Nishi Family › Compare › Graceful Degradation

Nishi Compare · capabilities, evidence and delivery

Graceful Degradation

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

How the estate keeps delivering on hardware that is already broken -- fault confirmation, reversionary modes, ordered load shedding and dispatch under known-inoperative equipment -- against aerospace and site-reliability practice. Rival marks are published-standard and vendor-doc reads, run OUTSIDE the estate as oracles, never in our build or run path.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The estate already confirms faults with a median-of-k over a shared ruler, names redundancy loss as its own state, reads a lost cache tier as a level rather than a lifetime counter, bands congestion into clear, rising and storm, and hands back a spawn budget instead of a bare refusal. What it lacks is the whole reversionary half that aerospace treats as the point of the exercise: there is no declared mode ladder, so every lane improvises its degraded behaviour and no two agree; there is no dispatch rule, so a box with a known-inoperative array is adjudicated fresh by each seat; and there is no ordered shed plan, so the estate sheds by whoever loses the admission coin flip. The sharpest gap is not a sensor: the smoothed witness that removes roughly 42 percent of build refusals was BUILT, WIRED and left UNARMED for want of one derivation nobody had run.

Where we need to go. An estate that keeps SHIPPING on hardware that is already broken, deliberately and measurably -- every degraded mode named, every shed order published as data, and dispatch under known-inoperative equipment decided by a function rather than re-argued by each seat -- so a degraded array costs throughput and never costs delivery.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the burst profiler DG1 was specified, built, run and read in one leg on 2026-09-04; estimates are relative to it.
Where we are: 4 open rungs. Six capabilities present with three of them exceeding the field; the reversionary and dispatch half open. Counts measured at emit below this line.
Cost to stop refusing builds on a box with headroom: 0.5 u. DG2 arm the smoothed witness from the DG1 derivation. The capability is already built and wired; only the two conf keys and the run that justifies them are missing. This is the cheapest rung on the page and the one that unblocks every other lane.
Cost to a declared mode ladder: 1 u. DG3 dg_mode. Every input axis is already measured; what is absent is one place that names the mode so lanes stop improvising.
Cost to dispatch under known-inoperative equipment: 2 u. DG4 dg_mel_verdict, the executable Minimum Equipment List, and DG5 dg_shed_plan as the data it acts on.

Research bar. Airbus flight control laws is measured on normal, alternate, direct and mechanical backup laws with the active law annunciated to the crew. Theirs: the reversionary-ladder reference. Ours: DG3.

Research bar. NASA JPL fault protection and safe mode is measured on autonomous fault detection with confirmation before entering a reduced-capability safe mode. Theirs: the autonomous-degradation reference. Ours: DG3 DG1.

Research bar. Google SRE handling overload is measured on graceful degradation, criticality-based load shedding and adaptive throttling. Theirs: the software load-shedding reference. Ours: DG5.

Research bar. Aviation Minimum Equipment List is measured on dispatch with named inoperative items under stated limitations and expiry. Theirs: the dispatch-under-fault reference. Ours: DG4.

Latest recorded release

2026-09-05 · DG7

A REFUSED BUILD NO LONGER EATS THE FOSSIL -- ROOT-FIXED IN THE BUILDER, PROMOTED TO BOTH ROOTS (2026-09-05). Measured on nx_goalmap_gate: a --build-only build STORED a 166,087 B fossil, the next run was admission-REFUSED (procs_blocked 9 >= 8) and the fossil was GONE (nx_fs size ABSENT) while its cache sidecar survived. Cause read from source: nx_sov_build_run.nx unlinked _build/<t>.sov.elf at its 'FAIL-LOUD' site (seq132/seq363, off ~68475) BEFORE build admission (off ~74341), tree-canon admission and the build-cache check -- so a refusal, which is not a build failure, destroyed the last good artifact and every staleness instrument then measured against an absence. Fix: the unlink moved to immediately before the compile loop, after every refusal has exited, and only on a cache MISS (a HIT has just materialised the artifact); invariant now THE ARTIFACT EXISTS IFF THE LAST ATTEMPT THAT REACHED THE COMPILER SUCCEEDED, also across refusals. Ship receipts: banked knowledge/library/nx_sov_build_run.elf.pre-unlinkmove-20260905 (142,600 B verified=1); rebuilt WITH --debug to match the live flavour (a first build without it read lost_permil=410, all srcpath/symbol metadata -- FLAVOUR MISMATCH, not loss); nx_contentdiff live vs candidate: lost_from_live=0, ONE-WAY-GAIN strict superset (the 6 gained runs are the 2026-09-04 artifact-assertion strings the live binary had never carried); /api/promote_toolchain target=nx_sov_build_run.elf -> TOOLCHAIN-PROMOTED canary=GREEN prev=1 (buildroot/_offc); /api/promote target=nx_sov_build_run -> PROMOTED 144,136 B sha 79ab55b6 prev=1 (serving root, the copy nx_job_run forks) -- two roots, two promotes. Gotchas for the next seat: the toolchain lane refuses target=<name> (wants <name>.elf) and reads a staged <name>.elf.new that the plain stage does not create -- nx_stage_alias alias <t> elf.new bridges it. LESSON: an admission refusal must be side-effect free; a guard that runs after a destructive step protects nothing.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

9 of 14 capability source symbols found|4 of them authored stronger-claims|5 open|coverage 642/1000|adoption 7 full / 2 partial

Evidence profile — what the gaps on this board actually are

Unstamped. No evidence profile is published for this domain yet: run nx_swcompare_evidence degradation and this section fills itself on the next beat. No numbers are shown, deliberately — a zero-filled profile would read as a board with no gaps, which is the one wrong answer nobody would question.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

RungCloses withDefinition of done (pre-declared)ExecutorEst.
Derive the fault-confirmation window from the host's own bursts (DG1)bp_simThe burst profiler: replays a recorded series through the REAL median and prints the verdict the armed gate would have produced, plus the latency each span costs -- LANDED 2026-09-04Organ0 u
An undersampled window reports UNDERSAMPLED, never zero (DG6)
after DG1		bp_span_atA zero in a refusal-rate column reads as this span refuses nothing -- LANDED 2026-09-04Organ0 u
Arm the smoothed witness with the derived count and gap (DG2)
after DG1		ioa_measure_medianWrite blocked_samples and blocked_gap_ms into build_admit.conf from the DG1 run, and record the run beside them as that conf requires. Re-arms four lanes with no rebuildData0.5 u
A named reversionary-mode ladder every lane reads (DG3)
after DG2		_ABSENT_:dg_modeOne place that names the active mode from the measured axes, so degraded behaviour stops being improvised per laneOrgan1 u
An executable Minimum Equipment List (DG4)
after DG3		_ABSENT_:dg_mel_verdictGiven the measured degraded components: which lanes may dispatch, under which limitation, with what expiryOrgan1.5 u
An ordered shed plan published as data (DG5)
after DG3		_ABSENT_:dg_shed_planWhat stops first when the array is degraded, as a conf a human can argue with and change without a rebuildData0.5 u

Milestones

MilestoneRungsCumulative
M0 · Confirm before declaringDG1 DG6 DG21 u u
M1 · Name the degraded modeDG32 u u
M2 · Dispatch and shed under known faultDG4 DG54 u u
RungCloses withDefinition of done (pre-declared)ExecutorEst.
The confirmed level, maintained continuously and read in constant time (DG7)
after DG1		ba_confirmednx_ioconfirm pays the confirmation window once per cadence and nx_build_admit reads it instantly. Gate 22 of 22 GREEN, content ruler GREEN, behaviour IDENTICAL, PROMOTED 2026-09-04. Armed by data and shipped OFF -- LANDEDOrgan0 u
Schedule the confirmation beat, then arm the freshness bound (DG8)
after DG7		_ABSENT_:dg_beat_armedRegister a clock row for nx_ioconfirm beat, then set confirm_max_age_s in build_admit.conf to a value DERIVED from that cadence. Until both exist the level goes stale and every consumer correctly falls back to the single instantaneous sample, so the capability is present and inert. Cadence and bound are a decidable pair: state both or do not wire itData0.5 u
Every promote banks a durable pre-change artifact the NEXT promote cannot overwrite (DG10)
after DG7		_ABSENT_:dg_bank_before_promoteCORRECTED 2026-09-07 against deploy DL8's recorded source review: hc_promote_to_expect already rotates .prev to .prev2, retaining two preceding generations; the earlier claim that the second promote destroys the only rollback is withdrawn. This board has not independently re-run that chain today. The remaining objective is a separately retained, hash-verified recovery artifact with a declared identity and retention policy, so a chosen known-good generation survives further chain rotation. Done when the existing promote path verifies that durable bank before replacement, records its artifact digest and non-temporary location, and a replay through more promotions than the retained chain depth still restores the selected generation byte-identically. Preserve the existing rolling chain, never-brick checks and correction history; this clarification claims neither implementation nor acceptanceOrgan1 u
Board-level journal anchor for degradation (DG0)-BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 4 log rows against the id DG0, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.Board0 u
Free the dispatch capacity three mis-periodded gates consume (DG11)
after DG8		-bootstrap-gate at 60s and worldgen-gate and intakekeep at 120s are 60 dispatches per 1800s window, 22 percent of all clock demand, while every other gate in the plane runs between 3600 and 86400s and all three execute out of buildroot/_build which is build scratch and not a deployed artifact path. Re-perioding them to their peers frees about 45 dispatches per window and costs no detection resolution that anyone relies on. This is the rung DG8 is actually waiting on, and it is data only with no rebuildData0.25 u
A dead-man watch row for the confirmation beat (DG12)
after DG8		-ioconfirmbeat is absent from all 20 rows nx_cron_watch reads, so the one beat that build admission depends on is the only beat in the estate with no liveness alarm. An execution surface with no heartbeat is invisible to every liveness instrument, which is how this ran starved for an unknown number of days with nothing to report itData0.25 u
Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read STALE against the current month 2026-10.
Bar freshness, counted
ClassCountNote
bars2sotabar rows on the plan
fresh0the bar month is the current month
attested0an older bar with a this-month barscan reporting no newer entry
stale0a this-month scan saw a newer month the bar ignores
unattested2nobody looked this month
malformed0a sotabar row missing a field
duplicate0bar ids an earlier row already carries
bars, summed2RECONCILED: the parts sum to the total 2
current month2026-10the month every bar is judged against
Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 12. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 2e5c73f5c02bdec76571a2230b83f74f761a38765e1cc895ead9833a98fc7a53. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 12 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

  1. DG1 — Derive the fault-confirmation window from the host's own bursts

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: bp_sim

    Acceptance: The burst profiler: replays a recorded series through the REAL median and prints the verdict the armed gate would have produced, plus the latency each span costs -- LANDED 2026-09-04

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  2. DG6 — An undersampled window reports UNDERSAMPLED, never zero

    Prerequisites: DG1 (acceptance unverified)

    Contract: bp_span_at

    Acceptance: A zero in a refusal-rate column reads as this span refuses nothing -- LANDED 2026-09-04

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  3. DG2 — Arm the smoothed witness with the derived count and gap

    Prerequisites: DG1 (acceptance unverified)

    Contract: ioa_measure_median

    Acceptance: Write blocked_samples and blocked_gap_ms into build_admit.conf from the DG1 run, and record the run beside them as that conf requires. Re-arms four lanes with no rebuild

    Authored effort: 0.5. Executor kind: Data. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  4. DG3 — A named reversionary-mode ladder every lane reads

    Prerequisites: DG2 (acceptance unverified)

    Contract: _ABSENT_:dg_mode

    Acceptance: One place that names the active mode from the measured axes, so degraded behaviour stops being improvised per lane

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  5. DG4 — An executable Minimum Equipment List

    Prerequisites: DG3 (acceptance unverified)

    Contract: _ABSENT_:dg_mel_verdict

    Acceptance: Given the measured degraded components: which lanes may dispatch, under which limitation, with what expiry

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  6. DG5 — An ordered shed plan published as data

    Prerequisites: DG3 (acceptance unverified)

    Contract: _ABSENT_:dg_shed_plan

    Acceptance: What stops first when the array is degraded, as a conf a human can argue with and change without a rebuild

    Authored effort: 0.5. Executor kind: Data. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  7. DG7 — The confirmed level, maintained continuously and read in constant time

    Prerequisites: DG1 (acceptance unverified)

