl { if buf[i + k] != name[k] { m = 0; k = nl } else { k = k + 1 } }
      if m == 1 { return i }
      i = i + 1
  }
  return 0
892}
893func pl_cell(fd: i64, v: i64) -> i64 {
  if v == 0 - 999 { w(fd, "<td class='ct'>-</td>" as *u8); return 0 }
  if v < 0 { w(fd, "<td class='ct'>unobs</td>" as *u8); return 0 }
  w(fd, "<td class='r'>" as *u8); wn(fd, v); w(fd, "</td>" as *u8)
  return 0
898}
899func ppp_pass(dom: *u8, fd: i64, mode: i64) -> i64 { return ppp_pass_heading(dom, fd, mode, 2) }
900func ppp_pass_heading(dom: *u8, fd: i64, mode: i64, heading_level: i64) -> i64 {
  let sp: *u8 = sys_mmap(600)
  var o: i64 = scopy(sp, 0, "knowledge/compare/" as *u8)
  o = scopy(sp, o, dom); o = scopy(sp, o, ".pppstate" as *u8); sp[o] = 0 as u8
  let ln: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(sp, ln)
  if (b as i64) == 0 {
      if mode == 2 { w(fd, "{\"measured\":false}" as *u8); return 0 }
      sc_heading_open(fd, heading_level, " class='ghead' id='ppp'" as *u8); w(fd, "Person &middot; product &middot; place &mdash; not yet measured for this domain" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n<div class='meth'><b>Every compare carries this layer.</b> Declare <code>knowledge/compare/" as *u8); w(fd, dom)
      w(fd, ".ppp</code> (rows <code>surface|nishi or c1..c4|label|url|connect</code> naming OUR live surface and each rival's front door), run <code>nx_ppp_probe domain " as *u8); w(fd, dom)
      w(fd, "</code>, and this section fills itself on the next beat: the same ruler on both sides &mdash; privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).</div>\n" as *u8)
      return 0
  }
  let n: i64 = ln[0]
  if n <= 0 { sys_free_file(b, n); if mode == 2 { w(fd, "{\"measured\":false}" as *u8) } return 0 }
  // the stamp is the LAST non-empty line; capture it BEFORE the parser NUL-splits anything
  var ls: i64 = n
  if ls > 0 { if b[ls - 1] == (10 as u8) { ls = ls - 1 } }
  while ls > 0 { if b[ls - 1] == (10 as u8) { break } ls = ls - 1 }
  let stamp: i64 = (b as i64) + ls
  var se: i64 = ls
  while se < n { if b[se] == (10 as u8) { break } se = se + 1 }
  b[se] = 0 as u8
  // collect data-row offsets (lines beginning 'p' = 'ppp|')
  let roff: *i64 = sys_mmap(PL_MAXROWS * 8) as *i64
  let rlen: *i64 = sys_mmap(PL_MAXROWS * 8) as *i64
  var rows: i64 = 0
  var p: i64 = 0
  while p < ls {
      var e: i64 = p
      while e < ls { if b[e] == (10 as u8) { break } e = e + 1 }
      if b[p] == (112 as u8) { if rows < PL_MAXROWS { roff[rows] = p; rlen[rows] = e - p; rows = rows + 1 } }
      p = e + 1
  }
  let fld: *i64 = sys_mmap(8 * 8) as *i64
  if mode == 2 {
      w(fd, "{\"stamp\":\"" as *u8); wj(fd, stamp as *u8); w(fd, "\",\"surfaces\":[" as *u8)
      var rj: i64 = 0
      var emitted: i64 = 0
      while rj < rows {
          b[roff[rj] + rlen[rj]] = 0 as u8
          let line: *u8 = (b as i64 + roff[rj]) as *u8
          let nf: i64 = splitpipe(line, fld, 5)
          if nf >= 5 {
              if emitted > 0 { wc(fd, 44) }
              w(fd, fld[4] as *u8)
              emitted = emitted + 1
          }
          rj = rj + 1
      }
      w(fd, "]}" as *u8)
      sys_free_file(b, n)
      return rows
  }
  // ---- mode 1: HTML ----
  w(fd, "<style>.pppsec{overflow-x:auto;margin:6px 0 2px}.pppt{border-collapse:collapse;width:100%;font-size:12.5px;min-width:760px}.pppt th{text-align:left;padding:8px 9px 8px 0;border-bottom:1px solid var(--fg,rgb(26,26,28));color:var(--mut,rgb(120,126,134));font-size:10px;letter-spacing:.06em;text-transform:uppercase;white-space:nowrap}.pppt td{border-bottom:1px solid var(--line,rgb(219,216,208));padding:9px 9px 9px 0;vertical-align:top;line-height:1.4}.pppt td.r{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}.pppt td.ct{font-family:var(--mono,ui-monospace,Consolas,monospace);font-size:11px;color:var(--mut,rgb(120,126,134))}.pppt tr.ours td{background:var(--tint,rgba(120,90,220,.06))}.pppt tr.ours td.ni b{color:var(--ac,rgb(88,64,180))}.pppt a{color:var(--ac,rgb(88,64,180));text-decoration:none}</style>\n" as *u8)
  sc_heading_open(fd, heading_level, " class='ghead' id='ppp'" as *u8); w(fd, "Person &middot; product &middot; place &mdash; the same ruler on our live surface and on theirs" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n" as *u8)
  w(fd, "<div class='meth'><b>Measured on both sides, from the bytes a first visitor receives.</b> <code>nx_ppp_probe</code> fetched every surface below over the sovereign TLS stack and scored three axes by declared rules, each a count against a published Aug-2026 bar. <b>Person</b> (privacy + CX): third-party asset/script hosts, the tracker classes The Markup's Blacklight tests for, consent-banner markers, <code>Set-Cookie</code> on the first consent-less response (the CNIL bar), the OWASP secure headers. <b>Product</b> (design + longevity): design-system hygiene (/12), computed WCAG 2.2 contrast over the page's real colour tokens, the static Core-Web-Vitals predictors (render-blocking css/js, unsized media &mdash; the source-visible causes of poor LCP/CLS), script count, dark-mode and reduced-motion queries, canonical URL. <b>Place</b> (findability + task): nav/main/footer landmarks, a skip link, on-site search, breadcrumb, exactly one h1, internal links, lang, viewport, title. Envelope: static HTML plus response headers, no render, no script execution &mdash; a client-rendered app is graded on what a no-JS first visitor receives, which is the progressive-enhancement bar itself. <b>unobs</b> = the probe could not see that sub-measure and scored it zero rather than acquit. Stamp: <code>" as *u8)
  w(fd, stamp as *u8); w(fd, "</code></div>\n" as *u8)
  w(fd, "<div class='pppsec'><table class='pppt'><thead><tr><th>Surface</th><th class='r'>Person</th><th class='r'>Product</th><th class='r'>Place</th><th class='r'>3p script hosts</th><th class='r'>trackers</th><th class='r'>set-cookie</th><th class='r'>sec hdr /5</th><th class='r'>design /12</th><th class='r'>contrast fails</th><th class='r'>blocking css+js</th><th class='r'>unsized img</th><th class='r'>scripts</th><th class='r'>KB</th><th>nav main skip search crumb</th></tr></thead><tbody>\n" as *u8)
  var ours_pe: i64 = 0 - 1
  var ours_pr: i64 = 0 - 1
  var ours_pl: i64 = 0 - 1
  var best_pe: i64 = 0 - 1
  var best_pr: i64 = 0 - 1
  var best_pl: i64 = 0 - 1
  var rr: i64 = 0
  while rr < rows {
      b[roff[rr] + rlen[rr]] = 0 as u8
      let line: *u8 = (b as i64 + roff[rr]) as *u8
      let nf: i64 = splitpipe(line, fld, 5)
      if nf >= 5 {
          let col: *u8 = fld[1] as *u8
          let label: *u8 = fld[2] as *u8
          let url: *u8 = fld[3] as *u8
          let js: *u8 = fld[4] as *u8
          var jn: i64 = 0
          while js[jn] != (0 as u8) { jn = jn + 1 }
          var ours: i64 = 0
          if streq(col, "nishi" as *u8) == 1 { ours = 1 }
          if ours == 1 { w(fd, "<tr class='ours'><td class='ni'><b>" as *u8) } else { w(fd, "<tr><td><b>" as *u8) }
          w(fd, label); w(fd, "</b><br><a href='" as *u8); w(fd, url); w(fd, "' rel='nofollow'><span class='ct'>" as *u8); w(fd, url); w(fd, "</span></a></td>" as *u8)
          let unreach: i64 = pl_jint(js, jn, 0, "\"unreachable\":" as *u8)
          if unreach != 0 - 999 {
              w(fd, "<td colspan='13'>UNREACHABLE (probe code " as *u8); wn(fd, unreach); w(fd, ") &mdash; no measurement, no score; re-run the probe rather than infer a number</td></tr>\n" as *u8)
          } else {
              let sp_pe: i64 = pl_off(js, jn, "\"person\":{" as *u8)
              let sp_pr: i64 = pl_off(js, jn, "\"product\":{" as *u8)
              let sp_pl: i64 = pl_off(js, jn, "\"place\":{" as *u8)
              let pe: i64 = pl_jint(js, jn, sp_pe, "\"score_permil\":" as *u8)
              let pr: i64 = pl_jint(js, jn, sp_pr, "\"score_permil\":" as *u8)
              let pl: i64 = pl_jint(js, jn, sp_pl, "\"score_permil\":" as *u8)
              if ours == 1 {
                  if pe > ours_pe { ours_pe = pe }
                  if pr > ours_pr { ours_pr = pr }
                  if pl > ours_pl { ours_pl = pl }
              } else {
                  if pe > best_pe { best_pe = pe }
                  if pr > best_pr { best_pr = pr }
                  if pl > best_pl { best_pl = pl }
              }
              pl_cell(fd, pe); pl_cell(fd, pr); pl_cell(fd, pl)
              pl_cell(fd, pl_jint(js, jn, sp_pe, "\"third_party_script_hosts\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pe, "\"tracker_hits\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pe, "\"set_cookie\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pe, "\"sec_headers\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pr, "\"design_hygiene\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pr, "\"contrast_fails\":" as *u8))
              let bc: i64 = pl_jint(js, jn, sp_pr, "\"blocking_css\":" as *u8)
              let bj: i64 = pl_jint(js, jn, sp_pr, "\"blocking_js\":" as *u8)
              if bc < 0 { pl_cell(fd, bc) } else { if bj < 0 { pl_cell(fd, bj) } else { pl_cell(fd, bc + bj) } }
              pl_cell(fd, pl_jint(js, jn, sp_pr, "\"unsized_media\":" as *u8))
              pl_cell(fd, pl_jint(js, jn, sp_pr, "\"script_tags\":" as *u8))
              let bytes: i64 = pl_jint(js, jn, 0, "\"bytes\":" as *u8)
              if bytes > 0 { w(fd, "<td class='r'>" as *u8); wn(fd, bytes / 1024); w(fd, "</td>" as *u8) } else { w(fd, "<td class='ct'>-</td>" as *u8) }
              w(fd, "<td class='r ct'>" as *u8)
              wn(fd, pl_jint(js, jn, sp_pl, "\"nav\":" as *u8)); wc(fd, 32); wn(fd, pl_jint(js, jn, sp_pl, "\"main\":" as *u8)); wc(fd, 32)
              wn(fd, pl_jint(js, jn, sp_pl, "\"skip_link\":" as *u8)); wc(fd, 32); wn(fd, pl_jint(js, jn, sp_pl, "\"site_search\":" as *u8)); wc(fd, 32)
              wn(fd, pl_jint(js, jn, sp_pl, "\"breadcrumb\":" as *u8)); w(fd, "</td></tr>\n" as *u8)
          }
      }
      rr = rr + 1
  }
  w(fd, "</tbody></table></div>\n" as *u8)
  // the direction of the gap, computed from the numbers above
  w(fd, "<div class='meth'><b>Where to beat them, from the numbers.</b> " as *u8)
  if ours_pe >= 0 { if best_pe >= 0 {
      w(fd, "PERSON ours " as *u8); wn(fd, ours_pe); w(fd, " vs best rival " as *u8); wn(fd, best_pe)
      if ours_pe > best_pe { w(fd, " &mdash; we lead; hold it (zero third-party hosts, zero trackers, headers 5/5 is the ceiling). " as *u8) } else { w(fd, " &mdash; behind: the higher-scoring rival shows which privacy rule we lose. " as *u8) }
  } }
  if ours_pr >= 0 { if best_pr >= 0 {
      w(fd, "PRODUCT ours " as *u8); wn(fd, ours_pr); w(fd, " vs best rival " as *u8); wn(fd, best_pr)
      if ours_pr > best_pr { w(fd, " &mdash; we lead on measurable hygiene; the perceptual premium is a judged rung, not this ruler. " as *u8) } else { w(fd, " &mdash; behind: design/12, contrast, blocking, unsized and scripts name the rule. " as *u8) }
  } }
  if ours_pl >= 0 { if best_pl >= 0 {
      w(fd, "PLACE ours " as *u8); wn(fd, ours_pl); w(fd, " vs best rival " as *u8); wn(fd, best_pl)
      if ours_pl > best_pl { w(fd, " &mdash; we lead on the findability floor; task completion by a real user is the next ruler. " as *u8) } else { w(fd, " &mdash; behind: nav main skip search crumb, in that order. " as *u8) }
  } }
  w(fd, "Re-measured by the beat; nothing here is typed by a seat.</div>\n" as *u8)
  sys_free_file(b, n)
  return rows
1041}
1042
1043// ============================================================================
1044// SC THEME PASS (2026-08-25) -- ONE palette, emitted from the estate's TOKEN SSOT
1045// (nx_brand_tokens), for BOTH domain generators. It is lifted HERE for the same
1046// reason plan_pass, dstate and wlow were lifted here: this module is the base class
1047// the two generators already share, so a palette that lives here CANNOT drift
1048// between them. Two hand-landed dark blocks in two files is the duplicate-ruler
1049// defect wearing a stylesheet.
1050//
1051// WHY IT EXISTS. Measured 2026-08-25 against the LIVE pages, not inherited:
1052// /compare/search scored theme-aware 0/2 and prefers-color-scheme occurred ZERO
1053// times in 79,499 bytes of matrix source. The dark PALETTE was already authored and
1054// already shipping as html[data-theme='dark'] -- it was simply unreachable from the
1055// operating system's own preference. ***A THEME THAT EXISTS BUT CANNOT BE REACHED
1056// WITHOUT HUNTING FOR A CHIP IS A CAPABILITY THE PAGE IS PAYING FOR AND NOT
1057// DELIVERING.*** Nothing here invents a palette, so no contrast pair moved: the dark
1058// values below are byte-identical to the literal they replace, which makes the dark
1059// rendering unchanged BY CONSTRUCTION rather than by inspection.
1060//
1061// ***THE DARK VALUES ARE DECLARED ONCE AND EMITTED TWICE.*** The same parsed rows go
1062// out under html[data-theme='dark'] (the chip) AND under the media query (the OS
1063// preference). Keeping two copies in step is exactly how a chip theme and an auto
1064// theme drift apart; here a drift is not merely unlikely, it is UNREPRESENTABLE --
1065// there is only one copy of the data, and it is re-SELECTED, never re-PARSED, so the
1066// SSOT keeps its 3-pipe field rule, its bt_ident_safe/bt_value_safe injection screens
1067// and its silent-skip semantics. A second brand parser here would be a second ruler.
1068//
1069// ***THE MEDIA BLOCK IS GUARDED :root:not([data-theme]) AND THAT GUARD IS LOAD-BEARING.***
1070// This page ships a three-way switcher (paper/ink/dark) whose sett() calls
1071// setAttribute('data-theme', n) for ALL THREE values -- paper INCLUDED -- and a boot
1072// script restores the stored choice before first paint. But PAPER IS THE BARE :root
1073// DEFAULT: there is no html[data-theme='paper'] rule to out-rank anything. So an
1074// UNGUARDED @media(prefers-color-scheme:dark){:root{...}} would carry EQUAL
1075// specificity to that default and sit LATER in the cascade, and would therefore
1076// repaint a user who had just explicitly chosen Paper on an OS-dark machine. Every
1077// explicit choice sets the attribute, so :not([data-theme]) makes all three chips win
1078// over the OS preference with ONE selector, while a visitor who has chosen nothing
1079// still gets their system preference. ***A DARK BLOCK ADDED WITHOUT FIRST ASKING
1080// WHETHER THE PAGE ALREADY HAS A THEME SWITCHER SILENTLY OVERRIDES AN EXPLICIT USER
1081// CHOICE -- AND FROM THE USER'S SIDE THAT IS INDISTINGUISHABLE FROM A BROKEN BUTTON.***
1082// nx_brand_tokens' bt_emit_dark_root_buf emits the UNGUARDED selector, which is
1083// CORRECT for a page with no switcher (nx_games_page). The difference is the switcher,
1084// not the SSOT, so the fix belongs at this call site and NOT in the shared emitter.
1085//
1086// BREAKPOINTS ARE THE ESTATE'S ONE LADDER, NOT A THIRD SET. 860/640 are taken from
1087// sites/nishifamily/nishi-ds.css section 5 RESPONSIVE -- the same two numbers
1088// nx_games_page adopted, for the same reason: a third ladder would be a duplicate
1089// ruler wearing a constant and nothing downstream could tell the two apart. They
1090// redefine TOKENS ONLY, never components: a token carries no paint, so a breakpoint
1091// cannot restyle anything the page did not already opt into by reading that token.
1092//
1093// MEMORY: the two scratch buffers are deliberately NOT munmap'd per call -- this is a
1094// one-shot page emitter that exits, and sc_theme_pass is called exactly once per page.
1095// Declared rather than left silent.
1096const SC_TOKCAP: i64 = 16384
1097const SC_BP_MD: i64 = 860
1098const SC_BP_SM: i64 = 640
1099
1100// The compare palette AS DATA. Light rows first, then the dark overrides. A token with
1101// NO dark row is theme-independent by construction -- that is why --nx-font-mono and
1102// the layout tokens carry none: a monospace stack and a wrap width are not chrome.
1103func sc_brand() -> *u8 {
  return "token|color|bg|rgb(243,241,236)\ntoken|color|fg|rgb(26,26,28)\ntoken|color|accent|rgb(88,64,180)\ntoken|color|panel|rgb(249,247,243)\ntoken|color|soft|rgb(236,233,226)\ntoken|color|tint|rgb(236,233,226)\ntoken|color|line|rgb(219,216,208)\ntoken|color|mut|rgb(92,96,104)\ntoken|color|faint|rgb(138,141,148)\ntoken|color|gk|rgb(60,64,72)\ntoken|color|goff|rgb(198,195,187)\ntoken|color|ghalf|rgb(122,126,134)\ntoken|color|codebg|rgb(229,226,218)\ntoken|color|ok|rgb(26,127,55)\ntoken|color|part|rgb(178,106,0)\ntoken|color|absent|rgb(179,38,30)\ntoken|color|exceed|rgb(130,80,223)\ntoken|font|mono|ui-monospace,Consolas,monospace\ntoken|layout|wrap|clamp(20rem,95vw,110rem)\ntoken|layout|gutter|clamp(14px,3vw,28px)\ntoken|layout|measure|66ch\ntoken|layout|capmin|27rem\ntoken|layout|capgap|clamp(10px,1.6vw,20px)\ntoken|layout|rail|13rem\ndark|color|bg|rgb(16,18,23)\ndark|color|fg|rgb(226,229,235)\ndark|color|accent|rgb(171,152,238)\ndark|color|panel|rgb(23,26,34)\ndark|color|soft|rgb(30,34,43)\ndark|color|tint|rgb(23,26,34)\ndark|color|line|rgb(43,47,56)\ndark|color|mut|rgb(139,146,158)\ndark|color|faint|rgb(100,107,119)\ndark|color|gk|rgb(168,175,186)\ndark|color|goff|rgb(58,63,73)\ndark|color|ghalf|rgb(120,127,138)\ndark|color|codebg|rgb(35,39,48)\ndark|color|ok|rgb(121,224,167)\ndark|color|part|rgb(255,166,120)\ndark|color|absent|rgb(118,130,154)\ndark|color|exceed|rgb(255,209,122)\n" as *u8
1105}
1106
1107// The SSOT's own dark wrapper, named once so its LENGTH is DERIVED and never
1108// hand-counted beside the literal -- a hand-counted length is a second copy of the
1109// string's shape and the two drift silently.