    Contract: ba_confirmed

    Acceptance: nx_ioconfirm pays the confirmation window once per cadence and nx_build_admit reads it instantly. Gate 22 of 22 GREEN, content ruler GREEN, behaviour IDENTICAL, PROMOTED 2026-09-04. Armed by data and shipped OFF -- LANDED

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  8. DG8 — Schedule the confirmation beat, then arm the freshness bound

    Prerequisites: DG7 (acceptance unverified)

    Contract: _ABSENT_:dg_beat_armed

    Acceptance: Register a clock row for nx_ioconfirm beat, then set confirm_max_age_s in build_admit.conf to a value DERIVED from that cadence. Until both exist the level goes stale and every consumer correctly falls back to the single instantaneous sample, so the capability is present and inert. Cadence and bound are a decidable pair: state both or do not wire it

    Authored effort: 0.5. Executor kind: Data. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  9. DG10 — Every promote banks a durable pre-change artifact the NEXT promote cannot overwrite

    Prerequisites: DG7 (acceptance unverified)

    Contract: _ABSENT_:dg_bank_before_promote

    Acceptance: CORRECTED 2026-09-07 against deploy DL8's recorded source review: hc_promote_to_expect already rotates .prev to .prev2, retaining two preceding generations; the earlier claim that the second promote destroys the only rollback is withdrawn. This board has not independently re-run that chain today. The remaining objective is a separately retained, hash-verified recovery artifact with a declared identity and retention policy, so a chosen known-good generation survives further chain rotation. Done when the existing promote path verifies that durable bank before replacement, records its artifact digest and non-temporary location, and a replay through more promotions than the retained chain depth still restores the selected generation byte-identically. Preserve the existing rolling chain, never-brick checks and correction history; this clarification claims neither implementation nor acceptance

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  10. DG0 — Board-level journal anchor for degradation

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: -

    Acceptance: BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 4 log rows against the id DG0, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.

    Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  11. DG11 — Free the dispatch capacity three mis-periodded gates consume

    Prerequisites: DG8 (acceptance unverified)

    Contract: -

    Acceptance: bootstrap-gate at 60s and worldgen-gate and intakekeep at 120s are 60 dispatches per 1800s window, 22 percent of all clock demand, while every other gate in the plane runs between 3600 and 86400s and all three execute out of buildroot/_build which is build scratch and not a deployed artifact path. Re-perioding them to their peers frees about 45 dispatches per window and costs no detection resolution that anyone relies on. This is the rung DG8 is actually waiting on, and it is data only with no rebuild

    Authored effort: 0.25. Executor kind: Data. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  12. DG12 — A dead-man watch row for the confirmation beat

    Prerequisites: DG8 (acceptance unverified)

    Contract: -

    Acceptance: ioconfirmbeat is absent from all 20 rows nx_cron_watch reads, so the one beat that build admission depends on is the only beat in the estate with no liveness alarm. An execution surface with no heartbeat is invisible to every liveness instrument, which is how this ran starved for an unknown number of days with nothing to report it

    Authored effort: 0.25. Executor kind: Data. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.
Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence degradation writes it beside its stamp); every gate below reads UNRECORDED until it runs.
Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.
DG1 Derive the fault-confirmation window from the host's own bursts · cell PRESENT · gate NO-GATE-DECLARED
Contractbp_sim · executor Organ · 0 u · stands on nothing
Definition of doneThe burst profiler: replays a recorded series through the REAL median and prints the verdict the armed gate would have produced, plus the latency each span costs -- LANDED 2026-09-04
Matrix cellCONFIRM: the confirmation window is DERIVED from this host's own burst structure · runtime/nx_blkprofile.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_blkprofile; declare nx_blkprofile TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-04 measure Storm re-measured live rather than inherited. procs_blocked read 15 then 5 inside about 60 seconds on an unchanged box and the build verdict flipped QUEUE to GRANT with it. Two nx_dstate samples 90 s apart shared only 4 pids (synocmstaskd, one nx_sov_build_run, two nx_store_put): the D-state population is mostly transient churn over a persistent core well UNDER the bar of 8.
2026-09-04 measure Hardware envelope named so no software rung is asked to fix it: md3 raid1 DEGRADED 1 of 2 with no redundancy, md2 members sata6p5 and sata8p5 at 808 and 88 corrected reads, kernel 5 uncorrectable errors across a 1824-sector span, and the write-back cache that tier fronted disabled. THE ARRAY IS THE CONSTRAINT; every rung here is about delivering despite it.
2026-09-04 land nx_blkprofile built sovereign on the NAS, 36,305 B, first attempt clean. It composes ioa_measure and ioa_median rather than re-implementing either, so its simulated verdicts are the armed gate's verdicts and not a second ruler that can drift.
2026-09-04 lesson Three APIs assumed while drafting were checked before use and one was wrong: sys_time_ms is ABSENT-PROVEN in buildroot/runtime with corpus_complete=1. The organ reports a NOMINAL window and reads no clock; the added-latency column needs none, since a sampler that sleeps a span pays that span by construction.
2026-09-04 lesson The organ's first run abstained with journal UNREADABLE rather than reporting zero rows. Cause was the estate's own CWD-relative trap: the build runner anchors CWD to buildroot/, so a bare knowledge/ path resolved into the other tree. Fixed with the two-root probe idiom ba_conf_load already uses, and the resolved path is now printed. The third state is what made this visible in one run instead of one investigation.
2026-09-04 retract The FIRST live derivation recommended blocked_samples=5 gap_ms=3000 and that recommendation was VACUOUS. Taking the asymptote as the widest span tested makes that span trivially satisfy its own tolerance, so a still-falling curve always recommends its own last row. Fixed to require corroboration by at least one LONGER span; the same organ on the same host then returned flattened=NO and RECOMMEND none. The defect was found by running the instrument and reading its own output.
DG6 An undersampled window reports UNDERSAMPLED, never zero · cell PRESENT · gate NO-GATE-DECLARED
Contractbp_span_at · executor Organ · 0 u · stands on DG1
Definition of doneA zero in a refusal-rate column reads as this span refuses nothing -- LANDED 2026-09-04
Matrix cellCONFIRM: an undersampled window is reported as such and never as a zero · runtime/nx_blkprofile.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_blkprofile; declare nx_blkprofile TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
DG2 Arm the smoothed witness with the derived count and gap · cell PRESENT · gate NO-GATE-DECLARED
Contractioa_measure_median · executor Data · 0.5 u · stands on DG1
Definition of doneWrite blocked_samples and blocked_gap_ms into build_admit.conf from the DG1 run, and record the run beside them as that conf requires. Re-arms four lanes with no rebuild
Matrix cellCONFIRM: a fault is declared only after it PERSISTS, never on one sample · runtime/nx_ioadmit_lib.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_ioadmit_lib; declare nx_ioadmit_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-04 lesson The fix was already built and left unarmed ON PURPOSE, with the reason written down: the conf refuses arming on a guessed gap because the gap must SPAN a burst to smooth anything, and the cost is paid by every admission check including the clock dispatcher's pre-dispatch call. Reading that note changed the work from write a debounce to run the derivation the note asks for.
2026-09-04 lesson A trap recorded in that conf and re-verified before editing: ba_conf_load finds its keys by PLAIN SUBSTRING with no comment handling, so a commented example written the ordinary way ARMS the key. The examples there are spelled with spaces around the equals sign deliberately. Prose is bytes too.
DG3 A named reversionary-mode ladder every lane reads · cell WATCHING · gate NO-GATE-DECLARED
Contract_ABSENT_:dg_mode · executor Organ · 1 u · stands on DG2
Definition of doneOne place that names the active mode from the measured axes, so degraded behaviour stops being improvised per lane
Matrix cellREVERT: a named reversionary-mode ladder every lane reads from one place · runtime/nx_degrade_lib.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_degrade_lib; declare nx_degrade_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
DG4 An executable Minimum Equipment List · cell WATCHING · gate NO-GATE-DECLARED
Contract_ABSENT_:dg_mel_verdict · executor Organ · 1.5 u · stands on DG3
Definition of doneGiven the measured degraded components: which lanes may dispatch, under which limitation, with what expiry
Matrix cellDISPATCH: an executable Minimum Equipment List for the estate · runtime/nx_degrade_lib.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_degrade_lib; declare nx_degrade_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
DG5 An ordered shed plan published as data · cell WATCHING · gate NO-GATE-DECLARED
Contract_ABSENT_:dg_shed_plan · executor Data · 0.5 u · stands on DG3
Definition of doneWhat stops first when the array is degraded, as a conf a human can argue with and change without a rebuild
Matrix cellSHED: an ORDERED shed plan naming what stops first · runtime/nx_degrade_lib.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_degrade_lib; declare nx_degrade_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
DG7 The confirmed level, maintained continuously and read in constant time · cell PRESENT · gate NO-GATE-DECLARED
Contractba_confirmed · executor Organ · 0 u · stands on DG1
Definition of donenx_ioconfirm pays the confirmation window once per cadence and nx_build_admit reads it instantly. Gate 22 of 22 GREEN, content ruler GREEN, behaviour IDENTICAL, PROMOTED 2026-09-04. Armed by data and shipped OFF -- LANDED
Matrix cellCONFIRM: the admission gate reads an ALREADY-CONFIRMED level rather than a window it paid for itself · runtime/_hdl_build/nx_build_admit.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_build_admit; declare nx_build_admit TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-04 land nx_build_admit SHIPPED through the guarded loop: gate nx_build_admit_gate 22 of 22 GREEN, adopt-gate content=GREEN behave=IDENTICAL, live_sha equals staged_sha d2f4b8af, _offc twin byte-identical. Live report now carries blocked_src, confirm_age_s and confirm_max_age_s so the provenance of the deciding number is never a guess. Verified live: blocked_src=instant confirm_max_age_s=0, i.e. present and OFF, no verdict changed.
2026-09-04 measure The evidence grade is declared WEAK and that is not hidden: nx_behaveprobe compared a usage or error path, so the 22 of 22 gate is the load-bearing proof and the probe is not. A green from a subject that could not have gone red is decoration.
2026-09-04 measure THE ESTATE-WIDE WRITE PRIMITIVE IS UNSAFE TO RETRY ONE TIME IN THREE. fsx_edit tests uniqueness against the PRE-image while the retry guarantee is a claim about the POST-image; they coincide only when the replacement destroys its anchor. Mined over 12,806 edit calls: 8,308 true replaces, 4,343 self-anchored (339 permil), 155 identity, sum reconciles. Seats re-issue the unsafe shape at 95 permil against a 99 permil control on the safe shape -- the doctrine is applied blindly because nothing discriminated. Three double-applies confirmed in the record plus one today that broke the build-admission gate. Debt 1788529551.
2026-09-04 land Fix landed in three hunks: a derived predicate fsx_edit_self_anchored in nx_fsops_lib, a receipt in nx_fsops_write that stamps kind=INSERT-SELF-ANCHORED retry=UNSAFE or kind=REPLACE retry=EXACT-SAFE, and two gate teeth. REFUSING was measured and REJECTED as primary: 339 permil of edits would refuse on day one, which is the permanently-red detector everyone routes around. Deriving the kind rather than asking the caller to declare it is what makes writer and reader unable to disagree -- the 2026-08-20 version of this fix lived in nx_atomic_publish as advice keyed on a SELF-DECLARED kind, and a caller got that declaration wrong fifteen days later.
2026-09-04 retract I reported I could not identify the 41st failing tooth. I could, and did, in one call: forking the DEPLOYED gate binary directly needs no build and no admission, and it printed the whole tooth list. It was ls-entry-count, and the cause was mine -- my hazard tooth authored a fixture INSIDE the directory whose entry count a sibling tooth asserts. A tail is not a list, and the cheap instrument was available the whole time.
2026-09-04 lesson The gate carried the law I broke, written 2026-07-31 in its own setup block: RESET EVERY PATH THIS GATE EVER AUTHORS, NOT JUST THE 3 FIXTURES, recorded because the gate had PASSED EXACTLY ONCE and FAILED EVERY RUN SINCE. I authored a new path in the counted dir and did not add it to that list. Fixed twice over: the fixture moved outside the counted directory so it cannot inflate the count by construction, and the stray unlinked at setup. A reset LIST invites exactly this; the durable shape is a fixture directory emptied wholesale.
2026-09-04 lesson Seven ship attempts. The dominant cost was SELF-CONTENTION: a standalone build or gate run launched alongside the ship, contending on the per-target build lock and on the shared /tmp/fsgate fixtures. Once nothing of mine competed, the build went straight through. A seat racing itself is indistinguishable from a busy box, and only the process roster tells them apart.
2026-09-04 land nx_fsops_write PROMOTED AND PROVEN LIVE 2026-09-04. Bank first: nx_filecopy of the live 52,016 B binary to knowledge/status/nx_fsops_write.elf.bank-pre-dg7, verified byte-for-byte with mode_preserved=493 so the rollback is executable, NOT a temp path. Then the promote: 53,592 B, verified byte-for-byte, mode preserved. Then proven in BOTH directions on the live tool -- a self-anchoring edit now answers kind=INSERT-SELF-ANCHORED retry=UNSAFE and a true replace answers kind=REPLACE retry=EXACT-SAFE. A field that answered the same both ways would have discriminated nothing, so both controls were run.
2026-09-04 measure Nine ship attempts failed before the hand promote succeeded. Dominant cost was SELF-CONTENTION (my own standalone builds and gate runs racing the ship for one target lock and one fixture dir), then genuine array saturation peaking at load1_centi=3400 against a 3286 storm ceiling. The sanctioned lane nx_organ_ship is admission-gated at its BUILD stage; the artifact was already STAGED at 53,592 B, so the whole remaining step was a promote the storm would not let that lane reach.
2026-09-05 land THE CONFIRMED LEVEL WAS DARK 24.4 h BECAUSE ITS CLOCK ROW FORKED THE ORGAN WITHOUT ITS VERB (2026-09-05, measured, fixed as data). knowledge/status/ioconfirm.status read ts=1788528368 (age 87,922 s vs confirm_max_age_s=900) while the clocksched- plane carried 'ioconfirmbeat 300 nx_ioconfirm.elf' with NO argv; nx_ioconfirm main() exits IC_EXIT_USAGE=2 unless argv[1] starts with b (beat) or r (read) (buildroot/runtime/nx_ioconfirm.nx off 7048-7319), so every fire printed usage and wrote nothing -- a dead beat that reads registered. Compounding: nx_catalog read PROMOTED-UNREGISTERED (S3), so nx_job_run refused it ('not an unpinned GREEN tool'). Fix, in order: /api/tools/register name=nx_ioconfirm elf=nx_ioconfirm.elf -> REGISTERED callable=1 (job 1788617691); hand beat via nx_job_run -> IOCONFIRM-BEAT wrote=141 blocked_confirmed=5 bar=8 samples=5 span_ms=12000 verdict=MEASURED; nx_build_admit check flipped blocked_src=instant-confirm-unusable -> blocked_src=confirmed confirm_age_s=14 VERDICT=GRANT; nx_clockjob put ioconfirmbeat 300 'nx_ioconfirm.elf beat' -> CLOCKJOB-PUT ok rows=170 (desired state; the clock folds it at its next window, ~30 min). No cron watch row existed for this beat, which is why nobody saw it go dark: a watch row is owed (cron_heartbeats: ioconfirm.status ts= max_age 900). LESSON: a clock row is a COMMAND LINE, not a name -- an organ whose main() demands a verb is dead on a bare row and indistinguishable from a beat nobody registered; the DG7 rung's own text ('register the clock row, observe two successive fresh stamps') was satisfied by a row that could never write. Verify next: two successive ts advances on ioconfirm.status >= 300 s apart after the fold.
2026-09-05 measure TWO SUCCESSIVE FRESH STAMPS OBSERVED, THE SECOND FROM THE CLOCK ROW ITSELF (2026-09-05). knowledge/status/ioconfirm.status ts=1788617700-band (hand beat via nx_job_run, blocked_confirmed=5) then ts=1788618978 (no hand run; the corrected clocksched row 'ioconfirmbeat 300 nx_ioconfirm.elf beat' had folded at the scheduler's window-init, ~20 min after CLOCKJOB-PUT rows=170). nx_build_admit check now reads blocked_src=confirmed confirm_age_s=142 VERDICT=GRANT at load1_centi=1205 procs_blocked=5/8. The DG7 rung's own arming condition ('register the clock row, observe two successive fresh stamps') is met by data; the remaining half is the cron-watch row (ioconfirm.status ts= max_age 900) so a future dark beat is SEEN, and deriving the bound from the OBSERVED interval before arming any smoothing.
2026-09-05 queue THE ARRAY IS THE STALL AND ITS PRODUCERS ARE NAMED (2026-09-05, three nx_dstate rosters 1788617800 / 1788619350 / 1788619450, partition RECONCILES each time). D-state grew 6 -> 9 -> 13 (userspace 4 -> 5 -> 9) at load1_centi 1539 -> 1425 -> 1702 on 8 cpus; swap_used_permil 895 vs bar 700, RESMON RED sev=2 for six beats. WHO: nx_web_crawl_step.elf pid 11713 in D across two samples 100 s apart (age 1332 -> 1432 s; also RESMON worst committed at 1,751,368 KB), nx_sov_build_run pid 20646 in D for its entire 300 s life AFTER its fossil landed (buildroot/_build/nx_goalmap_gate.sov.elf 166,087 B exists while _jobs/job_1788619133.claim stays CLAIMED -- a build that finished compiling and cannot fsync its receipt), btrfs-transaction + md4_defer kthreads, nx_hostctl pid 6558, and THIRD-PARTY amuled (Synology DownloadStation) in D, plus the torrent seed lane SATURATED live=4 and nx_seed_announce_all the largest committed process. Consequence measured: every organ that touches the array (nx_debt add, nx_netobs, nx_symdrop, nx_site_publish) queues behind them; the beach is SERVED (sites.elf children are the short-lived D processes, ages <1 s) but every ship of anything waits on the crawler's and the downloader's I/O. DECISIONS OWED TO THE OPERATOR, not a seat: (1) throttle or pause the crawler and torrent lanes while the md3 NVMe mirror is DEGRADED [2/1] [_U] (replace the member); (2) stop the vendor DownloadStation daemon (amuled) -- a third-party writer on the estate's array is outside the sovereignty law; (3) a serving-latency ruler (first-byte time for /world/beach under storm) is ABSENT -- declare it as a watch so the stall becomes a number. Estate remedy already in reach: nx_heavyio_lib's concurrency bound is what the crawler should be asking before each step; measure whether nx_web_crawl_step composes it (nx_txtscan count runtime/nx_web_crawl_step.nx heavyio) before assuming.