1110func sc_dark_open() -> *u8 { return "@media(prefers-color-scheme:dark){:root{\n" as *u8 }
1111func sc_dark_close() -> *u8 { return "}}\n" as *u8 }
1112
1113func sc_theme_pass(fd: i64) -> i64 {
  let bd: *u8 = sc_brand()
  let bn: i64 = bt_len(bd)
  let tb: *u8 = sys_mmap(SC_TOKCAP)
  // ---- light :root, straight from the SSOT ----
  let lw: i64 = bt_emit_root_buf(bd, bn, tb, SC_TOKCAP)
  if lw < 0 { w(2, "FATAL sc_theme_pass: brand parsed ZERO light tokens -- refusing to emit a page with no palette\n" as *u8); sys_exit(2); return 2 }
  // bt_app SATURATES at cap instead of failing, so an undersized buffer truncates the
  // palette mid-block and still returns a POSITIVE count. ***A CAP REACHED IN SILENCE
  // BECOMES A MEASUREMENT NOBODY KNOWS IS PARTIAL*** -- refuse at the boundary instead.
  if lw >= SC_TOKCAP - 1 { w(2, "FATAL sc_theme_pass: light block reached SC_TOKCAP -- this palette is TRUNCATED, not complete\n" as *u8); sys_exit(2); return 2 }
  sys_write(fd, tb, lw)
  // ---- page-local ALIASES over the SSOT names: one indirection, so a brand DATA edit
  // re-themes the whole page and every rule below keeps reading the short name it
  // always read. They are var() REFERENCES, not copies, so they resolve at use time --
  // which is why ONE alias block serves paper, ink, dark and the OS preference alike.
  w(fd, ":root{--bg:var(--nx-color-bg);--fg:var(--nx-color-fg);--ac:var(--nx-color-accent);--panel:var(--nx-color-panel);--soft:var(--nx-color-soft);--tint:var(--nx-color-tint);--line:var(--nx-color-line);--mut:var(--nx-color-mut);--faint:var(--nx-color-faint);--gk:var(--nx-color-gk);--goff:var(--nx-color-goff);--ghalf:var(--nx-color-ghalf);--codebg:var(--nx-color-codebg);--mono:var(--nx-font-mono);--y:var(--nx-color-ok);--p:var(--nx-color-part);--n:var(--nx-color-absent);--ex:var(--nx-color-exceed)}\n" as *u8)
  // ---- dark: ONE parse, TWO selectors ----
  let dw: i64 = bt_emit_dark_root_buf(bd, bn, tb, SC_TOKCAP)
  // bt_emit_dark_root_buf returns 0 (never negative) when the brand carries no dark
  // rows, so this guard is <= 0. A < 0 guard here would be a tooth that CANNOT FIRE.
  if dw <= 0 { w(2, "FATAL sc_theme_pass: brand carries NO dark override -- the page would ship theme-blind\n" as *u8); sys_exit(2); return 2 }
  if dw >= SC_TOKCAP - 1 { w(2, "FATAL sc_theme_pass: dark block reached SC_TOKCAP -- TRUNCATED, not complete\n" as *u8); sys_exit(2); return 2 }
  let op: *u8 = sc_dark_open()
  let ol: i64 = bt_len(op)
  let cl: i64 = bt_len(sc_dark_close())
  // The re-selection is only valid if the SSOT still emits the wrapper we expect. If it
  // ever changes, slicing past a stale prefix would emit a CORRUPT block that still
  // looks like CSS -- so verify the prefix and refuse loudly rather than guess.
  var gi: i64 = 0
  while gi < ol { if tb[gi] != op[gi] { w(2, "FATAL sc_theme_pass: nx_brand_tokens changed its dark wrapper -- re-selecting it would corrupt the block\n" as *u8); sys_exit(2); return 2 } gi = gi + 1 }
  let rs: i64 = ol
  let re: i64 = dw - cl
  if re <= rs { w(2, "FATAL sc_theme_pass: dark block carried no rows between its wrapper\n" as *u8); sys_exit(2); return 2 }
  let rb: *u8 = sys_mmap(SC_TOKCAP)
  var k: i64 = 0
  while rs + k < re { rb[k] = tb[rs + k]; k = k + 1 }
  w(fd, "html[data-theme='dark']{\n" as *u8)
  sys_write(fd, rb, k)
  w(fd, "}\n" as *u8)
  w(fd, "@media(prefers-color-scheme:dark){:root:not([data-theme]){\n" as *u8)
  sys_write(fd, rb, k)
  w(fd, "}}\n" as *u8)
  // ---- breakpoints: TOKENS ONLY, on the estate's one ladder ----
  w(fd, "@media (max-width:" as *u8); wn(fd, SC_BP_MD); w(fd, "px){:root{--nx-layout-gutter:clamp(12px,3.6vw,18px)}}\n" as *u8)
  w(fd, "@media (max-width:" as *u8); wn(fd, SC_BP_SM); w(fd, "px){:root{--nx-layout-wrap:100%;--nx-layout-gutter:12px}}\n" as *u8)
  return 0
1160}
1161
1162// ---- sc_layout_pass: THE ONE LAYOUT EMITTER FOR EVERY COMPARE PAGE (2026-08-31) ----
1163// WHY THIS EXISTS. The body rule was hand-copied into SEVEN generators and had already drifted to
1164// SIX different page widths (960/980/1000/1040/1080/1180) -- the duplicate-ruler defect living in
1165// emitted CSS, where nothing compares the copies. Worse, the two layout TOKENS the SSOT publishes
1166// (--nx-layout-wrap/--nx-layout-gutter) were DEFINED on every page and REFERENCED by none of the
1167// sota-class ones: they hardcoded max-width:980px and a second clamp() straight over the top.
1168// ***A TOKEN DEFINED AND NEVER READ IS NOT A DESIGN SYSTEM, IT IS DEAD BYTES THAT LOOK LIKE ONE***
1169// -- and the page it governed rendered as one narrow column down the middle of a 1920px display.
1170//
1171// FULL CANVAS WITHOUT UNREADABLE PROSE. These are two different width budgets and the fix is to stop
1172// spending one on the other. The PAGE takes a fluid clamp (95vw, capped) so the LAYOUT uses the
1173// display; PROSE keeps its own measure cap (--nx-layout-measure, 66ch) applied to the text element
1174// itself, never to its container. Surplus width therefore cannot lengthen a line -- it has nowhere
1175// to go except into more capability cards side by side, which is more information on screen rather
1176// than a 200-character sentence.
1177//
1178// WHY SC_CAP_SPLIT IS A CONST AND NOT A TOKEN. Every other layout number here is a --nx-layout-*
1179// token, per rule 11. This one CANNOT be: a CSS container/media query CONDITION does not accept
1180// var(), so the threshold must reach the stylesheet as a literal. A named const emitted through wn()
1181// is the same guarantee by the only mechanism CSS allows -- it is not an exception to the rule, it is
1182// the rule honoured where var() is structurally unavailable. 496px is where a card can seat the
1183// 13rem rail beside a main column still wider than the rail; below it the card stacks.
1184//
1185// CONTAINER QUERY, NOT A BREAKPOINT, FOR THE CARD. The same .cap renders one-per-row on a phone and
1186// three-across on a desktop, so its reflow depends on ITS OWN width, not the window's. @container is
1187// Baseline Widely Available (2025-08-14). The container-name is declared explicitly and queried by
1188// name: an unresolvable container silently falls back to small-viewport units rather than erroring,
1189// so the anonymous form would fail as a confident wrong answer.
1190const SC_CAP_SPLIT: i64 = 496
1191// Shared production sections preserve all domain detail and existing deep links.
1192func sc_production_open(fd: i64, id: *u8, title: *u8, purpose: *u8) -> i64 {
  w(fd, "<section class='production-section' aria-labelledby='" as *u8); w(fd, id); w(fd, "'>\n<h2 class='production-title' id='" as *u8); w(fd, id); w(fd, "'>" as *u8); w(fd, title); w(fd, "</h2>\n<p class='production-purpose'>" as *u8); w(fd, purpose); w(fd, "</p>\n<div class='production-detail'>\n" as *u8)
  return 0
1195}
1196func sc_production_close(fd: i64) -> i64 { w(fd, "</div></section>\n" as *u8); return 0 }
1197
1198func sc_layout_pass(fd: i64) -> i64 {
  w(fd, ".production-section{margin-block:3em;border-top:1px solid var(--line);padding-top:1.5em}.production-title{font-size:clamp(1.6rem,3vw,2.5rem);line-height:1.15;letter-spacing:-.025em;margin:0 0 .5em;scroll-margin-top:1em}.production-purpose{max-width:var(--nx-layout-measure);color:var(--mut);margin:0 0 2em}.production-detail{min-width:0}.production-detail h3{font-size:1.25rem;margin-top:2em}.production-detail h4{font-size:1.1rem}.production-nav{display:flex;flex-wrap:wrap;gap:.5em;padding:1em 0;border-block:1px solid var(--line);margin:2em 0}.production-nav a{display:block;padding:.6em .9em;text-decoration:none;border:1px solid var(--line);border-radius:.4em}.production-nav a:hover,.production-nav a:focus-visible{background:var(--panel);text-decoration:underline}.production-detail>*{min-width:0;max-width:100%}\n" as *u8)
  // page shell -- reads the SSOT tokens, so a brand DATA edit re-widths every compare page at once
  w(fd, "*{box-sizing:border-box}html{scrollbar-gutter:stable}\n" as *u8)
  w(fd, "body{background:var(--bg);font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:var(--nx-layout-wrap);margin:0 auto;padding:0 var(--nx-layout-gutter) 6vh;color:var(--fg);line-height:1.6;font-size:1rem}\n" as *u8)
  // min-width:0 defeats the min-content floor that grid/flex children carry by default. Without it a
  // single wide table forces every ancestor wider than its track and THE PAGE scrolls sideways --
  // the overflow lands on the document, which is the one place it must never land.
  w(fd, "main{min-width:0}main>*{min-width:0;max-width:100%}table{max-width:100%}\n" as *u8)
  // long unbroken identifiers (organ names, hashes, paths) are the only real width bombs on these
  // pages; break them where they occur instead of letting them set the table's minimum width
  w(fd, ".pl .ct,.ev code,.rlinks code,.watch{overflow-wrap:anywhere}\n" as *u8)
  // ---- PROSE MEASURE: ONE cap for the prose blocks BOTH archetypes emit ----
  // THE REGRESSION THIS FUNCTION CAUSED, AND WHY THE FIX LANDS HERE. Widening body from a fixed 980px
  // to a fluid clamp is right for the LAYOUT and wrong for PROSE unless the prose carries its own cap.
  // Matrix learned that on 2026-08-25 and capped .meth/.lead/.answer/.verdict at 72ch. Sota never
  // received it: measured over the whole corpus, 72ch occurs 5 times in the estate and ALL FIVE are in
  // nx_swcompare_matrix (coverage_complete=1 corpus_complete=1 over 23,407 files). So sota's .meth --
  // the ~1,100-character "How this is scored" block, the FIRST prose a reader meets -- went from
  // inheriting 980px (~130 characters a line) to inheriting up to 1760px (~240), roughly 3x the WCAG
  // 1.4.8 (AAA) 80-character ceiling. ***A FIX THAT LIVES IN ONE ORGAN AND NOT ITS SIBLING IS HALF A
  // FIX***, and widening the canvas converted this one from latent to acute.
  //
  // WHY THE TOKEN AND NOT A SECOND 72ch. --nx-layout-measure is already the SSOT's declared prose
  // measure and is already read by .cap-note. Hard-coding 72ch a second time -- in the SHARED lib, no
  // less -- is the duplicate-ruler defect this extraction exists to remove, and nothing downstream
  // could tell the two copies apart. It does NOT overrule matrix: matrix emits its own .meth/.verdict
  // rules AFTER this one at equal specificity, so matrix still renders at 72ch and its emitted bytes
  // are unchanged. Only sota, which carried NO cap at all, changes. .lead and .answer are deliberately
  // NOT here -- they are matrix-only classes already carrying their own 72ch, so listing them would
  // add a second ruler for a page that already has one.
  w(fd, ".lead,.answer,.meth,.verdict{max-width:var(--nx-layout-measure);text-wrap:pretty}\n" as *u8)
  w(fd, ".exec-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,var(--nx-layout-capmin)),1fr));gap:var(--nx-layout-capgap);align-items:start;margin:var(--nx-layout-capgap) 0}.exec-grid>*{min-width:0;overflow-wrap:anywhere}.exec-grid>.lead,.exec-grid>.answer,.exec-grid>.meth{max-width:min(100%,var(--nx-layout-measure));margin:0}.exec-grid>h2,.exec-grid>h3,.exec-grid>table{grid-column:1/-1}.table-scroll{max-width:100%;overflow-x:auto;overscroll-behavior-inline:contain}.table-scroll>table{max-width:none;min-width:100%;width:max-content}.table-scroll th,.table-scroll td{white-space:nowrap}.table-scroll th:first-child,.table-scroll td:first-child{white-space:normal;width:var(--nx-layout-capmin);min-width:min(100vw - 2 * var(--nx-layout-gutter),var(--nx-layout-capmin));max-width:var(--nx-layout-capmin)}.table-scroll:focus-visible{outline:3px solid var(--ac);outline-offset:2px}\n" as *u8)
  // ---- the capability board: a responsive multi-column grid ----
  // auto-FILL, never auto-fit: auto-fit collapses the empty tracks and stretches a lone card across
  // the whole canvas, which re-creates at component scale the exact single-wide-column defect this
  // function exists to remove. min(100%,...) inside minmax is load-bearing: the auto-repeat count is
  // computed from the track MINIMUM, so a bare minmax(27rem,1fr) overflows any container narrower
  // than 27rem instead of dropping to one column.
  w(fd, ".caps{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,var(--nx-layout-capmin)),1fr));gap:var(--nx-layout-capgap);align-items:start;margin:6px 0}\n" as *u8)
  // the category headings are emitted INSIDE .caps, so they are grid items too and must span the row
  w(fd, ".caps>.ghead{grid-column:1/-1}\n" as *u8)
  // THE CARD IS SCOPED .caps>.cap, NOT BARE .cap, FOR THE SAME REASON .ghead ABOVE IS. "cap" is an
  // overloaded name in this estate and a bare rule in a SHARED lib claims it globally. Measured over
  // the whole corpus (coverage_complete=1 corpus_complete=1, 23,407 files) there are four other
  // holders: nx_swcompare_crm:64 and nx_swcompare_sending:65 both emit <td class='cap'> inside a <tr>,
  // and _hdl_build/nx_rewards:175 emits <span class='cap'> -- none of them a child of .caps, so the
  // child combinator excludes all three BY CONSTRUCTION. That matters because the roadmap is to
  // convert those generators onto this emitter, and display:grid landing on a <td> overrides
  // display:table-cell and destroys the table. Scoping costs 6 bytes and removes the trap before
  // anyone can walk into it.
  //
  // ***THIS IS NOT A COMPLETE FENCE AND MUST NOT BE READ AS ONE.*** The same census found a FIFTH
  // holder that the child combinator does NOT exclude: nx_compare_unified:281 emits
  // <div class='caps'> with <span class='cap on'> as its DIRECT CHILDREN, so .caps>.cap matches its
  // chip row exactly. It is harmless today -- nx_compare_unified does not call sc_layout_pass (the
  // four callers, RE-CENSUSED 2026-08-31 at coverage_complete=1 corpus_complete=1 over 23,407 files,
  // are nx_swcompare_sota, nx_swcompare_matrix, nx_swcompare_hub and nx_swcompare_watch_gate -- an
  // earlier revision of this comment said THREE and omitted hub. LINE NUMBERS ARE DELIBERATELY NOT
  // CITED HERE: hub's call site moved 729 -> 863 while this comment was being written, so a line
  // citation would rot faster than the fact it carries -- re-derive it with a grep for the symbol.
  // That undercount is load-bearing, not cosmetic: this enumeration IS the whole basis for calling the
  // collision harmless, so a fence that miscounts its own callers asserts a gap it never measured) -- but
  // whoever converts nx_compare_unified inherits a live collision, and a chip is not a card. Naming
  // the residual here rather than in a report nobody re-reads: a count without a worklist is not
  // actionable, and a fence published as "done" is worse than one published with its gap.
  w(fd, ".caps>.cap{container-type:inline-size;container-name:nxcap;display:grid;grid-template-columns:minmax(0,1fr) minmax(0,var(--nx-layout-rail));gap:6px 18px;padding:14px 16px;border:1px solid var(--line);border-radius:14px;background:var(--panel);align-items:start;min-width:0}\n" as *u8)
  w(fd, ".caps>.cap>.capmain,.caps>.cap>.capside{grid-column:1/-1}.capmain{min-width:0}.cap-note{max-width:var(--nx-layout-measure);text-wrap:pretty}\n" as *u8)
  w(fd, ".capside{display:flex;flex-direction:row;flex-wrap:wrap;align-items:center;gap:8px}.rw{max-width:100%}\n" as *u8)
  w(fd, "@container nxcap (min-width:" as *u8); wn(fd, SC_CAP_SPLIT); w(fd, "px){.caps>.cap>.capmain{grid-column:1;grid-row:1}.caps>.cap>.capside{grid-column:2;grid-row:1;flex-direction:column;align-items:flex-end}.caps>.cap .rw{justify-content:flex-end;max-width:var(--nx-layout-rail)}}\n" as *u8)
  w(fd, ".production-detail{overflow-wrap:anywhere}.lead,.answer,.meth,.verdict{overflow-wrap:anywhere}.production-detail .legend .m{display:inline-block;max-width:100%;white-space:normal}.plan-table-scroll>table{width:100%;min-width:var(--nx-layout-measure);max-width:none}.plan-table-scroll th,.plan-table-scroll td{white-space:normal;overflow-wrap:anywhere}.plan-table-scroll th:first-child,.plan-table-scroll td:first-child{width:auto;min-width:0;max-width:none}.exec-grid>.plan-table-scroll{grid-column:1/-1}.plan-table-scroll th,.plan-table-scroll td.ct{overflow-wrap:normal}.plan-table-scroll th{white-space:nowrap}" as *u8)
  sg_css(fd)
  return 0
1271}
1272
1273// ---- THE EVIDENCE PROFILE AS MACHINE-READABLE DATA (2026-08-31, frontier F1208) -------------------
1274// ONE RENDERER IN THE BASE, BOTH GENERATORS CALL IT -- the refs_pass / plan_pass precedent exactly. The
1275// HTML band (ev_pass, in nx_swcompare_matrix) and this JSON projection read THE SAME stamp through THE
1276// SAME reader, nx_evprofile_lib, so a board page and its api.json cannot disagree about that domain's
1277// gaps: there is one artifact and one parser, and this function only PROJECTS what evp_parse already
1278// read. THE GENERATOR ADDS A READER, NEVER A MEASUREMENT -- every field below is already materialised
1279// verbatim on knowledge/status/evstamp_<domain>.verdict by nx_swcompare_evidence.
1280//
1281// ABSTAIN, NEVER ACQUIT -- AND HERE THE ABSTAIN PATH IS THE COMMON PATH. 92 of the 95 live stamps are
1282// v1 (measured 2026-08-31), so the branch that emits NO NUMBERS is the one nearly every board takes,
1283// and it is therefore the one that has to be right: a v1 stamp carries none of the profile keys,
1284// evp_parse leaves every slot -1, and writing a 0 there would publish a gapless board for a domain
1285// nobody ever measured. AN ALWAYS-ZERO FIELD READS AS EVIDENCE.
1286// The evidence key is emitted on EVERY path, including the abstentions. An ABSENT key is
1287// indistinguishable from an emitter that never shipped, so the abstention is published as a VALUE --
1288// status UNKNOWN / UNSTAMPED / AMBIGUOUS -- and never as a silence.
1289//
1290// NO SCALAR GRADE, DELIBERATELY. Counts WITH their denominators, the partition sums, and the list of
1291// gap classes that FIRE. A stored scalar is a field a seat can edit; a counted partition is not, and
1292// any consumer can recompute whatever ranking it wants from these numbers at read time.
1293//
1294// NO PATH IS BUILT HERE. evp_load composes ep_artifact_path, so this behaves identically whether the
1295// generator was launched from the estate root or -- as nx_compare_regen launches it -- from buildroot,
1296// whose knowledge/status holds ZERO evstamp files. A bare relative read there would confidently render
1297// no-evidence for all 96 domains.
1298func evj_class(fired: i64, name: *u8, n: *i64) -> i64 {
  if fired != 1 { return 0 }
  if n[0] > 0 { wc(1, 44) }
  wq(1); wj(1, name); wq(1)
  n[0] = n[0] + 1
  return 1
1304}
1305
1306func evj_pass(dom: *u8) -> i64 {
  let buf: *u8 = sys_mmap(EVP_STAMP_CAP)
  let pathout: *u8 = sys_mmap(EVP_PATH_CAP)
  let flags: *i64 = sys_mmap(8 * EVP_NFLAG) as *i64
  let n: i64 = evp_load(dom, buf, EVP_STAMP_CAP, pathout, flags)
  wc(1, 44); wq(1); w(1, "evidence" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_s(1, "producer" as *u8, "nx_swcompare_evidence" as *u8); wc(1, 44)
  kv_s(1, "reader" as *u8, "nx_evprofile_lib" as *u8); wc(1, 44)
  // Two different files answering to one name is REFUSED, not silently decided: ep_open_rd probes the
  // caller CWD first on purpose, so a stray copy beside the generator would win, and win silently.
  if n == EVP_RC_AMBIGUOUS {
      kv_s(1, "evidence_status" as *u8, "AMBIGUOUS" as *u8); wc(1, 44)
      kv_s(1, "source" as *u8, pathout); wc(1, 44)
      kv_s(1, "note" as *u8, "two different files answer to one stamp name -- one under the generator working directory, one at the estate root, and their bytes differ. No reader may pick one, so no numbers are published." as *u8)
      wc(1, 125)
      return 0
  }
  if n < 0 {
      kv_s(1, "evidence_status" as *u8, "UNSTAMPED" as *u8); wc(1, 44)
      kv_s(1, "note" as *u8, "no evidence stamp exists for this domain yet: run nx_swcompare_evidence on it and this object fills itself on the next beat. Not one numeric field is emitted, deliberately -- a zero-filled profile reads as a board with no gaps, which is the one wrong answer nobody would question." as *u8)
      wc(1, 125)
      return 0
  }
  let f: *i64 = sys_mmap(8 * EVP_NF) as *i64
  evp_parse(buf, n, f)
  kv_s(1, "source" as *u8, pathout); wc(1, 44)
  kv_n(1, "stamp_version" as *u8, f[EVP_F_V]); wc(1, 44)
  kv_n(1, "stamp_read_capped" as *u8, flags[EVP_FL_BRIM]); wc(1, 44)
  // THE VERSION IS DERIVED FROM THE WIRE, NEVER DECLARED ON IT: a v1 stamp simply has no profile keys.
  if f[EVP_F_V] < 2 {
      kv_s(1, "evidence_status" as *u8, "UNKNOWN" as *u8); wc(1, 44)
      kv_s(1, "note" as *u8, "this stamp predates the gap profile and carries none of its keys, so the reader abstains rather than acquit. UNKNOWN IS NOT ZERO. Re-stamp with nx_swcompare_evidence on this domain and the counts below appear." as *u8)
      wc(1, 125)
      return 0
  }
  let now: i64 = sys_now_realtime_sec()
  let ttl: i64 = evp_ttl_sec()
  let stale: i64 = evp_stale(f, now, ttl)
  var age: i64 = now - f[EVP_F_EPOCH]
  if age < 0 { age = 0 }
  kv_s(1, "evidence_status" as *u8, "MEASURED" as *u8); wc(1, 44)
  kv_n(1, "ok" as *u8, f[EVP_F_OK]); wc(1, 44)
  kv_n(1, "epoch" as *u8, f[EVP_F_EPOCH]); wc(1, 44)
  kv_n(1, "age_sec" as *u8, age); wc(1, 44)
  kv_n(1, "ttl_sec" as *u8, ttl); wc(1, 44)
  kv_n(1, "stale" as *u8, stale); wc(1, 44)
  // EVERY COUNT CARRIES ITS DENOMINATOR: a bare grounded=14 is not a fact about a board.
  wq(1); w(1, "grounded" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_n(1, "count" as *u8, f[EVP_F_GROUNDED]); wc(1, 44); kv_n(1, "of" as *u8, f[EVP_F_PRESENT])
  wc(1, 125); wc(1, 44)
  kv_n(1, "unsupported" as *u8, f[EVP_F_UNGROUND]); wc(1, 44)
  wq(1); w(1, "gates" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_n(1, "green" as *u8, f[EVP_F_GREEN]); wc(1, 44)
  kv_n(1, "ran" as *u8, f[EVP_F_RAN]); wc(1, 44)
  kv_n(1, "declared" as *u8, f[EVP_F_DECLARED]); wc(1, 44)
  kv_n(1, "skipped" as *u8, f[EVP_F_SKIPPED]); wc(1, 44)
  kv_n(1, "hashed" as *u8, f[EVP_F_HASHED]); wc(1, 44)
  kv_n(1, "redseen" as *u8, f[EVP_F_REDSEEN]); wc(1, 44)
  kv_n(1, "vacuous" as *u8, f[EVP_F_VACUOUS])
  wc(1, 125); wc(1, 44)
  wq(1); w(1, "gaps" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_n(1, "open" as *u8, f[EVP_F_ABSENT]); wc(1, 44)
  kv_n(1, "named" as *u8, f[EVP_F_ABSNAMED]); wc(1, 44)
  kv_n(1, "unnamed" as *u8, f[EVP_F_ABSBARE])
  wc(1, 125); wc(1, 44)
  kv_n(1, "flips_ready" as *u8, f[EVP_F_LANDED]); wc(1, 44)
  // A PARTITION IS A CLAIM: PUBLISH THE PARTS AND THE SUM SO A LEAK CANNOT HIDE BEHIND A TOTAL.
  // reconciles is THREE-STATE on purpose -- 1 sums, 0 LEAKS, -1 not measurable from this stamp --
  // because a partition we could not check and one that failed are different facts.
  wq(1); w(1, "partition" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_n(1, "grounded_plus_unsupported" as *u8, f[EVP_F_GROUNDED] + f[EVP_F_UNGROUND]); wc(1, 44)
  kv_n(1, "present_axes" as *u8, f[EVP_F_PRESENT]); wc(1, 44)
  kv_n(1, "named_plus_unnamed" as *u8, f[EVP_F_ABSNAMED] + f[EVP_F_ABSBARE]); wc(1, 44)
  kv_n(1, "open" as *u8, f[EVP_F_ABSENT]); wc(1, 44)
  kv_n(1, "reconciles" as *u8, evp_reconciles(f))
  wc(1, 125); wc(1, 44)
  // THE FAILING CONJUNCT, NAMED. A bare verdict is a disjunction and the reader always guesses the
  // alarming third; GPqN and gPQN are the same word and opposite work. evp_conj_char is the WRITER's
  // own function, so these letters cannot drift from the letters the referee stamped.
  wq(1); w(1, "conj" as *u8); wq(1); wc(1, 58); wq(1)
  wc(1, evp_conj_char(f[EVP_F_CJ_G], 71, 103))
  wc(1, evp_conj_char(f[EVP_F_CJ_P], 80, 112))
  wc(1, evp_conj_char(f[EVP_F_CJ_Q], 81, 113))
  wc(1, evp_conj_char(f[EVP_F_CJ_N], 78, 110))
  wq(1); wc(1, 44)
  kv_s(1, "first_failing_conjunct" as *u8, evp_conj_name(evp_conj_fail(f))); wc(1, 44)
  // WHICH DOCUMENT WAS GRADED. There are two knowledge trees and their copies of a matrix differ, so a
  // verdict that cannot name its subject document is not a verdict about the published board.
  wq(1); w(1, "graded_document" as *u8); wq(1); wc(1, 58); wc(1, 123)
  kv_s(1, "tree" as *u8, evp_tree_name(f[EVP_F_MROOT])); wc(1, 44)
  kv_n(1, "bytes" as *u8, f[EVP_F_MBYTES]); wc(1, 44)
  kv_n(1, "read_capped" as *u8, f[EVP_F_MCAPPED])
  wc(1, 125); wc(1, 44)
  kv_s(1, "gates_map_tree" as *u8, evp_tree_name(f[EVP_F_GATESROOT])); wc(1, 44)
  // THE GAP CLASSES THAT FIRE -- the machine half of the worklist. SEPARATE, NEVER MERGED: CLAIM-ONLY
  // needs a gate WRITTEN and GATE-FAILING needs one FIXED, and a single blended number sends a seat at
  // the wrong work. The remedy prose lives on the board page and is deliberately NOT copied here: two
  // copies of one sentence is a duplicate ruler that drifts on the first edit.
  wq(1); w(1, "classes" as *u8); wq(1); wc(1, 58); wc(1, 91)
  let cn: *i64 = sys_mmap(16) as *i64
  cn[0] = 0
  evj_class(evp_claim_only(f), "CLAIM-ONLY" as *u8, cn)
  evj_class(evp_gate_failing(f), "GATE-FAILING" as *u8, cn)
  evj_class(evp_fabricated(f), "UNSUPPORTED-CLAIM" as *u8, cn)
  evj_class(evp_flip_ready(f), "FLIP-READY" as *u8, cn)
  evj_class(evp_unnamed_gap(f), "UNNAMED-GAP" as *u8, cn)
  evj_class(evp_vacuous_gate(f), "VACUOUS-GATE" as *u8, cn)
  evj_class(stale, "STALE" as *u8, cn)
  wc(1, 93); wc(1, 44)
  kv_n(1, "classes_fired" as *u8, cn[0])
  wc(1, 125)
  return cn[0]
1418}
1419
1420// ---- MEASURED HEAD-TO-HEAD RECEIPTS (2026-09-01, lang leg) ---------------------------------------------
1421// OPERATOR: "meet and exceed gcc and rust and all the other languages independently verified with evidence
1422// documented and our /compare properly storing and making the evidence reproducible and visible and have that
1423// be an ecosystem wide capability". A performance number typed into a note is a CLAIM; this section renders a
1424// RECEIPT. knowledge/compare/<dom>.bench is written by a measuring organ (nx_lang_h2h for lang) and carries
1425// the host, every toolchain version, every source and binary sha256, min and median microseconds per arm, the
1426// checksum every arm had to agree on, and the exact command that regenerates it. ONE reader
1427// (nx_bench_receipt_lib) is shared by the writer, this renderer and the gate, and the verdict on the page is
1428// RE-DERIVED from the rows here, never copied from the file's own @verdict line -- the two are printed side by
1429// side and an agreement flag says whether the writer and the reader concur.
1430// ONE renderer in the base, BOTH generators call it (the refs_pass / plan_pass / watch_pass precedent), so a
1431// matrix board and a sota board publish the same bench dialect. A domain with no .bench emits NOTHING in both
1432// modes: every board without a receipt is byte-identical by construction.
1433const BD_SECS_PER_DAY: i64 = 86400
1434const BD_DAYS_TO_CIVIL_SHIFT: i64 = 719468   // days from 0000-03-01 to 1970-01-01 (Hinnant, civil_from_days)
1435const BD_DAYS_PER_ERA: i64 = 146097
1436const BD_DAYS_PER_4Y: i64 = 1460
1437const BD_DAYS_PER_100Y: i64 = 36524
1438const BD_DAYS_PER_ERA_LESS1: i64 = 146096
1439const BD_DAYS_PER_YEAR: i64 = 365
1440const BD_YEARS_PER_ERA: i64 = 400
1441const BD_MONTH_NUM: i64 = 153
1442const BD_MONTH_SHIFT: i64 = 2
1443const BD_MONTH_SCALE: i64 = 5
1444const BD_MARCH: i64 = 3
1445const BD_JAN_FROM_MP: i64 = 9
1446const BD_MP_WRAP: i64 = 10
1447const BD_FEB: i64 = 2
1448const BD_TEN: i64 = 10
1449const BD_SHA_SHOWN: i64 = 12
1450// YYYY-MM-DD from unix seconds (proleptic Gregorian, UTC); a non-positive epoch prints a dash
1451func bd_ymd(epoch: i64, dst: *u8, off: i64) -> i64 {
  if epoch <= 0 { return br_cat(dst, off, "-" as *u8) }
  let z: i64 = epoch / BD_SECS_PER_DAY + BD_DAYS_TO_CIVIL_SHIFT
  let era: i64 = z / BD_DAYS_PER_ERA
  let doe: i64 = z - era * BD_DAYS_PER_ERA
  let yoe: i64 = (doe - doe / BD_DAYS_PER_4Y + doe / BD_DAYS_PER_100Y - doe / BD_DAYS_PER_ERA_LESS1) / BD_DAYS_PER_YEAR
  let doy: i64 = doe - (BD_DAYS_PER_YEAR * yoe + yoe / 4 - yoe / 100)
  let mp: i64 = (BD_MONTH_SCALE * doy + BD_MONTH_SHIFT) / BD_MONTH_NUM
  let d: i64 = doy - (BD_MONTH_NUM * mp + BD_MONTH_SHIFT) / BD_MONTH_SCALE + 1
  var m: i64 = mp + BD_MARCH
  if mp >= BD_MP_WRAP { m = mp - BD_JAN_FROM_MP }
  var y: i64 = yoe + era * BD_YEARS_PER_ERA
  if m <= BD_FEB { y = y + 1 }
  var o: i64 = br_catn(dst, off, y)
  o = br_put(dst, o, 45)
  if m < BD_TEN { o = br_put(dst, o, 48) }
  o = br_catn(dst, o, m)
  o = br_put(dst, o, 45)
  if d < BD_TEN { o = br_put(dst, o, 48) }
  o = br_catn(dst, o, d)
  return o
1472}
1473// the first BD_SHA_SHOWN hex digits of a digest, or the whole thing when shorter
1474func bd_sha_short(fd: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { if i < BD_SHA_SHOWN { wc(fd, s[i] as i64) } i = i + 1 }
  return 0
1478}
1479func bd_status_class(st: i64) -> *u8 {
  if st == BR_ST_VALID { return "ok" as *u8 }
  if st == BR_ST_VOID { return "void" as *u8 }
  if st == BR_ST_UNMEASURABLE { return "unm" as *u8 }
  return "fail" as *u8
1484}
1485// ---- IM3 (intelmine, 2026-09-05): MINED INTELLIGENCE ON THE BOARD -- knowledge/compare/<dom>.proposed, rendered by the base for both generators ----
1486// nx_intelmine_propose routes review and competitive signals (nx_reviewmine_lib over Steam reviews under the
1487// exceeds / meets / mixed / does-not-meet rubric, the installed-title census) through capability_map.conf and APPENDS
1488//   prop|epoch|appid|name|signal|kind|term|domain|rung-title|evidence        (PR_NF fields; the writer dedupes on appid+kind+term)
1489// The proposer writes DATA and never a page. This is the ONE renderer, so every domain inherits the band on its next
1490// beat and a one-off report can never be built beside it (the grow-the-emitter law). An ABSENT file emits NOTHING --
1491// no section, no JSON key: an empty band would read as "the field has nothing to say", the one wrong answer nobody
1492// questions. A malformed row is COUNTED beside the rendered ones, never dropped in silence. A proposal is a LEAD, never
1493// a rung: it closes only when a rung with a gate lands, and the page says so in its own words.
1494const PR_READ_CAP: i64 = 65536        // announces when it binds; a .proposed file is rows, not a corpus
1495const PR_PATH_CAP: i64 = 600          // knowledge/compare/<dom>.proposed -- the reserve its sibling passes use
1496const PR_I64_BYTES: i64 = 8
1497const PR_NF: i64 = 10                 // fields per prop| row, from the writer's own emit order (ip_emit)
1498const PR_SPLIT: i64 = 16              // field table: PR_NF plus room, so an over-long row is read whole rather than clipped to fit
1499const PR_F_TAG: i64 = 0
1500const PR_F_EPOCH: i64 = 1
1501const PR_F_APPID: i64 = 2
1502const PR_F_NAME: i64 = 3
1503const PR_F_SIGNAL: i64 = 4
1504const PR_F_KIND: i64 = 5
1505const PR_F_TERM: i64 = 6
1506const PR_F_DOMAIN: i64 = 7
1507const PR_F_TITLE: i64 = 8
1508const PR_F_EVIDENCE: i64 = 9
1509const PR_CH_COMMENT: i64 = 35
1510const PR_CH_LF: i64 = 10
1511const PR_CH_COMMA: i64 = 44
1512const PR_CH_COLON: i64 = 58
1513const PR_CH_LBRACE: i64 = 123
1514const PR_CH_RBRACE: i64 = 125
1515const PR_CH_LBRACKET: i64 = 91
1516const PR_CH_RBRACKET: i64 = 93
1517// RENDER-TIME TITLE (intelmine IM23/IM27, 2026-09-05): a row whose name column is its appid was written before any
1518// census or platform-api name existed, and the writer dedupes rows so it never rewrites them. The banked name
1519// (nx_steam_reviews name <appid> -> <appid>.name, one line) is read HERE instead, from the estate root as the mgmt
1520// daemon sees it AND from one directory up as the regen sees it (CWD = buildroot) -- the two-root read, announced
1521// per row as name_src=banked, never a silent guess. Absent in both: the row prints its appid and says so.
1522const PR_NAME_CAP: i64 = 256
1523const PR_NAME_DIR: *u8 = "knowledge/reviews/steam/"
1524const PR_NAME_DIR_UP: *u8 = "../knowledge/reviews/steam/"
1525const PR_NAME_SUFFIX: *u8 = ".name"
1526func pr_name_read(dir: *u8, appid: *u8, out: *u8, cap: i64) -> i64 {
  let path: *u8 = sys_mmap(PR_PATH_CAP)
  var o: i64 = scopy(path, 0, dir)
  o = scopy(path, o, appid); o = scopy(path, o, PR_NAME_SUFFIX); path[o] = 0 as u8
  let n: i64 = c_read(path, out, cap - 1)
  if n <= 0 { return 0 - 1 }
  var e: i64 = 0
  while e < n { if out[e] == (PR_CH_LF as u8) { break } e = e + 1 }
  out[e] = 0 as u8
  if e <= 0 { return 0 - 1 }
  return e
1537}
1538func pr_name_lookup(appid: *u8, out: *u8, cap: i64) -> i64 {
  let n: i64 = pr_name_read(PR_NAME_DIR, appid, out, cap)
  if n > 0 { return n }
  return pr_name_read(PR_NAME_DIR_UP, appid, out, cap)
1542}
1543func prop_pass(dom: *u8, fd: i64, mode: i64) -> i64 { return prop_pass_heading(dom, fd, mode, 2) }
1544func prop_pass_heading(dom: *u8, fd: i64, mode: i64, heading_level: i64) -> i64 {
  let path: *u8 = sys_mmap(PR_PATH_CAP)
  var o: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
  o = scopy(path, o, dom); o = scopy(path, o, ".proposed" as *u8); path[o] = 0 as u8
  let buf: *u8 = sys_mmap(PR_READ_CAP)
  let n: i64 = c_read(path, buf, PR_READ_CAP - 1)
  if n <= 0 { return 0 }
  var capped: i64 = 0
  if n >= PR_READ_CAP - 1 { capped = 1 }
  buf[n] = 0 as u8
  let fld: *i64 = sys_mmap(PR_SPLIT * PR_I64_BYTES) as *i64
  if mode == 2 {
      wc(fd, PR_CH_COMMA); wq(fd); w(fd, "proposed" as *u8); wq(fd); wc(fd, PR_CH_COLON); wc(fd, PR_CH_LBRACE)
      kv_s(fd, "file" as *u8, path); wc(fd, PR_CH_COMMA)
      kv_s(fd, "writer" as *u8, "nx_intelmine_propose" as *u8); wc(fd, PR_CH_COMMA)
      wq(fd); w(fd, "rows" as *u8); wq(fd); wc(fd, PR_CH_COLON); wc(fd, PR_CH_LBRACKET)
  }
  if mode == 1 {
      sc_heading_open(fd, heading_level, "" as *u8); w(fd, "Mined from the field &mdash; review and competitive intelligence proposed to this board" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n" as *u8)
      if capped == 1 { w(fd, "<div class='meth'>proposed artefact READ-CAPPED at " as *u8); wn(fd, PR_READ_CAP); w(fd, " bytes &mdash; the rows below are a PREFIX of the file</div>\n" as *u8) }
      w(fd, "<p class='lead'>Rows written by <code>nx_intelmine_propose</code> from <code>nx_reviewmine_lib</code> signals (Steam reviews under the exceeds / meets / mixed / does-not-meet rubric, the installed-title census) and routed here by <code>capability_map.conf</code>. <b>DEFECT</b> names a rival failing that a rung here answers; <b>DEMANDED</b> a capability buyers ask for and do not get; <b>WE-DO-BETTER</b> an exceed the reviews corroborate; <b>THEY-DO-WELL</b> a bar this board must meet; <b>SHIPS</b> a rival capability to match. <b>A proposal is a lead, never a rung</b> &mdash; it closes only when a rung with a gate lands, and nothing in this band changes a measured cell.</p>\n" as *u8)
      sc_plan_table_open(fd, "Capability proposals" as *u8); w(fd, "<thead><tr><th>Signal</th><th>Kind</th><th>Term</th><th>Title</th><th>Proposed rung</th><th>Evidence</th></tr></thead><tbody>\n" as *u8)
  }
  var rows: i64 = 0
  var malformed: i64 = 0
  let nbuf: *u8 = sys_mmap(PR_NAME_CAP)
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (PR_CH_LF as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      if line[0] != (PR_CH_COMMENT as u8) { if line[0] != (0 as u8) {
          let nf: i64 = splitpipe(line, fld, PR_SPLIT)
          var ok: i64 = 0
          if nf >= PR_NF { if streq(fld[PR_F_TAG] as *u8, "prop" as *u8) == 1 { ok = 1 } }
          if ok == 0 { malformed = malformed + 1 } else {
              rows = rows + 1
              let name: *u8 = fld[PR_F_NAME] as *u8
              let appid: *u8 = fld[PR_F_APPID] as *u8
              // the proposer wrote the appid as the name when nothing named the title: try the banked name at render
              // time (name_src=banked), and only when that is absent too print the number AND say so (name_src=appid)
              var shown: *u8 = name
              var nsrc: *u8 = "row" as *u8
              if streq(name, appid) == 1 {
                  nsrc = "appid" as *u8
                  if pr_name_lookup(appid, nbuf, PR_NAME_CAP) > 0 { shown = nbuf; nsrc = "banked" as *u8 }
              }
              if mode == 1 {
                  w(fd, "<tr><td><span class='ex'>" as *u8); wnote(fd, fld[PR_F_SIGNAL] as *u8); w(fd, "</span></td><td class='ct'>" as *u8); wnote(fd, fld[PR_F_KIND] as *u8)
                  w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[PR_F_TERM] as *u8); w(fd, "</td><td>" as *u8)
                  if streq(nsrc, "appid" as *u8) == 1 { w(fd, "appid <span class='ct'>" as *u8); wnote(fd, appid); w(fd, "</span> (title unresolved: no census row and no banked name)" as *u8) } else { wnote(fd, shown); w(fd, " <span class='ct'>" as *u8); wnote(fd, appid); w(fd, "</span>" as *u8) }
                  w(fd, "</td><td><b>" as *u8); wnote(fd, fld[PR_F_TITLE] as *u8); w(fd, "</b></td><td class='ct'>" as *u8); wnote(fd, fld[PR_F_EVIDENCE] as *u8); w(fd, "</td></tr>\n" as *u8)
              }
              if mode == 2 {
                  if rows > 1 { wc(fd, PR_CH_COMMA) }
                  wc(fd, PR_CH_LBRACE)
                  kv_s(fd, "epoch" as *u8, fld[PR_F_EPOCH] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "appid" as *u8, appid); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "name" as *u8, shown); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "name_src" as *u8, nsrc); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "signal" as *u8, fld[PR_F_SIGNAL] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "kind" as *u8, fld[PR_F_KIND] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "term" as *u8, fld[PR_F_TERM] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "domain" as *u8, fld[PR_F_DOMAIN] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "title" as *u8, fld[PR_F_TITLE] as *u8); wc(fd, PR_CH_COMMA)
                  kv_s(fd, "evidence" as *u8, fld[PR_F_EVIDENCE] as *u8)
                  wc(fd, PR_CH_RBRACE)
              }
          }
      } }
  }
  if mode == 1 {
      sc_plan_table_close(fd); w(fd, "\n<p class='stats'>proposals <b>" as *u8); wn(fd, rows); w(fd, "</b><span class='sep'>|</span>malformed rows <b>" as *u8); wn(fd, malformed)
      w(fd, "</b> (counted, never rendered: a row that is not <code>prop|</code> with " as *u8); wn(fd, PR_NF); w(fd, " fields)<span class='sep'>|</span>read-capped <b>" as *u8); wn(fd, capped); w(fd, "</b></p>\n" as *u8)
  }
  if mode == 2 {
      wc(fd, PR_CH_RBRACKET); wc(fd, PR_CH_COMMA)
      kv_n(fd, "count" as *u8, rows); wc(fd, PR_CH_COMMA)
      kv_n(fd, "malformed" as *u8, malformed); wc(fd, PR_CH_COMMA)
      kv_n(fd, "read_capped" as *u8, capped)
      wc(fd, PR_CH_RBRACE)
  }
  return rows
1629}
1630// THE DISCOVERED FIELD (fieldwatch FW1, 2026-09-05; operator: the six columns "arent a good sample of the industry").
1631// knowledge/compare/<dom>.field is WRITTEN by nx_field_discover from <dom>.seeds -- public lists (Wikipedia wikitext,
1632// GitHub topics, awesome lists) read mechanically -- and rendered here by the ONE reader for both generators. The page
1633// shows the field, then measures the matrix's own @cols as a SUBSET of it: columns_in_field of columns, and how many
1634// discovered rivals have no column at all. A seat's pick is thereby shown for what it is. Absent file = no section.