2026-09-05 land A REFUSED BUILD NO LONGER EATS THE FOSSIL -- ROOT-FIXED IN THE BUILDER, PROMOTED TO BOTH ROOTS (2026-09-05). Measured on nx_goalmap_gate: a --build-only build STORED a 166,087 B fossil, the next run was admission-REFUSED (procs_blocked 9 >= 8) and the fossil was GONE (nx_fs size ABSENT) while its cache sidecar survived. Cause read from source: nx_sov_build_run.nx unlinked _build/<t>.sov.elf at its 'FAIL-LOUD' site (seq132/seq363, off ~68475) BEFORE build admission (off ~74341), tree-canon admission and the build-cache check -- so a refusal, which is not a build failure, destroyed the last good artifact and every staleness instrument then measured against an absence. Fix: the unlink moved to immediately before the compile loop, after every refusal has exited, and only on a cache MISS (a HIT has just materialised the artifact); invariant now THE ARTIFACT EXISTS IFF THE LAST ATTEMPT THAT REACHED THE COMPILER SUCCEEDED, also across refusals. Ship receipts: banked knowledge/library/nx_sov_build_run.elf.pre-unlinkmove-20260905 (142,600 B verified=1); rebuilt WITH --debug to match the live flavour (a first build without it read lost_permil=410, all srcpath/symbol metadata -- FLAVOUR MISMATCH, not loss); nx_contentdiff live vs candidate: lost_from_live=0, ONE-WAY-GAIN strict superset (the 6 gained runs are the 2026-09-04 artifact-assertion strings the live binary had never carried); /api/promote_toolchain target=nx_sov_build_run.elf -> TOOLCHAIN-PROMOTED canary=GREEN prev=1 (buildroot/_offc); /api/promote target=nx_sov_build_run -> PROMOTED 144,136 B sha 79ab55b6 prev=1 (serving root, the copy nx_job_run forks) -- two roots, two promotes. Gotchas for the next seat: the toolchain lane refuses target=<name> (wants <name>.elf) and reads a staged <name>.elf.new that the plain stage does not create -- nx_stage_alias alias <t> elf.new bridges it. LESSON: an admission refusal must be side-effect free; a guard that runs after a destructive step protects nothing.
2026-09-05 measure THE BEAT FIRES, BUT NOT AT ITS DECLARED 300 s (2026-09-05). ioconfirm.status ts advanced 1788617700-band (hand) -> 1788618978 (clock) -> ~1788621081 (clock; read back as confirm_age_s=1107 at 1788622188, i.e. blocked_src had fallen to instant-confirm-unusable again) -> fresh again by 1788622367 (confirm_age_s=22). Observed interval ~2,100 s against a declared 300 s row -- the clock plane's known convergence (CLAUDE.md: the declared cadence column is not a predictor; everything drifts toward ~21,600 s) applied to a 900 s freshness bound, so admission runs on a CONFIRMED level roughly a third of the time and on the single instantaneous sample the rest. Cadence x bound is the decidable pair: either the dispatcher honours 300 s for this row or confirm_max_age_s must be derived from the OBSERVED interval (2,100 s + one missed beat = ~4,200 s) -- and the DG7 rung's own text already says derive the bound from the observed interval before arming any smoothing. Owed: a cron-watch row for ioconfirm.status so the gap is SEEN, and the dispatcher-cadence defect adjudicated on the clock domain, not here.
2026-09-05 measure THE BUILDER FIX PROVEN ON A REAL REFUSAL, NOT A FIXTURE (2026-09-05 late): nx_sov_build_run nx_wasm_craft_gate --build-only was REFUSED by admission (VERDICT=QUEUE, procs_running=22 >= ncpu 8, load1_centi 2434, exit 6) and buildroot/_build/nx_wasm_craft_gate.sov.elf read 402,747 B afterwards -- the prior fossil (sha c5b69c34, the GE57 build) SURVIVED. Under the pre-fix builder this same refusal deleted the fossil this morning (measured on nx_goalmap_gate). The unlink-after-admission move is therefore live and behaving on the serving root's builder (sha 79ab55b6). Re-issued on the next sampled GRANT (load1_centi 2802 -- the load conjunct only QUEUEs above 3286, the D-state witness 5/8 and run queue 4/8 both clear).
2026-09-05 measure THE ADMISSION SENSOR IS DARK AGAIN (2026-09-05 evening): nx_build_admit reads blocked_src=instant-confirm-unusable confirm_age_s=1017 then 1030 against confirm_max_age_s=900, i.e. the ioconfirm beat that was re-armed this morning (clock row ioconfirmbeat 300 s, verb beat) has not stamped for 17 minutes while procs_blocked swung 3 to 11 on 8 cpus; every build in this seat's queue (nx_goalmap, nx_goalmap_gate, nx_engine_dispatch_gate control, nx_swcompare_sota second leg) is refused QUEUE on that reading; a beat that goes dark exactly during the storm it exists to measure is the cron-watch gap named this morning (max_age 900 on ioconfirm.status) still unfilled -- owner DG7, not this lane
DG8 Schedule the confirmation beat, then arm the freshness bound · cell WATCHING · gate NO-GATE-DECLARED
Contract_ABSENT_:dg_beat_armed · executor Data · 0.5 u · stands on DG7
Definition of doneRegister a clock row for nx_ioconfirm beat, then set confirm_max_age_s in build_admit.conf to a value DERIVED from that cadence. Until both exist the level goes stale and every consumer correctly falls back to the single instantaneous sample, so the capability is present and inert. Cadence and bound are a decidable pair: state both or do not wire it
Matrix cellCONFIRM: the confirmation beat is scheduled AND OBSERVED to meet the bound its consumer requires · runtime/nx_degrade_lib.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_degrade_lib; declare nx_degrade_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-04 queue NOT ARMED, deliberately. Arming confirm_max_age_s before the beat is scheduled would leave a stale level that falls back on every call -- the capability would read as live while doing nothing. The order is: promote nx_ioconfirm, register the clock row, observe two successive fresh stamps, derive the bound from the observed interval rather than the declared one, and only then arm.
2026-09-04 queue REMAINING STEP IS MECHANICAL: one nx_organ_ship nx_fsops_write on a quiet array with no sibling build running. Source landed, both new teeth PASS, GATE_CHECKS corrected 38 to 40, the 41st tooth fixed, build succeeds. BQ-nx_fsops_write is queued in the absorber at deployq row 378 with queue_launch_rc=0 and fires on the next orchestrate pass with headroom -- SUPERSEDED, see the land row below.
2026-09-04 land DG8 ARMED AND SCHEDULED 2026-09-04, completing the chain. nx_blkprofile PROMOTED 38,897 B and nx_ioconfirm PROMOTED 29,155 B, both hash-verified with mode_preserved=493. Clock row landed in the clockjobs plane: ioconfirmbeat 300 nx_ioconfirm.elf beat -- the clock forks the serving-root binary DIRECTLY, so the beat needs neither nx_job_run registration nor build admission, which is why it can run on a box that refuses builds. Then knowledge/build_admit.conf armed with the freshness bound at 900 s, with the cadence, the beat span and the derivation all written on the line as that conf demands.
2026-09-04 measure ARMED BEHAVIOUR PROVEN IMMEDIATELY, AND IT PROVED THE THIRD STATE RATHER THAN THE HAPPY PATH: the live gate now reports blocked_src=instant-confirm-unusable confirm_age_s=8758 confirm_max_age_s=900 -- it READ the level, measured it 8,758 s old against a 900 s bound, REFUSED it, fell back to the single instantaneous sample, and PUBLISHED all three facts. A stale level is therefore visible as stale and can never be mistaken for a live one, which is the whole reason the bound exists. It flips to blocked_src=confirmed on the first beat the clock fires.
2026-09-04 lesson Cadence and bound were treated as a DECIDABLE PAIR and both are stated in the conf: 300 s cadence, a 12 s beat window, a 900 s bound giving two whole missed beats of margin. This estate has measured a beat whose cadence could not satisfy the bound it fed and went blind by construction for 34 consecutive intervals; stating both numbers beside each other is what makes that checkable instead of discoverable, and it costs one line of conf.
2026-09-06 measure THE BEAT IS STARVED, NOT DEAD, AND ONLY TWO TIMESTAMPS SEPARATE THOSE TWO. nx_build_admit reported blocked_src=instant-confirm-unusable with confirm_age_s=1035 against confirm_max_age_s=900, which reads exactly like a stopped beat. Reading knowledge/status/ioconfirm.status then gave ts=1788731704 where the earlier report implies ts=1788730650, an OBSERVED interval of 1054 s against a DECLARED cadence of 300 s. The beat fires at roughly one third of its declared rate, so the confirmed level crosses the 900 s bound between fires and every admission check correctly falls back to a single instantaneous sample. Present and inert, exactly as the DG8 queue row predicted, and the cause is upstream of both the organ and the conf
DG10 Every promote banks a durable pre-change artifact the NEXT promote cannot overwrite · cell WATCHING · gate NO-GATE-DECLARED
Contract_ABSENT_:dg_bank_before_promote · executor Organ · 1 u · stands on DG7
Definition of doneCORRECTED 2026-09-07 against deploy DL8's recorded source review: hc_promote_to_expect already rotates .prev to .prev2, retaining two preceding generations; the earlier claim that the second promote destroys the only rollback is withdrawn. This board has not independently re-run that chain today. The remaining objective is a separately retained, hash-verified recovery artifact with a declared identity and retention policy, so a chosen known-good generation survives further chain rotation. Done when the existing promote path verifies that durable bank before replacement, records its artifact digest and non-temporary location, and a replay through more promotions than the retained chain depth still restores the selected generation byte-identically. Preserve the existing rolling chain, never-brick checks and correction history; this clarification claims neither implementation nor acceptance
Matrix cellREVERT: every promote banks a durable pre-change artifact the NEXT promote cannot overwrite · runtime/nx_degrade_lib.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_degrade_lib; declare nx_degrade_lib TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-04 lesson THE OPERATOR'S CORRECTION, AND IT IS THE RIGHT ONE: bank-before-promote and never-store-value-in-temp are not a judgement call to be re-made per deploy, they are ways of working and belong estate-wide in the path. My objection to the raw copy was never the copy -- it was having no way back, and that is SOLVABLE rather than a reason to stop. The banked artifact is the difference between a deploy and a gamble, and the organ should refuse without one instead of trusting the seat to remember.
DG0 Board-level journal anchor for degradation · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
Contract- · executor Board · 0 u · stands on nothing
Definition of doneBOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 4 log rows against the id DG0, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.
Matrix cellNO-MATRIX-ROW — no matrix row carries -; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work log2026-09-04 lesson Two 503s on the source write reported stage=read-after-accept and two follow-up size reads both said ABSENT. Both were wrong: the write had landed. The read path lags the write path here, so an artifact check taken promptly is not evidence. What prevented a double-apply was a chunked driver that reads the CURRENT size before every append and compares it against the byte count that chunk expects to find; six consecutive artifact checks read ABSENT for writes that had ALL landed.
2026-09-04 land DOMAIN ADMITTED 2026-09-04. nx_domain_admit degradation first REFUSED with a precise reason -- no barcheck row for this domain AND no UNPINNED declaration, the comparison is silently unfalsifiable -- which is the same refusal loadgov recorded on 2026-09-02, so the wording is quoted rather than paraphrased. Closed by declaring what is true: NONE of the four column rivals is pinnable, because a federal regulation, a 2016 book chapter, a curated secondary reference and a single PDF paper are not projects and ship no version feed. Declaration in the matrix header, the block that backs it in knowledge/barcheck.conf, and the re-run reads C2 bars pinned=0 unpinned-declared=1 VERDICT=ADMIT with rows=13 grounded=9 absent=0 ungrounded=0 organ-unreadable=0 and four watch contracts counted as named-not-faults.
2026-09-04 lesson A MISSING VERSION PIN IS NOT A MISSING REFERENCE, and conflating them would have made this board look weaker than it is. All four rivals ARE pinned BY CONTENT in degradation.refs -- a sha256 over the mirrored bytes, re-derived and matched by nx_compare_refs_gate at pins=1271 matched=1271 estate-wide. A version pin tracks a subject that MOVES; a content pin proves WHICH BYTES were read. These four subjects do not move, so the content pin is the right instrument and the absent version row is honest rather than a gap.
2026-09-04 measure nx_compare_refs_gate run as referee: 23/24, and the two repairs this seat owed are CONFIRMED by it -- declared-refs-cited-inline-every-one PASS and cite-marks-resolve-every-one PASS, with uncited_keys=0 unmarked_domains=0 unresolved=0 across files=103 rows=1336. The single FAIL is mirror-incompleteness-ratchet-does-not-rise, incomplete=1 against baseline=0, and the named row is NOT this domain's: procgen.refs key=fastnoise2 mirror=rf_51393572.raw reason=json-unterminated. Scope measured before touching anything -- nx_absent over the compare tree returns matches=1 corpus_complete=1, so exactly one domain cites it and there is no pin cascade. Left to its owning lane as debt 1788537699 WITH the control that settles it, because this estate measured that detector at a 941 permil false-positive rate where a truncation reproducing exactly on re-fetch is not a truncation.
2026-09-06 measure Hardware re-measured 2026-09-06 and unchanged in kind from the 2026-09-04 reading: md3 raid1 DEGRADED 1 of 2 with no redundancy, md2 members sata6p5 and sata8p5 at 808 and 88 corrected reads, kernel io_error=5 unc=4 over 2 distinct sectors spanning 1824 sectors, nx_raidwatch verdict=RED. In the SAME minute build admission read VERDICT=GRANT with mem_available_mb=20251 and procs_blocked=6 against a bar of 8. The array is the constraint and the box is not short of headroom, so a refusal blamed on load in this state earns the two-sample test before it is believed
2026-09-06 lesson A READ-ONLY GLOB CAME BACK status=503 title=Outcome Unknown retry=unsafe. Every MCP call reaches the edge as a POST, so the delivery taxonomy has no way to say that this particular verb had no side effect, and it reports the most alarming state it owns. Measured twice this session, and the second case shows the cost runs both ways: a research fetch that returned that identical 503 HAD landed, 22519 bytes on disk. THE EDGE KNOWS THE METHOD IT USED AND NOT THE SAFETY OF THE VERB IT CARRIED, so it over-warns on reads and under-informs on writes, and a seat that believes it redoes work already done
2026-09-06 queue TWO FINDINGS NAMED FOR THEIR OWNERS RATHER THAN CLAIMED HERE, per this board's scope note. First, the gate-roster beat has not completed a pass in 443687 s, about 5.1 days, against a 108000 s bound; that surface runs 630 NAS-side detectors, so 630 gates currently read as covered while nothing runs them, and that belongs to the roster owner. Second, DG8 ranks priority 0 because the ranker reports UNMAPPED, no matrix row carries dg_beat_armed; it is a DATA contract rather than a symbol contract, so the right row shape is a board-owner decision and was deliberately not guessed here
DG11 Free the dispatch capacity three mis-periodded gates consume · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
Contract- · executor Data · 0.25 u · stands on DG8
Definition of donebootstrap-gate at 60s and worldgen-gate and intakekeep at 120s are 60 dispatches per 1800s window, 22 percent of all clock demand, while every other gate in the plane runs between 3600 and 86400s and all three execute out of buildroot/_build which is build scratch and not a deployed artifact path. Re-perioding them to their peers frees about 45 dispatches per window and costs no detection resolution that anyone relies on. This is the rung DG8 is actually waiting on, and it is data only with no rebuild
Matrix cellNO-MATRIX-ROW — no matrix row carries -; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work log2026-09-06 measure Live nx_cron_watch reads 20 watches with 5 stale: netobs at 60s, memvel at 600s against its 900 bound, wsmine at 74904 s, gateroster at 443687 s against 108000, and edge-vantage which is ambiguous by construction and not an estate fault. ioconfirmbeat is not among the 20 at all. The shared cause named in the netobs remediation is the clock dispatcher: TLN_MAXDISPATCH is a compiled per-window ceiling of 240 against about 268 dispatches of demand with no priority aging, so the same slow rows lose every window while 86 percent of the window time budget sits unused
DG12 A dead-man watch row for the confirmation beat · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
Contract- · executor Data · 0.25 u · stands on DG8
Definition of doneioconfirmbeat is absent from all 20 rows nx_cron_watch reads, so the one beat that build admission depends on is the only beat in the estate with no liveness alarm. An execution surface with no heartbeat is invisible to every liveness instrument, which is how this ran starved for an unknown number of days with nothing to report it
Matrix cellNO-MATRIX-ROW — no matrix row carries -; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work logno log row names this rung yet

dossiers=12 cells_joined=9 no_matrix_row=3 (sum 12) gates_recorded=0 gates_unrecorded=0 no_gate_declared=9 (sum 9 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 14 feature rows mapped of 14 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map
Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/degradation.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults
Position map, two-dimensional cutOne bubble per player. Bubble area is breadth, the ring colour is momentum, the dashed lines are the category means, and both axes are fitted to the field of play with their tick numerals shown. Every value is repeated in the table that follows. 300 400 500 600 700 800 900 1000 250 300 350 400 450 500 centrality (permil, fitted 300–1000) distinctiveness (permil, fitted 250–500) mean 670 mean 410 Unconventional Aspirational Peripheral Mainstream Nishi, centrality 675, distinctiveness 462, breadth 523, depth 814, momentum 0 Airbus FBW laws, centrality 875, distinctiveness 433, breadth 666, depth 933, momentum 0 NASA JPL fault protection, centrality 925, distinctiveness 462, breadth 738, depth 939, momentum 0 Google SRE load shedding, centrality 375, distinctiveness 291, breadth 214, depth 750, momentum 0 Aviation MEL/CDL, centrality 500, distinctiveness 402, breadth 357, depth 833, momentum 0 Nishi Airbus FBW laws NASA JPL fault protection Google SRE load shedding Aviation MEL/CDL