1635const FI_READ_CAP: i64 = 262144       // announces when it binds: a .field is rows, not a corpus
1636const FI_PATH_CAP: i64 = 600
1637const FI_I64_BYTES: i64 = 8
1638const FI_NF: i64 = 7                  // rival|name|seeds_hit|mentions|first_seed|link|kind (nx_field_lib fl_emit)
1639const FI_SPLIT: i64 = 12
1640const FI_F_TAG: i64 = 0
1641const FI_F_NAME: i64 = 1
1642const FI_F_SEEDS: i64 = 2
1643const FI_F_MENTIONS: i64 = 3
1644const FI_F_FIRST: i64 = 4
1645const FI_F_LINK: i64 = 5
1646const FI_F_KIND: i64 = 6
1647const FI_SHOW: i64 = 60               // rows rendered; the rest are COUNTED and the stats line says shown of count
1648const FI_COLS_MAX: i64 = 16
1649const FI_CH_COMMENT: i64 = 35
1650const FI_CH_LF: i64 = 10
1651const FI_CH_PIPE: i64 = 124
1652const FI_CH_COMMA: i64 = 44
1653const FI_CH_COLON: i64 = 58
1654const FI_CH_LBRACE: i64 = 123
1655const FI_CH_RBRACE: i64 = 125
1656const FI_CH_LBRACKET: i64 = 91
1657const FI_CH_RBRACKET: i64 = 93
1658const FI_UPPER_A: i64 = 65
1659const FI_UPPER_Z: i64 = 90
1660const FI_CASE_DELTA: i64 = 32
1661func fi_lc(c: i64) -> i64 { if c >= FI_UPPER_A { if c <= FI_UPPER_Z { return c + FI_CASE_DELTA } } return c }
1662// case-insensitive: does hay contain needle (needle non-empty)?
1663func fi_ci_contains(hay: *u8, needle: *u8) -> i64 {
  var nl: i64 = 0
  while needle[nl] != (0 as u8) { nl = nl + 1 }
  if nl < 1 { return 0 }
  var hl: i64 = 0
  while hay[hl] != (0 as u8) { hl = hl + 1 }
  var i: i64 = 0
  while i + nl <= hl {
      var m: i64 = 0
      var j: i64 = 0
      while j < nl { if fi_lc(hay[i + j] as i64) == fi_lc(needle[j] as i64) { m = m + 1 } j = j + 1 }
      if m == nl { return 1 }
      i = i + 1
  }
  return 0
1678}
1679// the leading words of a column label (up to the first space) -- "Blender 4.5 plus addons" matches a rival named Blender
1680func fi_head_word(col: *u8, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  while col[i] != (0 as u8) { if col[i] == (32 as u8) { break } if i < cap - 1 { out[i] = col[i] } i = i + 1 }
  if i > cap - 1 { i = cap - 1 }
  out[i] = 0 as u8
  return i
1686}
1687// colv/ncols: the matrix generator's ALREADY-SPLIT @cols vector (one owner of the split); the sota generator passes 0/0.
1688func field_pass(dom: *u8, fd: i64, mode: i64, colv: *i64, ncols_in: i64) -> i64 { return field_pass_heading(dom, fd, mode, colv, ncols_in, 2) }
1689func field_pass_heading(dom: *u8, fd: i64, mode: i64, colv: *i64, ncols_in: i64, heading_level: i64) -> i64 {
  let path: *u8 = sys_mmap(FI_PATH_CAP)
  var o: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
  o = scopy(path, o, dom); o = scopy(path, o, ".field" as *u8); path[o] = 0 as u8
  let buf: *u8 = sys_mmap(FI_READ_CAP)
  let n: i64 = c_read(path, buf, FI_READ_CAP - 1)
  if n <= 0 { return 0 }
  var capped: i64 = 0
  if n >= FI_READ_CAP - 1 { capped = 1 }
  buf[n] = 0 as u8
  var ncols: i64 = ncols_in
  if ncols > FI_COLS_MAX { ncols = FI_COLS_MAX }
  if ncols < 0 { ncols = 0 }
  let colhit: *i64 = sys_mmap(FI_COLS_MAX * FI_I64_BYTES) as *i64
  let head: *u8 = sys_mmap(FI_PATH_CAP)
  let fld: *i64 = sys_mmap(FI_SPLIT * FI_I64_BYTES) as *i64
  var summary: *u8 = "" as *u8
  var rows: i64 = 0
  var shown: i64 = 0
  var malformed: i64 = 0
  var p: i64 = 0
  // pass 1: the summary row and the column coverage (every row, never a prefix)
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (FI_CH_LF as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      if line[0] != (FI_CH_COMMENT as u8) { if line[0] != (0 as u8) {
          if starts(line, "field|" as *u8) == 1 { summary = line } else {
              let nf: i64 = splitpipe(line, fld, FI_SPLIT)
              var ok: i64 = 0
              if nf >= FI_NF { if streq(fld[FI_F_TAG] as *u8, "rival" as *u8) == 1 { ok = 1 } }
              if ok == 0 { malformed = malformed + 1 } else {
                  rows = rows + 1
                  var c: i64 = 0
                  while c < ncols {
                      if colhit[c] == 0 {
                          fi_head_word(colv[c] as *u8, head, FI_PATH_CAP)
                          if fi_ci_contains(fld[FI_F_NAME] as *u8, head) == 1 { colhit[c] = 1 }
                      }
                      c = c + 1
                  }
              }
          }
      } }
  }
  var cols_in: i64 = 0
  var c2: i64 = 0
  while c2 < ncols { if colhit[c2] == 1 { cols_in = cols_in + 1 } c2 = c2 + 1 }
  // pass 2: render (re-read, because splitpipe NUL-terminates in place)
  let n2: i64 = c_read(path, buf, FI_READ_CAP - 1)
  buf[n2] = 0 as u8
  if mode == 2 {
      wc(fd, FI_CH_COMMA); wq(fd); w(fd, "field" as *u8); wq(fd); wc(fd, FI_CH_COLON); wc(fd, FI_CH_LBRACE)
      kv_s(fd, "file" as *u8, path); wc(fd, FI_CH_COMMA)
      kv_s(fd, "writer" as *u8, "nx_field_discover" as *u8); wc(fd, FI_CH_COMMA)
      kv_s(fd, "summary" as *u8, summary); wc(fd, FI_CH_COMMA)
      kv_n(fd, "columns" as *u8, ncols); wc(fd, FI_CH_COMMA)
      kv_n(fd, "columns_in_field" as *u8, cols_in); wc(fd, FI_CH_COMMA)
      wq(fd); w(fd, "rows" as *u8); wq(fd); wc(fd, FI_CH_COLON); wc(fd, FI_CH_LBRACKET)
  }
  if mode == 1 {
      sc_heading_open(fd, heading_level, " id='field'" as *u8); w(fd, "The field &mdash; discovered, not chosen" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n" as *u8)
      if capped == 1 { w(fd, "<div class='meth'>field artefact READ-CAPPED at " as *u8); wn(fd, FI_READ_CAP); w(fd, " bytes &mdash; the rows below are a PREFIX of the file</div>\n" as *u8) }
      w(fd, "<p class='lead'>Rows written by <code>nx_field_discover</code> from <code>" as *u8); wnote(fd, dom); w(fd, ".seeds</code>: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict &mdash; it earns a column when its capabilities are read and pinned.</p>\n" as *u8)
      w(fd, "<div class='meth'><code>" as *u8); wnote(fd, summary); w(fd, "</code></div>\n" as *u8)
      sc_plan_table_open(fd, "Competitor field" as *u8); w(fd, "<thead><tr><th>Rank</th><th>Rival</th><th>Seeds</th><th>Mentions</th><th>First seed</th><th>Kind</th><th>Link</th></tr></thead><tbody>\n" as *u8)
  }
  var p2: i64 = 0
  var rank: i64 = 0
  while p2 < n2 {
      var e: i64 = p2
      while e < n2 { if buf[e] == (FI_CH_LF as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p2) as *u8
      p2 = e + 1
      if line[0] != (FI_CH_COMMENT as u8) { if line[0] != (0 as u8) { if starts(line, "rival|" as *u8) == 1 {
          let nf: i64 = splitpipe(line, fld, FI_SPLIT)
          if nf >= FI_NF { if shown < FI_SHOW {
              rank = rank + 1
              shown = shown + 1
              if mode == 1 {
                  w(fd, "<tr><td class='ct'>" as *u8); wn(fd, rank); w(fd, "</td><td><b>" as *u8); wnote(fd, fld[FI_F_NAME] as *u8)
                  w(fd, "</b></td><td class='ct'>" as *u8); wnote(fd, fld[FI_F_SEEDS] as *u8); w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[FI_F_MENTIONS] as *u8)
                  w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[FI_F_FIRST] as *u8); w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[FI_F_KIND] as *u8)
                  w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[FI_F_LINK] as *u8); w(fd, "</td></tr>\n" as *u8)
              }
              if mode == 2 {
                  if shown > 1 { wc(fd, FI_CH_COMMA) }
                  wc(fd, FI_CH_LBRACE)
                  kv_s(fd, "name" as *u8, fld[FI_F_NAME] as *u8); wc(fd, FI_CH_COMMA)
                  kv_s(fd, "seeds" as *u8, fld[FI_F_SEEDS] as *u8); wc(fd, FI_CH_COMMA)
                  kv_s(fd, "mentions" as *u8, fld[FI_F_MENTIONS] as *u8); wc(fd, FI_CH_COMMA)
                  kv_s(fd, "first_seed" as *u8, fld[FI_F_FIRST] as *u8); wc(fd, FI_CH_COMMA)
                  kv_s(fd, "link" as *u8, fld[FI_F_LINK] as *u8); wc(fd, FI_CH_COMMA)
                  kv_s(fd, "kind" as *u8, fld[FI_F_KIND] as *u8)
                  wc(fd, FI_CH_RBRACE)
              }
          } }
      } } }
  }
  if mode == 1 {
      sc_plan_table_close(fd); w(fd, "\n<p class='stats'>field candidates <b>" as *u8); wn(fd, rows); w(fd, "</b><span class='sep'>|</span>shown <b>" as *u8); wn(fd, shown)
      w(fd, "</b> of " as *u8); wn(fd, rows); w(fd, "<span class='sep'>|</span>matrix columns in the field <b>" as *u8); wn(fd, cols_in); w(fd, "</b> of " as *u8); wn(fd, ncols)
      w(fd, "<span class='sep'>|</span>discovered rivals with no column <b>" as *u8); wn(fd, rows - cols_in); w(fd, "</b><span class='sep'>|</span>malformed rows <b>" as *u8); wn(fd, malformed)
      w(fd, "</b> (counted, never rendered)<span class='sep'>|</span>read-capped <b>" as *u8); wn(fd, capped); w(fd, "</b></p>\n" as *u8)
  }
  if mode == 2 {
      wc(fd, FI_CH_RBRACKET); wc(fd, FI_CH_COMMA)
      kv_n(fd, "count" as *u8, rows); wc(fd, FI_CH_COMMA)
      kv_n(fd, "shown" as *u8, shown); wc(fd, FI_CH_COMMA)
      kv_n(fd, "no_column" as *u8, rows - cols_in); wc(fd, FI_CH_COMMA)
      kv_n(fd, "malformed" as *u8, malformed); wc(fd, FI_CH_COMMA)
      kv_n(fd, "read_capped" as *u8, capped)
      wc(fd, FI_CH_RBRACE)
  }
  return rows
1807}
1808// ---- GAUGE HEARTBEATS (codeeffectiveness CE9, 2026-09-06): A GAUGE CELL THAT READS STALE, NEVER ZERO ----
1809// <dom>.gauge rows: gauge|<label>|<stamp-path>|<cadence_s>|<note>   (cadence_s 0 = take it from the stamp)
1810// WHY THIS IS IN THE BASE. The estate paid once for its effectiveness gauge going dark for 28 days and reading as
1811// "no movement": a number with no heartbeat is a claim with an expiry date nobody recorded. Every gauge row here is
1812// re-judged on every publish by THE ONE ruler the writing beat also uses (nx_gauge_lib.ga_judge), so the page and the
1813// beat cannot disagree: FRESH shows the value, STALE withholds it (age beyond two beats), BLIND withholds it (an axis
1814// abstained), ABSENT means nothing has measured. In api.json the "gauge" value key exists ONLY on a FRESH row -- a
1815// consumer that reads a missing key as zero is the defect this pass exists to make impossible on the page.
1816const GP_PATH_CAP: i64 = 600
1817const GP_READ_CAP: i64 = 65536
1818const GP_SPLIT: i64 = 8
1819const GP_NF: i64 = 5
1820const GP_F_LABEL: i64 = 1
1821const GP_F_PATH: i64 = 2
1822const GP_F_CAD: i64 = 3
1823const GP_F_NOTE: i64 = 4
1824const GP_ROW_CAP: i64 = 1024
1825const GP_CH_NL: i64 = 10
1826const GP_CH_HASH: i64 = 35
1827const GP_CH_COMMA: i64 = 44
1828const GP_CH_COLON: i64 = 58
1829const GP_CH_LBRACKET: i64 = 91
1830const GP_CH_RBRACKET: i64 = 93
1831const GP_CH_LBRACE: i64 = 123
1832const GP_CH_RBRACE: i64 = 125
1833func gauge_pass(dom: *u8, fd: i64, mode: i64) -> i64 { return gauge_pass_heading(dom, fd, mode, 2) }
1834func gauge_pass_heading(dom: *u8, fd: i64, mode: i64, heading_level: i64) -> i64 {
  let path: *u8 = sys_mmap(GP_PATH_CAP)
  var o: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
  o = scopy(path, o, dom); o = scopy(path, o, ".gauge" as *u8); path[o] = 0 as u8
  let buf: *u8 = sys_mmap(GP_READ_CAP)
  let n: i64 = c_read(path, buf, GP_READ_CAP - 1)
  if n <= 0 { return 0 }
  var capped: i64 = 0
  if n >= GP_READ_CAP - 1 { capped = 1 }
  let now: i64 = sys_now_realtime_sec()
  let fld: *i64 = sys_mmap(GP_SPLIT * GA_WORD) as *i64
  let f: *i64 = sys_mmap(GA_F_SLOTS * GA_WORD) as *i64
  let rb: *u8 = sys_mmap(GP_ROW_CAP)
  var rows: i64 = 0
  var malformed: i64 = 0
  var c_fresh: i64 = 0
  var c_stale: i64 = 0
  var c_blind: i64 = 0
  var c_absent: i64 = 0
  if mode == 2 {
      wc(fd, GP_CH_COMMA); wq(fd); w(fd, "gauge" as *u8); wq(fd); wc(fd, GP_CH_COLON); wc(fd, GP_CH_LBRACE)
      kv_s(fd, "file" as *u8, path); wc(fd, GP_CH_COMMA)
      kv_s(fd, "reader" as *u8, "nx_gauge_lib" as *u8); wc(fd, GP_CH_COMMA)
      kv_n(fd, "now" as *u8, now); wc(fd, GP_CH_COMMA)
      wq(fd); w(fd, "rows" as *u8); wq(fd); wc(fd, GP_CH_COLON); wc(fd, GP_CH_LBRACKET)
  }
  if mode == 1 {
      sc_heading_open(fd, heading_level, " id='gauge'" as *u8); w(fd, "Gauges &mdash; a heartbeat, never a bare number" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n" as *u8)
      if capped == 1 { w(fd, "<div class='meth'>gauge artefact READ-CAPPED at " as *u8); wn(fd, GP_READ_CAP); w(fd, " bytes &mdash; the rows below are a PREFIX of the file</div>\n" as *u8) }
      w(fd, "<p class='lead'>Each row names a gauge stamp written by its measuring beat. This page re-judges the stamp on every publish with the same ruler the beat uses (<code>nx_gauge_lib</code>): <b>FRESH</b> shows the value; <b>STALE</b> withholds it (older than two beats); <b>BLIND</b> withholds it (an axis abstained); <b>ABSENT</b> means nothing has measured. A stale gauge never reads as zero.</p>\n" as *u8)
      w(fd, "<table class='gauge-tab'><thead><tr><th>gauge</th><th>state</th><th>reading</th><th>note</th></tr></thead><tbody>\n" as *u8)
  }
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (GP_CH_NL as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      if line[0] != (GP_CH_HASH as u8) { if line[0] != (0 as u8) { if starts(line, "gauge|" as *u8) == 1 {
          let nf: i64 = splitpipe(line, fld, GP_SPLIT)
          if nf < GP_NF { malformed = malformed + 1 } else {
              let cs: *u8 = fld[GP_F_CAD] as *u8
              let cad: i64 = sj_atoi_span(cs, 0, sj_vlen(cs))
              // RESOLVE BEFORE JUDGING (2026-09-06): the regen runs with CWD=buildroot while every beat stamps from the serving root, so a
              // bare stamp path read ABSENT on the page for a stamp FRESH on disk (measured: knowledge/status/stepsolve.stamp 66 B at the
              // root, absent under buildroot). ep_artifact_path is the ONE probe order; an absent stamp still judges ABSENT through the same ruler.
              let gpath: *u8 = sys_mmap(GP_PATH_CAP)
              if ep_artifact_path(gpath, fld[GP_F_PATH] as *u8) == 0 { let go: i64 = scopy(gpath, 0, fld[GP_F_PATH] as *u8); gpath[go] = 0 as u8 }
              let st: i64 = ga_judge(gpath, now, cad, f)
              var age: i64 = 0 - 1
              if f[GA_F_TS] > 0 { age = now - f[GA_F_TS] }
              var mcad: i64 = cad
              if mcad <= 0 { mcad = f[GA_F_CADENCE] }
              let rl: i64 = ga_render(rb, 0, st, age, ga_max_age(mcad), f[GA_F_GAUGE], f[GA_F_KNOWN], f[GA_F_TOTAL])
              rb[rl] = 0 as u8
              if st == GA_FRESH { c_fresh = c_fresh + 1 }
              if st == GA_STALE { c_stale = c_stale + 1 }
              if st == GA_BLIND { c_blind = c_blind + 1 }
              if st == GA_ABSENT { c_absent = c_absent + 1 }
              if mode == 1 {
                  w(fd, "<tr><td><b>" as *u8); wnote(fd, fld[GP_F_LABEL] as *u8); w(fd, "</b></td><td class='ct'>" as *u8); w(fd, ga_state_name(st))
                  w(fd, "</td><td class='ct'>" as *u8); wnote(fd, rb); w(fd, "</td><td>" as *u8); wnote(fd, fld[GP_F_NOTE] as *u8); w(fd, "</td></tr>\n" as *u8)
              }
              if mode == 2 {
                  if rows > 0 { wc(fd, GP_CH_COMMA) }
                  wc(fd, GP_CH_LBRACE)
                  kv_s(fd, "label" as *u8, fld[GP_F_LABEL] as *u8); wc(fd, GP_CH_COMMA)
                  kv_s(fd, "stamp" as *u8, fld[GP_F_PATH] as *u8); wc(fd, GP_CH_COMMA)
                  kv_s(fd, "state" as *u8, ga_state_name(st)); wc(fd, GP_CH_COMMA)
                  kv_n(fd, "age_s" as *u8, age); wc(fd, GP_CH_COMMA)
                  kv_n(fd, "max_age_s" as *u8, ga_max_age(mcad)); wc(fd, GP_CH_COMMA)
                  kv_n(fd, "axes_known" as *u8, f[GA_F_KNOWN]); wc(fd, GP_CH_COMMA)
                  kv_n(fd, "axes_total" as *u8, f[GA_F_TOTAL]); wc(fd, GP_CH_COMMA)
                  if st == GA_FRESH { kv_n(fd, "gauge" as *u8, f[GA_F_GAUGE]); wc(fd, GP_CH_COMMA) }
                  kv_s(fd, "reading" as *u8, rb); wc(fd, GP_CH_COMMA)
                  kv_s(fd, "note" as *u8, fld[GP_F_NOTE] as *u8)
                  wc(fd, GP_CH_RBRACE)
              }
              rows = rows + 1
          }
      } } }
  }
  if mode == 2 {
      wc(fd, GP_CH_RBRACKET); wc(fd, GP_CH_COMMA)
      kv_n(fd, "count" as *u8, rows); wc(fd, GP_CH_COMMA)
      kv_n(fd, "fresh" as *u8, c_fresh); wc(fd, GP_CH_COMMA)
      kv_n(fd, "stale" as *u8, c_stale); wc(fd, GP_CH_COMMA)
      kv_n(fd, "blind" as *u8, c_blind); wc(fd, GP_CH_COMMA)
      kv_n(fd, "absent" as *u8, c_absent); wc(fd, GP_CH_COMMA)
      kv_n(fd, "malformed" as *u8, malformed); wc(fd, GP_CH_COMMA)
      kv_n(fd, "read_capped" as *u8, capped)
      wc(fd, GP_CH_RBRACE)
  }
  if mode == 1 {
      w(fd, "</tbody></table>\n<p class='stats'>gauges <b>" as *u8); wn(fd, rows)
      w(fd, "</b><span class='sep'>|</span>fresh <b>" as *u8); wn(fd, c_fresh); w(fd, "</b><span class='sep'>|</span>stale <b>" as *u8); wn(fd, c_stale)
      w(fd, "</b><span class='sep'>|</span>blind <b>" as *u8); wn(fd, c_blind); w(fd, "</b><span class='sep'>|</span>absent <b>" as *u8); wn(fd, c_absent)
      w(fd, "</b> (partition sums)<span class='sep'>|</span>malformed rows <b>" as *u8); wn(fd, malformed); w(fd, "</b> (counted, never rendered)</p>\n" as *u8)
  }
  return rows
1935}
1936// ---- GAPS FROM THE RECORD (ecosystem EC38, 2026-09-06) ------------------------------------------------------
1937// Renders the record census (nx_goalmap record): organs the estate invokes and directives its own plan queue rows
1938// name that NO board row carries. The feed is the plane's own bytes written beside the conf by the same run
1939// (knowledge/recordgaps.conf.rows), resolved through ep_artifact_path like every status artifact, and its freshness
1940// is judged from the sibling stamp with the ONE gauge ruler: a stale census renders its rows under a STALE state
1941// and a BLIND one says how many declared sources are still unread; neither ever reads as "no gaps".
1942// Per board: this board's own directive rows (board == dom) always; the estate-wide UNASSIGNED organs in full on
1943// the ecosystem hub and as a COUNT everywhere else (hundreds of rows on every page would be the site saying one
1944// thing a hundred times). mode 1 = HTML section, mode 2 = api.json object. Absent feed = no section, returns 0.