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 300–1000, distinctiveness 250–500 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 734 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)
Position map, three-dimensional cubeThe same players in an isometric cube. Each axis is fitted to its own field of play and carries numerals on the floor grid and the vertical axis; each bubble drops a dotted line to its floor shadow so height reads as height. Values are in the table that follows. 300 400 500 600 700 800 900 1000 250 300 350 400 450 500 100 200 300 400 500 600 700 800 centrality distinctiveness breadth Google SRE load shedding: centrality 375, distinctiveness 291, breadth 214 Aviation MEL/CDL: centrality 500, distinctiveness 402, breadth 357 Nishi: centrality 675, distinctiveness 462, breadth 523 Airbus FBW laws: centrality 875, distinctiveness 433, breadth 666 NASA JPL fault protection: centrality 925, distinctiveness 462, breadth 738 Nishi Airbus FBW laws NASA JPL fault protection Google SRE load shedding Aviation MEL/CDL
axes fitted: centrality 300–1000 · distinctiveness 250–500 · breadth 100–800 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 2 (a fact of the data: two players that close are that close) · data spread 132 permil of the plot
Position map, small multiplesEvery pair of registered axes as one small cut. Each panel fits both axes to the field of play, the dashed lines are the category means, bubble area is breadth and the ring colour is momentum; the legend below names the colours. 300 1000 250 500 distinctiveness vs centrality Nishi: centrality 675, distinctiveness 462 Airbus FBW laws: centrality 875, distinctiveness 433 NASA JPL fault protection: centrality 925, distinctiveness 462 Google SRE load shedding: centrality 375, distinctiveness 291 Aviation MEL/CDL: centrality 500, distinctiveness 402 300 1000 100 800 breadth vs centrality Nishi: centrality 675, breadth 523 Airbus FBW laws: centrality 875, breadth 666 NASA JPL fault protection: centrality 925, breadth 738 Google SRE load shedding: centrality 375, breadth 214 Aviation MEL/CDL: centrality 500, breadth 357 300 1000 700 1000 depth vs centrality Nishi: centrality 675, depth 814 Airbus FBW laws: centrality 875, depth 933 NASA JPL fault protection: centrality 925, depth 939 Google SRE load shedding: centrality 375, depth 750 Aviation MEL/CDL: centrality 500, depth 833 300 1000 480 520 momentum vs centrality Nishi: centrality 675, momentum 500 Airbus FBW laws: centrality 875, momentum 500 NASA JPL fault protection: centrality 925, momentum 500 Google SRE load shedding: centrality 375, momentum 500 Aviation MEL/CDL: centrality 500, momentum 500 250 500 100 800 breadth vs distinctiveness Nishi: distinctiveness 462, breadth 523 Airbus FBW laws: distinctiveness 433, breadth 666 NASA JPL fault protection: distinctiveness 462, breadth 738 Google SRE load shedding: distinctiveness 291, breadth 214 Aviation MEL/CDL: distinctiveness 402, breadth 357 250 500 700 1000 depth vs distinctiveness Nishi: distinctiveness 462, depth 814 Airbus FBW laws: distinctiveness 433, depth 933 NASA JPL fault protection: distinctiveness 462, depth 939 Google SRE load shedding: distinctiveness 291, depth 750 Aviation MEL/CDL: distinctiveness 402, depth 833 250 500 480 520 momentum vs distinctiveness Nishi: distinctiveness 462, momentum 500 Airbus FBW laws: distinctiveness 433, momentum 500 NASA JPL fault protection: distinctiveness 462, momentum 500 Google SRE load shedding: distinctiveness 291, momentum 500 Aviation MEL/CDL: distinctiveness 402, momentum 500 100 800 700 1000 depth vs breadth Nishi: breadth 523, depth 814 Airbus FBW laws: breadth 666, depth 933 NASA JPL fault protection: breadth 738, depth 939 Google SRE load shedding: breadth 214, depth 750 Aviation MEL/CDL: breadth 357, depth 833 100 800 480 520 momentum vs breadth Nishi: breadth 523, momentum 500 Airbus FBW laws: breadth 666, momentum 500 NASA JPL fault protection: breadth 738, momentum 500 Google SRE load shedding: breadth 214, momentum 500 Aviation MEL/CDL: breadth 357, momentum 500 700 1000 480 520 momentum vs depth Nishi: depth 814, momentum 500 Airbus FBW laws: depth 933, momentum 500 NASA JPL fault protection: depth 939, momentum 500 Google SRE load shedding: depth 750, momentum 500 Aviation MEL/CDL: depth 833, momentum 500
Nishi Airbus FBW laws NASA JPL fault protection Google SRE load shedding Aviation MEL/CDL
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 2 (a fact of the data: two players that close are that close) · data spread 569 permil of the plot
PlayerQuadrantcentralitydistinctivenessbreadthdepthmomentumRows heldDays on spineFirst seen
NishiAspirational6754625238140 since 2026-09-239102026-09-15
Airbus FBW lawsAspirational8754336669330 since 2026-09-2310102026-09-15
NASA JPL fault protectionAspirational9254627389390 since 2026-09-2311102026-09-15
Google SRE load sheddingPeripheral3752912147500 since 2026-09-234102026-09-15
Aviation MEL/CDLPeripheral5004023578330 since 2026-09-236102026-09-15
DayMatrix rows reviewedPlayers recorded
2026-09-15145
2026-09-16145
2026-09-17145
2026-09-18145
2026-09-19145
2026-09-20145
2026-09-21145
2026-09-22145
2026-09-23145
2026-10-08145

players 5|matrix rows 14|feature mass 40|centrality mean 670|distinctiveness mean 410|axes 5|spine days 10 (shown 10)|rows written today 0|readability defects 2D 0 cube 0|spine knowledge/status/cdmap/degradation.spine

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 56, unassessed 0. Authored assessments are not verified outcomes.

CapabilityNishiAirbus FBW lawsNASA JPL fault protectionGoogle SRE load sheddingAviation MEL/CDL
CONFIRM
a fault is declared only after it PERSISTS, never on one sampleMeasured: ioa_measure_median exists in runtime/nx_ioadmit_lib.nx, verified at emit. The median of k samples spaced gap_ms apart, in the SAME ruler the build gate and every I O spawner share so the two can never disagree. Flight control and spacecraft fault protection both require a confirmation time before reconfiguring and are Best here. Site reliability is the outlier and pays for it: single-sample health checks that alternated failing and healthy drove automatic failover to remove healthy capacity in the October 2025 us-east-1 event, and the remedy that worked was disabling the automation, not tuning it. [jpl-faultprot] The spacecraft bar this row is measured against is JPL fault protection [jpl-faultprot], where a fault is confirmed before anything reconfigures. Adoption: LIB-WIRED importers=30 nonval=29 — fully adopted (top of its ladder).
dossier
Pros Implementing source symbol found; runtime acceptance separate; ahead of Google SRE load shedding; fully adopted on the estate ladderCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads)
●◉◉○●
the confirmation window is DERIVED from this host's own burst structureSource present; authored stronger claim: bp_sim in runtime/nx_blkprofile.nx, verified at emit. EXCEED, and none of the four does it. Aerospace fixes confirmation times at DESIGN time from analysis; we replay a recorded series of the real signal through the REAL median and read the shortest span whose verdict stops tracking the bursts. The span table prints the verdict the armed gate WOULD have produced on that series, so arming is a measurement rather than a taste. It also prints the latency each span costs every caller, because a confirmation window that fixes admission and stalls the dispatcher has moved the defect rather than removed it. Adoption: REGISTERED-DARK — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked).
dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
Pros Source symbol found; stronger capability claim is authored; ahead of Airbus FBW laws, NASA JPL fault protection, Google SRE load shedding, Aviation MEL/CDLCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
◉○○○○
an undersampled window is reported as such and never as a zeroSource present; authored stronger claim: bp_span_at in runtime/nx_blkprofile.nx, verified at emit. EXCEED. A span that cannot be simulated from the recorded interval returns UNDERSAMPLED, because a zero in a refusal-rate column reads as this span refuses nothing, which is the most flattering possible misreading of an absent measurement. Adoption: REGISTERED-DARK — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked).
dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
Pros Source symbol found; stronger capability claim is authored; ahead of Airbus FBW laws, NASA JPL fault protection, Google SRE load shedding, Aviation MEL/CDLCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
◉○○○○
DETECT
loss of redundancy is its own named state, not a degraded synonym for failureMeasured: ioadm_degraded exists in runtime/nx_ioadmit_lib.nx, verified at emit. An array running degraded still SERVES; it has simply lost its margin. Aerospace names this precisely (dispatch is permitted, the next failure is not survivable) and so does the MEL. Reading it as failure grounds a fleet that could fly. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=30 nonval=29 — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Google SRE load shedding; fully adopted on the estate ladderCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads), Aviation MEL/CDL (leads)
●◉◉○◉
a lost cache tier read as a LEVEL, never as a lifetime counterSource present; authored stronger claim: ioa_dmcache in runtime/nx_ioadmit_lib.nx, verified at emit. EXCEED, and it was earned twice over. The flashcache counters that look like a level are lifetime totals; read as levels they report tens of GB stranded on a degraded device, which is alarming, actionable and wrong. The rung's own description made that error and so did the seat correcting it, hours apart. The mode field is not the discriminator either: it keeps printing WRITE_BACK after the cache has been flushed and disabled, so a verdict built on it reads GREEN through the entire outage. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=30 nonval=29 — fully adopted (top of its ladder).
Pros Source symbol found; stronger capability claim is authored; ahead of Airbus FBW laws, NASA JPL fault protection, Google SRE load shedding, Aviation MEL/CDL; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)
◉○●○○
SHED
a spawn budget that degrades throughput instead of refusing outrightMeasured: ioa_spawn_budget exists in runtime/nx_ioadmit_lib.nx, verified at emit. How many more I O-bound processes may start right now, derived as per_cpu times ncpu minus blocked minus a reserve slot. Graduated shedding is site reliability's strongest suit and it is Best here. Unobservable returns a third state rather than a fabricated budget, so a reader that cannot see never invents headroom [sre-overload]. The published bar is Google SRE graduated load shedding [sre-overload], which degrades throughput rather than refusing outright. Adoption: LIB-WIRED importers=30 nonval=29 — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Aviation MEL/CDL; fully adopted on the estate ladderCons behind Google SRE load shedding (leads)
●●●◉○
congestion banded clear, rising and storm rather than a booleanMeasured: ioa_congestion exists in runtime/nx_ioadmit_lib.nx, verified at emit. Dirty plus writeback against two bars. A boolean cannot express approach, and approach is the only part a shed plan can act on before the wall. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=30 nonval=29 — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Aviation MEL/CDL; fully adopted on the estate ladderCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads)
●◉◉●○
REVERT
a named reversionary-mode ladder every lane reads from one placeOpen — watching runtime/nx_degrade_lib.nx : dg_mode, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. WATCH CONTRACT. Airbus degrades through normal, alternate, direct and mechanical backup, and the CREW IS TOLD WHICH LAW IS ACTIVE; JPL safe mode is the same idea for a spacecraft. The estate today has the SENSORS for every input and no declared ladder, so each lane improvises its own degraded behaviour and no two agree. Ship dg_mode reading the measured axes and this row grounds itself on the next emit [airbus-laws]. The reference ladder is the Airbus fly-by-wire control laws [airbus-laws], whose named modes and the conditions selecting between them are exactly what this row is measured against.
dossierwatching dg_mode
Pros none measured yetCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads); open contract; expected source declaration not established
○◉◉○○
DISPATCH
an executable Minimum Equipment List for the estateOpen — watching runtime/nx_degrade_lib.nx : dg_mel_verdict, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. WATCH CONTRACT and the EXCEED on this page. Aviation dispatches aircraft with known-inoperative equipment every day under an MEL that names, per item, whether dispatch is allowed and under what limitation and for how long. That document is PAPER and a human applies it. Ours would be executable: given the measured degraded components, which lanes may still dispatch, under which limitation, and with what expiry. The MEL column is Best because the discipline is theirs; the exceed is making it a function [mel-91-213]. The rule permitting dispatch with a named item inoperative is 14 CFR 91.213 [mel-91-213].
dossierwatching dg_mel_verdict
Pros none measured yetCons behind Aviation MEL/CDL (leads); open contract; expected source declaration not established
○○○○◉
SHED
an ORDERED shed plan naming what stops firstOpen — watching runtime/nx_degrade_lib.nx : dg_shed_plan, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. WATCH CONTRACT. Electrical load management sheds named non-essential buses in a published order to protect flight-critical loads. The estate sheds by whoever happens to lose the admission coin flip, which is not an order and cannot be reasoned about. The shed plan must be DATA so it can be read, argued with and changed without a rebuild -- see the two CONFIRM rows below for the half that is already landed. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching dg_shed_plan
Pros none measured yetCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads), Google SRE load shedding, Aviation MEL/CDL; open contract; expected source declaration not established
○◉◉●●
CONFIRM
the admission gate reads an ALREADY-CONFIRMED level rather than a window it paid for itselfSource present; authored stronger claim: ba_confirmed in runtime/_hdl_build/nx_build_admit.nx, verified at emit. EXCEED, and it is the rung this whole page was opened by. Flight control confirms a fault in a CONTINUOUS monitor and lets the control law read the confirmed state; it does not stop the law for a confirmation window. Our build gate did the opposite: one instantaneous read of procs_blocked, so 118 permil of builds were refused by a spike on a box whose sustained level was HALF the bar, and a second run hours later measured 240 permil. The smoothing already wired into the gate would fix it and costs its whole span on EVERY caller including the clock dispatcher, and the measured curve had not flattened even at 12000 ms. So the window is paid once per cadence by nx_ioconfirm and read here in constant time. Landed OFF: with confirm_max_age_s absent from the conf this reads nothing and no verdict changes. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: RUN-BY:fork:nx_sov_build_run — fully adopted (top of its ladder).
dossier
Pros Source symbol found; stronger capability claim is authored; ahead of Google SRE load shedding, Aviation MEL/CDL; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)
◉◉◉○○
freshness is a THIRD STATE, so a stale level falls back instead of acquittingMeasured: ic_field exists in runtime/nx_ioconfirm.nx, verified at emit. A confirmed level that nobody refreshed is WORSE than none, because it decides with authority about a box it last saw minutes ago. FRESH, STALE and ABSENT are three distinct exits and a future timestamp is STALE, not fresh, because clock skew and a forged write are unobservable rather than healthy. Aerospace and spacecraft fault protection both treat a stale monitor as loss of the monitor; site reliability commonly treats a missing datapoint as a passing one, which is how a blind check becomes a green one, and it is the commonest way a monitor lies. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: RUN-BY:clock — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Google SRE load shedding; fully adopted on the estate ladderCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads)
●◉◉○●
REVERT
every promote banks a durable pre-change artifact the NEXT promote cannot overwriteOpen — watching runtime/nx_degrade_lib.nx : dg_bank_before_promote, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. WATCH CONTRACT, and the EXCEED is the refusal rather than the bank. The estate already banks a prev slot on deploy, but prev holds THE PREVIOUS DEPLOY and not THE LAST KNOWN GOOD, so the SECOND deploy of a session silently destroys the only way back -- measured 2026-08-21, and an older-generation binary cannot be rebuilt, so it is not recoverable by rebuilding. Spacecraft fault protection banks state before reconfiguring and is Best; the MEL discipline is Best at recording what you are dispatching WITHOUT. What none of the four does, and what the literature only writes essays about, is TEST that the undo path survives the change: AWS conceded of its own October 2025 event that the situation had no established operational recovery procedure. Make it mechanical -- no promote proceeds without a durable hash-verified bank under a path the next promote cannot reuse, and never under a reaped temp directory. Bank-before-promote is written in this estate's doctrine today and executed by whoever remembers, which is the shape every invariant here has been measured to lose. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching dg_bank_before_promote
Pros none measured yetCons behind Airbus FBW laws, NASA JPL fault protection (leads), Aviation MEL/CDL (leads); open contract; expected source declaration not established
○●◉○◉
CONFIRM
the confirmation beat is scheduled AND OBSERVED to meet the bound its consumer requiresOpen — watching runtime/nx_degrade_lib.nx : dg_beat_armed, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. WATCH CONTRACT, and this row exists because the rung was ranking at priority ZERO for want of it -- no matrix row carried the symbol, so the ranker reported UNMAPPED and the one rung that unblocks build admission sorted last. ITS DESCRIPTION IS ALSO CORRECTED BY MEASUREMENT 2026-09-06. DG8 was written as arm the freshness bound once the beat is scheduled, and BOTH of those are now DONE: ioconfirmbeat is live on the clocksched- plane at a declared 300s and confirm_max_age_s is armed at 900. The outstanding condition is the third one nobody wrote down -- that the beat is OBSERVED to fire within the bound. It is not. Two timestamps taken minutes apart gave an observed interval of 1054s against 300s declared, so the level expires between fires and every admission check falls back to a single instantaneous sample that refuses roughly 42 percent of builds on a box with headroom. A DECLARED CADENCE IS NOT A MEASURED ONE, and a scheduled beat is not a beat that runs. Flight control and spacecraft fault protection both run their confirmation monitors continuously and check the monitor itself, which is why both columns read Best here; site reliability alerts on staleness but rarely binds the monitor's own period to the consumer's freshness bound, and the MEL has no counterpart. Closes when the observed interval is inside the bound, which is what rung DG11 is for rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching dg_beat_armed
Pros none measured yetCons behind Airbus FBW laws (leads), NASA JPL fault protection (leads), Google SRE load shedding; open contract; expected source declaration not established
○◉◉●○
Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.
Rival claims, counted
ClassCountNote
rows with rival marks12rows carrying a Yes, Best or Part in a rival column
cited4a reference mark resolves to a pinned mirror
uncited8an observation read, badged until a reference lands
rows, summed12RECONCILED: the parts sum to the total 12

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.
WhenRungKindEntry
2026-09-04DG1measureStorm re-measured live rather than inherited. procs_blocked read 15 then 5 inside about 60 seconds on an unchanged box and the build verdict flipped QUEUE to GRANT with it. Two nx_dstate samples 90 s apart shared only 4 pids (synocmstaskd, one nx_sov_build_run, two nx_store_put): the D-state population is mostly transient churn over a persistent core well UNDER the bar of 8.
2026-09-04DG1measureHardware envelope named so no software rung is asked to fix it: md3 raid1 DEGRADED 1 of 2 with no redundancy, md2 members sata6p5 and sata8p5 at 808 and 88 corrected reads, kernel 5 uncorrectable errors across a 1824-sector span, and the write-back cache that tier fronted disabled. THE ARRAY IS THE CONSTRAINT; every rung here is about delivering despite it.
2026-09-04DG2lessonThe fix was already built and left unarmed ON PURPOSE, with the reason written down: the conf refuses arming on a guessed gap because the gap must SPAN a burst to smooth anything, and the cost is paid by every admission check including the clock dispatcher's pre-dispatch call. Reading that note changed the work from write a debounce to run the derivation the note asks for.
2026-09-04DG2lessonA trap recorded in that conf and re-verified before editing: ba_conf_load finds its keys by PLAIN SUBSTRING with no comment handling, so a commented example written the ordinary way ARMS the key. The examples there are spelled with spaces around the equals sign deliberately. Prose is bytes too.
2026-09-04DG1landnx_blkprofile built sovereign on the NAS, 36,305 B, first attempt clean. It composes ioa_measure and ioa_median rather than re-implementing either, so its simulated verdicts are the armed gate's verdicts and not a second ruler that can drift.
2026-09-04DG1lessonThree APIs assumed while drafting were checked before use and one was wrong: sys_time_ms is ABSENT-PROVEN in buildroot/runtime with corpus_complete=1. The organ reports a NOMINAL window and reads no clock; the added-latency column needs none, since a sampler that sleeps a span pays that span by construction.
2026-09-04DG1lessonThe organ's first run abstained with journal UNREADABLE rather than reporting zero rows. Cause was the estate's own CWD-relative trap: the build runner anchors CWD to buildroot/, so a bare knowledge/ path resolved into the other tree. Fixed with the two-root probe idiom ba_conf_load already uses, and the resolved path is now printed. The third state is what made this visible in one run instead of one investigation.
2026-09-04DG0lessonTwo 503s on the source write reported stage=read-after-accept and two follow-up size reads both said ABSENT. Both were wrong: the write had landed. The read path lags the write path here, so an artifact check taken promptly is not evidence. What prevented a double-apply was a chunked driver that reads the CURRENT size before every append and compares it against the byte count that chunk expects to find; six consecutive artifact checks read ABSENT for writes that had ALL landed.
2026-09-04DG7landnx_build_admit SHIPPED through the guarded loop: gate nx_build_admit_gate 22 of 22 GREEN, adopt-gate content=GREEN behave=IDENTICAL, live_sha equals staged_sha d2f4b8af, _offc twin byte-identical. Live report now carries blocked_src, confirm_age_s and confirm_max_age_s so the provenance of the deciding number is never a guess. Verified live: blocked_src=instant confirm_max_age_s=0, i.e. present and OFF, no verdict changed.
2026-09-04DG7measureThe evidence grade is declared WEAK and that is not hidden: nx_behaveprobe compared a usage or error path, so the 22 of 22 gate is the load-bearing proof and the probe is not. A green from a subject that could not have gone red is decoration.
2026-09-04DG1retractThe FIRST live derivation recommended blocked_samples=5 gap_ms=3000 and that recommendation was VACUOUS. Taking the asymptote as the widest span tested makes that span trivially satisfy its own tolerance, so a still-falling curve always recommends its own last row. Fixed to require corroboration by at least one LONGER span; the same organ on the same host then returned flattened=NO and RECOMMEND none. The defect was found by running the instrument and reading its own output.
2026-09-04DG8queueNOT ARMED, deliberately. Arming confirm_max_age_s before the beat is scheduled would leave a stale level that falls back on every call -- the capability would read as live while doing nothing. The order is: promote nx_ioconfirm, register the clock row, observe two successive fresh stamps, derive the bound from the observed interval rather than the declared one, and only then arm.
2026-09-04DG7measureTHE ESTATE-WIDE WRITE PRIMITIVE IS UNSAFE TO RETRY ONE TIME IN THREE. fsx_edit tests uniqueness against the PRE-image while the retry guarantee is a claim about the POST-image; they coincide only when the replacement destroys its anchor. Mined over 12,806 edit calls: 8,308 true replaces, 4,343 self-anchored (339 permil), 155 identity, sum reconciles. Seats re-issue the unsafe shape at 95 permil against a 99 permil control on the safe shape -- the doctrine is applied blindly because nothing discriminated. Three double-applies confirmed in the record plus one today that broke the build-admission gate. Debt 1788529551.
2026-09-04DG7landFix landed in three hunks: a derived predicate fsx_edit_self_anchored in nx_fsops_lib, a receipt in nx_fsops_write that stamps kind=INSERT-SELF-ANCHORED retry=UNSAFE or kind=REPLACE retry=EXACT-SAFE, and two gate teeth. REFUSING was measured and REJECTED as primary: 339 permil of edits would refuse on day one, which is the permanently-red detector everyone routes around. Deriving the kind rather than asking the caller to declare it is what makes writer and reader unable to disagree -- the 2026-08-20 version of this fix lived in nx_atomic_publish as advice keyed on a SELF-DECLARED kind, and a caller got that declaration wrong fifteen days later.
2026-09-04DG7retractI reported I could not identify the 41st failing tooth. I could, and did, in one call: forking the DEPLOYED gate binary directly needs no build and no admission, and it printed the whole tooth list. It was ls-entry-count, and the cause was mine -- my hazard tooth authored a fixture INSIDE the directory whose entry count a sibling tooth asserts. A tail is not a list, and the cheap instrument was available the whole time.
2026-09-04DG7lessonThe gate carried the law I broke, written 2026-07-31 in its own setup block: RESET EVERY PATH THIS GATE EVER AUTHORS, NOT JUST THE 3 FIXTURES, recorded because the gate had PASSED EXACTLY ONCE and FAILED EVERY RUN SINCE. I authored a new path in the counted dir and did not add it to that list. Fixed twice over: the fixture moved outside the counted directory so it cannot inflate the count by construction, and the stray unlinked at setup. A reset LIST invites exactly this; the durable shape is a fixture directory emptied wholesale.
2026-09-04DG7lessonSeven ship attempts. The dominant cost was SELF-CONTENTION: a standalone build or gate run launched alongside the ship, contending on the per-target build lock and on the shared /tmp/fsgate fixtures. Once nothing of mine competed, the build went straight through. A seat racing itself is indistinguishable from a busy box, and only the process roster tells them apart.
2026-09-04DG8queueREMAINING STEP IS MECHANICAL: one nx_organ_ship nx_fsops_write on a quiet array with no sibling build running. Source landed, both new teeth PASS, GATE_CHECKS corrected 38 to 40, the 41st tooth fixed, build succeeds. BQ-nx_fsops_write is queued in the absorber at deployq row 378 with queue_launch_rc=0 and fires on the next orchestrate pass with headroom -- SUPERSEDED, see the land row below.
2026-09-04DG7landnx_fsops_write PROMOTED AND PROVEN LIVE 2026-09-04. Bank first: nx_filecopy of the live 52,016 B binary to knowledge/status/nx_fsops_write.elf.bank-pre-dg7, verified byte-for-byte with mode_preserved=493 so the rollback is executable, NOT a temp path. Then the promote: 53,592 B, verified byte-for-byte, mode preserved. Then proven in BOTH directions on the live tool -- a self-anchoring edit now answers kind=INSERT-SELF-ANCHORED retry=UNSAFE and a true replace answers kind=REPLACE retry=EXACT-SAFE. A field that answered the same both ways would have discriminated nothing, so both controls were run.
2026-09-04DG10lessonTHE OPERATOR'S CORRECTION, AND IT IS THE RIGHT ONE: bank-before-promote and never-store-value-in-temp are not a judgement call to be re-made per deploy, they are ways of working and belong estate-wide in the path. My objection to the raw copy was never the copy -- it was having no way back, and that is SOLVABLE rather than a reason to stop. The banked artifact is the difference between a deploy and a gamble, and the organ should refuse without one instead of trusting the seat to remember.
2026-09-04DG7measureNine ship attempts failed before the hand promote succeeded. Dominant cost was SELF-CONTENTION (my own standalone builds and gate runs racing the ship for one target lock and one fixture dir), then genuine array saturation peaking at load1_centi=3400 against a 3286 storm ceiling. The sanctioned lane nx_organ_ship is admission-gated at its BUILD stage; the artifact was already STAGED at 53,592 B, so the whole remaining step was a promote the storm would not let that lane reach.
2026-09-04DG8landDG8 ARMED AND SCHEDULED 2026-09-04, completing the chain. nx_blkprofile PROMOTED 38,897 B and nx_ioconfirm PROMOTED 29,155 B, both hash-verified with mode_preserved=493. Clock row landed in the clockjobs plane: ioconfirmbeat 300 nx_ioconfirm.elf beat -- the clock forks the serving-root binary DIRECTLY, so the beat needs neither nx_job_run registration nor build admission, which is why it can run on a box that refuses builds. Then knowledge/build_admit.conf armed with the freshness bound at 900 s, with the cadence, the beat span and the derivation all written on the line as that conf demands.
2026-09-04DG8measureARMED BEHAVIOUR PROVEN IMMEDIATELY, AND IT PROVED THE THIRD STATE RATHER THAN THE HAPPY PATH: the live gate now reports blocked_src=instant-confirm-unusable confirm_age_s=8758 confirm_max_age_s=900 -- it READ the level, measured it 8,758 s old against a 900 s bound, REFUSED it, fell back to the single instantaneous sample, and PUBLISHED all three facts. A stale level is therefore visible as stale and can never be mistaken for a live one, which is the whole reason the bound exists. It flips to blocked_src=confirmed on the first beat the clock fires.
2026-09-04DG8lessonCadence and bound were treated as a DECIDABLE PAIR and both are stated in the conf: 300 s cadence, a 12 s beat window, a 900 s bound giving two whole missed beats of margin. This estate has measured a beat whose cadence could not satisfy the bound it fed and went blind by construction for 34 consecutive intervals; stating both numbers beside each other is what makes that checkable instead of discoverable, and it costs one line of conf.
2026-09-04DG0landDOMAIN ADMITTED 2026-09-04. nx_domain_admit degradation first REFUSED with a precise reason -- no barcheck row for this domain AND no UNPINNED declaration, the comparison is silently unfalsifiable -- which is the same refusal loadgov recorded on 2026-09-02, so the wording is quoted rather than paraphrased. Closed by declaring what is true: NONE of the four column rivals is pinnable, because a federal regulation, a 2016 book chapter, a curated secondary reference and a single PDF paper are not projects and ship no version feed. Declaration in the matrix header, the block that backs it in knowledge/barcheck.conf, and the re-run reads C2 bars pinned=0 unpinned-declared=1 VERDICT=ADMIT with rows=13 grounded=9 absent=0 ungrounded=0 organ-unreadable=0 and four watch contracts counted as named-not-faults.
2026-09-04DG0lessonA MISSING VERSION PIN IS NOT A MISSING REFERENCE, and conflating them would have made this board look weaker than it is. All four rivals ARE pinned BY CONTENT in degradation.refs -- a sha256 over the mirrored bytes, re-derived and matched by nx_compare_refs_gate at pins=1271 matched=1271 estate-wide. A version pin tracks a subject that MOVES; a content pin proves WHICH BYTES were read. These four subjects do not move, so the content pin is the right instrument and the absent version row is honest rather than a gap.
2026-09-04DG0measurenx_compare_refs_gate run as referee: 23/24, and the two repairs this seat owed are CONFIRMED by it -- declared-refs-cited-inline-every-one PASS and cite-marks-resolve-every-one PASS, with uncited_keys=0 unmarked_domains=0 unresolved=0 across files=103 rows=1336. The single FAIL is mirror-incompleteness-ratchet-does-not-rise, incomplete=1 against baseline=0, and the named row is NOT this domain's: procgen.refs key=fastnoise2 mirror=rf_51393572.raw reason=json-unterminated. Scope measured before touching anything -- nx_absent over the compare tree returns matches=1 corpus_complete=1, so exactly one domain cites it and there is no pin cascade. Left to its owning lane as debt 1788537699 WITH the control that settles it, because this estate measured that detector at a 941 permil false-positive rate where a truncation reproducing exactly on re-fetch is not a truncation.
2026-09-05DG7landTHE CONFIRMED LEVEL WAS DARK 24.4 h BECAUSE ITS CLOCK ROW FORKED THE ORGAN WITHOUT ITS VERB (2026-09-05, measured, fixed as data). knowledge/status/ioconfirm.status read ts=1788528368 (age 87,922 s vs confirm_max_age_s=900) while the clocksched- plane carried 'ioconfirmbeat 300 nx_ioconfirm.elf' with NO argv; nx_ioconfirm main() exits IC_EXIT_USAGE=2 unless argv[1] starts with b (beat) or r (read) (buildroot/runtime/nx_ioconfirm.nx off 7048-7319), so every fire printed usage and wrote nothing -- a dead beat that reads registered. Compounding: nx_catalog read PROMOTED-UNREGISTERED (S3), so nx_job_run refused it ('not an unpinned GREEN tool'). Fix, in order: /api/tools/register name=nx_ioconfirm elf=nx_ioconfirm.elf -> REGISTERED callable=1 (job 1788617691); hand beat via nx_job_run -> IOCONFIRM-BEAT wrote=141 blocked_confirmed=5 bar=8 samples=5 span_ms=12000 verdict=MEASURED; nx_build_admit check flipped blocked_src=instant-confirm-unusable -> blocked_src=confirmed confirm_age_s=14 VERDICT=GRANT; nx_clockjob put ioconfirmbeat 300 'nx_ioconfirm.elf beat' -> CLOCKJOB-PUT ok rows=170 (desired state; the clock folds it at its next window, ~30 min). No cron watch row existed for this beat, which is why nobody saw it go dark: a watch row is owed (cron_heartbeats: ioconfirm.status ts= max_age 900). LESSON: a clock row is a COMMAND LINE, not a name -- an organ whose main() demands a verb is dead on a bare row and indistinguishable from a beat nobody registered; the DG7 rung's own text ('register the clock row, observe two successive fresh stamps') was satisfied by a row that could never write. Verify next: two successive ts advances on ioconfirm.status >= 300 s apart after the fold.
2026-09-05DG7measureTWO SUCCESSIVE FRESH STAMPS OBSERVED, THE SECOND FROM THE CLOCK ROW ITSELF (2026-09-05). knowledge/status/ioconfirm.status ts=1788617700-band (hand beat via nx_job_run, blocked_confirmed=5) then ts=1788618978 (no hand run; the corrected clocksched row 'ioconfirmbeat 300 nx_ioconfirm.elf beat' had folded at the scheduler's window-init, ~20 min after CLOCKJOB-PUT rows=170). nx_build_admit check now reads blocked_src=confirmed confirm_age_s=142 VERDICT=GRANT at load1_centi=1205 procs_blocked=5/8. The DG7 rung's own arming condition ('register the clock row, observe two successive fresh stamps') is met by data; the remaining half is the cron-watch row (ioconfirm.status ts= max_age 900) so a future dark beat is SEEN, and deriving the bound from the OBSERVED interval before arming any smoothing.
2026-09-05DG7queueTHE ARRAY IS THE STALL AND ITS PRODUCERS ARE NAMED (2026-09-05, three nx_dstate rosters 1788617800 / 1788619350 / 1788619450, partition RECONCILES each time). D-state grew 6 -> 9 -> 13 (userspace 4 -> 5 -> 9) at load1_centi 1539 -> 1425 -> 1702 on 8 cpus; swap_used_permil 895 vs bar 700, RESMON RED sev=2 for six beats. WHO: nx_web_crawl_step.elf pid 11713 in D across two samples 100 s apart (age 1332 -> 1432 s; also RESMON worst committed at 1,751,368 KB), nx_sov_build_run pid 20646 in D for its entire 300 s life AFTER its fossil landed (buildroot/_build/nx_goalmap_gate.sov.elf 166,087 B exists while _jobs/job_1788619133.claim stays CLAIMED -- a build that finished compiling and cannot fsync its receipt), btrfs-transaction + md4_defer kthreads, nx_hostctl pid 6558, and THIRD-PARTY amuled (Synology DownloadStation) in D, plus the torrent seed lane SATURATED live=4 and nx_seed_announce_all the largest committed process. Consequence measured: every organ that touches the array (nx_debt add, nx_netobs, nx_symdrop, nx_site_publish) queues behind them; the beach is SERVED (sites.elf children are the short-lived D processes, ages <1 s) but every ship of anything waits on the crawler's and the downloader's I/O. DECISIONS OWED TO THE OPERATOR, not a seat: (1) throttle or pause the crawler and torrent lanes while the md3 NVMe mirror is DEGRADED [2/1] [_U] (replace the member); (2) stop the vendor DownloadStation daemon (amuled) -- a third-party writer on the estate's array is outside the sovereignty law; (3) a serving-latency ruler (first-byte time for /world/beach under storm) is ABSENT -- declare it as a watch so the stall becomes a number. Estate remedy already in reach: nx_heavyio_lib's concurrency bound is what the crawler should be asking before each step; measure whether nx_web_crawl_step composes it (nx_txtscan count runtime/nx_web_crawl_step.nx heavyio) before assuming.
2026-09-05DG7landA REFUSED BUILD NO LONGER EATS THE FOSSIL -- ROOT-FIXED IN THE BUILDER, PROMOTED TO BOTH ROOTS (2026-09-05). Measured on nx_goalmap_gate: a --build-only build STORED a 166,087 B fossil, the next run was admission-REFUSED (procs_blocked 9 >= 8) and the fossil was GONE (nx_fs size ABSENT) while its cache sidecar survived. Cause read from source: nx_sov_build_run.nx unlinked _build/<t>.sov.elf at its 'FAIL-LOUD' site (seq132/seq363, off ~68475) BEFORE build admission (off ~74341), tree-canon admission and the build-cache check -- so a refusal, which is not a build failure, destroyed the last good artifact and every staleness instrument then measured against an absence. Fix: the unlink moved to immediately before the compile loop, after every refusal has exited, and only on a cache MISS (a HIT has just materialised the artifact); invariant now THE ARTIFACT EXISTS IFF THE LAST ATTEMPT THAT REACHED THE COMPILER SUCCEEDED, also across refusals. Ship receipts: banked knowledge/library/nx_sov_build_run.elf.pre-unlinkmove-20260905 (142,600 B verified=1); rebuilt WITH --debug to match the live flavour (a first build without it read lost_permil=410, all srcpath/symbol metadata -- FLAVOUR MISMATCH, not loss); nx_contentdiff live vs candidate: lost_from_live=0, ONE-WAY-GAIN strict superset (the 6 gained runs are the 2026-09-04 artifact-assertion strings the live binary had never carried); /api/promote_toolchain target=nx_sov_build_run.elf -> TOOLCHAIN-PROMOTED canary=GREEN prev=1 (buildroot/_offc); /api/promote target=nx_sov_build_run -> PROMOTED 144,136 B sha 79ab55b6 prev=1 (serving root, the copy nx_job_run forks) -- two roots, two promotes. Gotchas for the next seat: the toolchain lane refuses target=<name> (wants <name>.elf) and reads a staged <name>.elf.new that the plain stage does not create -- nx_stage_alias alias <t> elf.new bridges it. LESSON: an admission refusal must be side-effect free; a guard that runs after a destructive step protects nothing.
2026-09-05DG7measureTHE BEAT FIRES, BUT NOT AT ITS DECLARED 300 s (2026-09-05). ioconfirm.status ts advanced 1788617700-band (hand) -> 1788618978 (clock) -> ~1788621081 (clock; read back as confirm_age_s=1107 at 1788622188, i.e. blocked_src had fallen to instant-confirm-unusable again) -> fresh again by 1788622367 (confirm_age_s=22). Observed interval ~2,100 s against a declared 300 s row -- the clock plane's known convergence (CLAUDE.md: the declared cadence column is not a predictor; everything drifts toward ~21,600 s) applied to a 900 s freshness bound, so admission runs on a CONFIRMED level roughly a third of the time and on the single instantaneous sample the rest. Cadence x bound is the decidable pair: either the dispatcher honours 300 s for this row or confirm_max_age_s must be derived from the OBSERVED interval (2,100 s + one missed beat = ~4,200 s) -- and the DG7 rung's own text already says derive the bound from the observed interval before arming any smoothing. Owed: a cron-watch row for ioconfirm.status so the gap is SEEN, and the dispatcher-cadence defect adjudicated on the clock domain, not here.
2026-09-05DG7measureTHE BUILDER FIX PROVEN ON A REAL REFUSAL, NOT A FIXTURE (2026-09-05 late): nx_sov_build_run nx_wasm_craft_gate --build-only was REFUSED by admission (VERDICT=QUEUE, procs_running=22 >= ncpu 8, load1_centi 2434, exit 6) and buildroot/_build/nx_wasm_craft_gate.sov.elf read 402,747 B afterwards -- the prior fossil (sha c5b69c34, the GE57 build) SURVIVED. Under the pre-fix builder this same refusal deleted the fossil this morning (measured on nx_goalmap_gate). The unlink-after-admission move is therefore live and behaving on the serving root's builder (sha 79ab55b6). Re-issued on the next sampled GRANT (load1_centi 2802 -- the load conjunct only QUEUEs above 3286, the D-state witness 5/8 and run queue 4/8 both clear).
2026-09-05DG7measureTHE ADMISSION SENSOR IS DARK AGAIN (2026-09-05 evening): nx_build_admit reads blocked_src=instant-confirm-unusable confirm_age_s=1017 then 1030 against confirm_max_age_s=900, i.e. the ioconfirm beat that was re-armed this morning (clock row ioconfirmbeat 300 s, verb beat) has not stamped for 17 minutes while procs_blocked swung 3 to 11 on 8 cpus; every build in this seat's queue (nx_goalmap, nx_goalmap_gate, nx_engine_dispatch_gate control, nx_swcompare_sota second leg) is refused QUEUE on that reading; a beat that goes dark exactly during the storm it exists to measure is the cron-watch gap named this morning (max_age 900 on ioconfirm.status) still unfilled -- owner DG7, not this lane
2026-09-06DG8measureTHE BEAT IS STARVED, NOT DEAD, AND ONLY TWO TIMESTAMPS SEPARATE THOSE TWO. nx_build_admit reported blocked_src=instant-confirm-unusable with confirm_age_s=1035 against confirm_max_age_s=900, which reads exactly like a stopped beat. Reading knowledge/status/ioconfirm.status then gave ts=1788731704 where the earlier report implies ts=1788730650, an OBSERVED interval of 1054 s against a DECLARED cadence of 300 s. The beat fires at roughly one third of its declared rate, so the confirmed level crosses the 900 s bound between fires and every admission check correctly falls back to a single instantaneous sample. Present and inert, exactly as the DG8 queue row predicted, and the cause is upstream of both the organ and the conf
2026-09-06DG11measureLive nx_cron_watch reads 20 watches with 5 stale: netobs at 60s, memvel at 600s against its 900 bound, wsmine at 74904 s, gateroster at 443687 s against 108000, and edge-vantage which is ambiguous by construction and not an estate fault. ioconfirmbeat is not among the 20 at all. The shared cause named in the netobs remediation is the clock dispatcher: TLN_MAXDISPATCH is a compiled per-window ceiling of 240 against about 268 dispatches of demand with no priority aging, so the same slow rows lose every window while 86 percent of the window time budget sits unused
2026-09-06DG0measureHardware re-measured 2026-09-06 and unchanged in kind from the 2026-09-04 reading: md3 raid1 DEGRADED 1 of 2 with no redundancy, md2 members sata6p5 and sata8p5 at 808 and 88 corrected reads, kernel io_error=5 unc=4 over 2 distinct sectors spanning 1824 sectors, nx_raidwatch verdict=RED. In the SAME minute build admission read VERDICT=GRANT with mem_available_mb=20251 and procs_blocked=6 against a bar of 8. The array is the constraint and the box is not short of headroom, so a refusal blamed on load in this state earns the two-sample test before it is believed
2026-09-06DG0lessonA READ-ONLY GLOB CAME BACK status=503 title=Outcome Unknown retry=unsafe. Every MCP call reaches the edge as a POST, so the delivery taxonomy has no way to say that this particular verb had no side effect, and it reports the most alarming state it owns. Measured twice this session, and the second case shows the cost runs both ways: a research fetch that returned that identical 503 HAD landed, 22519 bytes on disk. THE EDGE KNOWS THE METHOD IT USED AND NOT THE SAFETY OF THE VERB IT CARRIED, so it over-warns on reads and under-informs on writes, and a seat that believes it redoes work already done
2026-09-06DG0queueTWO FINDINGS NAMED FOR THEIR OWNERS RATHER THAN CLAIMED HERE, per this board's scope note. First, the gate-roster beat has not completed a pass in 443687 s, about 5.1 days, against a 108000 s bound; that surface runs 630 NAS-side detectors, so 630 gates currently read as covered while nothing runs them, and that belongs to the roster owner. Second, DG8 ranks priority 0 because the ranker reports UNMAPPED, no matrix row carries dg_beat_armed; it is a DATA contract rather than a symbol contract, so the right row shape is a board-owner decision and was deliberately not guessed here
On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.
Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/degradation.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain degradation, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from degradation.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.
Field discovery, counted
ClassCountNote
seeds2
scanned2
fetched2
reused0
failed0
named2
candidates2
mentions2
capped0
RankRivalSeedsMentionsFirst seedKindLink
1Airbus FBW laws11col0-airbusnamedhttps://skybrary.aero/articles/flight-control-laws
2Google SRE load shedding11col2-googlenamedhttps://sre.google/sre-book/handling-overload/