1945const GX_FEED: *u8 = "knowledge/recordgaps.conf.rows"
1946const GX_STAMP: *u8 = "knowledge/recordgaps.conf.stamp"
1947const GX_READ_CAP: i64 = 4194304
1948const GX_NF: i64 = 5
1949const GX_F_KIND: i64 = 0
1950const GX_F_NAME: i64 = 1
1951const GX_F_BOARD: i64 = 2
1952const GX_F_SRC: i64 = 3
1953const GX_F_EV: i64 = 4
1954const GX_HUB: *u8 = "ecosystem"
1955const GX_UNASSIGNED: *u8 = "UNASSIGNED"
1956func gaps_pass(dom: *u8, fd: i64, mode: i64) -> i64 { return gaps_pass_heading(dom, fd, mode, 2) }
1957func gaps_pass_heading(dom: *u8, fd: i64, mode: i64, heading_level: i64) -> i64 {
  let path: *u8 = sys_mmap(GP_PATH_CAP)
  if ep_artifact_path(path, GX_FEED) == 0 { return 0 }
  let buf: *u8 = sys_mmap(GX_READ_CAP)
  let n: i64 = c_read(path, buf, GX_READ_CAP - 1)
  if n <= 0 { return 0 }
  var capped: i64 = 0
  if n >= GX_READ_CAP - 1 { capped = 1 }
  let now: i64 = sys_now_realtime_sec()
  let spath: *u8 = sys_mmap(GP_PATH_CAP)
  if ep_artifact_path(spath, GX_STAMP) == 0 { let so: i64 = scopy(spath, 0, GX_STAMP); spath[so] = 0 as u8 }
  let f: *i64 = sys_mmap(GA_F_SLOTS * GA_WORD) as *i64
  var st: i64 = ga_judge(spath, now, 0, f)
  if f[GA_F_CADENCE] > 0 { st = ga_judge(spath, now, f[GA_F_CADENCE], f) }
  var age: i64 = 0 - 1
  if f[GA_F_TS] > 0 { age = now - f[GA_F_TS] }
  let fld: *i64 = sys_mmap(GP_SPLIT * GA_WORD) as *i64
  var hub: i64 = 0
  if streq(dom, GX_HUB) == 1 { hub = 1 }
  var total: i64 = 0
  var own: i64 = 0
  var unassigned: i64 = 0
  var malformed: i64 = 0
  var shown: i64 = 0
  if mode == 2 {
      wc(fd, GP_CH_COMMA); wq(fd); w(fd, "gaps" as *u8); wq(fd); wc(fd, GP_CH_COLON); wc(fd, GP_CH_LBRACE)
      kv_s(fd, "feed" as *u8, path); wc(fd, GP_CH_COMMA)
      kv_s(fd, "stamp" as *u8, spath); wc(fd, GP_CH_COMMA)
      kv_s(fd, "state" as *u8, ga_state_name(st)); wc(fd, GP_CH_COMMA)
      kv_n(fd, "age_s" as *u8, age); wc(fd, GP_CH_COMMA)
      kv_n(fd, "sources_read" as *u8, f[GA_F_KNOWN]); wc(fd, GP_CH_COMMA)
      kv_n(fd, "sources_declared" as *u8, f[GA_F_TOTAL]); wc(fd, GP_CH_COMMA)
      kv_n(fd, "hub" as *u8, hub); wc(fd, GP_CH_COMMA)
      wq(fd); w(fd, "rows" as *u8); wq(fd); wc(fd, GP_CH_COLON); wc(fd, GP_CH_LBRACKET)
  }
  if mode == 1 {
      sc_heading_open(fd, heading_level, " id='gaps'" as *u8); w(fd, "Gaps from the record &mdash; what the estate does that no board carries" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n" as *u8)
      w(fd, "<p class='lead'>The record census (<code>nx_goalmap record</code>) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state <b>" as *u8)
      w(fd, ga_state_name(st)); w(fd, "</b>" as *u8)
      if age >= 0 { w(fd, " (age " as *u8); wn(fd, age); w(fd, " s)" as *u8) }
      w(fd, ", sources read <b>" as *u8); wn(fd, f[GA_F_KNOWN]); w(fd, "</b> of <b>" as *u8); wn(fd, f[GA_F_TOTAL])
      w(fd, "</b> declared &mdash; a BLIND census is a FLOOR: unread sources can only add rows.</p>\n" as *u8)
      if capped == 1 { w(fd, "<div class='meth'>feed READ-CAPPED at " as *u8); wn(fd, GX_READ_CAP); w(fd, " bytes &mdash; the rows below are a PREFIX of the file</div>\n" as *u8) }
      w(fd, "<table class='gaps-tab'><thead><tr><th>kind</th><th>name</th><th>board</th><th>source</th><th>evidence</th></tr></thead><tbody>\n" as *u8)
  }
  var p: i64 = 0
  while p < n {
      var e: i64 = p
      while e < n { if buf[e] == (GP_CH_NL as u8) { break } e = e + 1 }
      buf[e] = 0 as u8
      let line: *u8 = (buf as i64 + p) as *u8
      p = e + 1
      if line[0] != (GP_CH_HASH as u8) { if line[0] != (0 as u8) {
          let nf: i64 = splitpipe(line, fld, GP_SPLIT)
          if nf < GX_NF { malformed = malformed + 1 } else {
              total = total + 1
              var render: i64 = 0
              if streq(fld[GX_F_BOARD] as *u8, dom) == 1 { own = own + 1; render = 1 }
              if streq(fld[GX_F_BOARD] as *u8, GX_UNASSIGNED) == 1 { unassigned = unassigned + 1; if hub == 1 { render = 1 } }
              if render == 1 {
                  if mode == 1 {
                      w(fd, "<tr><td class='ct'>" as *u8); wnote(fd, fld[GX_F_KIND] as *u8); w(fd, "</td><td><code>" as *u8); wnote(fd, fld[GX_F_NAME] as *u8)
                      w(fd, "</code></td><td class='ct'>" as *u8); wnote(fd, fld[GX_F_BOARD] as *u8); w(fd, "</td><td class='ct'>" as *u8); wnote(fd, fld[GX_F_SRC] as *u8)
                      w(fd, "</td><td>" as *u8); wnote(fd, fld[GX_F_EV] as *u8); w(fd, "</td></tr>\n" as *u8)
                  }
                  if mode == 2 {
                      if shown > 0 { wc(fd, GP_CH_COMMA) }
                      wc(fd, GP_CH_LBRACE)
                      kv_s(fd, "kind" as *u8, fld[GX_F_KIND] as *u8); wc(fd, GP_CH_COMMA)
                      kv_s(fd, "name" as *u8, fld[GX_F_NAME] as *u8); wc(fd, GP_CH_COMMA)
                      kv_s(fd, "board" as *u8, fld[GX_F_BOARD] as *u8); wc(fd, GP_CH_COMMA)
                      kv_s(fd, "source" as *u8, fld[GX_F_SRC] as *u8); wc(fd, GP_CH_COMMA)
                      kv_s(fd, "evidence" as *u8, fld[GX_F_EV] as *u8)
                      wc(fd, GP_CH_RBRACE)
                  }
                  shown = shown + 1
              }
          }
      } }
  }
  if mode == 2 {
      wc(fd, GP_CH_RBRACKET); wc(fd, GP_CH_COMMA)
      kv_n(fd, "shown" as *u8, shown); wc(fd, GP_CH_COMMA)
      kv_n(fd, "own" as *u8, own); wc(fd, GP_CH_COMMA)
      kv_n(fd, "estate_unassigned" as *u8, unassigned); wc(fd, GP_CH_COMMA)
      kv_n(fd, "total" as *u8, total); wc(fd, GP_CH_COMMA)
      kv_n(fd, "malformed" as *u8, malformed); wc(fd, GP_CH_COMMA)
      kv_n(fd, "read_capped" as *u8, capped)
      wc(fd, GP_CH_RBRACE)
  }
  if mode == 1 {
      w(fd, "</tbody></table>\n<p class='stats'>rows shown <b>" as *u8); wn(fd, shown)
      w(fd, "</b><span class='sep'>|</span>this board's directives <b>" as *u8); wn(fd, own)
      w(fd, "</b><span class='sep'>|</span>estate-wide un-boarded organs <b>" as *u8); wn(fd, unassigned)
      if hub == 0 { w(fd, "</b> (listed in full on <a href='/compare/ecosystem'>/compare/ecosystem</a>)<span class='sep'>|</span>census rows <b>" as *u8) } else { w(fd, "</b><span class='sep'>|</span>census rows <b>" as *u8) }
      wn(fd, total); w(fd, "</b><span class='sep'>|</span>malformed <b>" as *u8); wn(fd, malformed); w(fd, "</b> (counted, never rendered)</p>\n" as *u8)
  }
  return shown
2055}
2056func bench_pass(dom: *u8, fd: i64, mode: i64) -> i64 { return bench_pass_heading(dom, fd, mode, 2) }
2057func bench_pass_heading(dom: *u8, fd: i64, mode: i64, heading_level: i64) -> i64 {
  let path: *u8 = sys_mmap(600)
  var o: i64 = scopy(path, 0, "knowledge/compare/" as *u8)
  o = scopy(path, o, dom); o = scopy(path, o, ".bench" as *u8); path[o] = 0 as u8
  let hdr: *i64 = sys_mmap(BR_H_N * 8) as *i64
  let arms: *i64 = sys_mmap(BR_MAXARMS * BR_STRIDE * 8) as *i64
  let n: i64 = br_load(path, hdr, arms)
  if n < 0 { return 0 }
  let verdict: i64 = br_verdict(hdr, arms, n)
  let written: i64 = hdr[BR_H_WRITTEN_VERDICT]
  var agree: i64 = 0
  if written == verdict { agree = 1 }
  var c_valid: i64 = 0; var c_void: i64 = 0; var c_unm: i64 = 0; var c_bf: i64 = 0; var c_rf: i64 = 0; var c_unk: i64 = 0
  var i: i64 = 0
  while i < n {
      let st: i64 = arms[i * BR_STRIDE + BR_A_STATUS]
      if st == BR_ST_VALID { c_valid = c_valid + 1 } else { if st == BR_ST_VOID { c_void = c_void + 1 } else {
      if st == BR_ST_UNMEASURABLE { c_unm = c_unm + 1 } else { if st == BR_ST_BUILDFAIL { c_bf = c_bf + 1 } else {
      if st == BR_ST_RUNFAIL { c_rf = c_rf + 1 } else { c_unk = c_unk + 1 } } } } }
      i = i + 1
  }
  let ymd: *u8 = sys_mmap(32)
  bd_ymd(hdr[BR_H_ASOF], ymd, 0)
  let rt: *u8 = sys_mmap(32)
  if mode == 2 {
      wc(fd, 44); wq(fd); w(fd, "bench" as *u8); wq(fd); wc(fd, 58); wc(fd, 123)
      kv_s(fd, "file" as *u8, path); wc(fd, 44)
      kv_s(fd, "reader" as *u8, "nx_bench_receipt_lib" as *u8); wc(fd, 44)
      kv_s(fd, "writer" as *u8, hdr[BR_H_WRITER] as *u8); wc(fd, 44)
      kv_s(fd, "title" as *u8, hdr[BR_H_TITLE] as *u8); wc(fd, 44)
      kv_s(fd, "workload" as *u8, hdr[BR_H_WORKLOAD] as *u8); wc(fd, 44)
      kv_s(fd, "host" as *u8, hdr[BR_H_HOST] as *u8); wc(fd, 44)
      kv_n(fd, "runs" as *u8, hdr[BR_H_RUNS]); wc(fd, 44)
      kv_s(fd, "ref" as *u8, hdr[BR_H_REF] as *u8); wc(fd, 44)
      kv_n(fd, "asof" as *u8, hdr[BR_H_ASOF]); wc(fd, 44)
      kv_s(fd, "asof_ymd" as *u8, ymd); wc(fd, 44)
      kv_s(fd, "repro" as *u8, hdr[BR_H_REPRO] as *u8); wc(fd, 44)
      kv_s(fd, "verdict" as *u8, br_verdict_name(verdict)); wc(fd, 44)
      kv_s(fd, "written_verdict" as *u8, br_verdict_name(written)); wc(fd, 44)
      kv_n(fd, "writer_reader_agree" as *u8, agree); wc(fd, 44)
      kv_n(fd, "arms" as *u8, n); wc(fd, 44)
      kv_n(fd, "valid" as *u8, c_valid); wc(fd, 44); kv_n(fd, "void" as *u8, c_void); wc(fd, 44)
      kv_n(fd, "unmeasurable" as *u8, c_unm); wc(fd, 44); kv_n(fd, "build_fail" as *u8, c_bf); wc(fd, 44)
      kv_n(fd, "run_fail" as *u8, c_rf); wc(fd, 44); kv_n(fd, "unknown" as *u8, c_unk); wc(fd, 44)
      wq(fd); w(fd, "rows" as *u8); wq(fd); wc(fd, 58); wc(fd, 91)
      var j: i64 = 0
      while j < n {
          let b: i64 = j * BR_STRIDE
          if j > 0 { wc(fd, 44) }
          wc(fd, 123)
          kv_s(fd, "arm" as *u8, arms[b + BR_A_NAME] as *u8); wc(fd, 44)
          kv_s(fd, "toolchain" as *u8, arms[b + BR_A_TOOL] as *u8); wc(fd, 44)
          kv_s(fd, "version" as *u8, arms[b + BR_A_VER] as *u8); wc(fd, 44)
          kv_s(fd, "source" as *u8, arms[b + BR_A_SRC] as *u8); wc(fd, 44)
          kv_s(fd, "source_sha256" as *u8, arms[b + BR_A_SRCSHA] as *u8); wc(fd, 44)
          kv_n(fd, "bin_bytes" as *u8, arms[b + BR_A_BINBYTES]); wc(fd, 44)
          kv_s(fd, "bin_sha256" as *u8, arms[b + BR_A_BINSHA] as *u8); wc(fd, 44)
          kv_n(fd, "runs" as *u8, arms[b + BR_A_RUNS]); wc(fd, 44)
          kv_n(fd, "min_us" as *u8, arms[b + BR_A_MIN]); wc(fd, 44)
          kv_n(fd, "median_us" as *u8, arms[b + BR_A_MED]); wc(fd, 44)
          kv_n(fd, "checksum" as *u8, arms[b + BR_A_CHK]); wc(fd, 44)
          kv_s(fd, "status" as *u8, br_status_name(arms[b + BR_A_STATUS])); wc(fd, 44)
          kv_n(fd, "ratio_permil" as *u8, arms[b + BR_A_RATIO]); wc(fd, 44)
          kv_s(fd, "note" as *u8, arms[b + BR_A_NOTE] as *u8)
          wc(fd, 125)
          j = j + 1
      }
      wc(fd, 93)
      wc(fd, 125)
      return n
  }
  if mode == 1 {
      // scoped style so the section renders identically under both generators' sheets; theme vars with fallbacks
      w(fd, "<style>.bench-tab{width:100%;border-collapse:collapse;font-size:.84rem}.bench-tab th,.bench-tab td{text-align:left;padding:6px 8px;border-bottom:1px solid var(--line,rgb(60,64,72));vertical-align:top}.bench-tab th{font-size:.7rem;letter-spacing:.08em;text-transform:uppercase;color:var(--mut,rgb(150,162,186))}.bench-tab td.num{font-variant-numeric:tabular-nums;text-align:right;white-space:nowrap}.bench-tab code{font-family:ui-monospace,Consolas,monospace;font-size:.78rem}.bst{font-size:.66rem;letter-spacing:.08em;text-transform:uppercase;font-weight:650;padding:2px 8px;border-radius:8px;display:inline-block;white-space:nowrap;border:1px solid var(--line,rgb(60,64,72))}.bst.ok{color:var(--nx-color-ok,rgb(26,127,55))}.bst.void{color:var(--nx-color-absent,rgb(179,38,30))}.bst.unm{color:var(--mut,rgb(150,162,186))}.bst.fail{color:var(--nx-color-part,rgb(178,106,0))}.bench-repro{font-family:ui-monospace,Consolas,monospace;font-size:.78rem;background:var(--soft,rgb(40,46,64));padding:8px 10px;border-radius:8px;overflow-x:auto;white-space:pre}.bench-ref{font-weight:600}</style>\n" as *u8)
      sc_heading_open(fd, heading_level, " class='ghead' id='bench'" as *u8); w(fd, "Measured head-to-head &mdash; a receipt, not a claim" as *u8); sc_heading_close(fd, heading_level); w(fd, "\n<div class='meth'><b>" as *u8); wnote(fd, hdr[BR_H_TITLE] as *u8); w(fd, ".</b> " as *u8); wnote(fd, hdr[BR_H_WORKLOAD] as *u8)
      w(fd, " Measured on <code>" as *u8); wnote(fd, hdr[BR_H_HOST] as *u8); w(fd, "</code> on " as *u8); w(fd, ymd); w(fd, " (unix " as *u8); wn(fd, hdr[BR_H_ASOF]); w(fd, "), " as *u8); wn(fd, hdr[BR_H_RUNS]); w(fd, " runs per arm, reference arm <span class='bench-ref'>" as *u8); wnote(fd, hdr[BR_H_REF] as *u8)
      w(fd, "</span> = 1.00x. Every arm had to print the same checksum or its row is VOID and never ranked; an arm whose toolchain is not declared on the host is UNMEASURABLE, an absence rather than a loss. Written by <code>" as *u8); wnote(fd, hdr[BR_H_WRITER] as *u8); w(fd, "</code>, re-derived here by <code>nx_bench_receipt_lib</code>: reader verdict <span class='bst " as *u8)
      if verdict == BR_V_VALID { w(fd, "ok" as *u8) } else { if verdict == BR_V_VOID { w(fd, "void" as *u8) } else { w(fd, "unm" as *u8) } }
      w(fd, "'>" as *u8); w(fd, br_verdict_name(verdict)); w(fd, "</span>, writer wrote " as *u8); w(fd, br_verdict_name(written))
      if agree == 1 { w(fd, " (writer and reader agree)" as *u8) } else { w(fd, " (<b>WRITER AND READER DISAGREE</b> -- the rows were edited after the receipt was written)" as *u8) }
      w(fd, ".</div>\n<div style='overflow-x:auto'><table class='bench-tab'><thead><tr><th>Arm</th><th>Toolchain</th><th>Version</th><th>Median &micro;s</th><th>Min &micro;s</th><th>vs reference</th><th>Checksum</th><th>Status</th><th>Runs</th><th>Source sha256</th><th>Binary</th></tr></thead><tbody>\n" as *u8)
      var k: i64 = 0
      while k < n {
          let b: i64 = k * BR_STRIDE
          let st: i64 = arms[b + BR_A_STATUS]
          w(fd, "<tr><td><b>" as *u8); wnote(fd, arms[b + BR_A_NAME] as *u8); w(fd, "</b></td><td>" as *u8); wnote(fd, arms[b + BR_A_TOOL] as *u8)
          w(fd, "</td><td><code>" as *u8); wnote(fd, arms[b + BR_A_VER] as *u8); w(fd, "</code></td><td class='num'>" as *u8)
          if st == BR_ST_VALID { wn(fd, arms[b + BR_A_MED]) } else { w(fd, "-" as *u8) }
          w(fd, "</td><td class='num'>" as *u8)
          if st == BR_ST_VALID { wn(fd, arms[b + BR_A_MIN]) } else { w(fd, "-" as *u8) }
          w(fd, "</td><td class='num'>" as *u8)
          br_ratio_text(arms[b + BR_A_RATIO], rt, 0); w(fd, rt)
          w(fd, "</td><td class='num'>" as *u8)
          if st == BR_ST_VALID { wn(fd, arms[b + BR_A_CHK]) } else { if st == BR_ST_VOID { wn(fd, arms[b + BR_A_CHK]) } else { w(fd, "-" as *u8) } }
          w(fd, "</td><td><span class='bst " as *u8); w(fd, bd_status_class(st)); w(fd, "'>" as *u8); w(fd, br_status_name(st)); w(fd, "</span>" as *u8)
          if st != BR_ST_VALID { w(fd, "<br><span class='ct'>" as *u8); wnote(fd, arms[b + BR_A_NOTE] as *u8); w(fd, "</span>" as *u8) }
          w(fd, "</td><td class='num'>" as *u8); wn(fd, arms[b + BR_A_RUNS])
          w(fd, "</td><td><code title='" as *u8); wnote(fd, arms[b + BR_A_SRC] as *u8); w(fd, "'>" as *u8); bd_sha_short(fd, arms[b + BR_A_SRCSHA] as *u8); w(fd, "</code></td><td class='num'><code>" as *u8); bd_sha_short(fd, arms[b + BR_A_BINSHA] as *u8); w(fd, "</code> " as *u8); wn(fd, arms[b + BR_A_BINBYTES]); w(fd, " B</td></tr>\n" as *u8)
          k = k + 1
      }
      w(fd, "</tbody></table></div>\n<p class='foot'>bench arms=" as *u8); wn(fd, n); w(fd, " valid=" as *u8); wn(fd, c_valid); w(fd, " void=" as *u8); wn(fd, c_void); w(fd, " unmeasurable=" as *u8); wn(fd, c_unm); w(fd, " build_fail=" as *u8); wn(fd, c_bf); w(fd, " run_fail=" as *u8); wn(fd, c_rf); w(fd, " unknown=" as *u8); wn(fd, c_unk); w(fd, " (partition sums) verdict=" as *u8); w(fd, br_verdict_name(verdict)); w(fd, "</p>\n" as *u8)
      w(fd, "<p class='foot'>reproduce: </p><div class='bench-repro'>" as *u8); wnote(fd, hdr[BR_H_REPRO] as *u8); w(fd, "</div>\n<p class='foot'>receipt: knowledge/compare/" as *u8); w(fd, dom); w(fd, ".bench &middot; a rerun on the same host that changes the ranking is a finding, not noise; a rerun on a different host is a different receipt and says so in its host line.</p>\n" as *u8)
      return n
  }
  return n
2162}
2163
2164// Additive shared dependency projection. Parsed declarations are not verified readiness.
2165// Owned by nx_swcompare_lib; no main, filesystem writes, publication or dispatch.
2166import "nx_sha256.nx"
2167const SGP_FIELDS: i64 = 8
2168const SGP_PATH_CAP: i64 = 600
2169const SGP_I64_MAX: i64 = 9223372036854775807
2170// WHY THE LEDGERS BELOW EXIST (2026-09-11): every counter in SgPlan was computed at parse time and
2171// the one consumer printed a single sentence -- malformed, missing, duplicate or cyclic -- and threw
2172// the rest away, so a refused board cost the next reader the whole investigation. The reason is in
2173// hand at the moment the defect is found; it is recorded there instead of being re-derived by hand.
2174// A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE.
2175const SGP_COLON: i64 = 58                // ':' -- the separator in a cross-board '<domain>:<rung>' ref
2176const SGP_NOTE_WORDS: i64 = 5            // one record: rule, rung-id ptr, name ptr, name len, number
2177const SGP_OFFENDER_MAX: i64 = 64         // offender rows RECORDED; offender_overflow carries the rest
2178const SGP_EXTERNAL_MAX: i64 = 64         // cross-board refs RECORDED; external_overflow carries the rest
2179const SGP_RULE_FIELDS: i64 = 1           // a rung row whose field count is not SGP_FIELDS
2180const SGP_RULE_BADID: i64 = 2            // a rung id outside the id grammar
2181const SGP_RULE_DUPID: i64 = 3            // a second declaration of one id
2182const SGP_RULE_BADDEP: i64 = 4           // a dependency token outside the id grammar
2183const SGP_RULE_MISSDEP: i64 = 5          // a dependency naming no rung on THIS plan
2184const SGP_RULE_DUPEDGE: i64 = 6          // the same dependency declared twice on one rung
2185const SGP_RULE_CYCLE: i64 = 7            // on a dependency cycle
2186const SGP_RULE_CYCLEDOWN: i64 = 8        // not on a cycle, but blocked by one
2187struct SgPlan {
  plan: *u8
  plan_bytes: i64
  plan_sha: *u8
  matrix_sha: *u8
  matrix_bytes: i64
  rank_sha: *u8
  rank_bytes: i64
  nodes: *i64
  count: i64
  declared: i64
  edges: *i64
  edge_count: i64
  malformed: i64
  duplicate_ids: i64
  duplicate_edges: i64
  missing_deps: i64
  cyclic_nodes: i64
  target_rows: i64
  role_rows: i64
  risk_rows: i64
  log_rows: i64
  rank_count: i64
  rank_mismatches: i64
  binding_rows: i64
  binding_ok: i64
  growth: *CgModel
  // ---- the offender and cross-board ledgers (2026-09-11). APPENDED, so every field above keeps
  // its place; sys_mmap zero-fills, so an unrecorded plan reads them as an empty ledger, not junk.
  external_deps: i64
  offenders: *i64
  offender_count: i64
  offender_overflow: i64
  externals: *i64
  external_count: i64
  external_overflow: i64
2223}
2224func sg_len(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { i = i + 1 } return i }
2225func sg_id(s: *u8, n: i64) -> i64 {
  if n <= 0 { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = s[i] as i64
      var ok: i64 = 0
      if c >= 48 { if c <= 57 { ok = 1 } }
      if c >= 65 { if c <= 90 { ok = 1 } }
      if c >= 97 { if c <= 122 { ok = 1 } }
      if c == 95 { ok = 1 }; if c == 45 { ok = 1 }
      if ok == 0 { return 0 }; i = i + 1
  }
  return 1
2238}
2239// Unlike splitpipe, count every field even when the caller's pointer reserve is full.
2240func sg_split(s: *u8, f: *i64, capacity: i64, delimiter: i64) -> i64 {
  var count: i64 = 1; var i: i64 = 0; f[0] = s as i64
  while s[i] != (0 as u8) {
      if s[i] == (delimiter as u8) { s[i] = 0 as u8; if count < capacity { f[count] = s as i64 + i + 1 }; count = count + 1 }
      i = i + 1
  }
  return count
2247}
2248func sg_decimal(s: *u8) -> i64 {
  if s[0] == (0 as u8) { return 0 - 1 }
  var v: i64 = 0; var i: i64 = 0
  while s[i] != (0 as u8) {
      let c: i64 = s[i] as i64; if c < 48 { return 0 - 1 }; if c > 57 { return 0 - 1 }
      let d: i64 = c - 48; if v > (SGP_I64_MAX - d) / 10 { return 0 - 1 }
      v = v * 10 + d; i = i + 1
  }
  return v
2257}
2258func sg_sha(b: *u8, n: i64) -> *u8 {
  let raw: *u8 = sys_mmap(32); let text: *u8 = sys_mmap(65)
  if (raw as i64) <= 0 { return "" as *u8 }; if (text as i64) <= 0 { return "" as *u8 }
  sha256_digest(b, n, raw)
  let digits: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < 32 { let c: i64 = raw[i] as i64; text[i*2] = digits[c / 16]; text[i*2+1] = digits[c % 16]; i = i + 1 }
  text[64] = 0 as u8; return text
2266}
2267func sg_find(m: *SgPlan, name: *u8, length: i64) -> i64 {
  var i: i64 = 0
  while i < m.count {
      let id: *u8 = m.nodes[i*SGP_FIELDS + 1] as *u8
      if sg_len(id) == length {
          var j: i64 = 0; var equal: i64 = 1
          while j < length { if id[j] != name[j] { equal = 0 }; j = j + 1 }
          if equal == 1 { return i }
      }
      i = i + 1
  }
  return 0 - 1
2279}
2280func sg_prefix_decimal(s: *u8, key: *u8) -> i64 {
  if starts(s, key) == 0 { return 0 - 1 }
  return sg_decimal((s as i64 + sg_len(key)) as *u8)
2283}
2284func sg_rank(m: *SgPlan, raw: *u8, n: i64) -> i64 {
  m.rank_count = 0 - 1
  if n <= 0 { return 0 }
  if n == SGP_I64_MAX { m.rank_mismatches = m.rank_mismatches + 1; return 0 }
  m.rank_sha = sg_sha(raw, n); m.rank_bytes = n
  if sg_len(m.rank_sha) != 64 { m.rank_mismatches = m.rank_mismatches + 1; return 0 }
  let b: *u8 = sys_mmap(n + 1); var c: i64 = 0
  if (b as i64) <= 0 { m.rank_mismatches = m.rank_mismatches + 1; return 0 }
  while c < n { if raw[c] == (0 as u8) { m.rank_mismatches = m.rank_mismatches + 1; return 0 }; b[c] = raw[c]; c = c + 1 }; b[n] = 0 as u8
  let f: *i64 = sys_mmap(12 * 8) as *i64
  if (f as i64) <= 0 { m.rank_mismatches = m.rank_mismatches + 1; return 0 }
  var pos: i64 = 0; var stamps: i64 = 0
  while pos < n {
      var end: i64 = pos; while end < n { if b[end] == (10 as u8) { break }; end = end + 1 }
      b[end] = 0 as u8; if end > pos { if b[end-1] == (13 as u8) { b[end-1] = 0 as u8 } }
      let line: *u8 = (b as i64 + pos) as *u8; pos = end + 1
      if starts(line, "# inputs_v=" as *u8) == 1 {
          m.binding_rows = m.binding_rows + 1
          let nf: i64 = sg_split(line, f, 12, 32)
          if nf == 6 {
              if streq(f[1] as *u8, "inputs_v=1" as *u8) == 1 {
                  let ps: *u8 = f[2] as *u8; let ms: *u8 = f[4] as *u8
                  if starts(ps, "plan_sha256=" as *u8) == 1 { if starts(ms, "matrix_sha256=" as *u8) == 1 {
                      if streq((ps as i64 + 12) as *u8, m.plan_sha) == 1 { if streq((ms as i64 + 14) as *u8, m.matrix_sha) == 1 {
                          if sg_prefix_decimal(f[3] as *u8, "plan_bytes=" as *u8) == m.plan_bytes {
                              if sg_prefix_decimal(f[5] as *u8, "matrix_bytes=" as *u8) == m.matrix_bytes { m.binding_ok = 1 }
                          }
                      } }
                  } }
              }
          }
      } else {
          if starts(line, "# asof=" as *u8) == 1 {
              stamps = stamps + 1
              let nf: i64 = sg_split(line, f, 12, 32)
              if nf > 12 { m.rank_mismatches = m.rank_mismatches + 1 } else {
                  var z: i64 = 0; var found: i64 = 0
                  while z < nf { if starts(f[z] as *u8, "rungs=" as *u8) == 1 { found = found + 1; m.rank_count = sg_prefix_decimal(f[z] as *u8, "rungs=" as *u8) }; z = z + 1 }
                  if found != 1 { m.rank_mismatches = m.rank_mismatches + 1 }
              }
          } else {
              if starts(line, "rank|" as *u8) == 1 {
                  let nf: i64 = sg_split(line, f, 12, 124)
                  if nf != 10 { m.rank_mismatches = m.rank_mismatches + 1 } else {
                      let id: *u8 = f[3] as *u8; let idx: i64 = sg_find(m, id, sg_len(id))
                      if idx < 0 { m.rank_mismatches = m.rank_mismatches + 1 } else {
                          if streq(f[9] as *u8, m.nodes[idx*SGP_FIELDS+3] as *u8) == 0 { m.rank_mismatches = m.rank_mismatches + 1 }
                      }
                  }
              }
          }
      }
  }
  if stamps != 1 { m.rank_mismatches = m.rank_mismatches + 1 }
  if m.binding_rows != 1 { m.binding_ok = 0 }
  if m.matrix_bytes <= 0 { m.binding_ok = 0 }
  return 0
2341}
2342// ---- THE OFFENDER AND CROSS-BOARD LEDGERS (2026-09-11) -----------------------------------------
2343// Both lists are BOUNDED and say so: the counters are the complete population, these are the
2344// worklist, and anything that does not fit is announced as an unlisted count, never dropped silently.
2345func sg_colon(s: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { if s[i] == (SGP_COLON as u8) { return i }; i = i + 1 }
  return 0 - 1
2349}
2350func sg_rule_name(rule: i64) -> *u8 {
  if rule == SGP_RULE_FIELDS { return "field-count" as *u8 }
  if rule == SGP_RULE_BADID { return "bad-id" as *u8 }
  if rule == SGP_RULE_DUPID { return "duplicate-id" as *u8 }
  if rule == SGP_RULE_BADDEP { return "bad-dep-id" as *u8 }
  if rule == SGP_RULE_MISSDEP { return "missing-dep" as *u8 }
  if rule == SGP_RULE_DUPEDGE { return "duplicate-edge" as *u8 }
  if rule == SGP_RULE_CYCLE { return "cycle" as *u8 }
  if rule == SGP_RULE_CYCLEDOWN { return "cycle-downstream" as *u8 }
  return "unnamed-rule" as *u8
2360}
2361// A record is written ONLY when there is room; the caller counts the ones that did not fit.
2362func sg_note(list: *i64, count: i64, capacity: i64, rule: i64, rung: *u8, name: *u8, length: i64, number: i64) -> i64 {
  if (list as i64) <= 0 { return 0 }
  if count >= capacity { return 0 }
  let b: i64 = count * SGP_NOTE_WORDS
  list[b] = rule; list[b+1] = rung as i64; list[b+2] = name as i64; list[b+3] = length; list[b+4] = number
  return 1
2368}
2369func sg_offend(m: *SgPlan, rule: i64, rung: *u8, name: *u8, length: i64, number: i64) -> i64 {
  if sg_note(m.offenders, m.offender_count, SGP_OFFENDER_MAX, rule, rung, name, length, number) == 1 { m.offender_count = m.offender_count + 1; return 1 }
  m.offender_overflow = m.offender_overflow + 1
  return 0
2373}
2374func sg_extern(m: *SgPlan, rung: *u8, name: *u8, length: i64) -> i64 {
  if sg_note(m.externals, m.external_count, SGP_EXTERNAL_MAX, 0, rung, name, length, 0) == 1 { m.external_count = m.external_count + 1; return 1 }
  m.external_overflow = m.external_overflow + 1
  return 0
2378}
2379// ONE emitter, so no caller can print a count without its worklist. COUNTERS FIRST: a reader that
2380// truncates keeps the population line, and the per-row detail follows it.
2381func sg_graph_text(m: *SgPlan, fd: i64) -> i64 {
  if (m as i64) <= 0 { w(fd, "GRAPH capture=UNAVAILABLE\n" as *u8); return 0 }
  w(fd, "GRAPH declared=" as *u8); wn(fd, m.declared)
  w(fd, " nodes=" as *u8); wn(fd, m.count)
  w(fd, " edges=" as *u8); wn(fd, m.edge_count)
  w(fd, " malformed=" as *u8); wn(fd, m.malformed)
  w(fd, " duplicate_ids=" as *u8); wn(fd, m.duplicate_ids)
  w(fd, " duplicate_edges=" as *u8); wn(fd, m.duplicate_edges)
  w(fd, " missing_deps=" as *u8); wn(fd, m.missing_deps)
  w(fd, " cyclic_nodes=" as *u8); wn(fd, m.cyclic_nodes)
  w(fd, " external_deps=" as *u8); wn(fd, m.external_deps)
  w(fd, " offenders_listed=" as *u8); wn(fd, m.offender_count)
  w(fd, " offenders_unlisted=" as *u8); wn(fd, m.offender_overflow)
  w(fd, " offender_cap=" as *u8); wn(fd, SGP_OFFENDER_MAX)
  w(fd, " externals_listed=" as *u8); wn(fd, m.external_count)
  w(fd, " externals_unlisted=" as *u8); wn(fd, m.external_overflow)
  w(fd, " external_cap=" as *u8); wn(fd, SGP_EXTERNAL_MAX)
  w(fd, "\n" as *u8)
  var i: i64 = 0
  while i < m.offender_count {
      let ob: i64 = i * SGP_NOTE_WORDS
      w(fd, "GRAPH OFFENDER rung=" as *u8); w(fd, m.offenders[ob+1] as *u8)
      w(fd, " rule=" as *u8); w(fd, sg_rule_name(m.offenders[ob]))
      if m.offenders[ob+3] > 0 { w(fd, " dep=" as *u8); sys_write(fd, m.offenders[ob+2] as *u8, m.offenders[ob+3]) }
      if m.offenders[ob] == SGP_RULE_FIELDS { w(fd, " fields=" as *u8); wn(fd, m.offenders[ob+4]); w(fd, " expected=" as *u8); wn(fd, SGP_FIELDS) }
      w(fd, "\n" as *u8)
      i = i + 1
  }
  if m.offender_overflow > 0 { w(fd, "GRAPH OFFENDER-OVERFLOW unlisted=" as *u8); wn(fd, m.offender_overflow); w(fd, " -- the counters above are the whole population; this list stops at offender_cap\n" as *u8) }
  var e: i64 = 0
  while e < m.external_count {
      let xb: i64 = e * SGP_NOTE_WORDS
      w(fd, "GRAPH EXTERNAL rung=" as *u8); w(fd, m.externals[xb+1] as *u8)
      w(fd, " ref=" as *u8); sys_write(fd, m.externals[xb+2] as *u8, m.externals[xb+3])
      w(fd, " -- cross-board reference: recorded, NOT an edge on this plan and NOT a refusal\n" as *u8)
      e = e + 1
  }
  if m.external_overflow > 0 { w(fd, "GRAPH EXTERNAL-OVERFLOW unlisted=" as *u8); wn(fd, m.external_overflow); w(fd, "\n" as *u8) }
  return 0
2420}
2421func sg_parse(raw: *u8, n: i64, rank: *u8, rn: i64, matrix: *u8, mn: i64) -> *SgPlan {
  // SgPlan stores 33 pointer/i64 fields, each one native 64-bit word.
  let m: *SgPlan = sys_mmap(33 * 8) as *SgPlan
  if (m as i64) <= 0 { return 0 as *SgPlan }
  m.rank_count = 0 - 1; m.matrix_bytes = mn
  m.plan_sha = "" as *u8; m.matrix_sha = "" as *u8; m.rank_sha = "" as *u8
  if n <= 0 { m.malformed = 1; return m }
  if (raw as i64) <= 0 { m.malformed = 1; return m }
  // Reserve arithmetic is bounded by the input byte count, not a policy cutoff.
  if n > SGP_I64_MAX / (SGP_FIELDS * 8) - 1 { m.malformed = 1; return m }
  if rn < 0 { m.malformed = 1; return m }; if mn < 0 { m.malformed = 1; return m }
  if rn > 0 { if (rank as i64) <= 0 { m.malformed = 1; return m } }
  if mn > 0 { if (matrix as i64) <= 0 { m.malformed = 1; return m } }
  m.growth = cg_parse(raw, n)
  m.plan_bytes = n; m.plan_sha = sg_sha(raw, n)
  if sg_len(m.plan_sha) != 64 { m.malformed = 1; return m }
  if mn > 0 { m.matrix_sha = sg_sha(matrix, mn); if sg_len(m.matrix_sha) != 64 { m.malformed = 1; return m } }
  let b: *u8 = sys_mmap(n + 1); m.plan = b
  if (b as i64) <= 0 { m.malformed = 1; return m }
  var maxrows: i64 = 1; var maxedges: i64 = 1; var c: i64 = 0
  while c < n {
      if raw[c] == (0 as u8) { m.malformed = m.malformed + 1 }
      if raw[c] == (10 as u8) { maxrows = maxrows + 1; maxedges = maxedges + 1 }
      if raw[c] == (44 as u8) { maxedges = maxedges + 1 }
      b[c] = raw[c]; c = c + 1
  }
  b[n] = 0 as u8
  m.nodes = sys_mmap(maxrows * SGP_FIELDS * 8) as *i64
  m.edges = sys_mmap(maxedges * 2 * 8) as *i64
  // The two ledgers. A failed reserve is DELIBERATELY NOT a malformed board: sg_note refuses to
  // write and the unlisted counter carries it, so losing the worklist can never change a verdict.
  m.offenders = sys_mmap(SGP_OFFENDER_MAX * SGP_NOTE_WORDS * 8) as *i64
  m.externals = sys_mmap(SGP_EXTERNAL_MAX * SGP_NOTE_WORDS * 8) as *i64
  let f: *i64 = sys_mmap(SGP_FIELDS * 8) as *i64
  if (m.nodes as i64) <= 0 { m.malformed = 1; return m }
  if (m.edges as i64) <= 0 { m.malformed = 1; return m }
  if (f as i64) <= 0 { m.malformed = 1; return m }
  var pos: i64 = 0
  while pos < n {
      var end: i64 = pos; while end < n { if b[end] == (10 as u8) { break }; end = end + 1 }
      b[end] = 0 as u8; if end > pos { if b[end-1] == (13 as u8) { b[end-1] = 0 as u8 } }
      let line: *u8 = (b as i64 + pos) as *u8; pos = end + 1
      if starts(line, "sotatarget|" as *u8) == 1 { m.target_rows = m.target_rows + 1 }
      if starts(line, "rungrole|" as *u8) == 1 { m.role_rows = m.role_rows + 1 }
      if starts(line, "risk|" as *u8) == 1 { m.risk_rows = m.risk_rows + 1 }
      if starts(line, "log|" as *u8) == 1 { m.log_rows = m.log_rows + 1 }
      if starts(line, "rung|" as *u8) == 1 {
          m.declared = m.declared + 1
          let nf: i64 = sg_split(line, f, SGP_FIELDS, 124)
          // f[1] is the id field. The line began with "rung|", so the split produced at least two
          // fields and f[1] is set even on a row whose field COUNT is wrong -- which is exactly the
          // row a reader most needs named.
          if nf != SGP_FIELDS { m.malformed = m.malformed + 1; sg_offend(m, SGP_RULE_FIELDS, f[1] as *u8, "" as *u8, 0, nf) } else {
              let id: *u8 = f[1] as *u8
              if sg_id(id, sg_len(id)) == 0 { m.malformed = m.malformed + 1; sg_offend(m, SGP_RULE_BADID, id, "" as *u8, 0, 0) } else {
                  if sg_find(m, id, sg_len(id)) >= 0 { m.duplicate_ids = m.duplicate_ids + 1; sg_offend(m, SGP_RULE_DUPID, id, "" as *u8, 0, 0) } else {
                      var j: i64 = 0; while j < SGP_FIELDS { m.nodes[m.count*SGP_FIELDS+j] = f[j]; j = j + 1 }
                      m.count = m.count + 1
                  }
              }
          }
      }
  }
  var node: i64 = 0
  while node < m.count {
      let deps: *u8 = m.nodes[node*SGP_FIELDS+7] as *u8
      if streq(deps, "-" as *u8) == 0 {
          var start: i64 = 0; var at: i64 = 0; var more: i64 = 1
          while more == 1 {
              var delimiter: i64 = 0
              if deps[at] == (0 as u8) { more = 0; delimiter = 1 }
              if deps[at] == (44 as u8) { delimiter = 1 }
              if delimiter == 1 {
              let length: i64 = at - start
              let name: *u8 = (deps as i64 + start) as *u8
              let rid: *u8 = m.nodes[node*SGP_FIELDS+1] as *u8
              // '<domain>:<rung>' is a DECLARED cross-board reference. The other board is not loaded
              // here, so it is RECORDED and COUNTED -- never an edge on this graph, and never a
              // refusal. A BARE unknown id still refuses, so the syntax IS the declaration and this
              // cannot launder a typo: 'gen:' or ':G16' or 'a:b:c' fail the id grammar below and
              // stay malformed, named as bad-dep-id.
              var ext: i64 = 0
              let colon: i64 = sg_colon(name, length)
              if colon > 0 { if sg_id(name, colon) == 1 { if sg_id((name as i64 + colon + 1) as *u8, length - colon - 1) == 1 { ext = 1 } } }
              if ext == 1 { m.external_deps = m.external_deps + 1; sg_extern(m, rid, name, length) } else {
              if sg_id(name, length) == 0 { m.malformed = m.malformed + 1; sg_offend(m, SGP_RULE_BADDEP, rid, name, length, 0) } else {
                  let dep: i64 = sg_find(m, name, length)
                  if dep < 0 { m.missing_deps = m.missing_deps + 1; sg_offend(m, SGP_RULE_MISSDEP, rid, name, length, 0) } else {
                      var duplicate: i64 = 0; var e: i64 = 0
                      while e < m.edge_count { if m.edges[e*2] == dep { if m.edges[e*2+1] == node { duplicate = 1 } }; e = e + 1 }
                      if duplicate == 1 { m.duplicate_edges = m.duplicate_edges + 1; sg_offend(m, SGP_RULE_DUPEDGE, rid, name, length, 0) } else {
                          m.edges[m.edge_count*2] = dep; m.edges[m.edge_count*2+1] = node; m.edge_count = m.edge_count + 1
                      }
                  }
              }
              }
              start = at + 1
              }
              at = at + 1
          }
      }
      node = node + 1
  }
  let degree: *i64 = sys_mmap((m.count+1)*8) as *i64
  let visited: *i64 = sys_mmap((m.count+1)*8) as *i64
  if (degree as i64) <= 0 { m.malformed = 1; return m }
  if (visited as i64) <= 0 { m.malformed = 1; return m }
  var e: i64 = 0; while e < m.edge_count { let to: i64 = m.edges[e*2+1]; degree[to] = degree[to] + 1; e = e + 1 }
  var removed: i64 = 0; var progress: i64 = 1
  while progress == 1 {
      progress = 0; var i: i64 = 0
      while i < m.count {
          if visited[i] == 0 { if degree[i] == 0 {
              visited[i] = 1; removed = removed + 1; progress = 1
              var j: i64 = 0; while j < m.edge_count { if m.edges[j*2] == i { let to: i64 = m.edges[j*2+1]; degree[to] = degree[to] - 1 }; j = j + 1 }
          } }
          i = i + 1
      }
  }
  m.cyclic_nodes = m.count - removed
  // Kahn's residue is ON a cycle OR BLOCKED BY one, and those two need OPPOSITE edits, so the
  // ledger names which. Reverse trim: a residual node that no residual node depends on cannot be on
  // a cycle. What survives the trim is the cycle core. Runs ONLY when there is a residue, so a valid
  // board pays nothing for it.
  if m.cyclic_nodes > 0 {
      let core: *i64 = sys_mmap((m.count+1)*8) as *i64
      if (core as i64) > 0 {
          var ci: i64 = 0
          while ci < m.count { if visited[ci] == 0 { core[ci] = 1 }; ci = ci + 1 }
          var trimming: i64 = 1
          while trimming == 1 {
              trimming = 0
              var t: i64 = 0
              while t < m.count {
                  if core[t] == 1 {
                      var out: i64 = 0
                      var te: i64 = 0
                      while te < m.edge_count { if m.edges[te*2] == t { if core[m.edges[te*2+1]] == 1 { out = out + 1 } }; te = te + 1 }
                      if out == 0 { core[t] = 0; trimming = 1 }
                  }
                  t = t + 1
              }
          }
          var cz: i64 = 0
          while cz < m.count {
              if visited[cz] == 0 {
                  var rule: i64 = SGP_RULE_CYCLEDOWN
                  if core[cz] == 1 { rule = SGP_RULE_CYCLE }
                  sg_offend(m, rule, m.nodes[cz*SGP_FIELDS+1] as *u8, "" as *u8, 0, 0)
              }
              cz = cz + 1
          }
      }
  }
  sg_rank(m, rank, rn)
  return m
2577}
2578func sg_valid(m: *SgPlan) -> i64 {
  if (m as i64) <= 0 { return 0 }
  if m.malformed + m.duplicate_ids + m.duplicate_edges + m.missing_deps + m.cyclic_nodes != 0 { return 0 }
  return 1
2582}
2583func sg_rank_state(m: *SgPlan) -> *u8 {
  if m.rank_bytes <= 0 { return "UNAVAILABLE" as *u8 }
  if m.rank_count != m.declared { return "STALE_INCONSISTENT" as *u8 }
  if m.rank_mismatches > 0 { return "STALE_INCONSISTENT" as *u8 }
  if m.binding_rows > 1 { return "INVALID_BINDING" as *u8 }
  if m.binding_rows == 1 { if m.binding_ok == 0 { return "STALE_OR_INVALID_BINDING" as *u8 } }
  if m.binding_ok == 1 { return "PLAN_MATRIX_BOUND_ONLY" as *u8 }
  return "UNBOUND" as *u8
2591}
2592func sg_load(domain: *u8) -> *SgPlan {
  let path: *u8 = sys_mmap(SGP_PATH_CAP)
  if (path as i64) <= 0 { return 0 as *SgPlan }
  let prefix: *u8 = "knowledge/compare/" as *u8
  let dn: i64 = sg_len(domain)
  if dn + sg_len(prefix) + sg_len(".matrix") + 1 > SGP_PATH_CAP { return 0 as *SgPlan }
  if sg_id(domain, dn) == 0 { return 0 as *SgPlan }
  let base: i64 = scopy(path, 0, prefix)
  let tail: i64 = scopy(path, base, domain)
  let plen: *i64 = sys_mmap(16) as *i64; let rlen: *i64 = sys_mmap(16) as *i64; let mlen: *i64 = sys_mmap(16) as *i64
  if (plen as i64) <= 0 { return 0 as *SgPlan }; if (rlen as i64) <= 0 { return 0 as *SgPlan }; if (mlen as i64) <= 0 { return 0 as *SgPlan }
  var end: i64 = scopy(path, tail, ".plan" as *u8); path[end] = 0 as u8
  let p: *u8 = sys_read_file(path, plen)
  if (p as i64) == 0 { return 0 as *SgPlan }
  end = scopy(path, tail, ".rank" as *u8); path[end] = 0 as u8
  let r: *u8 = sys_read_file(path, rlen)
  if (r as i64) == 0 { rlen[0] = 0 }
  end = scopy(path, tail, ".matrix" as *u8); path[end] = 0 as u8
  let x: *u8 = sys_read_file(path, mlen)
  if (x as i64) == 0 { mlen[0] = 0 }
  return sg_parse(p, plen[0], r, rlen[0], x, mlen[0])
2613}
2614
2615// Growth projects the same borrowed plan capture; eligibility remains a separate unverified axis.
2616func sg_growth_json(g: *CgModel,fd: i64) -> i64 {
  if (g as i64)<=0 { w(fd,"null" as *u8); return 0 }
  // Six bytes is JSON's maximum one-input-byte escape (\\u00xx).
  // Fixed overhead is derived from the projection's complete literal inventory, once per possible row.
  let inventory: *u8="\"nx_compare_growth_lib_20260910.nx\",:{}[]\"json_emit.nx\",:{}[]\"id\",:{}[]\"rung_id\",:{}[]\"entry_basis\",:{}[]\"target_id\",:{}[]\"research_refs_authored\",:{}[]\"learned_model_authored\",:{}[]\"questions_authored\",:{}[]\"path_id\",:{}[]\"prerequisite_exercises_authored\",:{}[]\"contract_symbol_authored\",:{}[]\"tool_or_api_ref_authored\",:{}[]\"workload_ref_authored\",:{}[]\"resource_ref_authored\",:{}[]\"acceptance_ref_authored\",:{}[]\"failure_next_authored\",:{}[]\"path_id\",:{}[]\"scope_authored\",:{}[]\"asserted_stage\",:{}[]\"evidence_refs_authored\",:{}[]\"assessed_unix_text\",:{}[]\"assessor_ref_authored\",:{}[]\"supersedes_assessment_id_authored\",:{}[]\"evidence_validated_stage\",:{}[]\"evidence_verified\",:{}[]\"evidence_age_seconds\",:{}[]\"investment_observed\",:{}[]\"investment_uncertainty\",:{}[]\"reference_resolution\",:{}[]\"local_graph_only_external_refs_unresolved\",:{}[]\"v\",:{}[]\"status\",:{}[]\"invalid_authored_growth\",:{}[]\"not_declared\",:{}[]\"authored_graph_valid\",:{}[]\"code\",:{}[]\"error_growth_row\",:{}[]\"scope\",:{}[]\"authored_growth_graph_not_behavior_or_mastery\",:{}[]\"paths\",:{}[]\"exercises\",:{}[]\"assessments\",:{}[]" as *u8
  let fixed: i64=bf_slen(inventory)
  if g.count>=SGP_I64_MAX/fixed-1 { w(fd,"{\"v\":1,\"status\":\"projection_unavailable\",\"code\":-2}" as *u8); return 0 }
  let structural: i64=(g.count+1)*fixed
  if g.n>(SGP_I64_MAX-structural-1)/6 { w(fd,"{\"v\":1,\"status\":\"projection_unavailable\",\"code\":-2}" as *u8); return 0 }
  let capacity: i64=g.n*6+structural
  let out: *u8=sys_mmap(capacity+1)
  if (out as i64)<=0 { w(fd,"{\"v\":1,\"status\":\"projection_unavailable\",\"code\":-2}" as *u8); return 0 }
  let n: i64=cg_json_into(g,out,capacity)
  if n<0 { w(fd,"{\"v\":1,\"status\":\"projection_unavailable\",\"code\":-2}" as *u8) } else { out[n]=0 as u8; w(fd,out) }
  sys_munmap(out,capacity+1); return n
2631}
2632func sg_growth_text(g: *CgModel,row: i64,col: i64,fd: i64) -> i64 {
  var offset: i64=0; let n: i64=cg_field(g,row,col,&offset)
  if n<0 { w(fd,"[field unavailable]" as *u8); return 0 }
  let text: *u8=sys_mmap(n+1)
  if (text as i64)<=0 { w(fd,"[field unavailable]" as *u8); return 0 }
  var i: i64=0; while i<n { text[i]=g.plan[offset+i]; i=i+1 }; text[n]=0 as u8
  sg_text(fd,text); sys_munmap(text,n+1); return n
2639}
2640func sg_growth_detail(g: *CgModel,row: i64,col: i64,label: *u8,fd: i64) -> i64 {
  w(fd,"<dt>" as *u8); w(fd,label); w(fd,"</dt><dd>" as *u8); sg_growth_text(g,row,col,fd); w(fd,"</dd>" as *u8); return 0
2642}
2643func sg_growth_html(g: *CgModel,fd: i64,heading: i64) -> i64 {
  w(fd,"<section class='capability-growth' aria-label='Learning and practice paths'>" as *u8)
  sc_heading_open(fd,heading,"" as *u8); w(fd,"Learning and practice paths" as *u8); sc_heading_close(fd,heading)
  if (g as i64)<=0 { w(fd,"<p>Growth capture unavailable.</p></section>" as *u8); return 0 }
  if g.error!=0 {
      w(fd,"<p>Invalid authored growth data. Error " as *u8); wn(fd,g.error); w(fd," at growth row " as *u8); wn(fd,g.error_row)
      w(fd,". Path details withheld; existing capability evidence retains its own scope.</p></section>" as *u8); return 0
  }
  if g.count==0 { w(fd,"<p>No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.</p></section>" as *u8); return 0 }
  w(fd,"<p>Paths can begin with proactive research, an observed failure or an operator target. Prerequisites below are authored and structurally checked; execution readiness, evidence validity and investment remain unknown. An asserted stage does not establish mastery or innovation.</p>" as *u8)
  var p: i64=0
  while p<g.count {
      if g.rows[p*CG_ROW_WORDS]==CG_PATH {
          w(fd,"<details><summary>Path " as *u8); sg_growth_text(g,p,2,fd); w(fd," for rung " as *u8); sg_growth_text(g,p,3,fd); w(fd,"</summary><dl>" as *u8)
          sg_growth_detail(g,p,4,"Entry",fd); sg_growth_detail(g,p,5,"Target",fd); sg_growth_detail(g,p,6,"Research references (unresolved)",fd)
          sg_growth_detail(g,p,7,"Learned model (authored)",fd); sg_growth_detail(g,p,8,"Open questions",fd); w(fd,"</dl>" as *u8)
          w(fd,"<p><b>Practice exercises</b></p><ul>" as *u8)
          var e: i64=0; var exercises: i64=0
          while e<g.count {
              if g.rows[e*CG_ROW_WORDS]==CG_EXERCISE { if cg_same(g,e,3,p,2)==1 {
                  exercises=exercises+1
                  w(fd,"<li><details><summary>Exercise " as *u8); sg_growth_text(g,e,2,fd); w(fd," &mdash; readiness unverified</summary><dl>" as *u8)
                  sg_growth_detail(g,e,4,"Declared prerequisites",fd); sg_growth_detail(g,e,5,"Capability contract",fd)
                  sg_growth_detail(g,e,6,"Tool or API reference (unresolved)",fd); sg_growth_detail(g,e,7,"Workload reference",fd)
                  sg_growth_detail(g,e,8,"Resource envelope reference",fd); sg_growth_detail(g,e,9,"Acceptance reference",fd)
                  sg_growth_detail(g,e,10,"If practice fails",fd); w(fd,"</dl></details></li>" as *u8)
              } }
              e=e+1
          }
          w(fd,"</ul>" as *u8); if exercises==0 { w(fd,"<p>No practice exercise declared.</p>" as *u8) }
          w(fd,"<p><b>Assessment history</b></p><ul>" as *u8)
          var a: i64=0; var assessments: i64=0
          while a<g.count {
              if g.rows[a*CG_ROW_WORDS]==CG_ASSESSMENT { if cg_same(g,a,3,p,2)==1 {
                  assessments=assessments+1
                  w(fd,"<li><details><summary>Assessment " as *u8); sg_growth_text(g,a,2,fd); w(fd," &mdash; asserted " as *u8); sg_growth_text(g,a,5,fd)
                  w(fd,"; evidence not validated</summary><dl>" as *u8)
                  sg_growth_detail(g,a,4,"Scope",fd); sg_growth_detail(g,a,6,"Evidence references (unresolved)",fd)
                  sg_growth_detail(g,a,7,"Authored assessment epoch",fd); sg_growth_detail(g,a,8,"Assessor reference",fd)
                  sg_growth_detail(g,a,9,"Supersedes assessment",fd); w(fd,"</dl></details></li>" as *u8)
              } }
              a=a+1
          }
          w(fd,"</ul>" as *u8); if assessments==0 { w(fd,"<p>No assessment declared.</p>" as *u8) }
          w(fd,"<p>Verified stage: unknown. Observed investment and uncertainty: unknown. No dispatch recommendation is made.</p></details>" as *u8)
      }
      p=p+1
  }
  w(fd,"</section>" as *u8); return 0
2692}
2693
2694func sg_json(m: *SgPlan, fd: i64) -> i64 {
  w(fd, ",\"ladder\":{\"v\":1,\"availability\":" as *u8)
  if (m as i64) == 0 { w(fd, "\"UNAVAILABLE\"}" as *u8); return 0 }
  w(fd, "\"CAPTURED\"," as *u8); kv_s(fd, "plan_sha256" as *u8, m.plan_sha); wc(fd, 44); kv_n(fd, "plan_bytes" as *u8, m.plan_bytes)
  wc(fd, 44); kv_s(fd, "matrix_sha256" as *u8, m.matrix_sha); wc(fd, 44); kv_n(fd, "matrix_bytes" as *u8, m.matrix_bytes)
  wc(fd, 44); kv_s(fd, "rank_sha256" as *u8, m.rank_sha); wc(fd, 44); kv_n(fd, "rank_bytes" as *u8, m.rank_bytes)
  wc(fd, 44); kv_s(fd, "rank_binding" as *u8, sg_rank_state(m)); wc(fd, 44); kv_n(fd, "rank_declared_nodes" as *u8, m.rank_count)
  wc(fd, 44); kv_n(fd, "rank_symbol_or_shape_errors" as *u8, m.rank_mismatches)
  wc(fd, 44); kv_n(fd, "declared_nodes" as *u8, m.declared); wc(fd, 44); kv_n(fd, "parsed_nodes" as *u8, m.count)
  wc(fd, 44); kv_n(fd, "declared_graph_valid" as *u8, sg_valid(m))
  wc(fd, 44); kv_n(fd, "malformed" as *u8, m.malformed); wc(fd, 44); kv_n(fd, "duplicate_ids" as *u8, m.duplicate_ids)
  wc(fd, 44); kv_n(fd, "duplicate_dependencies" as *u8, m.duplicate_edges); wc(fd, 44); kv_n(fd, "missing_dependencies" as *u8, m.missing_deps)
  wc(fd, 44); kv_n(fd, "cyclic_or_cycle_dependent_nodes" as *u8, m.cyclic_nodes)
  wc(fd, 44); kv_n(fd, "target_rows" as *u8, m.target_rows); wc(fd, 44); kv_n(fd, "role_rows" as *u8, m.role_rows)
  wc(fd, 44); kv_n(fd, "unprojected_risk_rows" as *u8, m.risk_rows); wc(fd, 44); kv_n(fd, "worklog_rows" as *u8, m.log_rows)
  w(fd, ",\"defaults\":{\"implementation\":\"UNKNOWN\",\"verification\":\"UNVERIFIED\",\"eligibility\":\"UNVERIFIED\",\"target_binding\":\"UNVERIFIED\",\"responsible\":null,\"accountable\":null,\"verifier\":null},\"eligible_now\":[],\"eligible_set_complete\":false,\"recommended\":[],\"recommendation_state\":\"WITHHELD\",\"changed_since_supported\":false,\"next_cursor\":null,\"nodes\":[" as *u8)
  if sg_valid(m) == 1 {
      var i: i64 = 0
      while i < m.count {
          if i > 0 { wc(fd, 44) }; wc(fd, 123)
          kv_s(fd, "id" as *u8, m.nodes[i*SGP_FIELDS+1] as *u8); wc(fd, 44); kv_s(fd, "title" as *u8, m.nodes[i*SGP_FIELDS+2] as *u8)
          wc(fd, 44); kv_s(fd, "contract_symbol" as *u8, m.nodes[i*SGP_FIELDS+3] as *u8)
          wc(fd, 44); kv_s(fd, "acceptance_authored" as *u8, m.nodes[i*SGP_FIELDS+4] as *u8)
          wc(fd, 44); kv_s(fd, "executor_kind_authored" as *u8, m.nodes[i*SGP_FIELDS+5] as *u8)
          wc(fd, 44); kv_s(fd, "effort_authored" as *u8, m.nodes[i*SGP_FIELDS+6] as *u8)
          w(fd, ",\"forecast\":false,\"prerequisites\":[" as *u8)
          var e: i64 = 0; var shown: i64 = 0
          while e < m.edge_count {
              if m.edges[e*2+1] == i { if shown > 0 { wc(fd, 44) }; let from: i64 = m.edges[e*2]; wq(fd); wj(fd, m.nodes[from*SGP_FIELDS+1] as *u8); wq(fd); shown = shown + 1 }
              e = e + 1
          }
          w(fd, "]}" as *u8); i = i + 1
      }
  }
  w(fd, "],\"capability_growth\":" as *u8); sg_growth_json(m.growth, fd)
  w(fd, "}" as *u8); return 0
2730}
2731// Literal authored fields use the existing text escaper; citation expansion is not needed here.
2732func sg_text(fd: i64, s: *u8) -> i64 {
  let n: i64 = sg_len(s)
  if n > (SGP_I64_MAX - IA_SEP_AND_NUL) / IA_MAX_EXPANSION - 1 { w(fd, "[text unavailable]" as *u8); return 0 }
  let cap: i64 = (n + 1) * IA_MAX_EXPANSION + IA_SEP_AND_NUL
  let out: *u8 = sys_mmap(cap); let cut: *i64 = sys_mmap(8) as *i64
  if (out as i64) <= 0 { w(fd, "[text unavailable]" as *u8); return 0 }
  if (cut as i64) <= 0 { w(fd, "[text unavailable]" as *u8); return 0 }
  let written: i64 = ia_esc_text(out, 0, s, cap, cut)
  if cut[0] != 0 { w(fd, "[text unavailable]" as *u8); return 0 }
  w(fd, out); return written
2742}
2743func sg_html(m: *SgPlan, fd: i64) -> i64 { return sg_html_heading(m, fd, 2) }
2744func sg_html_heading(m: *SgPlan, fd: i64, heading_level: i64) -> i64 {
  w(fd, "<section class='ladder-model' aria-label='Declared prerequisite paths'>" as *u8); sc_heading_open(fd, heading_level, "" as *u8); w(fd, "Inspect a rung and its prerequisites" as *u8); sc_heading_close(fd, heading_level)
  if (m as i64) == 0 { w(fd, "<p>Plan unavailable; no path or eligibility can be established.</p></section>" as *u8); return 0 }
  w(fd, "<p>Declared nodes " as *u8); wn(fd, m.declared); w(fd, ". Rank input binding: <b>" as *u8); w(fd, sg_rank_state(m))
  w(fd, "</b>. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.</p><p>Plan SHA-256 <code>" as *u8); w(fd, m.plan_sha); w(fd, "</code>. Target rows " as *u8); wn(fd, m.target_rows)
  w(fd, "; role rows " as *u8); wn(fd, m.role_rows); w(fd, ". Existing risks and release worklog retain their own scope; no node completion is inferred.</p>" as *u8)
  if sg_valid(m) == 0 {
      w(fd, "<p><b>Invalid declared graph.</b> Malformed rows or IDs " as *u8); wn(fd, m.malformed); w(fd, "; duplicate IDs " as *u8); wn(fd, m.duplicate_ids)
      w(fd, "; duplicate prerequisites " as *u8); wn(fd, m.duplicate_edges); w(fd, "; missing prerequisites " as *u8); wn(fd, m.missing_deps)
      w(fd, "; cyclic or cycle-dependent nodes " as *u8); wn(fd, m.cyclic_nodes); w(fd, ". Node paths withheld.</p></section>" as *u8)
      sg_growth_html(m.growth, fd, heading_level)
      return 0
  }
  w(fd, "<p>Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.</p><ol class='ladder-nodes'>" as *u8)
  var i: i64 = 0
  while i < m.count {
      let id: *u8 = m.nodes[i*SGP_FIELDS+1] as *u8
      w(fd, "<li><details id='ladder-node-" as *u8); w(fd, id); w(fd, "'><summary>" as *u8); w(fd, id); w(fd, " &mdash; " as *u8); sg_text(fd, m.nodes[i*SGP_FIELDS+2] as *u8)
      w(fd, "</summary><p><b>Prerequisites:</b> " as *u8)
      var e: i64 = 0; var shown: i64 = 0
      while e < m.edge_count {
          if m.edges[e*2+1] == i {
              let from: i64 = m.edges[e*2]; let dep: *u8 = m.nodes[from*SGP_FIELDS+1] as *u8
              if shown > 0 { w(fd, ", " as *u8) }; w(fd, "<a href='#ladder-node-" as *u8); w(fd, dep); w(fd, "'>" as *u8); w(fd, dep); w(fd, "</a> (acceptance unverified)" as *u8); shown = shown + 1
          }; e = e + 1
      }
      if shown == 0 { w(fd, "None declared; this does not establish execution eligibility." as *u8) }
      w(fd, "</p><p><b>Contract:</b> <code>" as *u8); sg_text(fd, m.nodes[i*SGP_FIELDS+3] as *u8); w(fd, "</code></p><p><b>Acceptance:</b> " as *u8); sg_text(fd, m.nodes[i*SGP_FIELDS+4] as *u8)
      w(fd, "</p><p><b>Authored effort:</b> " as *u8); sg_text(fd, m.nodes[i*SGP_FIELDS+6] as *u8); w(fd, ". <b>Executor kind:</b> " as *u8); sg_text(fd, m.nodes[i*SGP_FIELDS+5] as *u8)
      w(fd, ". Responsible, accountable and verifier not established. <a href='#worklog'>Inspect retained worklog</a>.</p></details></li>" as *u8); i = i + 1
  }
  w(fd, "</ol></section>" as *u8)
  sg_growth_html(m.growth, fd, heading_level)
  return 0
2778}
2779func sg_css(fd: i64) -> i64 {
  w(fd, ".capability-growth{min-width:0}.capability-growth details{display:block}.capability-growth summary{display:list-item;cursor:pointer;list-style:revert;font-size:1rem;line-height:1.5}.capability-growth details summary::after,.capability-growth details[open] summary::after{content:none}.capability-growth summary:focus-visible{outline:3px solid var(--ac);outline-offset:2px}.capability-growth p{max-width:var(--nx-layout-measure)}.capability-growth dd{margin-inline-start:0;overflow-wrap:anywhere}.capability-growth dt{font-weight:600}.capability-growth dl{display:grid;grid-template-columns:minmax(0,1fr);gap:var(--nx-layout-capgap)}.capability-growth ul{padding-inline-start:1.5em}" as *u8)
  w(fd, ".ladder-model{min-width:0}.ladder-model p{max-width:var(--nx-layout-measure)}.ladder-model code{overflow-wrap:anywhere}.ladder-nodes{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,var(--nx-layout-capmin)),1fr));gap:var(--nx-layout-capgap);padding-inline-start:1.5em}.ladder-nodes li{min-width:0}.ladder-nodes details{display:block}.ladder-nodes summary{display:list-item;cursor:pointer;list-style:revert;font-size:1rem;line-height:1.5}.ladder-nodes summary::after{content:none}.ladder-nodes summary:focus-visible,.ladder-nodes a:focus-visible{outline:3px solid var(--ac);outline-offset:2px}.ladder-nodes details:target{outline:2px solid var(--ac);outline-offset:4px}\n" as *u8)
  return 0
2783}
2784
2785// Snapshot projection consumes the existing collector's summary; it never remeasures evidence.
2786// Token grammar is caller-owned as specified by nx_json.nx. Working storage derives from input bytes.
2787import "nx_json.nx"
2788import "nx_json_lib.nx"
2789struct EfsDoc { src: *u8, len: i64, tokens: *i64, count: i64, error: i64 }
2790const EFS_DOC_BYTES: i64=40
2791const EFS_TOKEN_WORDS: i64=4
2792const EFS_KEY: i64=14
2793func efs_free(d: *EfsDoc) -> i64 {
if (d as i64)<=0 { return 0 }
if (d.tokens as i64)>0 { sys_munmap(d.tokens as *u8,d.len*EFS_TOKEN_WORDS*8) }
return sys_munmap(d as *u8,EFS_DOC_BYTES)
2797}
2798func efs_parse(src: *u8,n: i64) -> *EfsDoc {
let d: *EfsDoc=sys_mmap(EFS_DOC_BYTES) as *EfsDoc
if (d as i64)<=0 { return 0 as *EfsDoc }
d.src=src;d.len=n;d.error=1
if (src as i64)<=0 { return d };if n<=0 { return d };if n>SGP_I64_MAX/(EFS_TOKEN_WORDS*8) { return d }
d.tokens=sys_mmap(n*EFS_TOKEN_WORDS*8) as *i64
if (d.tokens as i64)<=0 { d.tokens=0 as *i64;return d }
let stack: *i64=sys_mmap(n*16) as *i64
if (stack as i64)<=0 { return d }
let t: *NxJsonTok=nx_json_new(src,n)
if (t as i64)<=0 { sys_munmap(stack as *u8,n*16);return d }
var depth: i64=0;var started: i64=0;var bad: i64=0;var done: i64=0
while done==0 {
var k: i64=nx_json_next(t)
if k==NX_JSON_ERROR { bad=1;break }
if k==NX_JSON_EOF { if depth!=0 { bad=1 };if started==0 { bad=1 };break }
var record: i64=0;var push: i64=0;var parent: i64=0-1
if depth==0 {
 if started==1 { bad=1;break }
 if k!=NX_JSON_LBRACE { bad=1;break }
 started=1;record=1;push=1
} else {
 let frame: i64=(depth-1)*2;let state: i64=stack[frame];parent=stack[frame+1]
 if state==0 || state==4 {
  if k==NX_JSON_RBRACE && state==0 { depth=depth-1 } else {
   if k!=NX_JSON_STRING { bad=1;break }
   k=EFS_KEY;record=1;stack[frame]=1
  }
 } else { if state==1 {
  if k!=NX_JSON_COLON { bad=1;break };stack[frame]=2
 } else { if state==3 || state==11 {
  var close: i64=NX_JSON_RBRACE;if state==11 { close=NX_JSON_RBRACKET }
  if k==close { depth=depth-1 } else {
   if k!=NX_JSON_COMMA { bad=1;break }
   if state==3 { stack[frame]=4 } else { stack[frame]=12 }
  }
 } else {
  if state==10 && k==NX_JSON_RBRACKET { depth=depth-1 } else {
   if k==NX_JSON_LBRACE { push=1 } else { if k==NX_JSON_LBRACKET { push=10 } else {
    if k!=NX_JSON_STRING && k!=NX_JSON_NUMBER && k!=NX_JSON_TRUE && k!=NX_JSON_FALSE && k!=NX_JSON_NULL { bad=1;break }
   } }
   record=1;if state==2 { stack[frame]=3 } else { stack[frame]=11 }
  }
 } } }
}
if record==1 {
 let at: i64=d.count*EFS_TOKEN_WORDS
 d.tokens[at]=k;d.tokens[at+1]=t.tok_off;d.tokens[at+2]=t.tok_len;d.tokens[at+3]=parent
 if push>0 {
  if depth>=n { bad=1;break }
  if push==1 { stack[depth*2]=0 } else { stack[depth*2]=10 }
  stack[depth*2+1]=d.count;depth=depth+1
 }
 d.count=d.count+1
}
}
sys_munmap(t as *u8,NX_JSONTOK_BYTES);sys_munmap(stack as *u8,n*16)
if bad==0 { d.error=0 };return d
2856}
2857func efs_equal(d: *EfsDoc,idx: i64,s: *u8) -> i64 {
if idx<0 || idx>=d.count { return 0 }
let b: i64=idx*EFS_TOKEN_WORDS;let cap: i64=d.tokens[b+2]+1
let decoded: *u8=sys_mmap(cap);if (decoded as i64)<=0 { return 0 }
let end: i64=jx_copy_str_argv(d.src,d.len,d.tokens[b+1]+1,decoded,cap)
var equal: i64=0;if end>=0 { equal=streq(decoded,s) }
sys_munmap(decoded,cap);return equal
2864}
2865// A duplicate required member refuses the projection instead of selecting a flattering copy.
2866func efs_get(d: *EfsDoc,parent: i64,key: *u8) -> i64 {
var hit: i64=0-1;var i: i64=0
while i<d.count {
let b: i64=i*EFS_TOKEN_WORDS
if d.tokens[b]==EFS_KEY && d.tokens[b+3]==parent { if efs_equal(d,i,key)==1 {
 if hit>=0 { return 0-2 };hit=i+1
} };i=i+1
};return hit
2874}
2875func efs_kind(d: *EfsDoc,i: i64) -> i64 { if i<0 || i>=d.count { return 0 };return d.tokens[i*EFS_TOKEN_WORDS] }
2876func efs_int(d: *EfsDoc,i: i64) -> i64 {
if efs_kind(d,i)!=NX_JSON_NUMBER { return 0-1 }
let b: i64=i*EFS_TOKEN_WORDS;let p: i64=d.tokens[b+1];let n: i64=d.tokens[b+2]
var v: i64=0;var j: i64=0
while j<n { let c: i64=d.src[p+j] as i64;if c<48 || c>57 { return 0-1 };let digit: i64=c-48
if v>(SGP_I64_MAX-digit)/10 { return 0-1 };v=v*10+digit;j=j+1
};return v
2883}
2884func efs_number(d: *EfsDoc,parent: i64,key: *u8) -> i64 { return efs_int(d,efs_get(d,parent,key)) }
2885func efs_string(d: *EfsDoc,i: i64) -> *u8 {
if efs_kind(d,i)!=NX_JSON_STRING { return 0 as *u8 }
let b: i64=i*EFS_TOKEN_WORDS;let cap: i64=d.tokens[b+2]+1
let s: *u8=sys_mmap(cap);if (s as i64)<=0 { return 0 as *u8 }
if jx_copy_str_argv(d.src,d.len,d.tokens[b+1]+1,s,cap)<0 { sys_munmap(s,cap);return 0 as *u8 };return s
2890}
2891func efs_print_string(d: *EfsDoc,i: i64,fd: i64) -> i64 {
let s: *u8=efs_string(d,i);if (s as i64)<=0 { return 0-1 }
sg_text(fd,s);return sys_munmap(s,d.tokens[i*EFS_TOKEN_WORDS+2]+1)
2894}
2895
2896func efs_validate(d: *EfsDoc) -> i64 {
if (d as i64)<=0 { return 1 };if d.error!=0 { return 2 }
let schema: i64=efs_get(d,0,"schema" as *u8)
if efs_kind(d,schema)!=NX_JSON_STRING || efs_equal(d,schema,"estate-evidence-progression/v1" as *u8)==0 { return 3 }
let summary: i64=efs_get(d,0,"summary" as *u8)
if efs_kind(d,summary)!=NX_JSON_LBRACE { return 3 }
if efs_kind(d,efs_get(d,0,"rows" as *u8))!=NX_JSON_LBRACKET { return 3 }
if efs_kind(d,efs_get(d,0,"enumeration_complete" as *u8))!=NX_JSON_TRUE { return 4 }
if efs_kind(d,efs_get(d,summary,"partition_reconciles" as *u8))!=NX_JSON_TRUE { return 4 }
if efs_kind(d,efs_get(d,0,"freshness_policy" as *u8))!=NX_JSON_NULL { return 3 }
if efs_kind(d,efs_get(d,0,"matrix_scope" as *u8))!=NX_JSON_STRING { return 3 }
if efs_kind(d,efs_get(d,0,"gate_scope" as *u8))!=NX_JSON_STRING { return 3 }
if efs_kind(d,efs_get(d,0,"stamp_scope" as *u8))!=NX_JSON_STRING { return 3 }
if efs_kind(d,efs_get(d,0,"artifact_binding" as *u8))!=NX_JSON_STRING { return 3 }
if efs_kind(d,efs_get(d,0,"served_acceptance" as *u8))!=NX_JSON_STRING { return 3 }
let total: i64=efs_number(d,summary,"eligible_matrix_domains" as *u8)
if total<0 { return 3 }
if efs_number(d,summary,"eligible_matrix_domains" as *u8)<0 || efs_number(d,summary,"eligible_matrix_domains" as *u8)>total { return 4 }
if efs_number(d,summary,"gate_declared_domains" as *u8)<0 || efs_number(d,summary,"gate_declared_domains" as *u8)>total { return 4 }
if efs_number(d,summary,"gate_declaration_unknown" as *u8)<0 || efs_number(d,summary,"gate_declaration_unknown" as *u8)>total { return 4 }
if efs_number(d,summary,"matrix_unknown" as *u8)<0 || efs_number(d,summary,"matrix_unknown" as *u8)>total { return 4 }
if efs_number(d,summary,"retained_stamp_valid" as *u8)<0 || efs_number(d,summary,"retained_stamp_valid" as *u8)>total { return 4 }
if efs_number(d,summary,"retained_stamp_missing" as *u8)<0 || efs_number(d,summary,"retained_stamp_missing" as *u8)>total { return 4 }
if efs_number(d,summary,"retained_stamp_invalid" as *u8)<0 || efs_number(d,summary,"retained_stamp_invalid" as *u8)>total { return 4 }
if efs_number(d,summary,"retained_stamp_unreadable" as *u8)<0 || efs_number(d,summary,"retained_stamp_unreadable" as *u8)>total { return 4 }
if efs_number(d,summary,"recorded_execution_domains" as *u8)<0 || efs_number(d,summary,"recorded_execution_domains" as *u8)>total { return 4 }
if efs_number(d,summary,"recorded_all_green_domains" as *u8)<0 || efs_number(d,summary,"recorded_all_green_domains" as *u8)>total { return 4 }
if efs_number(d,summary,"current_artifact_binding_unknown" as *u8)<0 || efs_number(d,summary,"current_artifact_binding_unknown" as *u8)>total { return 4 }
2924
var remainder: i64=total
let valid: i64=efs_number(d,summary,"retained_stamp_valid" as *u8)
remainder=remainder-valid
remainder=remainder-efs_number(d,summary,"retained_stamp_missing" as *u8)
if remainder<0 { return 4 }
remainder=remainder-efs_number(d,summary,"retained_stamp_invalid" as *u8)
if remainder<0 { return 4 }
remainder=remainder-efs_number(d,summary,"retained_stamp_unreadable" as *u8)
if remainder!=0 { return 4 }
let runs: i64=efs_number(d,summary,"recorded_execution_domains" as *u8)
if runs>valid || efs_number(d,summary,"recorded_all_green_domains" as *u8)>runs { return 4 }
if efs_number(d,summary,"gate_declaration_unknown" as *u8)>total-efs_number(d,summary,"gate_declared_domains" as *u8) { return 4 }
let first: i64=efs_number(d,0,"observed_start_epoch" as *u8)
let last: i64=efs_number(d,0,"observed_end_epoch" as *u8)
if first<0 || last<first { return 5 }
let lo: i64=efs_get(d,summary,"age_min_seconds" as *u8);let hi: i64=efs_get(d,summary,"age_max_seconds" as *u8)
if efs_kind(d,lo)==NX_JSON_NULL && efs_kind(d,hi)==NX_JSON_NULL { return 0 }
if efs_int(d,lo)<0 || efs_int(d,hi)<efs_int(d,lo) { return 5 }
return 0
2944}
2945func efs_metric(d: *EfsDoc,summary: i64,key: *u8,label: *u8,meaning: *u8,fd: i64) -> i64 {
w(fd,"<tr><th scope='row'>" as *u8);sg_text(fd,label);w(fd,"</th><td>" as *u8)
wn(fd,efs_number(d,summary,key));w(fd," / " as *u8);wn(fd,efs_number(d,summary,"eligible_matrix_domains" as *u8))
w(fd," files</td><td>" as *u8);sg_text(fd,meaning);w(fd,"</td></tr>" as *u8);return 0
2949}
2950func efs_html(d: *EfsDoc,fd: i64,heading: i64,path: *u8,hash: *u8) -> i64 {
let valid: i64=efs_validate(d)
if valid!=0 { w(fd,"<p>Evidence snapshot unavailable: invalid document or schema, code " as *u8);wn(fd,valid);w(fd,". No measurements inferred.</p>" as *u8);return valid }
let summary: i64=efs_get(d,0,"summary" as *u8)
w(fd,"<section class='evidence-snapshot'><style>.exec-grid>.evidence-snapshot{grid-column:1/-1}.evidence-snapshot{min-width:0;overflow-wrap:anywhere}.evidence-snapshot .plan-table-scroll>table{min-width:0;width:100%;table-layout:fixed}.evidence-snapshot caption{text-align:left;font-weight:600;padding-block:.5em}.evidence-snapshot th,.evidence-snapshot td{white-space:normal;overflow-wrap:anywhere}.evidence-snapshot dd{margin-inline-start:0}.foot{overflow-wrap:anywhere}@media(max-width:" as *u8);wn(fd,SC_BP_SM)
w(fd,"px){.evidence-snapshot .plan-table-scroll{overflow:visible}.evidence-snapshot table,.evidence-snapshot caption,.evidence-snapshot tbody,.evidence-snapshot tr,.evidence-snapshot th,.evidence-snapshot td{display:block;width:auto;max-width:100%;min-width:0}.evidence-snapshot thead{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)}.evidence-snapshot tr{border:1px solid var(--line);border-radius:.5em;margin-block:.75em;padding:.75em}.evidence-snapshot th,.evidence-snapshot td{border:0;padding:.25em 0}.evidence-snapshot th{font-size:1rem;text-align:left}.evidence-snapshot td:nth-child(2)::before{content:'Count / eligible files: ';font-weight:600}.evidence-snapshot td:nth-child(3)::before{content:'Meaning: ';font-weight:600}}</style>" as *u8)
sc_heading_open(fd,heading,"" as *u8);w(fd,"Estate evidence measurements" as *u8);sc_heading_close(fd,heading)
w(fd,"<p>Scope: every matrix file in <code>" as *u8);efs_print_string(d,efs_get(d,0,"matrix_scope" as *u8),fd)
w(fd,"</code>, including candidates and fixtures. This is a directory population, not a count of registered products.</p>" as *u8)
sc_plan_table_open(fd,"Estate evidence measurements" as *u8)
w(fd,"<caption>Estate evidence measurements</caption><thead><tr><th>Measure</th><th>Count / eligible files</th><th>Meaning and limits</th></tr></thead><tbody>" as *u8)
efs_metric(d,summary,"gate_declared_domains" as *u8,"Gate declarations" as *u8,"Files with syntactic gate declarations; execution is not implied." as *u8,fd)
efs_metric(d,summary,"retained_stamp_valid" as *u8,"Coherent retained records" as *u8,"Structurally valid historical verdict records; current artifacts are unbound." as *u8,fd)
efs_metric(d,summary,"retained_stamp_missing" as *u8,"Missing records" as *u8,"No verdict file in the explicitly selected stamp directory." as *u8,fd)
efs_metric(d,summary,"recorded_execution_domains" as *u8,"Recorded execution" as *u8,"Retained record reports one or more runs; not current acceptance." as *u8,fd)
efs_metric(d,summary,"recorded_all_green_domains" as *u8,"Recorded all-green runs" as *u8,"Historical record only; not proof that the current artifact passes." as *u8,fd)
efs_metric(d,summary,"current_artifact_binding_unknown" as *u8,"Current artifact binding unknown" as *u8,"No retained source/artifact binding in this collector schema." as *u8,fd)
efs_metric(d,summary,"matrix_unknown" as *u8,"Matrix format unknown" as *u8,"Files with unrecognized matrix rows; not a product failure count." as *u8,fd)
2968
sc_plan_table_close(fd)
w(fd,"<dl><dt>Unknown gate declarations</dt><dd>" as *u8);wn(fd,efs_number(d,summary,"gate_declaration_unknown" as *u8))
w(fd,"</dd><dt>Invalid / unreadable retained records</dt><dd>" as *u8);wn(fd,efs_number(d,summary,"retained_stamp_invalid" as *u8));w(fd," / " as *u8);wn(fd,efs_number(d,summary,"retained_stamp_unreadable" as *u8))
w(fd,"</dd><dt>Evidence age at observation</dt><dd>" as *u8)
let lo: i64=efs_get(d,summary,"age_min_seconds" as *u8)
if efs_kind(d,lo)==NX_JSON_NULL { w(fd,"Unknown: no age range retained" as *u8) } else {
wn(fd,efs_int(d,lo));w(fd," to " as *u8);wn(fd,efs_number(d,summary,"age_max_seconds" as *u8));w(fd," seconds" as *u8)
}
w(fd,". No freshness cutoff applied.</dd><dt>Observation window (Unix seconds)</dt><dd>" as *u8)
wn(fd,efs_number(d,0,"observed_start_epoch" as *u8));w(fd," to " as *u8);wn(fd,efs_number(d,0,"observed_end_epoch" as *u8))
w(fd,"</dd><dt>Gate / verdict scope</dt><dd><code>" as *u8);efs_print_string(d,efs_get(d,0,"gate_scope" as *u8),fd)
w(fd,"</code> / <code>" as *u8);efs_print_string(d,efs_get(d,0,"stamp_scope" as *u8),fd)
w(fd,"</code></dd><dt>Current artifact binding</dt><dd>" as *u8);efs_print_string(d,efs_get(d,0,"artifact_binding" as *u8),fd)
w(fd,"</dd><dt>Served acceptance in this snapshot</dt><dd>" as *u8);efs_print_string(d,efs_get(d,0,"served_acceptance" as *u8),fd)
w(fd,"</dd><dt>Retained evidence</dt><dd style='overflow-wrap:anywhere'><code>" as *u8);sg_text(fd,path)
w(fd,"</code><br>SHA256 <code>" as *u8);sg_text(fd,hash);w(fd,"</code></dd></dl></section>" as *u8)
return 0
2986}
2987
2988import "nx_fio.nx"
2989func efs_capture(path: *u8,expected: *u8,r: *NxFileReadRegion) -> *u8 {
fio_region_init(r)
if sg_len(expected)!=64 { r.code=FIO_EINVAL;return 0 as *u8 }
if fio_region_open(path,r)!=0 { return 0 as *u8 }
let n: i64=r.total
if n<=0 || n>=SGP_I64_MAX { fio_region_fail(r,"extent",FIO_EINVAL);return 0 as *u8 }
let body: *u8=sys_mmap(n+1)
if (body as i64)<=0 { fio_region_fail(r,"allocation",0-12);return 0 as *u8 }
var offset: i64=0
while offset<n {
let got: i64=fio_region_next(r,(body as i64+offset) as *u8,n-offset)
if got<=0 { break };offset=offset+got
}
fio_region_close(r)
if r.code!=0 || offset!=n { sys_munmap(body,n+1);if r.code==0 { r.code=FIO_EIO };return 0 as *u8 }
let digest: *u8=sys_mmap(32)
if (digest as i64)<=0 { sys_munmap(body,n+1);r.code=0-12;return 0 as *u8 }
sha256_digest(body,n,digest)
let hex: *u8="0123456789abcdef" as *u8;var i: i64=0;var same: i64=1
while i<32 {
let v: i64=digest[i] as i64
if expected[i*2]!=hex[v/16] || expected[i*2+1]!=hex[v%16] { same=0 };i=i+1
}
sys_munmap(digest,32)
if same==0 { sys_munmap(body,n+1);r.code=FIO_EBADMSG;return 0 as *u8 }
body[n]=0 as u8;return body
3015}
3016func efs_render(path: *u8,expected: *u8,heading: i64,fd: i64) -> i64 {
let r: *NxFileReadRegion=sys_mmap(72) as *NxFileReadRegion
if (r as i64)<=0 { w(fd,"<p>Evidence snapshot unavailable: allocation failed.</p>" as *u8);return 1 }
let body: *u8=efs_capture(path,expected,r)
if (body as i64)<=0 {
w(fd,"<p>Evidence snapshot unavailable: read or identity check failed, code " as *u8);wn(fd,r.code)
w(fd,". No measurements inferred.</p>" as *u8);sys_munmap(r as *u8,72);return 1
}
let d: *EfsDoc=efs_parse(body,r.total)
let rc: i64=efs_html(d,fd,heading,path,expected)
efs_free(d);sys_munmap(body,r.total+1);sys_munmap(r as *u8,72);return rc
3027}
nx_swcompare_evidence_lib_t138.nx source

`nx_swcompare_evidence_lib_t138.nx` source