field candidates 2|shown 2 of 2|matrix columns in the field 2 of 4|discovered rivals with no column 0|malformed rows 0 (counted, never rendered)|read-capped 0

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 14 capabilities: 10 exclusive to it and 4 shared with other boards. Shared rows on this page: 4 = home here 0 + home elsewhere 4 + ambiguous 0 + undecided 0 + refused 0 (partition 4); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=150.

CapabilityOrganBoards grading itHomeRuleEvidenceStanding on this board
ioa_spawn_budgetnx_ioadmit_lib.nxloadgov*+, observability+, degradationloadgovrungplanhome elsewhere
adopt: @xrow loadgov|ioa_spawn_budget|home by rung (fleet duplicate census)
ba_confirmednx_build_admit.nxloadgov*+, degradation*loadgovrungplan+gateshome elsewhere
adopt: @xrow loadgov|ba_confirmed|home by rung (fleet duplicate census)
ioa_congestionnx_ioadmit_lib.nxobservability*+, degradationobservabilityrungplanhome elsewhere
adopt: @xrow observability|ioa_congestion|home by rung (fleet duplicate census)
ioa_dmcachenx_ioadmit_lib.nxobservability*+, degradationobservabilityrungplanhome elsewhere
adopt: @xrow observability|ioa_dmcache|home by rung (fleet duplicate census)

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396597 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kindnameboardsourceevidence
directivenx_seed_announce_alldegradationplan-queuerung=DG7
directivenx_symdropdegradationplan-queuerung=DG7
directivenx_heavyio_libdegradationplan-queuerung=DG7

rows shown 3|this board's directives 3|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.
  1. [sre-overload] Alejandro Forero Cuervo, edited by Sarah Chavis. Handling Overload, a chapter of Site Reliability Engineering (eds. Beyer, Jones, Petoff and Murphy), O Reilly Media 2016: graceful degradation, criticality-based load shedding, and client-side adaptive throttling in which a client self-regulates once requests exceed a multiple of accepts. publisher · read in our library knowledge/fetched/cmp_degradation_sre-overload.html · pin h8ca912a82390e7f61e8bbae7baab3a74489f5068d71dee1ff24aed99375e0373 · accessed 2026-09-04 · published-courseGrounds: The Google SRE load shedding column. Grounds SHED: a spawn budget that degrades throughput instead of refusing outright, the row where site reliability is Best and graduated shedding is the bar, and SHED: an ORDERED shed plan naming what stops first, for which criticality-ordered shedding is the published reference.
  2. [airbus-laws] SKYbrary Aviation Safety. Flight Control Laws: fly-by-wire control modes and the reversionary ladder, degrading through Alternate Law and Direct Law to Mechanical Back Up, with the failure conditions that trigger each reversion and the protections surrendered at each step. publisher · read in our library knowledge/fetched/cmp_degradation_airbus-laws.html · pin h2fb8ea32e7cf06a2fc93480455b047e397337647bbf03b40d4e63870d1385d3c · accessed 2026-09-04 · mirrored-indexGrounds: The Airbus FBW laws column. Grounds REVERT: a named reversionary-mode ladder every lane reads from one place -- the named laws and the failure conditions that select between them are exactly the reference that row is measured against.
  3. [mel-91-213] Code of Federal Regulations Title 14 Part 91 Section 91.213, Inoperative instruments and equipment: dispatch with inoperative items under an approved Minimum Equipment List, the categories of equipment that may never appear on such a list, and the requirement that an inoperative item be removed or deactivated with the cockpit control placarded and the maintenance recorded. publisher · read in our library knowledge/fetched/cmp_degradation_mel-91-213.html · pin h19e8959399519fc007fbd09c908f5cf5f39371e4f4e09bd997c3a6c32b72753d · accessed 2026-09-04 · published-standardGrounds: The Aviation MEL and CDL column. Grounds DISPATCH: an executable Minimum Equipment List for the estate, the row whose exceed is turning this paper discipline into a function, and DETECT: loss of redundancy is its own named state, not a degraded synonym for failure, since this rule is what permits dispatch with a named item inoperative.
  4. [jpl-faultprot] NASA Small Spacecraft Systems Virtual Institute knowledge base, resource 05-2750: a JPL spacecraft fault protection paper covering fault detection with confirmation and the general-purpose safe mode response that configures the vehicle into a lower-power predictable state until operators can diagnose it. Title and authorship are attributed and not read: the PDF text was not extracted in session and nothing is quoted from it. publisher · read in our library knowledge/fetched/cmp_degradation_jpl-faultprot.pdf · pin h6f49d7bc679f80d1a8f65e53fd2f04fbb70f7d520a1f395208932c3607faca1e · accessed 2026-09-04 · published-paperGrounds: The NASA JPL fault protection column. Grounds CONFIRM: a fault is declared only after it PERSISTS, never on one sample, the row where spacecraft fault protection is Best because confirmation is required before reconfiguring, and REVERT: a named reversionary-mode ladder every lane reads from one place, for which safe mode is the spacecraft analogue.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/degradation.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls