Nishi Family › Compare › Developer Guardrails and the Agentic Control Plane

Nishi Compare · capabilities, evidence and delivery

Developer Guardrails and the Agentic Control Plane

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

The roadmap-binding board behind /compare/devguardrails. Rival codes copied verbatim from the named devguardrails.sota row; Nishi cells are MEASURED -- the ranker requires the implementing symbol as a top-level func in the real organ source on disk.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Shipped and measured, and genuinely ahead of the field: the whole build-gate-promote-deploy loop is agent-callable over MCP under attenuate-only capability tokens [capmyths03], deploys are never-brick with health-checked promote and automatic rollback, the compare surface re-measures and republishes itself on a beat with an orphan census whose parts must sum, and the bounded-read discipline is real -- nx_fs declares its own truncation in the payload and a PostToolUse warner restates the bound so a partial read cannot be quoted as a census. That envelope behaviour is the estate at its best and nothing in this plan weakens it. What is MISSING is the layer underneath: the guard plane that enforces all of this cannot state its own health, the seat is held to laws whose enforcing organs it is not granted, and this domain -- the one that measures the agentic control plane -- had no plan at all, so the ranker structurally refused it and the tool plane was the only major surface in the estate with no computed build order. MEASURED 2026-08-22 by full enumeration of the compare data directory, 349 of 349 entries with truncated=0: devguardrails carried a refs file and a sota sheet and neither a matrix nor a plan. cleanserve is in the same state and is named here so the next reader does not have to re-derive it.

Where we need to go. Make the seat-facing tool plane as honest about itself as the surfaces it guards. Every rung below converts one currently-invisible failure into a row that is emitted whether or not anyone asks: a hook that times out is counted against attempts rather than logged into a denominator-free void, a law that mandates an organ also grants it, a per-call tax is bounded and named, and this domain becomes rankable so the order of the remaining work is computed from the boards rather than chosen by a seat.

The unit. 1 u = one measured session-leg (organ plus gate plus live flip), the pmdash and charsim calibration used across the estate.

Where are we: 6 open rungs and 1 landed. The agentic control plane is the estate's strongest surface and its own guard plane is the least instrumented thing in it. Counts measured at emit below this line.

Cost to a guard plane that can state its health: 2.5 u. DG1 the attempt counter and DG2 the two-cause collapse. These are the cheapest rungs and the two that stop a silently-suppressed hook from reading as a working one.

Cost to a seat that can reach its own laws: 1.5 u. DG3 the capability floor and DG4 the bounded per-call tax. Both are configuration and wrapping, not new capability, and DG3 unblocks the rank proof this very file could not produce.

Cost to a rankable and adopted tool plane: 3 u. DG5 the watch-contract matrix and DG6 the gate-adoption adjudication, which is the estate's own largest published gap.

Latest recorded release

2026-09-04 · DG10

THE SECOND QUESTION IS NOW PUBLISHED ON /compare/acceptance ITSELF. nx_acceptview.nx 33415 to 36268 B, byte-identical both trees, builds clean (47010 to 48345 B artifact). Every subject card now carries an improving? chip beside its percept-vs-floor chip, with FOUR named states because three would force a lie: UNREADABLE-ARM-COUNT, NO-ARMS-NEVER-GRADED, ONE-ARM-NO-BASELINE, CONTRASTABLE, each printing the arm count against the two a contrast needs. THE ORGAN STILL COMPUTES NO VERDICT -- its own header forbids a second opinion rendered beside the first, and this is not one: the ledger asks has everyone signed, this asks whether an improvement claim is even ANSWERABLE, and the two are not derivable from each other because a bar-clearing frame can be a regression from a much better predecessor. The arm count is read straight off ref_rows which nx_accept list already prints, so nothing is re-derived. WHAT IT WILL PUBLISH TODAY IS THE FINDING: face has ONE referee row and the other four subjects have NONE, so the page will read ONE-ARM-NO-BASELINE once and NO-ARMS-NEVER-GRADED four times. AN ABSTENTION NOBODY READS IS A LIE NOBODY TOLD -- omitting the improvement question made the page read as though it were not being asked rather than as though it could not be answered. Compile-verified; NOT run-verified locally, because the emitter forks nx_accept.elf and writes the served site root, so the rendered chip is proven on the next compare beat and not by me.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

1 of 8 capability source symbols found|0 of them authored stronger-claims|7 open|coverage 125/1000|adoption 1 full / 0 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 0 vs present 0 · named + unnamed + withheld = 6 vs open 6 · both reconcile

liar-kill conj=GpqN · first failing conjunct: present

graded document: BUILDROOT tree, 9356 bytes · gates map: NONE · stamped 37d 6h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_devguardrails.verdict

Gap class	What it is, and the work it names
CLAIM-ONLY	No declared gate ran for this board, so every capability mark here rests on a symbol existing in source and on nothing executing. The remedy is to WRITE a `.gates` map naming gates that already run — authoring, not research.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence devguardrails itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_INCONSISTENT. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Current prerequisite graph is invalid or unavailable. Historical rank data is retained, but cannot establish a current order. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
This domain becomes rankable (DG0)	dg_plan_admitted	LANDED by this file. devguardrails had a refs register and a sota sheet but no plan, proven by full enumeration of buildroot knowledge compare at 349 of 349 entries with truncated=0, so nx_compare_rank refused it and no build order existed for the tool plane. HONEST LIMIT declared rather than hidden: the rank proof itself is BLOCKED, because nx_compare_rank is not in this seat's capability set -- which is precisely rung DG3, so the blocker for proving this rung is itself a rung on this board	Organ	0 u
The guard plane states its own health (DG1)	wg_attempt_counter	The hook guard writes its evidence log ONLY at condemnation sites -- Write-GuardLog is called at the SKIP-ORGAN and TIMEOUT-ORGAN branches and nowhere else, and the script's own header enumerates every logged verdict as a refusal. MEASURED 2026-08-22 over the whole file: 1067 recorded events across 2026-08-10 to 2026-08-22, partitioning exactly as 474 TIMEOUT-ORGAN plus 216 SKIP-ORGAN plus 159 SKIP-VM plus 152 SKIP plus 44 RESET-ORGAN plus 12 TIMEOUT-VM plus 4 TIMEOUT plus 3 RESET plus 2 LAUNCH-FAIL plus 1 RESET-VM, which sums to 1067 with no residual. There is no success call site, so 1067 is a COUNT OF REFUSALS AND NOT A RATE, and hook health is structurally uncomputable -- the estate's own law that every aggregate assertion binds to its denominator, violated in the plane that enforces the estate's laws. ACCEPT: attempts are counted alongside refusals so a rate exists, two consecutive windows reconcile, and a deliberately forced timeout raises attempts and refusals by exactly one each	Organ	1 u
The timeout worklist collapsed to its two causes (DG2) after DG1	wg_stop_budget	A count without a worklist is not actionable, and a worklist that is not collapsed to causes adjudicates one edit N times. MEASURED 2026-08-22 over the whole log: the 474 organ timeouts are 286 nx_worklog_stop and 134 nx_memplane_run, so TWO Stop-hook organs are 420 of 474 or about 886 permil, and every other subject is 24 or fewer. A live instance was open during this very session, with nx_truncwarn breaker-open and its age climbing from 77 to 139 seconds while being repeatedly skipped -- so the truncation warner the operator had just seen fire was suppressed minutes later. Per-organ extraction differs from the verdict tally by one row because the two counts read different fields, stated rather than smoothed. ACCEPT: both dominant organs complete inside their budget on a real turn, measured on the turn and not on a fixture, or the slow leg moves off the blocking path -- and the fix is proven by the breaker for those keys staying closed across a full session	Organ	1.5 u
The seat can reach the laws it is held to (DG3)	cap_law_floor	The measurement law requires that absence is never asserted from a filtered read and that nx_absent is the organ that proves it. MEASURED 2026-08-22: nx_absent returns capability denied to this seat, and so does nx_compare_rank, the roadmap ranker. The seat is therefore mandated to prove absence with a tool it is not granted, and told to work from the ranked board while unable to ask for the ranking. This is the governor-privilege inversion the estate already banked against a build governor, recurring on the absence-prover and the ranker, and a read-only census is not a privileged act. THIS IS THE FOURTH INDEPENDENT REDISCOVERY OF ONE UNFIXED DEFECT AND NOT A NEW FINDING, so the priors are named here to stop the next reader repeating the investigation: 1785028986 measured register-then-use as a two-actor operation with a manual mint step, 1785436247 measured the entire body and anatomy organ family absent from the standing allow-set, and 1786115553 measured the discovery tools themselves ungranted. That last row also records the CONSEQUENCE this operator report independently reproduced from the outside -- a seat that hits a cap wall on its first probe reaches for shell, which the row names as a concrete driver of the estate's shell-usage rate, so the felt badness of the tool surface and this capability gap are the same defect seen from two ends. The fix shape is known and is not a wider token: the any-grants presenter in nx_tools_api already collects the body capability, the X-Nishi-Cap header, the Bearer header and the query capability and lets the FIRST ONE THAT GRANTS win, and minting everything at once was already refused as allow-too-long at 60 tools, so the remedy is a third scoped read-only capability alongside the two that exist. The refusal text is otherwise exemplary -- it names the exact mint call and tells the caller not to fall back to shell [mcp-spec]. ACCEPT: a seat holding the standard read capability can run the absence-prover and the ranker, a write or admin operation still refuses from that same capability, and the negative control is that an unminted capability is still denied	Organ	1 u
The per-call hook tax is bounded and named (DG4)	wg_wrap_costwarden	Every other hook on this host runs under the wsl guard, which bounds it five ways and fails open. The PreToolUse hook matching every nishi MCP call does NOT -- it is raw inline PowerShell with no guard wrapper and no timeout, spawning a process and taking a named mutex on EVERY tool call. MEASURED this session: two Thread failed to start errors and one No stderr output from that hook, and the same host exhaustion reached the seat's own tooling when a Bash call failed with uv_spawn while 330 processes were live. ACCEPT: the hook runs under the same bounded launcher as its siblings, a spawn failure degrades to silence rather than to an error banner in the operator's transcript, and the cost of the hook per call is measured and published rather than assumed	Organ	0.5 u
Watch contracts for the tool plane (DG5) after DG0	dg_matrix_admit	This domain renders from a sota sheet only, so it has no matrix and therefore no watch contracts, and a rung here cannot flip itself when its organ ships -- every status on this board is a hand assertion until it does. Admit a devguardrails.matrix whose gap rows name each open symbol on this plan as an absent-symbol watch contract, so the page re-measures itself on the beat like every other hive domain. ACCEPT: each open rung symbol on this plan resolves to exactly one matrix row, a planted symbol flips its row from open to landed on the next emit with zero hand edits, and the flip is recorded as the receipt and never quoted as the proof of the rung's done-rule	Organ	1 u
Gate adoption adjudicated rather than rebuilt (DG6) after DG5	ga_adjudicate	The sota sheet already publishes the estate's largest honest gap, and publishing it is not closing it: 2317 gate sources exist, 135 are deployed, 30 are actually invoked, and there are 0 invocation gaps -- so every gate anything runs is deployed and byte-identical to source, and the problem is 2287 sources nothing invokes plus 105 deployed binaries nobody calls. A deployed uninvoked gate is a measurement the estate pays for and does not collect, and it degrades to a false sense of coverage because its existence is counted while its verdict is not. The remedy is adjudication, wire or retire, and explicitly NOT the mass rebuild the 94-percent-undeployed headline invites, which the record already forbids after two of eight sampled rebuilds lost capability. ACCEPT: every deployed uninvoked gate carries a decision of wired or retired with its reason, retirement is reversible through the retire-path organ and never a delete, and the invoked count moves while the invocation-gap count stays at 0	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
D0 · The guard plane can state its own health	DG1,DG2	2.5 u
D1 · The seat can reach its own laws	DG3,DG4	1.5 u
D2 · The tool plane is rankable and adopted	DG5,DG6	3 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Board capability claims re-measured against a gate verdict (DG7) after	wp_gate_binding	A .matrix row may declare gate=<gate-name>; the emitter reads that gate's verdict against the LIVE artifact on every publish and renders the same drift classes the sota =<symbol> bindings already use, so a row asserting an absence its gate contradicts publishes as STALE-UNDER and a row asserting a capability its gate denies REFUSES to publish	Organ	4 u
Per-run gate fixtures (DG8) after	gk_fixture_dir	nx_gatekit_lib exposes one primitive returning a per-run fixture directory derived from gate name plus pid; nx_bck_elide_gate adopts it and its 14 hardcoded path literals collapse to that call; two concurrent runs of the same gate against different subjects both return their true verdict instead of a false SKIP	Organ	2 u
Acceptance can say whether we are IMPROVING, not only whether we cleared a bar (DG10) after the panel percept self-check is 12 of 13 RED, so the only voting lens is currently failing the condition its own header admits it under	ab_axis_verdict	LANDED as the arithmetic, OPEN as the wiring, and the honest half is stated first. nx_abstat_lib plus nx_abstat_gate ship the two-arm contrast with Bonferroni-corrected per-axis tests, 24 of 24 GREEN, both trees byte-identical at 14582 and 8987 B, binary sha256 9b21c20a reproduced across three convergence edits. It composes rather than duplicates: the Bonferroni critical-t table stays the one in nx_multivariate and this is a caller, the Welford recurrence carries a callable equivalence proof the gate RUNS, and the sample floor is NX_MC_MIN_N. Five states per axis because four would force a lie, with BELOW_MDE as the anti-p-hacking state and a pre-declared minimum detectable effect, REGRESSED dominating IMPROVED, and zero-variance answering INSUFFICIENT with the reason named rather than NO-CHANGE. THE BLOCKING LIMIT, MEASURED NOT ASSUMED: the cjc_panel referee supplies exactly ONE voting lens, cjp_percept, a single scalar over a whole fitted 400x240 frame, so K equals 1 and the family-wise correction is a NO-OP until a second lens earns a floor. There is no hair region, no garment region and no locomotion measure, so refereeing three subjects from one beach crop would produce three identical rows, and locomotion is temporal and cannot be refereed by a still at all. ACCEPT: a second per-region lens earns a floor under a calibrate receipt at FP 0 and FN 0, nx_abstat is wired to the acceptance surface, and one real two-arm contrast between two named builds publishes a verdict with its tested-axis denominator beside it	Organ	0 u
The L4 migration has its transformation half and a site-level count (DG9)	nx_gvmigrate	RECONSTRUCTED 2026-09-04 by nx_board_idref_gate, which found 4 log rows on this board addressed to DG9 with NO rung row to attach them to. This board declares DG0 through DG8 and DG10, so DG9 was simply skipped while its work was journalled. Derived from those rows and nothing else: the campaign is 670 SITES not 667 gates and an 18-line sample read zero; nx_gvmigrate SHIPPED, PROMOTED 067b6576 and REGISTERED as the missing TRANSFORMATION half of the L4 migration; judge-equivalence proven on nx_acquire_gate with both arms built and run at 34 of 34 sites migrated. It carries a queue row naming the honest ceiling of the mechanical lane, so this reads LANDED WITH A NAMED REMAINDER. Correct this row rather than deleting it if the owning lane meant otherwise.	Organ	1 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 14. Rank input binding: STALE_INCONSISTENT. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 fcdf6029e8b38bd7388c43e190754492ca22205af220124f4c175cd35fbc612c. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Invalid declared graph. Malformed rows or IDs 7; duplicate IDs 0; duplicate prerequisites 0; missing prerequisites 0; cyclic or cycle-dependent nodes 0. Node paths withheld.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence devguardrails writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

DG0 This domain becomes rankable · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`dg_plan_admitted` · executor Organ · 0 u · stands on nothing
Definition of done	LANDED by this file. devguardrails had a refs register and a sota sheet but no plan, proven by full enumeration of buildroot knowledge compare at 349 of 349 entries with truncated=0, so nx_compare_rank refused it and no build order existed for the tool plane. HONEST LIMIT declared rather than hidden: the rank proof itself is BLOCKED, because nx_compare_rank is not in this seat's capability set -- which is precisely rung DG3, so the blocker for proving this rung is itself a rung on this board
Matrix cell	NO-MATRIX-ROW — no matrix row carries `dg_plan_admitted`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DG1 The guard plane states its own health · cell WATCHING · gate NO-GATE-DECLARED

Contract	`wg_attempt_counter` · executor Organ · 1 u · stands on nothing
Definition of done	The hook guard writes its evidence log ONLY at condemnation sites -- Write-GuardLog is called at the SKIP-ORGAN and TIMEOUT-ORGAN branches and nowhere else, and the script's own header enumerates every logged verdict as a refusal. MEASURED 2026-08-22 over the whole file: 1067 recorded events across 2026-08-10 to 2026-08-22, partitioning exactly as 474 TIMEOUT-ORGAN plus 216 SKIP-ORGAN plus 159 SKIP-VM plus 152 SKIP plus 44 RESET-ORGAN plus 12 TIMEOUT-VM plus 4 TIMEOUT plus 3 RESET plus 2 LAUNCH-FAIL plus 1 RESET-VM, which sums to 1067 with no residual. There is no success call site, so 1067 is a COUNT OF REFUSALS AND NOT A RATE, and hook health is structurally uncomputable -- the estate's own law that every aggregate assertion binds to its denominator, violated in the plane that enforces the estate's laws. ACCEPT: attempts are counted alongside refusals so a rate exists, two consecutive windows reconcile, and a deliberately forced timeout raises attempts and refusals by exactly one each
Matrix cell	The guard plane states its own health · `runtime/nx_hookguard.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_hookguard`; declare `nx_hookguard TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 measure THIRD MEASURED RECURRENCE of the async-launch bound's false-deny class (debt 1787686197, corrected by 1787707354), 2026-09-06, from the motion lane: nx_job_run refused nx_motion_serve_gate_staged -- a VERIFIER that exits -- because jlb_denied (nx_job_launch_bound.nx) refuses any underscore-segment starting with a control-plane stem (daemon, serve, supervis, hostctl, mgmt, deploy, promote, restart, kill) and has no declaration hook, so a gate named after its daemon subject in the estate's own <target>_gate convention can never be job-run. The refusal direction is correct and fail-closed (a daemon must never wedge the async slot) and was NOT loosened. Measured consequences on this lane: the gate was renamed for its true scope (nx_motion_gate proves the door and the job; the resolver derives it from both targets), and nx_retire_path refused to retire the superseded source for the same token ('serve' is a protected name), so the same stem list now bites two guards from opposite sides. The remedy shape that closes the class without loosening either guard: jlb_denied consults knowledge/status/organ_kind.conf -- a declared oracle or oneshot is launchable, a declared daemon is denied, an undeclared name falls to the stem rule -- with a bite tooth in nx_job_launch_bound_gate proving that nx_studio_gate (a daemon declared as one) stays denied while a declared oracle carrying 'serve' launches. Filed here as a measurement for the guardrail lane, not re-filed on the debt board.

DG2 The timeout worklist collapsed to its two causes · cell WATCHING · gate NO-GATE-DECLARED

Contract	`wg_stop_budget` · executor Organ · 1.5 u · stands on DG1
Definition of done	A count without a worklist is not actionable, and a worklist that is not collapsed to causes adjudicates one edit N times. MEASURED 2026-08-22 over the whole log: the 474 organ timeouts are 286 nx_worklog_stop and 134 nx_memplane_run, so TWO Stop-hook organs are 420 of 474 or about 886 permil, and every other subject is 24 or fewer. A live instance was open during this very session, with nx_truncwarn breaker-open and its age climbing from 77 to 139 seconds while being repeatedly skipped -- so the truncation warner the operator had just seen fire was suppressed minutes later. Per-organ extraction differs from the verdict tally by one row because the two counts read different fields, stated rather than smoothed. ACCEPT: both dominant organs complete inside their budget on a real turn, measured on the turn and not on a fixture, or the slow leg moves off the blocking path -- and the fix is proven by the breaker for those keys staying closed across a full session
Matrix cell	The timeout worklist collapsed to its two causes · `runtime/_hdl_build/nx_worklog_stop.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_worklog_stop`; declare `nx_worklog_stop TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DG3 The seat can reach the laws it is held to · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cap_law_floor` · executor Organ · 1 u · stands on nothing
Definition of done	The measurement law requires that absence is never asserted from a filtered read and that nx_absent is the organ that proves it. MEASURED 2026-08-22: nx_absent returns capability denied to this seat, and so does nx_compare_rank, the roadmap ranker. The seat is therefore mandated to prove absence with a tool it is not granted, and told to work from the ranked board while unable to ask for the ranking. This is the governor-privilege inversion the estate already banked against a build governor, recurring on the absence-prover and the ranker, and a read-only census is not a privileged act. THIS IS THE FOURTH INDEPENDENT REDISCOVERY OF ONE UNFIXED DEFECT AND NOT A NEW FINDING, so the priors are named here to stop the next reader repeating the investigation: 1785028986 measured register-then-use as a two-actor operation with a manual mint step, 1785436247 measured the entire body and anatomy organ family absent from the standing allow-set, and 1786115553 measured the discovery tools themselves ungranted. That last row also records the CONSEQUENCE this operator report independently reproduced from the outside -- a seat that hits a cap wall on its first probe reaches for shell, which the row names as a concrete driver of the estate's shell-usage rate, so the felt badness of the tool surface and this capability gap are the same defect seen from two ends. The fix shape is known and is not a wider token: the any-grants presenter in nx_tools_api already collects the body capability, the X-Nishi-Cap header, the Bearer header and the query capability and lets the FIRST ONE THAT GRANTS win, and minting everything at once was already refused as allow-too-long at 60 tools, so the remedy is a third scoped read-only capability alongside the two that exist. The refusal text is otherwise exemplary -- it names the exact mint call and tells the caller not to fall back to shell [mcp-spec]. ACCEPT: a seat holding the standard read capability can run the absence-prover and the ranker, a write or admin operation still refuses from that same capability, and the negative control is that an unminted capability is still denied
Matrix cell	The seat can reach the laws it is held to · `runtime/nx_tools_api.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tools_api`; declare `nx_tools_api TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DG4 The per-call hook tax is bounded and named · cell WATCHING · gate NO-GATE-DECLARED

Contract	`wg_wrap_costwarden` · executor Organ · 0.5 u · stands on nothing
Definition of done	Every other hook on this host runs under the wsl guard, which bounds it five ways and fails open. The PreToolUse hook matching every nishi MCP call does NOT -- it is raw inline PowerShell with no guard wrapper and no timeout, spawning a process and taking a named mutex on EVERY tool call. MEASURED this session: two Thread failed to start errors and one No stderr output from that hook, and the same host exhaustion reached the seat's own tooling when a Bash call failed with uv_spawn while 330 processes were live. ACCEPT: the hook runs under the same bounded launcher as its siblings, a spawn failure degrades to silence rather than to an error banner in the operator's transcript, and the cost of the hook per call is measured and published rather than assumed
Matrix cell	The per-call hook tax is bounded and named · `runtime/nx_hookguard.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_hookguard`; declare `nx_hookguard TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DG5 Watch contracts for the tool plane · cell WATCHING · gate UNRECORDED

Contract	`dg_matrix_admit` · executor Organ · 1 u · stands on DG0
Definition of done	This domain renders from a sota sheet only, so it has no matrix and therefore no watch contracts, and a rung here cannot flip itself when its organ ships -- every status on this board is a hand assertion until it does. Admit a devguardrails.matrix whose gap rows name each open symbol on this plan as an absent-symbol watch contract, so the page re-measures itself on the beat like every other hive domain. ACCEPT: each open rung symbol on this plan resolves to exactly one matrix row, a planted symbol flips its row from open to landed on the next emit with zero hand edits, and the flip is recorded as the receipt and never quoted as the proof of the rung's done-rule
Matrix cell	Watch contracts for the tool plane · `runtime/nx_compare_regen.nx` · WATCHING decl
Gate	`nx_compare_regen_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

DG6 Gate adoption adjudicated rather than rebuilt · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ga_adjudicate` · executor Organ · 2 u · stands on DG5
Definition of done	The sota sheet already publishes the estate's largest honest gap, and publishing it is not closing it: 2317 gate sources exist, 135 are deployed, 30 are actually invoked, and there are 0 invocation gaps -- so every gate anything runs is deployed and byte-identical to source, and the problem is 2287 sources nothing invokes plus 105 deployed binaries nobody calls. A deployed uninvoked gate is a measurement the estate pays for and does not collect, and it degrades to a false sense of coverage because its existence is counted while its verdict is not. The remedy is adjudication, wire or retire, and explicitly NOT the mass rebuild the 94-percent-undeployed headline invites, which the record already forbids after two of eight sampled rebuilds lost capability. ACCEPT: every deployed uninvoked gate carries a decision of wired or retired with its reason, retirement is reversible through the retire-path organ and never a delete, and the invoked count moves while the invocation-gap count stays at 0
Matrix cell	Gate adoption adjudicated rather than rebuilt · `runtime/_hdl_build/nx_gateadjudicate.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_gateadjudicate`; declare `nx_gateadjudicate TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DG7 Board capability claims re-measured against a gate verdict · cell WATCHING · gate NO-GATE-DECLARED

Contract	`wp_gate_binding` · executor Organ · 4 u · stands on
Definition of done	A .matrix row may declare gate=<gate-name>; the emitter reads that gate's verdict against the LIVE artifact on every publish and renders the same drift classes the sota =<symbol> bindings already use, so a row asserting an absence its gate contradicts publishes as STALE-UNDER and a row asserting a capability its gate denies REFUSES to publish
Matrix cell	A board capability claim is RE-MEASURED against a gate verdict, never hand-asserted · `runtime/nx_swcompare_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_swcompare_lib`; declare `nx_swcompare_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land DETECTOR HALF SHIPPED: nx_board_contract_gate, laptop-built and content-put to the NAS (admission refused every NAS build all session), promoted c13cb337 38382 B, registered, _offc twinned, rostered. LIVE CENSUS: 104 domains, 4856 rows, 1127 contracts, declared 117, mispointed_candidates 11, pending_in_file 573, pending_no_organ 426, partition sums to 1127 exactly. Ratchet auto-tightened 1052 -> 11. 2026-09-03 measure THE WORKLIST IS 11 ROWS AND EVERY ONE IS NAMED: referee/qa_score, instrument/ev_llm_judge, charsim/ap_foot_ground, graphics/ws_groundtruth_emit + hr_marschner_lobe + gpe_texm_normal_bind, procgen/gm_xpbd_step, phototwin/gt_drape_mesh, gameengine/wc_theme_bundle + gpe_wasm_hair_bind. runtime/nx_game_page_emit.nx is the named pointer for FOUR symbols it does not declare -- one cluster, not four independent rows. 2026-09-03 retract MY OWN FIRST LIVE RUN WAS A FALSE-POSITIVE MACHINE AND I CORRECTED IT BEFORE TRUSTING IT: v1 called all three non-DECLARED classes unflippable and reported 1052 of 1169 contracts as defects. An _ABSENT_ contract naming an organ nobody has written yet is EXACTLY what an open build contract IS. Only MISPOINTED-CANDIDATE (symbol TEXT present, no DECLARATION) is the LR7 shape. v1 also parsed comment and @directive lines as rows, which is where 42 of the phantom contracts came from. 2026-09-03 lesson A DETECTOR'S FIRST CENSUS IS WHERE ITS FALSE POSITIVES LIVE, AND THE FLATTERING BIG NUMBER IS THE ONE TO DISTRUST. 1052 looked like a major finding; 11 is the finding. Also: a SUBSTRING test would have been worse than nothing here -- nx_boundscheck.nx really does contain the characters bck_elide_dominated, inside the longer symbol bck_elide_dominated_witness, so the naive probe reports the very row that motivated this gate as perfectly healthy. 2026-09-03 queue STILL OWED, NAMED NOT GUESSED: PENDING-IN-FILE (573) cannot be split into not-written-yet versus declared-somewhere-ELSE without a tree-wide declaration index. That index is the leg that would turn this from an 11-row worklist into the full mispointing census. The emitter-side gate= binding of DG7 proper is also still owed; this gate is the detector, not the binding. 2026-09-03 land SECOND LEG SHIPPED: the DECLARATION INDEX. nx_board_contract_gate now resolves every unresolved contract symbol against the WHOLE compile corpus (19249 files) via gk_corpus_scan, so the builder's own overlay rule decides which file counts. 12/12 GREEN, promoted 49817 B. LIVE: 1128 contracts, 118 declared, 1010 unresolved -> 999 PENDING-CONFIRMED (genuinely unwritten) and 11 DECLARED-ELSEWHERE, of which exactly 1 carries positive evidence. 2026-09-03 retract SECOND FALSE-POSITIVE CLASS IN MY OWN DETECTOR, IN ONE SESSION. The index first printed all 11 as DEFECT-MISPOINTED. Adjudicating them by hand refuted most: pe_load is declared in a CPU-PAGING MMU test and has nothing to do with performersearch; tg_run lives in a TLS handshake gate, not a racing test grid; ct_scan in nx_ctxtop, not a contamination scanner. SHORT SYMBOL PREFIXES COLLIDE ACROSS THIS ESTATE, so a same-named function is NOT evidence of a mispoint. Renamed to DECLARED-ELSEWHERE (a FACT), added a conservative strength signal, and the ratchet was deliberately NOT moved onto it. 2026-09-03 measure THE ONE STRONG ROW WAS REAL AND IS NOW FIXED: extllm XL8 declared _ABSENT_:xl_publish_guard against runtime/nx_extllm.nx while nx_absent proves the symbol is declared EXACTLY ONCE in the corpus, at runtime/nx_extllm_publish_guard.nx:196, corpus_complete=1. Field 2 repointed 14461->14475 under CAS with the delta predicted and asserted. The capability shipped and the board had been reading it as absent -- the same class as LR7, found mechanically this time instead of by a day of investigation. 2026-09-03 lesson A DETECTOR'S SECOND LEG HAS ITS OWN FIRST CENSUS, AND ITS OWN FALSE POSITIVES. I applied the v1 lesson to the counts and then walked straight into the same trap in the resolver. The discipline that caught it both times is the same: hand-adjudicate the actual hits before publishing the count, and when they cannot be separated mechanically, publish the FACT with its ambiguity named rather than a verdict. 2026-09-03 land MAGIC NUMBERS REMOVED, NOT RAISED (operator standing order). v2 hit gk_corpus_scan's cap at 12000 and I RAISED it to 40000 -- the exact anti-pattern the estate has already paid for. Now every bound is MEASURED: NEW gk_dircount/gk_corpus_count in nx_gatekit_lib count the corpus and the longest path BEFORE a byte is allocated; the contract tables are sized by a counting pass over the boards; the hash table is derived from that count rounded to a power of two. Residual guessed constants in this organ: ZERO. The scan's refusal is now unreachable BY CONSTRUCTION rather than avoided by luck. 2026-09-03 land COLLISION ADJUDICATION, SOTA. Symbol-name equality cannot decide 'same function' in this estate. IMPORT-EDGE reachability was tried FIRST and REFUTED by its control (neither the genuine mispoint NOR the collision had an edge either way). What discriminates is SUBJECT EVIDENCE plus DECLARATION COUNT: the declaring file must be demonstrably about the owning domain, and N>1 forces WEAK because the first declaration found is not the only one. LIVE: tg_run is declared in 8 places, tr_report in 3, sb_run in 3 -- all correctly WEAK. 2026-09-03 retract THIRD FALSE-POSITIVE CLASS, AND IT KILLED AUTO-REPOINT. Hand-adjudication refuted BOTH rows the first discriminator called STRONG: nx_roster_full names Racing as one of twenty ROLES, not as a test reporter; dyna_bind_skin has a same-named organ of its own. The N>1 rule now reproduces the first refutation MECHANICALLY (tr_report N=3 -> WEAK). strength is therefore ADVISORY ONLY and must never be auto-applied -- this gate reports evidence and a human decides. 2026-09-03 measure FINAL LIVE STANDING: 1127 contracts, 120 declared, 997 pending-confirmed, 10 declared-elsewhere -- 9 WEAK namesakes and 1 advisory. The extllm repoint propagated (declared 118->120, declared_elsewhere 11->10), which is the loop closing on itself. 2026-09-03 lesson THREE FALSE-POSITIVE CLASSES IN ONE DETECTOR IN ONE SESSION, EACH FOUND THE SAME WAY: hand-adjudicate the actual hits before publishing the count. v1 counted open work as defects; v2's resolver counted namesakes as mispoints; v3's strength signal counted a coincidental word match as evidence. The tool got better each time ONLY because its own output was read to the end rather than trusted.

DG8 Per-run gate fixtures · cell LANDED · gate NO-GATE-DECLARED

Contract	`gk_fixture_dir` · executor Organ · 2 u · stands on
Definition of done	nx_gatekit_lib exposes one primitive returning a per-run fixture directory derived from gate name plus pid; nx_bck_elide_gate adopts it and its 14 hardcoded path literals collapse to that call; two concurrent runs of the same gate against different subjects both return their true verdict instead of a false SKIP
Matrix cell	Gate fixtures are per-RUN so two concurrent runs of one gate cannot clobber each other · `runtime/_hdl_build/nx_gatekit_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_gatekit_lib`; declare `nx_gatekit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land PATTERN DEMONSTRATED, PRIMITIVE STILL OWED: nx_board_contract_gate derives its fixture dir per RUN (a microsecond clock reading at entry, because sys_getpid is absent from this tree's shim and nx_getpid_const_probe exists precisely because a pid here has read as a constant). It is the reference implementation. The shared nx_gatekit_lib primitive and nx_bck_elide_gate's adoption of it (14 hardcoded literals) remain open. 2026-09-03 land SHIPPED AND PROVEN END TO END. gk_fixture_dir added to nx_gatekit_lib (34385 B, CAS-guarded), refereed by NEW nx_gk_fixture_gate 7/7 GREEN on BOTH hosts, bite-proven with a neg-control that rebuilds the OLD constant-path shape and asserts it COLLIDES. nx_bck_elide_gate ADOPTED it: all 17 shared constant paths (10 /tmp + 7 _build) replaced by per-run composition, residual 0. THE DONE-RULE IS MET: two concurrent runs against two DIFFERENT compilers both returned their TRUE verdict, 13/13 GREEN each, where the identical experiment this morning produced two false SKIPs. Single-run control still 13/13, so the refactor is behaviour-neutral. 2026-09-03 measure The promote ruler went RED and every named loss was a constant path I deliberately deleted. The arithmetic reconciles EXACTLY: 17 literals removed, lost_other=17. That is what a legitimate enumerated capability loss looks like, and it is why allow_capability_loss was passed with the reconciliation named rather than waved through. 2026-09-03 lesson THE COLLISION SURFACE WAS BIGGER THAN THE ONE I NAMED. I filed this rung against 14 hardcoded /tmp literals; the gate also shared SEVEN _build artifact paths and an assembler temp. Fixing only the /tmp half would have left the race intact while looking done. Count the whole surface before declaring a concurrency fix complete. 2026-09-03 land MY OWN NEW DETECTOR CAUGHT MY OWN RUNG: this row's field 2 said runtime/nx_gatekit_lib.nx while the lib lives at runtime/_hdl_build/nx_gatekit_lib.nx, so the watch could never have flipped -- exactly the class nx_board_contract_gate exists to find. Repointed in this change.

DG10 Acceptance can say whether we are IMPROVING, not only whether we cleared a bar · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ab_axis_verdict` · executor Organ · 0 u · stands on the panel percept self-check is (UNRESOLVED: no such rung on this plan), so the only voting lens is cur (UNRESOLVED: no such rung on this plan)
Definition of done	LANDED as the arithmetic, OPEN as the wiring, and the honest half is stated first. nx_abstat_lib plus nx_abstat_gate ship the two-arm contrast with Bonferroni-corrected per-axis tests, 24 of 24 GREEN, both trees byte-identical at 14582 and 8987 B, binary sha256 9b21c20a reproduced across three convergence edits. It composes rather than duplicates: the Bonferroni critical-t table stays the one in nx_multivariate and this is a caller, the Welford recurrence carries a callable equivalence proof the gate RUNS, and the sample floor is NX_MC_MIN_N. Five states per axis because four would force a lie, with BELOW_MDE as the anti-p-hacking state and a pre-declared minimum detectable effect, REGRESSED dominating IMPROVED, and zero-variance answering INSUFFICIENT with the reason named rather than NO-CHANGE. THE BLOCKING LIMIT, MEASURED NOT ASSUMED: the cjc_panel referee supplies exactly ONE voting lens, cjp_percept, a single scalar over a whole fitted 400x240 frame, so K equals 1 and the family-wise correction is a NO-OP until a second lens earns a floor. There is no hair region, no garment region and no locomotion measure, so refereeing three subjects from one beach crop would produce three identical rows, and locomotion is temporal and cannot be refereed by a still at all. ACCEPT: a second per-region lens earns a floor under a calibrate receipt at FP 0 and FN 0, nx_abstat is wired to the acceptance surface, and one real two-arm contrast between two named builds publishes a verdict with its tested-axis denominator beside it
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ab_axis_verdict`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-04 land A/B + MULTIVARIATE ACCEPTANCE CORE SHIPPED TO BOTH TREES: nx_abstat_lib.nx 14582 B and nx_abstat_gate.nx 8987 B, byte-identical laptop and NAS (NAS builds stayed cap-denied all session, so the proof is the laptop build). Gate 24/24 GREEN, binary sha256 9b21c20a864894fd0a7ef83ee46f317c9762de614de8ae9ed830becfc094afb5 37885 B, REPRODUCED IDENTICALLY across three comment-only convergence edits -- the byte-identical rebuild is what proves those edits were comment-only, not the assertion that they were. Composes the incumbents rather than re-implementing: _mv_bonferroni_critical_t_q10 for the corrected critical t, the Welford recurrence for variance with a callable equivalence proof against _mc_welford_update, NX_MC_MIN_N for the sample floor. 2026-09-04 measure FIVE BOARDS, FIVE INDEPENDENT RECON AGENTS, ONE CONVERGENT VERDICT, none of them told what was being built: graphics 'statistical significance is NONE-FOUND, multivariate exists only as an unshipped contract' - gameengine 'NONE-FOUND for A/B testing, control arms in the experimental sense, variance, confidence intervals, statistical significance, or multivariate' - charsim 'control arms and A/B pairs EXIST, statistical machinery is NONE-FOUND' - browser 'A/B, VARIANCE, SIGNIFICANCE, MULTIVARIATE effectively NONE-FOUND' - procgen 'no A/B or statistical-inference capability exists'. THE ESTATE HAD CONTROL ARMS AND BASELINES EVERYWHERE AND NO STATISTICAL MACHINERY ANYWHERE. That is why /compare/acceptance can say a frame cleared its floor and cannot say whether it improved. 2026-09-04 retract I NEARLY PUBLISHED MY OWN HEADLESS VIEWPORT AS A RENDER DEFECT, AND ONE CONTROL CALL REFUTED IT. Live /world/beach telemetry reported res 735x368 at quality tier 1 while p99 sat at 4 ms against a 6 ms budget, and I formed the hypothesis that the renderer was throttling to a third of available resolution -- a clean explanation of the operator PS2-era complaint. THE DISCRIMINATING MEASUREMENT was reading the viewport beside the telemetry: innerW 750, dpr 1, canvas CSS width 737, canvas backing store 735x368. THE BACKING STORE EQUALS ITS CSS SIZE, so the renderer is resolution-correct and 735 px was ac_cdp headless Chromium defaulting to 800x600. THE HYPOTHESIS THAT EXPLAINS THE COMPLAINT IN FRONT OF YOU IS THE ONE MOST WORTH CONTROLLING, because it is the one you will not want to test. 2026-09-04 lesson FOUR POINT MEASUREMENTS OF ONE UNCHANGED SUBJECT GAVE FOUR DIFFERENT ANSWERS, AND THE SPREAD WAS MY OWN INSTRUMENT. Same live build of /world/beach, four ac_cdp runs: quality tier 5, 1, 5, 5 and worst_ever 13, 250, 13, 12, with frame totals 2640, 5940, 719, 4550. A longer wait produced eight times FEWER frames than a shorter one. Cause: ac_cdp pins one remote-debugging port and one profile dir, so my three concurrent Chromium instances contended and one run failed outright. A SINGLE-ARM ACCEPTANCE GRADE WOULD HAVE PUBLISHED WHICHEVER SAMPLE THE SEAT HAPPENED TO TAKE, and that is exactly the shape of a referee row today -- one capture, one number, no control, no variance. This near-miss is recorded in nx_abstat_lib header as the motivating measurement, because a methodology argued from principle is weaker than one argued from the day it was needed. COROLLARY FOR THE CAPTURE HARNESS: ac_cdp runs must be serialised, and any A/B arm built from it must vary a declared nuisance factor rather than inherit measurement load as if it were signal. 2026-09-04 land THE K=1 BLOCKER IS BROKEN FOR THE PERFORMANCE SUBJECT: nx_frameab.nx 15487 B + nx_frameab_gate.nx 6510 B shipped byte-identical to both trees, gate 21/21 GREEN. It needed NO new capture, NO lens and NO calibration corpus, because the arms already existed and nobody had read them as arms: knowledge/store/frametrace- is append-only and its LAST COLUMN CARRIES EVERY INDIVIDUAL FRAME TIME, 256 replicated samples per row against a floor of 30. Three per-frame axes (frame ms, over-budget rate, jank rate) take the Bonferroni critical t from 2007 to 2447, so the family-wise correction is no longer a no-op. Composes fpc_row_frames for the CSV and pf_sample/pf_pct for the ring; this organ owns only the row selection and the refusal. PROVEN BOTH DIRECTIONS ON REAL FIXTURES built by the incumbent writer: same-budget pair with a faster candidate returns verdict=IMPROVED exit 0 with mean_b_q10 20480 to mean_a_q10 14336 and se2 168 hand-checkable, and the differing-budget pair returns REFUSED CONFOUNDED-BUDGET exit 4. 2026-09-04 measure THE CONFOUND WAS REAL AND SITTING IN THE LIVE PLANE, WHICH IS WHY THE GUARD IS THE POINT AND NOT A COURTESY. The three live beach rows carry budgets 94, 84 and 6 ms. Budget follows the display refresh, so those rows came from DIFFERENT MACHINES, and a seat contrasting the newest against the oldest would have measured the hardware while publishing a verdict about the build -- failing in the flattering direction, because a faster machine reads as a better build. The organ refuses that pair by name rather than returning a confident number. ALSO NAMED RATHER THAN HIDDEN, found by its own fixture: a rate axis whose two arms are BOTH constant has an undefined t statistic, so a genuine 100-percent-to-0 over-budget shift reports INSUFFICIENT with reason ZERO-VARIANCE. That is abstain-never-acquit and it is the safe direction, but the correct instrument for a rate is a two-proportion test this organ does not have -- OPEN, and the honest reason the tested-axis denominator on that fixture reads 1 of 3. 2026-09-04 land THE RATE-AXIS LIMIT WAS CLOSED IN THE SAME SESSION RATHER THAN FILED, PER THE STANDING ORDER. ab_is_binary, ab_pooled_p_q10, ab_prop_se2_q10, ab_prop_reason and ab_prop_verdict add the two-proportion test beside the Welch t, compared by squaring so no root is taken. A 0/1 axis is a PROPORTION and a proportion spread is a FUNCTION of its mean rather than estimated separately from it, which is exactly why the degenerate case that defeats the t-test is ordinary for this one. MEASURED on the same fixture: over_budget_rate moved INSUFF to UP and tested_axes moved 1 of 3 to 2 of 3, with pooled_p_q10 512 and se2_q10 12 both hand-recomputable from the declared inputs. An axis must DECLARE which test it is, so this is a separate named function and not a flag, and a continuous axis handed to the proportion test is REFUSED by name as NOT-A-PROPORTION-AXIS rather than approximated. Gate 21/21 to 28/28 GREEN. All four files now byte-identical across both trees at 20459, 8987, 16429 and 8352. 2026-09-04 lesson A GATE WAS 26 OF 26 GREEN WHILE THE ORGAN PRINTED A LINE THAT REFUTED ITSELF. Adding the proportion test made the live output read verdict=UP beside reason=ZERO-VARIANCE-BOTH-ARMS-NOT-A-TEST, because the verdict came from the new test and the reason still came from ab_axis_reason, which answers for the CONTINUOUS one. Every tooth passed; none compared a verdict against its own reason. A VERDICT AND ITS REASON DERIVED FROM DIFFERENT INSTRUMENTS IS A COMPOUND ASSERTION THAT NAMES THE WRONG SUBJECT, AND IT IS WORSE THAN NO REASON AT ALL, BECAUSE THE READER TRUSTS THE FIELD. Fixed by deriving the reason from the same test that produced the verdict, and pinned by a new tooth named decided-proportion-axis-reason-is-OK-not-an-abstention. Only the LIVE RUN showed it -- the gate could not, because it asserted on the two halves separately and never on their agreement. 2026-09-04 measure SHARED PRNG DEFECT FOUND AND DELIBERATELY NOT FIXED UNDER A RUNG THAT DOES NOT OWN IT. runtime/nx_random.nx has TWO mask bugs and NishiLang right-shift is ARITHMETIC, so on a negative word the sign-extension bits are never cleared. (1) nx_rng_rotl computes hi as (x >> (64-k)) & ((1 << (64-k)) - 1); the rotate needs the mask (1 << k) - 1, so for k=23 it masks 41 bits where 23 are correct. (2) nx_rng_splitmix masks (z >> 30) with 0x3FFFFFFFFFFFFFFF where 0x3FFFFFFFF is required and (z >> 27) with 0x1FFFFFFFFFFFFFFF where 0x1FFFFFFFFF is required; the third shift (z >> 31) & 0x1FFFFFFFF is CORRECT, which is what makes the other two read as a hex-digit typo rather than a design choice. MEASURED CONSEQUENCE over 20000 draws: nx_rng_next returns a negative word 53.6 percent of the time, about ten standard errors from even, and a uniform built by modulo over it read mean 0.483 against 0.5. NOT CHANGED HERE ON PURPOSE: altering a PRNG rewrites every stream in the estate and any consumer holding recorded golden values breaks silently. Filed for adjudication by whoever owns nx_random. 2026-09-04 lesson THE LAPTOP TREE IS SILENTLY FORKED IN THE CHARJUDGE LANE AND IT ALMOST MADE ME DESTROY A SIBLING SEAT'S WORK. Measured 2026-09-03: _hdl_build/nx_charjudge.nx is 2723 B on the laptop against 3328 B on the NAS, and nx_charjudge_lib.nx is 15879 B dated Aug 7 against 29466 B on the NAS -- the lib is nearly DOUBLE. The NAS CLI carries a named CHJ_NOUT constant and THREE extra face-attribution outputs (face_pyramid_levels, face_max_candidates, face_min_level_w) with a comment explaining that a bare zero face axis is ambiguous between a probe that never fired and one that fired and separated nothing. I had a full-file laptop-derived replacement ready to write over it. WHAT SAVED IT WAS CHECKING THE DESTINATION SIZE BEFORE WRITING, because nx_fs_write refuses a blind clobber and I had to fetch a CAS token to proceed -- the refusal is what made me look. A GUARD THAT FORCES YOU TO NAME THE CURRENT STATE BEFORE OVERWRITING IT IS WORTH MORE THAN ONE THAT ONLY VALIDATES YOUR NEW CONTENT. Remedy applied: the fix went in as FOUR SURGICAL EDITS onto the NAS version instead of a whole-file write, so their constant and their three fields are untouched. COMPILE PROOF, since the laptop cannot build the NAS shape: a throwaway shim carrying sys_mmap(CHJ_NOUT*8) plus the guard built clean and behaved correctly (grades at rc=0 with two args, abstains NO-LABEL-ARGUMENT at rc=4 with one), so the only unverified residue is that CHJ_NOUT comes from the lib rather than a local const. 2026-09-04 land THE SECOND QUESTION IS NOW PUBLISHED ON /compare/acceptance ITSELF. nx_acceptview.nx 33415 to 36268 B, byte-identical both trees, builds clean (47010 to 48345 B artifact). Every subject card now carries an improving? chip beside its percept-vs-floor chip, with FOUR named states because three would force a lie: UNREADABLE-ARM-COUNT, NO-ARMS-NEVER-GRADED, ONE-ARM-NO-BASELINE, CONTRASTABLE, each printing the arm count against the two a contrast needs. THE ORGAN STILL COMPUTES NO VERDICT -- its own header forbids a second opinion rendered beside the first, and this is not one: the ledger asks has everyone signed, this asks whether an improvement claim is even ANSWERABLE, and the two are not derivable from each other because a bar-clearing frame can be a regression from a much better predecessor. The arm count is read straight off ref_rows which nx_accept list already prints, so nothing is re-derived. WHAT IT WILL PUBLISH TODAY IS THE FINDING: face has ONE referee row and the other four subjects have NONE, so the page will read ONE-ARM-NO-BASELINE once and NO-ARMS-NEVER-GRADED four times. AN ABSTENTION NOBODY READS IS A LIE NOBODY TOLD -- omitting the improvement question made the page read as though it were not being asked rather than as though it could not be answered. Compile-verified; NOT run-verified locally, because the emitter forks nx_accept.elf and writes the served site root, so the rendered chip is proven on the next compare beat and not by me. 2026-09-04 measure THE A/B MACHINERY IS BUILT AND THE LIVE DATA CANNOT FEED IT, AND THAT IS THE REAL BLOCKER ON THE PERFORMANCE SUBJECT. Measured 2026-09-03 by loading knowledge/store/frametrace- whole: the ENTIRE plane is THREE ROWS for beach -- 1788410417 at budget 94, 1788443136 at budget 84, 1788482507 at budget 6 -- total_bytes 2317, window_lines 3. NO TWO ROWS SHARE A BUDGET, and budget follows the display refresh, so no two windows in the whole plane came from the same host. nx_frameab therefore returns REFUSED CONFOUNDED-BUDGET for every available pair and can produce NO VERDICT from live data, which is the guard working correctly rather than a defect in it. I ALSO TRIED TO MANUFACTURE AN ARM AND FAILED, WHICH IS THE OTHER HALF: a second serialised ac_cdp run of /world/beach at the identical window size reported budget 6 n 256 total 6001 in the page's own telemetry and WROTE NO NEW PLANE ROW, so the page does not beacon on every load. ARMS DO NOT ACCUMULATE. THE REMEDY IS NAMED AND IT IS NOT MORE STATISTICS: a beat that captures a frame window on a FIXED host on a schedule, so that two same-budget rows exist to contrast. Until then every improvement claim on this subject rests on point measurements taken by whoever happened to look, which is the exact failure this whole rung was built to end. A CONTRAST ENGINE WITH NO REPEATED MEASUREMENTS IS A CORRECT ANSWER TO A QUESTION NOBODY CAN ASK YET. 2026-09-04 retract I SHIPPED A REAL STATISTICAL FLAW THIS SESSION AND HAVE NOW FIXED IT: nx_frameab was PSEUDOREPLICATING. It pushed 256 frames from ONE window as 256 independent observations, but frames inside a single run share a thermal state, a GPU clock, a scene and a page load, so they are not independent draws. Treating them as independent inflates n by the window length and shrinks the standard error by its square root -- about SIXTEEN TIMES here -- which manufactures a confident verdict out of a single run. A LARGE n ASSEMBLED FROM ONE RUN IS NOT REPLICATION, IT IS THE SAME MEASUREMENT WRITTEN DOWN N TIMES, AND IT FAILS IN THE FLATTERING DIRECTION BECAUSE IT MAKES EVERYTHING LOOK SIGNIFICANT. FIXED: the unit of replication is now the WINDOW. fab_push_window contributes exactly ONE observation per axis per run -- the window MEAN in MICROSECONDS so it survives a one-millisecond frame timer, plus the over-budget and jank RATES in permil -- and NX_MC_MIN_N now means THIRTY RUNS per arm rather than thirty frames. THE DIAGNOSIS IMPROVED MATERIALLY ON THE REAL PRODUCTION ROWS: the same two beach windows that previously read ZERO-VARIANCE-BOTH-ARMS-NOT-A-TEST now read TOO-FEW-SAMPLES-BASELINE with n_b=1 n_a=1 and mean 4096000 which is 4.000 ms in microseconds. The old answer implied the SUBJECT was perfectly stable and would have sent a reader hunting for why variance was zero; the true answer is that there is ONE RUN PER ARM and one run cannot estimate its own variance. THE OLD FRAME-LEVEL HELPER IS DELIBERATELY KEPT under its own name as the gate's synthetic-arm builder, because that is how the ARITHMETIC is tested, while the new one is how PRODUCTION is measured -- collapsing the two is exactly how the wrong unit shipped. Six new teeth pin the production estimator specifically, since a gate that only exercised the fixture builder would prove the arithmetic and say nothing about the estimator that ships. Gate 28/28 to 34/34 GREEN, both files byte-identical across trees at 19295 and 10372. 2026-09-04 retract I CORRECTED MY OWN OVERCLAIM ON THE PUBLISHED PAGE, WHICH I HAD CREATED HOURS EARLIER. The improving? chip I added to /compare/acceptance read arms N of 2 and called TWO captures CONTRASTABLE. After the pseudoreplication fix moved the unit of replication to the RUN, that label promised a verdict the statistics cannot deliver: two runs let you PAIR, they do not let you INFER, because a two-sample test needs the sample floor per arm and that floor is thirty. TWO MEASUREMENTS MAKE A COMPARISON; THEY DO NOT MAKE AN INFERENCE, AND A SURFACE THAT BLURS THE TWO INVITES EXACTLY THE CLAIM THE WHOLE LANE EXISTS TO PREVENT. FIXED: a fifth state PAIRED-NOT-YET-POWERED sits between ONE-ARM-NO-BASELINE and CONTRASTABLE, and the chip now prints runs N; 2 to pair, 30 to infer, so a reader sees both thresholds and which side of them this subject sits on. nx_acceptview 36268 to 37123 B, byte-identical both trees, builds clean. THE PATTERN WORTH KEEPING: a methodology change in one organ silently invalidated a LABEL on a published surface in another. Nothing failed, no gate went red, and the page would have kept promising inference from two captures indefinitely. WHEN THE UNIT OF ANALYSIS CHANGES, EVERY SURFACE THAT NAMES A THRESHOLD IS STALE UNTIL RE-READ -- and the surfaces do not know it, because a label is not a computation and cannot go red.

DG9 The L4 migration has its transformation half and a site-level count · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nx_gvmigrate` · executor Organ · 1 u · stands on nothing
Definition of done	RECONSTRUCTED 2026-09-04 by nx_board_idref_gate, which found 4 log rows on this board addressed to DG9 with NO rung row to attach them to. This board declares DG0 through DG8 and DG10, so DG9 was simply skipped while its work was journalled. Derived from those rows and nothing else: the campaign is 670 SITES not 667 gates and an 18-line sample read zero; nx_gvmigrate SHIPPED, PROMOTED 067b6576 and REGISTERED as the missing TRANSFORMATION half of the L4 migration; judge-equivalence proven on nx_acquire_gate with both arms built and run at 34 of 34 sites migrated. It carries a queue row naming the honest ceiling of the mechanical lane, so this reads LANDED WITH A NAMED REMAINDER. Correct this row rather than deleting it if the owning lane meant otherwise.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nx_gvmigrate`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 measure 2026-09-03 THE L4 CAMPAIGN IS 670 SITES, NOT 667 GATES, AND AN 18-LINE SAMPLE SAID ZERO. nx_gatelaw_gate reads L4=2 of 3,422 gate sources while 666 already inherit the base class and print only PASS or FAIL, which is the fleet-level reason PROVEN reads 0/105: an arithmetic that cannot see a number can never contradict one. Full-population scan of gv_check call sites, corpus_complete=1 over 23,592 files: 901 sites, of which 670 carry equality, 147 gt, 44 ge, 44 lt, 42 ne, 24 le, 7 and-and, and 262 are MULTI-LINE continuations. I first sampled 18 of those lines, found ZERO equality sites, and nearly abandoned the work on the grounds that gv_check_eq covered nothing -- the sample had landed on two threshold-heavy gates. ONLY THE POPULATION REVERSED IT. Coarse caveat stated honestly: those are line-contains counts so a token inside a tooth NAME inflates them, which is why the organ re-derives the truth per site by parsing rather than trusting the grep. 2026-09-03 land 2026-09-03 nx_gvmigrate SHIPPED, PROMOTED 067b6576 AND REGISTERED -- the missing TRANSFORMATION half of the L4 migration. It is deliberately NOT a second migrator: nx_gate_migrate already owns the dangerous half (a 4-clause judge-equivalence oracle over exit code, verdict line, PASS/FAIL vector and evidence side-effect, with commit-or-restore never-brick), so this organ only writes the edit substrate <src>.migrated exactly as nx_dedup_migrate stage does and hands it over. It parses balanced parens while SKIPPING STRING LITERALS, because this dialect permits a literal newline inside a string and a comma inside a tooth name would otherwise derail every argument split. Only the (A == B) as i64 shape is rewritten because it is the only shape the base class has an emitter for; every other operator is SKIPPED AND NAMED rather than guessed at, and the counts form a partition that SUMS to the sites found or the organ exits non-zero. 2026-09-03 measure 2026-09-03 PROVEN BY JUDGE-EQUIVALENCE ON A REAL GATE, BOTH ARMS BUILT AND RUN. On nx_acquire_gate: 34 of 34 sites migrated, partition RECONCILES, and the ORIGINAL left byte-identical (cmp verified). Arm A original and arm B migrated both COMPILE, both exit 0, both print passed 40/40 verdict=GREEN, and the PASS/FAIL vector is IDENTICAL across 34 teeth. The payoff is the whole point of the rung: lines containing actual= went from 0 to 34, so a gate that published nothing now publishes 34 numbers with its behaviour provably unchanged. Restore was byte-verified as part of the experiment, not as its cleanup. Re-run LIVE on the NAS against buildroot/runtime/nx_acquire_gate.nx it produced a byte-identical result (34/34, 11303 bytes), which also proves the two trees hold the same gate source. 2026-09-03 queue 2026-09-03 NEXT AND ITS HONEST CEILING. The mechanical lane is now open for the equality subset: nx_gvmigrate stage <src> then nx_gate_migrate verify <gate> <migrated-src>, which commits or restores. What this CANNOT do is the other 231 sites -- gt, ge, lt, le, ne and compound conditions have NO emitter in nx_gate_verdict, so they are skipped by name and will stay PASS-only until someone adds a gv_check_cmp(name, actual, op, bound, ctr) to the base class. That is the next primitive, and naming it here beats letting a future census rediscover the gap. A staged substrate buildroot/runtime/nx_acquire_gate.nx.migrated is left on the NAS awaiting its verify -- it is an edit substrate, not a deployed change.

dossiers=11 cells_joined=8 no_matrix_row=3 (sum 11) gates_recorded=0 gates_unrecorded=1 no_gate_declared=7 (sum 8 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 8 feature rows mapped of 8 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/devguardrails.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 0–1000, distinctiveness 100–700 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 712 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 0–1000 · distinctiveness 100–700 · breadth 0–800 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 288 permil of the plot

Nishi Datadog OpenTelemetry Backstage Kubernetes
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 6 (a fact of the data: two players that close are that close) · data spread 597 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Peripheral	235	166	83	666	0 since 2026-09-23	1	10	2026-09-15
Datadog	Aspirational	941	597	666	888	0 since 2026-09-23	6	10	2026-09-15
OpenTelemetry	Mainstream	823	400	458	733	0 since 2026-09-23	5	10	2026-09-15
Backstage	Unconventional	529	583	375	1000	0 since 2026-09-23	3	10	2026-09-15
Kubernetes	Unconventional	235	583	166	666	0 since 2026-09-23	2	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	8	5
2026-09-16	8	5
2026-09-17	8	5
2026-09-18	8	5
2026-09-19	8	5
2026-09-20	8	5
2026-09-21	8	5
2026-09-22	8	5
2026-09-23	8	5
2026-10-08	8	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 32, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Datadog	OpenTelemetry	Backstage	Kubernetes
The guard plane states its own health Open — watching `runtime/nx_hookguard.nx` : `wg_attempt_counter`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. OPEN -- rung DG1. Cells copied from the sota row SLOs with error budgets driving release decisions, which this plan's own risk row already binds to this rung. The hook guard writes its evidence log ONLY at condemnation sites, so its 1067 recorded events across 2026-08-10 to 2026-08-22 are a COUNT OF REFUSALS AND NOT A RATE and hook health is structurally uncomputable. ACCEPT: attempts are counted alongside refusals so a rate exists, two consecutive windows reconcile, and a forced timeout raises attempts and refusals by exactly one each. ORGAN PATH IS A GREENFIELD CONTRACT, NOT AN OVERSIGHT: the guard today is laptop-local PowerShell and nx_hookguard does not exist, PROVEN not assumed by glob over buildroot/runtime returning matches=0 with corpus_complete=1 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching wg_attempt_counter Pros none measured yetCons behind Datadog (leads), OpenTelemetry; open contract; expected source declaration not established	○	◉	◐	○	○
The timeout worklist collapsed to its two causes DARK — `runtime/_hdl_build/nx_worklog_stop.nx` EXISTS but does not declare `wg_stop_budget`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung DG2. Cells copied from the sota row Distributed tracing across services, the field capability that attributes a slow path to its cause. The 474 organ timeouts are 286 nx_worklog_stop and 134 nx_memplane_run, so TWO Stop-hook organs are about 886 permil of them and every other subject is 24 or fewer. The organ named here is the dominant subject and it is real and on disk. ACCEPT: both dominant organs complete inside their budget ON A REAL TURN and not on a fixture, or the slow leg moves off the blocking path, proven by the breaker for those keys staying closed across a full session rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching wg_stop_budget Pros none measured yetCons behind Datadog (leads), OpenTelemetry (leads), Kubernetes; open contract; expected source declaration not established	○	◉	◉	○	◐
The seat can reach the laws it is held to DARK — `runtime/nx_tools_api.nx` EXISTS but does not declare `cap_law_floor`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung DG3, and the governor-privilege inversion. Cells copied from the sota row Policy-as-code evaluated at admission, where Kubernetes admission control is the bar. The seat is mandated to prove absence with nx_absent and to work from the ranked board, and is granted neither. THIS IS THE FOURTH INDEPENDENT REDISCOVERY OF ONE UNFIXED DEFECT, priors 1785028986 and 1785436247 and 1786115553, named so the next reader does not repeat the investigation. The organ is real and on disk and is the right home: its any-grants presenter already lets the first capability that grants win, so the remedy is a third scoped read-only capability beside the two that exist, never a wider token rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cap_law_floor Pros none measured yetCons behind Kubernetes (leads); open contract; expected source declaration not established	○	○	○	○	◉
The per-call hook tax is bounded and named Open — watching `runtime/nx_hookguard.nx` : `wg_wrap_costwarden`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. OPEN -- rung DG4. Cells copied from the sota row Continuous profiling in production, the field capability that attributes cost to a code path. The PreToolUse hook matching every nishi MCP call is raw inline PowerShell with no guard wrapper and no timeout, spawning a process and taking a named mutex on EVERY tool call, where every sibling hook runs bounded and fails open. ACCEPT: the hook runs under the same bounded launcher as its siblings, a spawn failure degrades to silence rather than an error banner in the operator transcript, and the per-call cost is measured and published rather than assumed rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching wg_wrap_costwarden Pros none measured yetCons behind Datadog (leads), OpenTelemetry; open contract; expected source declaration not established	○	◉	◐	○	○
Watch contracts for the tool plane DARK — `runtime/nx_compare_regen.nx` EXISTS but does not declare `dg_matrix_admit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung DG5, the rung this file is. Cells copied from the sota row Hive queue workstream contracts that flip themselves, where the estate holds Best and every rival is honestly zero -- and this domain was the one not using the mechanism it leads the field on. THE DATA HALF LANDED 2026-08-25 and is what made this domain rankable at all. The row STAYS OPEN on purpose: the rung's own accept rule additionally demands that a planted symbol flips its row with zero hand edits, and that proof has not been run. DECLARED LIMIT: this symbol names a data admission rather than a func any organ exports, so the mechanical watch cannot witness it and it will read open until an organ declares it -- a watch contract pointing at a structurally unimplementable symbol can never flip, and saying so is cheaper than letting the next reader discover it dossierwatching dg_matrix_admit Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Gate adoption adjudicated rather than rebuilt DARK — `runtime/_hdl_build/nx_gateadjudicate.nx` EXISTS but does not declare `ga_adjudicate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung DG6, the estate's largest published honest gap. Cells copied from the sota row Service catalogue with ownership and status, where Backstage is the bar. 2317 gate sources exist, 135 are deployed, 30 are actually invoked and there are 0 invocation gaps, so every gate anything runs is deployed and byte-identical to source and the problem is 2287 sources nothing invokes plus 105 deployed binaries nobody calls. The remedy is adjudication, wire or retire, and explicitly NOT the mass rebuild the 94-percent headline invites, which the record forbids after two of eight sampled rebuilds lost capability. ACCEPT: every deployed uninvoked gate carries a decision with its reason, retirement is reversible through the retire-path organ and never a delete, and the invoked count moves while the invocation-gap count stays at 0 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ga_adjudicate Pros none measured yetCons behind Datadog, Backstage (leads); open contract; expected source declaration not established	○	◐	○	◉	○
A board capability claim is RE-MEASURED against a gate verdict, never hand-asserted DARK — `runtime/nx_swcompare_lib.nx` EXISTS but does not declare `wp_gate_binding`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 AND THE ABSENCE IS PROVEN: nx_shelltool grep for a gate= binding across all 611 files of buildroot/knowledge/compare returns matches=0 with coverage_complete=1 and corpus_complete=1. NO compare row anywhere in the estate binds its claim to a gate verdict. COST MEASURED THE SAME DAY ON ONE BOARD: /compare/lang carried a hand-written note asserting that the live toolchain provably lacks LN7 bounds-check elision and that the single outstanding action was a toolchain promote. That promote had already landed; nx_bck_elide_gate against the LIVE promoted compiler is 13/13 GREEN. The sibling rung LN18 was understated the same way. TWO rungs on ONE board, both stale, both in the PESSIMISTIC direction which nobody audits, and each cost a full re-derivation to discover. THE INCUMBENT PATTERN IS THE RIGHT SHAPE AND THE WRONG INSTRUMENT: nx_swcompare_sota already carries MEASURED BINDINGS where a grade row may declare =<symbol> and the emitter re-measures symbol PRESENCE IN SOURCE on every publish, classifying CONSISTENT, STALE-UNDER and UNBACKED. Symbol presence cannot settle this class -- LR7 symbol bck_elide_dominated was in source the whole time while the note said the shipped compiler lacked the capability. WATCHING wp_gate_binding: extend that same binding vocabulary with gate=<gate-name> whose verdict is read against the LIVE artifact and rendered with the SAME drift classes, so a row asserting an absence the gate contradicts publishes as STALE-UNDER and one asserting a capability the gate denies REFUSES to publish. Extend the incumbent, never add a second ruler. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching wp_gate_binding Pros none measured yetCons behind Datadog (leads), OpenTelemetry (leads), Backstage (leads); open contract; expected source declaration not established	○	◉	◉	◉	○
Gate fixtures are per-RUN so two concurrent runs of one gate cannot clobber each other Measured: `gk_fixture_dir` exists in `runtime/_hdl_build/nx_gatekit_lib.nx`, verified at emit. MEASURED 2026-09-03 BY WALKING INTO IT. Two runs of nx_bck_elide_gate launched in the same second against two different compilers BOTH returned verdict=SKIP with the precondition the named compiler built none of the fixtures, and the gate honestly warned that the products on disk would be a PREVIOUS run s binaries. Neither run was faulty and the pass itself was working -- the shared cc.log showed BCK-ELIDE sites=4 elided=2 throughout. Re-run SEQUENTIALLY the same gate on the same box is 13/13 GREEN. ROOT CAUSE: the gate holds 14 hardcoded /tmp/nx_bck_elide_gate/ path literals, so the fixture directory is per-GATE but not per-RUN. The estate already has the per-gate half of this law (gate scratch belongs in /tmp/<gate>/ and must not share a fixture with a production beat, enforced by nx_gate_fixture_ratchet_gate) and the concurrency half is missing. THIS IS A KNOWN PRODUCTION CLASS, NOT A HAND-RUN CURIOSITY: the compare referee suffered exactly it when parallel domains shared a capture path and read each other s gates as pass=0/0 RED. FAILS IN THE ABSTAINING DIRECTION, WHICH IS WHY IT SURVIVES -- a false SKIP proves nothing rather than acquitting, so it never raises an alarm and simply destroys the evidence and costs the next seat the investigation. WATCHING gk_fixture_dir: one shared primitive in nx_gatekit_lib returning a per-run directory derived from the gate name plus its pid, adopted by gates rather than re-typed, so the 14 literals collapse to one call and the class cannot recur by discipline. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=162 nonval=51` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Kubernetes; fully adopted on the estate ladderCons behind Datadog (leads), OpenTelemetry (leads), Backstage (leads)	●	◉	◉	◉	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	7	rows carrying a Yes, Best or Part in a rival column
cited	0	a reference mark resolves to a pinned mirror
uncited	7	an observation read, badged until a reference lands
rows, summed	7	RECONCILED: the parts sum to the total 7

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
Counting hook attempts adds a write to the hottest path in the session and could itself become the tax it measures	possible x medium	DG1 increments a counter in the file the guard already opens at its existing call sites rather than adding a new artifact or a new process, so the attempt path gains no spawn; if the counter cannot be written the guard still fails open and the absent count reads as UNOBSERVABLE rather than as zero.
Granting the absence-prover and the ranker to the read capability widens the read surface	certain x low	DG3 grants exactly two read-only census tools and nothing that writes, promotes or deploys, and the negative control is kept: the same capability must still be refused for a write or admin operation, so least-authority is preserved rather than traded away [capmyths03].
Adjudicating 2287 gate sources is read as a mandate to build them and becomes a campaign that hammers the host	possible x high	DG6 scopes to the 105 deployed uninvoked binaries, which is a decision list and not a build queue, and states in the rung that the mass rebuild is forbidden; an unbuildable or abandoned subject is retired reversibly rather than hidden inside a queue that then never finishes.
A guard-plane health rate is published and then read as a service level with no target behind it	possible x medium	The rate ships as a count and a denominator only. Nothing here defines an SLO or an error budget and the sota sheet already grades that row as absent [sre-slo], so the number is presented as an observation and the target stays an open gap rather than an implied one.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-03	DG7	land	DETECTOR HALF SHIPPED: nx_board_contract_gate, laptop-built and content-put to the NAS (admission refused every NAS build all session), promoted c13cb337 38382 B, registered, _offc twinned, rostered. LIVE CENSUS: 104 domains, 4856 rows, 1127 contracts, declared 117, mispointed_candidates 11, pending_in_file 573, pending_no_organ 426, partition sums to 1127 exactly. Ratchet auto-tightened 1052 -> 11.
2026-09-03	DG7	measure	THE WORKLIST IS 11 ROWS AND EVERY ONE IS NAMED: referee/qa_score, instrument/ev_llm_judge, charsim/ap_foot_ground, graphics/ws_groundtruth_emit + hr_marschner_lobe + gpe_texm_normal_bind, procgen/gm_xpbd_step, phototwin/gt_drape_mesh, gameengine/wc_theme_bundle + gpe_wasm_hair_bind. runtime/nx_game_page_emit.nx is the named pointer for FOUR symbols it does not declare -- one cluster, not four independent rows.
2026-09-03	DG7	retract	MY OWN FIRST LIVE RUN WAS A FALSE-POSITIVE MACHINE AND I CORRECTED IT BEFORE TRUSTING IT: v1 called all three non-DECLARED classes unflippable and reported 1052 of 1169 contracts as defects. An _ABSENT_ contract naming an organ nobody has written yet is EXACTLY what an open build contract IS. Only MISPOINTED-CANDIDATE (symbol TEXT present, no DECLARATION) is the LR7 shape. v1 also parsed comment and @directive lines as rows, which is where 42 of the phantom contracts came from.
2026-09-03	DG7	lesson	A DETECTOR'S FIRST CENSUS IS WHERE ITS FALSE POSITIVES LIVE, AND THE FLATTERING BIG NUMBER IS THE ONE TO DISTRUST. 1052 looked like a major finding; 11 is the finding. Also: a SUBSTRING test would have been worse than nothing here -- nx_boundscheck.nx really does contain the characters bck_elide_dominated, inside the longer symbol bck_elide_dominated_witness, so the naive probe reports the very row that motivated this gate as perfectly healthy.
2026-09-03	DG7	queue	STILL OWED, NAMED NOT GUESSED: PENDING-IN-FILE (573) cannot be split into not-written-yet versus declared-somewhere-ELSE without a tree-wide declaration index. That index is the leg that would turn this from an 11-row worklist into the full mispointing census. The emitter-side gate= binding of DG7 proper is also still owed; this gate is the detector, not the binding.
2026-09-03	DG8	land	PATTERN DEMONSTRATED, PRIMITIVE STILL OWED: nx_board_contract_gate derives its fixture dir per RUN (a microsecond clock reading at entry, because sys_getpid is absent from this tree's shim and nx_getpid_const_probe exists precisely because a pid here has read as a constant). It is the reference implementation. The shared nx_gatekit_lib primitive and nx_bck_elide_gate's adoption of it (14 hardcoded literals) remain open.
2026-09-03	DG8	land	SHIPPED AND PROVEN END TO END. gk_fixture_dir added to nx_gatekit_lib (34385 B, CAS-guarded), refereed by NEW nx_gk_fixture_gate 7/7 GREEN on BOTH hosts, bite-proven with a neg-control that rebuilds the OLD constant-path shape and asserts it COLLIDES. nx_bck_elide_gate ADOPTED it: all 17 shared constant paths (10 /tmp + 7 _build) replaced by per-run composition, residual 0. THE DONE-RULE IS MET: two concurrent runs against two DIFFERENT compilers both returned their TRUE verdict, 13/13 GREEN each, where the identical experiment this morning produced two false SKIPs. Single-run control still 13/13, so the refactor is behaviour-neutral.
2026-09-03	DG8	measure	The promote ruler went RED and every named loss was a constant path I deliberately deleted. The arithmetic reconciles EXACTLY: 17 literals removed, lost_other=17. That is what a legitimate enumerated capability loss looks like, and it is why allow_capability_loss was passed with the reconciliation named rather than waved through.
2026-09-03	DG8	lesson	THE COLLISION SURFACE WAS BIGGER THAN THE ONE I NAMED. I filed this rung against 14 hardcoded /tmp literals; the gate also shared SEVEN _build artifact paths and an assembler temp. Fixing only the /tmp half would have left the race intact while looking done. Count the whole surface before declaring a concurrency fix complete.
2026-09-03	DG8	land	MY OWN NEW DETECTOR CAUGHT MY OWN RUNG: this row's field 2 said runtime/nx_gatekit_lib.nx while the lib lives at runtime/_hdl_build/nx_gatekit_lib.nx, so the watch could never have flipped -- exactly the class nx_board_contract_gate exists to find. Repointed in this change.
2026-09-03	DG7	land	SECOND LEG SHIPPED: the DECLARATION INDEX. nx_board_contract_gate now resolves every unresolved contract symbol against the WHOLE compile corpus (19249 files) via gk_corpus_scan, so the builder's own overlay rule decides which file counts. 12/12 GREEN, promoted 49817 B. LIVE: 1128 contracts, 118 declared, 1010 unresolved -> 999 PENDING-CONFIRMED (genuinely unwritten) and 11 DECLARED-ELSEWHERE, of which exactly 1 carries positive evidence.
2026-09-03	DG7	retract	SECOND FALSE-POSITIVE CLASS IN MY OWN DETECTOR, IN ONE SESSION. The index first printed all 11 as DEFECT-MISPOINTED. Adjudicating them by hand refuted most: pe_load is declared in a CPU-PAGING MMU test and has nothing to do with performersearch; tg_run lives in a TLS handshake gate, not a racing test grid; ct_scan in nx_ctxtop, not a contamination scanner. SHORT SYMBOL PREFIXES COLLIDE ACROSS THIS ESTATE, so a same-named function is NOT evidence of a mispoint. Renamed to DECLARED-ELSEWHERE (a FACT), added a conservative strength signal, and the ratchet was deliberately NOT moved onto it.
2026-09-03	DG7	measure	THE ONE STRONG ROW WAS REAL AND IS NOW FIXED: extllm XL8 declared _ABSENT_:xl_publish_guard against runtime/nx_extllm.nx while nx_absent proves the symbol is declared EXACTLY ONCE in the corpus, at runtime/nx_extllm_publish_guard.nx:196, corpus_complete=1. Field 2 repointed 14461->14475 under CAS with the delta predicted and asserted. The capability shipped and the board had been reading it as absent -- the same class as LR7, found mechanically this time instead of by a day of investigation.
2026-09-03	DG7	lesson	A DETECTOR'S SECOND LEG HAS ITS OWN FIRST CENSUS, AND ITS OWN FALSE POSITIVES. I applied the v1 lesson to the counts and then walked straight into the same trap in the resolver. The discipline that caught it both times is the same: hand-adjudicate the actual hits before publishing the count, and when they cannot be separated mechanically, publish the FACT with its ambiguity named rather than a verdict.
2026-09-03	DG7	land	MAGIC NUMBERS REMOVED, NOT RAISED (operator standing order). v2 hit gk_corpus_scan's cap at 12000 and I RAISED it to 40000 -- the exact anti-pattern the estate has already paid for. Now every bound is MEASURED: NEW gk_dircount/gk_corpus_count in nx_gatekit_lib count the corpus and the longest path BEFORE a byte is allocated; the contract tables are sized by a counting pass over the boards; the hash table is derived from that count rounded to a power of two. Residual guessed constants in this organ: ZERO. The scan's refusal is now unreachable BY CONSTRUCTION rather than avoided by luck.
2026-09-03	DG7	land	COLLISION ADJUDICATION, SOTA. Symbol-name equality cannot decide 'same function' in this estate. IMPORT-EDGE reachability was tried FIRST and REFUTED by its control (neither the genuine mispoint NOR the collision had an edge either way). What discriminates is SUBJECT EVIDENCE plus DECLARATION COUNT: the declaring file must be demonstrably about the owning domain, and N>1 forces WEAK because the first declaration found is not the only one. LIVE: tg_run is declared in 8 places, tr_report in 3, sb_run in 3 -- all correctly WEAK.
2026-09-03	DG7	retract	THIRD FALSE-POSITIVE CLASS, AND IT KILLED AUTO-REPOINT. Hand-adjudication refuted BOTH rows the first discriminator called STRONG: nx_roster_full names Racing as one of twenty ROLES, not as a test reporter; dyna_bind_skin has a same-named organ of its own. The N>1 rule now reproduces the first refutation MECHANICALLY (tr_report N=3 -> WEAK). strength is therefore ADVISORY ONLY and must never be auto-applied -- this gate reports evidence and a human decides.
2026-09-03	DG7	measure	FINAL LIVE STANDING: 1127 contracts, 120 declared, 997 pending-confirmed, 10 declared-elsewhere -- 9 WEAK namesakes and 1 advisory. The extllm repoint propagated (declared 118->120, declared_elsewhere 11->10), which is the loop closing on itself.
2026-09-03	DG7	lesson	THREE FALSE-POSITIVE CLASSES IN ONE DETECTOR IN ONE SESSION, EACH FOUND THE SAME WAY: hand-adjudicate the actual hits before publishing the count. v1 counted open work as defects; v2's resolver counted namesakes as mispoints; v3's strength signal counted a coincidental word match as evidence. The tool got better each time ONLY because its own output was read to the end rather than trusted.
2026-09-03	DG9	measure	2026-09-03 THE L4 CAMPAIGN IS 670 SITES, NOT 667 GATES, AND AN 18-LINE SAMPLE SAID ZERO. nx_gatelaw_gate reads L4=2 of 3,422 gate sources while 666 already inherit the base class and print only PASS or FAIL, which is the fleet-level reason PROVEN reads 0/105: an arithmetic that cannot see a number can never contradict one. Full-population scan of gv_check call sites, corpus_complete=1 over 23,592 files: 901 sites, of which 670 carry equality, 147 gt, 44 ge, 44 lt, 42 ne, 24 le, 7 and-and, and 262 are MULTI-LINE continuations. I first sampled 18 of those lines, found ZERO equality sites, and nearly abandoned the work on the grounds that gv_check_eq covered nothing -- the sample had landed on two threshold-heavy gates. ONLY THE POPULATION REVERSED IT. Coarse caveat stated honestly: those are line-contains counts so a token inside a tooth NAME inflates them, which is why the organ re-derives the truth per site by parsing rather than trusting the grep.
2026-09-03	DG9	land	2026-09-03 nx_gvmigrate SHIPPED, PROMOTED 067b6576 AND REGISTERED -- the missing TRANSFORMATION half of the L4 migration. It is deliberately NOT a second migrator: nx_gate_migrate already owns the dangerous half (a 4-clause judge-equivalence oracle over exit code, verdict line, PASS/FAIL vector and evidence side-effect, with commit-or-restore never-brick), so this organ only writes the edit substrate <src>.migrated exactly as nx_dedup_migrate stage does and hands it over. It parses balanced parens while SKIPPING STRING LITERALS, because this dialect permits a literal newline inside a string and a comma inside a tooth name would otherwise derail every argument split. Only the (A == B) as i64 shape is rewritten because it is the only shape the base class has an emitter for; every other operator is SKIPPED AND NAMED rather than guessed at, and the counts form a partition that SUMS to the sites found or the organ exits non-zero.
2026-09-03	DG9	measure	2026-09-03 PROVEN BY JUDGE-EQUIVALENCE ON A REAL GATE, BOTH ARMS BUILT AND RUN. On nx_acquire_gate: 34 of 34 sites migrated, partition RECONCILES, and the ORIGINAL left byte-identical (cmp verified). Arm A original and arm B migrated both COMPILE, both exit 0, both print passed 40/40 verdict=GREEN, and the PASS/FAIL vector is IDENTICAL across 34 teeth. The payoff is the whole point of the rung: lines containing actual= went from 0 to 34, so a gate that published nothing now publishes 34 numbers with its behaviour provably unchanged. Restore was byte-verified as part of the experiment, not as its cleanup. Re-run LIVE on the NAS against buildroot/runtime/nx_acquire_gate.nx it produced a byte-identical result (34/34, 11303 bytes), which also proves the two trees hold the same gate source.
2026-09-03	DG9	queue	2026-09-03 NEXT AND ITS HONEST CEILING. The mechanical lane is now open for the equality subset: nx_gvmigrate stage <src> then nx_gate_migrate verify <gate> <migrated-src>, which commits or restores. What this CANNOT do is the other 231 sites -- gt, ge, lt, le, ne and compound conditions have NO emitter in nx_gate_verdict, so they are skipped by name and will stay PASS-only until someone adds a gv_check_cmp(name, actual, op, bound, ctr) to the base class. That is the next primitive, and naming it here beats letting a future census rediscover the gap. A staged substrate buildroot/runtime/nx_acquire_gate.nx.migrated is left on the NAS awaiting its verify -- it is an edit substrate, not a deployed change.
2026-09-04	DG10	land	A/B + MULTIVARIATE ACCEPTANCE CORE SHIPPED TO BOTH TREES: nx_abstat_lib.nx 14582 B and nx_abstat_gate.nx 8987 B, byte-identical laptop and NAS (NAS builds stayed cap-denied all session, so the proof is the laptop build). Gate 24/24 GREEN, binary sha256 9b21c20a864894fd0a7ef83ee46f317c9762de614de8ae9ed830becfc094afb5 37885 B, REPRODUCED IDENTICALLY across three comment-only convergence edits -- the byte-identical rebuild is what proves those edits were comment-only, not the assertion that they were. Composes the incumbents rather than re-implementing: _mv_bonferroni_critical_t_q10 for the corrected critical t, the Welford recurrence for variance with a callable equivalence proof against _mc_welford_update, NX_MC_MIN_N for the sample floor.
2026-09-04	DG10	measure	FIVE BOARDS, FIVE INDEPENDENT RECON AGENTS, ONE CONVERGENT VERDICT, none of them told what was being built: graphics 'statistical significance is NONE-FOUND, multivariate exists only as an unshipped contract' - gameengine 'NONE-FOUND for A/B testing, control arms in the experimental sense, variance, confidence intervals, statistical significance, or multivariate' - charsim 'control arms and A/B pairs EXIST, statistical machinery is NONE-FOUND' - browser 'A/B, VARIANCE, SIGNIFICANCE, MULTIVARIATE effectively NONE-FOUND' - procgen 'no A/B or statistical-inference capability exists'. THE ESTATE HAD CONTROL ARMS AND BASELINES EVERYWHERE AND NO STATISTICAL MACHINERY ANYWHERE. That is why /compare/acceptance can say a frame cleared its floor and cannot say whether it improved.
2026-09-04	DG10	retract	I NEARLY PUBLISHED MY OWN HEADLESS VIEWPORT AS A RENDER DEFECT, AND ONE CONTROL CALL REFUTED IT. Live /world/beach telemetry reported res 735x368 at quality tier 1 while p99 sat at 4 ms against a 6 ms budget, and I formed the hypothesis that the renderer was throttling to a third of available resolution -- a clean explanation of the operator PS2-era complaint. THE DISCRIMINATING MEASUREMENT was reading the viewport beside the telemetry: innerW 750, dpr 1, canvas CSS width 737, canvas backing store 735x368. THE BACKING STORE EQUALS ITS CSS SIZE, so the renderer is resolution-correct and 735 px was ac_cdp headless Chromium defaulting to 800x600. THE HYPOTHESIS THAT EXPLAINS THE COMPLAINT IN FRONT OF YOU IS THE ONE MOST WORTH CONTROLLING, because it is the one you will not want to test.
2026-09-04	DG10	lesson	FOUR POINT MEASUREMENTS OF ONE UNCHANGED SUBJECT GAVE FOUR DIFFERENT ANSWERS, AND THE SPREAD WAS MY OWN INSTRUMENT. Same live build of /world/beach, four ac_cdp runs: quality tier 5, 1, 5, 5 and worst_ever 13, 250, 13, 12, with frame totals 2640, 5940, 719, 4550. A longer wait produced eight times FEWER frames than a shorter one. Cause: ac_cdp pins one remote-debugging port and one profile dir, so my three concurrent Chromium instances contended and one run failed outright. A SINGLE-ARM ACCEPTANCE GRADE WOULD HAVE PUBLISHED WHICHEVER SAMPLE THE SEAT HAPPENED TO TAKE, and that is exactly the shape of a referee row today -- one capture, one number, no control, no variance. This near-miss is recorded in nx_abstat_lib header as the motivating measurement, because a methodology argued from principle is weaker than one argued from the day it was needed. COROLLARY FOR THE CAPTURE HARNESS: ac_cdp runs must be serialised, and any A/B arm built from it must vary a declared nuisance factor rather than inherit measurement load as if it were signal.
2026-09-04	DG10	land	THE K=1 BLOCKER IS BROKEN FOR THE PERFORMANCE SUBJECT: nx_frameab.nx 15487 B + nx_frameab_gate.nx 6510 B shipped byte-identical to both trees, gate 21/21 GREEN. It needed NO new capture, NO lens and NO calibration corpus, because the arms already existed and nobody had read them as arms: knowledge/store/frametrace- is append-only and its LAST COLUMN CARRIES EVERY INDIVIDUAL FRAME TIME, 256 replicated samples per row against a floor of 30. Three per-frame axes (frame ms, over-budget rate, jank rate) take the Bonferroni critical t from 2007 to 2447, so the family-wise correction is no longer a no-op. Composes fpc_row_frames for the CSV and pf_sample/pf_pct for the ring; this organ owns only the row selection and the refusal. PROVEN BOTH DIRECTIONS ON REAL FIXTURES built by the incumbent writer: same-budget pair with a faster candidate returns verdict=IMPROVED exit 0 with mean_b_q10 20480 to mean_a_q10 14336 and se2 168 hand-checkable, and the differing-budget pair returns REFUSED CONFOUNDED-BUDGET exit 4.
2026-09-04	DG10	measure	THE CONFOUND WAS REAL AND SITTING IN THE LIVE PLANE, WHICH IS WHY THE GUARD IS THE POINT AND NOT A COURTESY. The three live beach rows carry budgets 94, 84 and 6 ms. Budget follows the display refresh, so those rows came from DIFFERENT MACHINES, and a seat contrasting the newest against the oldest would have measured the hardware while publishing a verdict about the build -- failing in the flattering direction, because a faster machine reads as a better build. The organ refuses that pair by name rather than returning a confident number. ALSO NAMED RATHER THAN HIDDEN, found by its own fixture: a rate axis whose two arms are BOTH constant has an undefined t statistic, so a genuine 100-percent-to-0 over-budget shift reports INSUFFICIENT with reason ZERO-VARIANCE. That is abstain-never-acquit and it is the safe direction, but the correct instrument for a rate is a two-proportion test this organ does not have -- OPEN, and the honest reason the tested-axis denominator on that fixture reads 1 of 3.
2026-09-04	DG10	land	THE RATE-AXIS LIMIT WAS CLOSED IN THE SAME SESSION RATHER THAN FILED, PER THE STANDING ORDER. ab_is_binary, ab_pooled_p_q10, ab_prop_se2_q10, ab_prop_reason and ab_prop_verdict add the two-proportion test beside the Welch t, compared by squaring so no root is taken. A 0/1 axis is a PROPORTION and a proportion spread is a FUNCTION of its mean rather than estimated separately from it, which is exactly why the degenerate case that defeats the t-test is ordinary for this one. MEASURED on the same fixture: over_budget_rate moved INSUFF to UP and tested_axes moved 1 of 3 to 2 of 3, with pooled_p_q10 512 and se2_q10 12 both hand-recomputable from the declared inputs. An axis must DECLARE which test it is, so this is a separate named function and not a flag, and a continuous axis handed to the proportion test is REFUSED by name as NOT-A-PROPORTION-AXIS rather than approximated. Gate 21/21 to 28/28 GREEN. All four files now byte-identical across both trees at 20459, 8987, 16429 and 8352.
2026-09-04	DG10	lesson	A GATE WAS 26 OF 26 GREEN WHILE THE ORGAN PRINTED A LINE THAT REFUTED ITSELF. Adding the proportion test made the live output read verdict=UP beside reason=ZERO-VARIANCE-BOTH-ARMS-NOT-A-TEST, because the verdict came from the new test and the reason still came from ab_axis_reason, which answers for the CONTINUOUS one. Every tooth passed; none compared a verdict against its own reason. A VERDICT AND ITS REASON DERIVED FROM DIFFERENT INSTRUMENTS IS A COMPOUND ASSERTION THAT NAMES THE WRONG SUBJECT, AND IT IS WORSE THAN NO REASON AT ALL, BECAUSE THE READER TRUSTS THE FIELD. Fixed by deriving the reason from the same test that produced the verdict, and pinned by a new tooth named decided-proportion-axis-reason-is-OK-not-an-abstention. Only the LIVE RUN showed it -- the gate could not, because it asserted on the two halves separately and never on their agreement.
2026-09-04	DG10	measure	SHARED PRNG DEFECT FOUND AND DELIBERATELY NOT FIXED UNDER A RUNG THAT DOES NOT OWN IT. runtime/nx_random.nx has TWO mask bugs and NishiLang right-shift is ARITHMETIC, so on a negative word the sign-extension bits are never cleared. (1) nx_rng_rotl computes hi as (x >> (64-k)) & ((1 << (64-k)) - 1); the rotate needs the mask (1 << k) - 1, so for k=23 it masks 41 bits where 23 are correct. (2) nx_rng_splitmix masks (z >> 30) with 0x3FFFFFFFFFFFFFFF where 0x3FFFFFFFF is required and (z >> 27) with 0x1FFFFFFFFFFFFFFF where 0x1FFFFFFFFF is required; the third shift (z >> 31) & 0x1FFFFFFFF is CORRECT, which is what makes the other two read as a hex-digit typo rather than a design choice. MEASURED CONSEQUENCE over 20000 draws: nx_rng_next returns a negative word 53.6 percent of the time, about ten standard errors from even, and a uniform built by modulo over it read mean 0.483 against 0.5. NOT CHANGED HERE ON PURPOSE: altering a PRNG rewrites every stream in the estate and any consumer holding recorded golden values breaks silently. Filed for adjudication by whoever owns nx_random.
2026-09-04	DG10	lesson	THE LAPTOP TREE IS SILENTLY FORKED IN THE CHARJUDGE LANE AND IT ALMOST MADE ME DESTROY A SIBLING SEAT'S WORK. Measured 2026-09-03: _hdl_build/nx_charjudge.nx is 2723 B on the laptop against 3328 B on the NAS, and nx_charjudge_lib.nx is 15879 B dated Aug 7 against 29466 B on the NAS -- the lib is nearly DOUBLE. The NAS CLI carries a named CHJ_NOUT constant and THREE extra face-attribution outputs (face_pyramid_levels, face_max_candidates, face_min_level_w) with a comment explaining that a bare zero face axis is ambiguous between a probe that never fired and one that fired and separated nothing. I had a full-file laptop-derived replacement ready to write over it. WHAT SAVED IT WAS CHECKING THE DESTINATION SIZE BEFORE WRITING, because nx_fs_write refuses a blind clobber and I had to fetch a CAS token to proceed -- the refusal is what made me look. A GUARD THAT FORCES YOU TO NAME THE CURRENT STATE BEFORE OVERWRITING IT IS WORTH MORE THAN ONE THAT ONLY VALIDATES YOUR NEW CONTENT. Remedy applied: the fix went in as FOUR SURGICAL EDITS onto the NAS version instead of a whole-file write, so their constant and their three fields are untouched. COMPILE PROOF, since the laptop cannot build the NAS shape: a throwaway shim carrying sys_mmap(CHJ_NOUT*8) plus the guard built clean and behaved correctly (grades at rc=0 with two args, abstains NO-LABEL-ARGUMENT at rc=4 with one), so the only unverified residue is that CHJ_NOUT comes from the lib rather than a local const.
2026-09-04	DG10	land	THE SECOND QUESTION IS NOW PUBLISHED ON /compare/acceptance ITSELF. nx_acceptview.nx 33415 to 36268 B, byte-identical both trees, builds clean (47010 to 48345 B artifact). Every subject card now carries an improving? chip beside its percept-vs-floor chip, with FOUR named states because three would force a lie: UNREADABLE-ARM-COUNT, NO-ARMS-NEVER-GRADED, ONE-ARM-NO-BASELINE, CONTRASTABLE, each printing the arm count against the two a contrast needs. THE ORGAN STILL COMPUTES NO VERDICT -- its own header forbids a second opinion rendered beside the first, and this is not one: the ledger asks has everyone signed, this asks whether an improvement claim is even ANSWERABLE, and the two are not derivable from each other because a bar-clearing frame can be a regression from a much better predecessor. The arm count is read straight off ref_rows which nx_accept list already prints, so nothing is re-derived. WHAT IT WILL PUBLISH TODAY IS THE FINDING: face has ONE referee row and the other four subjects have NONE, so the page will read ONE-ARM-NO-BASELINE once and NO-ARMS-NEVER-GRADED four times. AN ABSTENTION NOBODY READS IS A LIE NOBODY TOLD -- omitting the improvement question made the page read as though it were not being asked rather than as though it could not be answered. Compile-verified; NOT run-verified locally, because the emitter forks nx_accept.elf and writes the served site root, so the rendered chip is proven on the next compare beat and not by me.
2026-09-04	DG10	measure	THE A/B MACHINERY IS BUILT AND THE LIVE DATA CANNOT FEED IT, AND THAT IS THE REAL BLOCKER ON THE PERFORMANCE SUBJECT. Measured 2026-09-03 by loading knowledge/store/frametrace- whole: the ENTIRE plane is THREE ROWS for beach -- 1788410417 at budget 94, 1788443136 at budget 84, 1788482507 at budget 6 -- total_bytes 2317, window_lines 3. NO TWO ROWS SHARE A BUDGET, and budget follows the display refresh, so no two windows in the whole plane came from the same host. nx_frameab therefore returns REFUSED CONFOUNDED-BUDGET for every available pair and can produce NO VERDICT from live data, which is the guard working correctly rather than a defect in it. I ALSO TRIED TO MANUFACTURE AN ARM AND FAILED, WHICH IS THE OTHER HALF: a second serialised ac_cdp run of /world/beach at the identical window size reported budget 6 n 256 total 6001 in the page's own telemetry and WROTE NO NEW PLANE ROW, so the page does not beacon on every load. ARMS DO NOT ACCUMULATE. THE REMEDY IS NAMED AND IT IS NOT MORE STATISTICS: a beat that captures a frame window on a FIXED host on a schedule, so that two same-budget rows exist to contrast. Until then every improvement claim on this subject rests on point measurements taken by whoever happened to look, which is the exact failure this whole rung was built to end. A CONTRAST ENGINE WITH NO REPEATED MEASUREMENTS IS A CORRECT ANSWER TO A QUESTION NOBODY CAN ASK YET.
2026-09-04	DG10	retract	I SHIPPED A REAL STATISTICAL FLAW THIS SESSION AND HAVE NOW FIXED IT: nx_frameab was PSEUDOREPLICATING. It pushed 256 frames from ONE window as 256 independent observations, but frames inside a single run share a thermal state, a GPU clock, a scene and a page load, so they are not independent draws. Treating them as independent inflates n by the window length and shrinks the standard error by its square root -- about SIXTEEN TIMES here -- which manufactures a confident verdict out of a single run. A LARGE n ASSEMBLED FROM ONE RUN IS NOT REPLICATION, IT IS THE SAME MEASUREMENT WRITTEN DOWN N TIMES, AND IT FAILS IN THE FLATTERING DIRECTION BECAUSE IT MAKES EVERYTHING LOOK SIGNIFICANT. FIXED: the unit of replication is now the WINDOW. fab_push_window contributes exactly ONE observation per axis per run -- the window MEAN in MICROSECONDS so it survives a one-millisecond frame timer, plus the over-budget and jank RATES in permil -- and NX_MC_MIN_N now means THIRTY RUNS per arm rather than thirty frames. THE DIAGNOSIS IMPROVED MATERIALLY ON THE REAL PRODUCTION ROWS: the same two beach windows that previously read ZERO-VARIANCE-BOTH-ARMS-NOT-A-TEST now read TOO-FEW-SAMPLES-BASELINE with n_b=1 n_a=1 and mean 4096000 which is 4.000 ms in microseconds. The old answer implied the SUBJECT was perfectly stable and would have sent a reader hunting for why variance was zero; the true answer is that there is ONE RUN PER ARM and one run cannot estimate its own variance. THE OLD FRAME-LEVEL HELPER IS DELIBERATELY KEPT under its own name as the gate's synthetic-arm builder, because that is how the ARITHMETIC is tested, while the new one is how PRODUCTION is measured -- collapsing the two is exactly how the wrong unit shipped. Six new teeth pin the production estimator specifically, since a gate that only exercised the fixture builder would prove the arithmetic and say nothing about the estimator that ships. Gate 28/28 to 34/34 GREEN, both files byte-identical across trees at 19295 and 10372.
2026-09-04	DG10	retract	I CORRECTED MY OWN OVERCLAIM ON THE PUBLISHED PAGE, WHICH I HAD CREATED HOURS EARLIER. The improving? chip I added to /compare/acceptance read arms N of 2 and called TWO captures CONTRASTABLE. After the pseudoreplication fix moved the unit of replication to the RUN, that label promised a verdict the statistics cannot deliver: two runs let you PAIR, they do not let you INFER, because a two-sample test needs the sample floor per arm and that floor is thirty. TWO MEASUREMENTS MAKE A COMPARISON; THEY DO NOT MAKE AN INFERENCE, AND A SURFACE THAT BLURS THE TWO INVITES EXACTLY THE CLAIM THE WHOLE LANE EXISTS TO PREVENT. FIXED: a fifth state PAIRED-NOT-YET-POWERED sits between ONE-ARM-NO-BASELINE and CONTRASTABLE, and the chip now prints runs N; 2 to pair, 30 to infer, so a reader sees both thresholds and which side of them this subject sits on. nx_acceptview 36268 to 37123 B, byte-identical both trees, builds clean. THE PATTERN WORTH KEEPING: a methodology change in one organ silently invalidated a LABEL on a published surface in another. Nothing failed, no gate went red, and the page would have kept promising inference from two captures indefinitely. WHEN THE UNIT OF ANALYSIS CHANGES, EVERY SURFACE THAT NAMES A THRESHOLD IS STALE UNTIL RE-READ -- and the surfaces do not know it, because a label is not a computation and cannot go red.
2026-09-06	DG11	lesson	OPERATOR STANDING ORDER 2026-09-06 take the WebGPU-door failure on world beach as a major learning and make ALL of nishi estate develop this way the failure a render door fell back to WebGL2 and reported only not-taken unexplained so it was broken AND unfalsifiable and visual claims were captured through a spoofable third-party CDP wire the operator ruled spoofable AI captures a hard fail these are estate-wide delivery-rigor gaps not one lane
2026-09-06	DG1	measure	THIRD MEASURED RECURRENCE of the async-launch bound's false-deny class (debt 1787686197, corrected by 1787707354), 2026-09-06, from the motion lane: nx_job_run refused nx_motion_serve_gate_staged -- a VERIFIER that exits -- because jlb_denied (nx_job_launch_bound.nx) refuses any underscore-segment starting with a control-plane stem (daemon, serve, supervis, hostctl, mgmt, deploy, promote, restart, kill) and has no declaration hook, so a gate named after its daemon subject in the estate's own <target>_gate convention can never be job-run. The refusal direction is correct and fail-closed (a daemon must never wedge the async slot) and was NOT loosened. Measured consequences on this lane: the gate was renamed for its true scope (nx_motion_gate proves the door and the job; the resolver derives it from both targets), and nx_retire_path refused to retire the superseded source for the same token ('serve' is a protected name), so the same stem list now bites two guards from opposite sides. The remedy shape that closes the class without loosening either guard: jlb_denied consults knowledge/status/organ_kind.conf -- a declared oracle or oneshot is launchable, a declared daemon is denied, an undeclared name falls to the stem rule -- with a bite tooth in nx_job_launch_bound_gate proving that nx_studio_gate (a daemon declared as one) stays denied while a declared oracle carrying 'serve' launches. Filed here as a measurement for the guardrail lane, not re-filed on the debt board.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

SOTA field — 11 peers, 38 axes, measured bindings

Gates, Teeth, Probes, Telemetry, Accelerators + the MCP swarm/hive/hub-spoke layer. 11 competitors, 26 axes. Nishi cells name the organ that proves them; where nothing proves it the cell is No, not Part.

How the field is scored. A state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured or published numbers (Nishi’s column is measured on this estate, competitor columns are researcher-sourced and cited in the note); grade axes carry Best / Yes / Part / No for every peer. A Nishi grade may be bound to an organ and a symbol and is then re-measured on every publish by the one symbol ruler the capability matrix above uses; an over-claim refuses to publish.

field, strip order:GitHubActionsGitLabCIJenkinsSonarQubeSemgrepSnykDatadogOpenTelemetryBackstageLaunchDarklyKubernetes·BestYesPartNo

Measured stakes (quantitative)

Agent-callable guardrail tools exposed over MCP

Nishi MEASURED 2026-08-14 by nx_capsearch's own corpus count (considered=1028); every one is ocap-gated and callable by an AI seat with an attenuated token. Peer columns reflect published MCP-server availability as of 2026-08 [mcp-spec], not tool counts, which are not comparable across products

GitHubActions MCP server (2025+)GitLabCI MCP serverJenkins plugins, no MCPSonarQube limitedSemgrep limitedSnyk limitedDatadog MCP serverOpenTelemetry n/a specBackstage pluginsLaunchDarkly SDK/APIKubernetes kubectl-ai era

1028 registered

Nishi, measured

Guardrail gates: sources / deployed / actually invoked

Nishi MEASURED 2026-08-07 by nx_gatesubj + nx_biteall over the whole tree. Published deliberately: 2,287 gate sources nothing invokes is the estate's largest honest gap, and 0 invocation gaps means every gate anything runs is deployed and byte-identical to source

GitHubActions n/a (workflow files)GitLabCI n/aJenkins n/aSonarQube rulesetsSemgrep rulesetsSnyk rulesetsDatadog monitorsOpenTelemetry n/aBackstage n/aLaunchDarkly flagsKubernetes admission ctl

2317 / 135 / 30

Nishi, measured

Automated beats under a dead-man switch

Nishi MEASURED 2026-08-14 via nx_cron_watch: each beat's evidence log carries a heartbeat and a max-age; a missed beat becomes STALE rather than silently absent. Peers schedule work but rarely ship the freshness assertion itself

GitHubActions schedulesGitLabCI schedulesJenkins timersSonarQube n/aSemgrep n/aSnyk n/aDatadog monitorsOpenTelemetry n/aBackstage n/aLaunchDarkly n/aKubernetes CronJob

15 watched, 0 stale

Nishi, measured

Deploy rollback on failed health check

Nishi never-brick promote: health-checked, .prev-banked, auto-rollback, verified live this session (DEPLOYED-GREEN after a daemon self-deploy). LaunchDarkly's flag flip is the fastest human-facing undo in the field and is graded Best for that reason

GitHubActions manual/actionGitLabCI manualJenkins manualSonarQube n/aSemgrep n/aSnyk n/aDatadog n/aOpenTelemetry n/aBackstage n/aLaunchDarkly instant flag flipKubernetes rolling undo

automatic, proven

Nishi, measured

Quality Gates (the blockers)

Pipeline runs automated tests on every change

Every compiler promotion passes nx_cc_equiv_gate (10 differential rows + a self-host fixpoint) and a 49-cell gauntlet before the canary door; hosted CI is the industrial bar for breadth and parallelism

YES

Merge/branch protection with required approvals

NO BRANCHES to protect: the substrate is content-addressed and promotion is gated at the artifact, not the ref [gh-branch-protection]. Honest No -- and the sovereign git host is DOWN and unsupervised (filed), so this is a real gap, not a design flourish

Change freeze / high-risk window blocking

Nothing implements a freeze window. LaunchDarkly-class kill switches are the bar. Filed, not designed away

Pre-deploy safety gate that can refuse the deploy

/api/deploy runs a pre-deploy gate and reports DEPLOY-SAFE with a blocker count before promoting; the promote door separately refuses on a digest mismatch, a capability-loss diff, or a backwards artifact

YES

Artifact identity verified before promotion

expect_sha256 is REQUIRED on promote: it refuses unless the staged bytes are exactly the ones the caller verified, which is the only check that catches a same-size substitution. Sigstore-class signing is the nearest peer practice [sigstore-docs]

YES

Teeth (the enforcers)

Style/format enforced mechanically

No canonical formatter exists -- gofmt is the bar and this is a filed rung, not a stance

Static analysis blocks the build on findings

nx_cwe_scan + nx_secret_scan_gate + nx_srclint exist and the secret gate is currently RED and uninvoked (filed); Semgrep/Snyk are the bar for rule breadth and CVE currency

PART

Compiler refuses silently-wrong constructs

The deepest teeth here and no peer's equivalent: the compiler refuses float-into-integer stores at all six store sites, out-of-range constant shifts, discarded pure expressions, non-exhaustive matches, wrong call arity and both directions of pointer/integer confusion -- each with a 5W plus H message naming the fix. A linter suggests; this refuses. EVIDENCE (this cell carried none until 2026-08-14): nx_langdiag_gate runs the whole language-diagnostic probe corpus, 11 rows GREEN, with in-tree witnesses per refusal (nx_probe_ub_shift.nx for the constant over-shift); each refusal stamps a greppable capability slug at the point of friction -- capability=shift-count-range is emitted from nx_parse.nx:3853 and asserted by the gate, so the claim is checkable at a line number rather than described

BEST

Refusals are pinned to the rule that fired

nx_langdiag_gate asserts each refusal names ITS OWN rule or capability slug, bite-proven by planting a slug the rule never prints (exit code matched, reason did not). Most suites assert only that something failed -- blind by construction, and this estate had that hole until 2026-08-14

BEST

Dependency/package license compliance

Zero third-party packages by doctrine, so nothing scans them; source carries license_tier headers and nx_licgate exists. Graded No because the CHECK is absent, not because the risk is

Mutation testing proves the teeth can bite

nx_gate_bite plants known-bad mutants and demands RED; a gate that has only ever passed is unverified. Essentially absent from mainstream CI practice

BEST

Software bill of materials emitted per build

No SBOM is produced. Zero third-party packages makes the inventory trivial to state and that is exactly why nothing states it -- an unstated inventory is not an attested one. Syft/Snyk-class output is the bar [spdx-spec]

Container or image vulnerability scanning

Nothing scans a shipped artifact for known CVEs. nx_nvd_ingest pulls the feed but no organ joins it to what we run

Policy-as-code evaluated at admission

No OPA/rego-class policy engine; guardrails are hand-written organs, so a new policy is a build rather than a rule. Kubernetes admission control is the bar [k8s-admission] and the 2026 MCP literature specifically names AI-updated global policy as the pattern to reach for

SLOs with error budgets driving release decisions

Nothing defines an SLO or an error budget, so nothing can burn one [sre-slo]; resource envelopes are asserted per change but not tracked against a target

Alert routing and on-call escalation

Gates write durable verdict logs and a dead-man switch flags a stale beat, but no alert reaches a human -- a RED at 3am waits for a seat to read it

Continuous profiling in production

Absent. Resource counters are sampled per beat; there is no CPU/heap profile attributable to a code path

Real user monitoring from the client side

Absent by posture as much as by gap -- the surfaces ship zero third-party script and no telemetry beacon, so field performance is inferred from synthetic checks only

Probes (the observers)

Synthetic user-journey checks

nx_page_verify is browser-grade (TLS handshake, asset fetch, PNG deep-decode, a11y-lite) and runs on the publish beat; Datadog Synthetics is the bar for geographic breadth

YES

Liveness checks on running services

Health-checked restart plus a supervisor guard and hostctl sentinel on a 1-minute beat; Kubernetes liveness probes are the bar [k8s-probes]

YES

Readiness gating before traffic

Deploy waits on a health check and rolls back, but there is no separate readiness signal that holds traffic; Kubernetes is the bar [k8s-probes]

PART

Probe corpus is native and self-asserting

The language-probe corpus runs as a NishiLang gate that asserts exit code AND the required diagnostic substring, with acceptance rows as the discrimination control and an UNRESOLVED third state when the subject is missing. It replaced hand-written shell scripts on 2026-08-14

YES

Telemetry (the monitors)

Resource metrics collected and acted on

CORRECTED 2026-08-14: this row previously claimed a per-minute beat. MEASURED against the live clocksched- plane: nx_procchurn 300s and nx_resgov 600s were on the clock, nx_resmon had NO ROW AT ALL, and no cadence was verified for nx_ctxtop. A COMPARE ROW IS A CLAIM, NOT A MEASUREMENT. Now declared: resmonbeat 300s (matching procchurn, its closest analogue -- both are /proc censuses) and memvelbeat 240s. Its leak axis is now VELOCITY-based (nx_memvel's sustained-grower count over N windows) rather than the VmSize==VmPeak SNAPSHOT, which cannot express growth at all, flagged the arena-once leak-FREE design as a leak, and therefore held this organ RED PERMANENTLY at 17 suspects against a red threshold of 6 while the true sustained count was 0. Stale or absent velocity data degrades the axis to UNOBSERVABLE, which casts no vote in either direction. resmon.log is append-only and unbounded, so it is now watched by nx_sizeguard at the sibling's proven budget (1 MiB / 20000 lines) -- fail loud before a reader truncates, never rotate, because nx_jrnlguard correctly treats a shrinking journal as a clobber. Measured attribution proved NAS churn was DSM, not the estate. Datadog is the bar

YES

Structured event logs with durable evidence

Every gate writes its own timestamped verdict log because a RED that lands in a vacuum is not a measurement; the actlog journal mines tool/verb frequency

YES

Distributed tracing across services

No trace context propagation exists. OpenTelemetry is the standard [otel-spec] and this is a genuine absence

Telemetry feeds the roadmap automatically

The loop no peer ships: capability-limit refusals stamp greppable capability slugs at the moment of friction, /api/build appends them to a durable demand journal, and the mine re-ranks the build order from real usage. Refusal to roadmap with no human in the circuit. EVIDENCE (this cell carried none until 2026-08-14): the journal is knowledge/status/lang_demand.jrnl -- epoch, slug, target; append-only, bounded at 8 rows per build, and it can never fail a build. LIVE-BITTEN 2026-08-13: a single refused build wrote its 3 rows the moment it failed, which is the whole loop demonstrated end to end rather than asserted

BEST

Accelerators (the enablers)

Ephemeral per-change environments

Absent: risky daemons are tested on a spare port by hand. Filed

Feature flags separate deploy from activation

Config-driven switches exist (opt-in debug emission, an opt-out crash guard, conf-gated lanes) but there is no flag service with targeting or instant kill; LaunchDarkly is the bar

PART

Service catalogue with ownership and status

nx_catalog answers is-it-there-and-is-it-WIRED across the full chain -- source, built, staged, promoted, registered, authorised, invoked -- with a weakest-link verdict. Backstage is the field bar for humans; this one is machine-readable and it is how the unregistered addr2line binary was found

PART

The agentic control plane (MCP swarm / hive / hub-and-spoke)

Guardrails callable by an AI agent over MCP

The entire build-gate-promote-deploy loop is driven by an AI seat over MCP [mcp-spec] in this very session; peers expose an MCP server over a product, not a whole sovereign ops plane

BEST

Least-authority capability tokens for agent access

X-Nishi-Cap ocap tokens [capmyths03]: attenuate-only, scoped per tool, expiring, revocable by nonce, every delegation audited to a consent log, and fixed-arg pinning so a hostile argv cannot escalate a pinned tool. The MCP ecosystem's own 2026 literature names secrets brokering and agent authorisation as its top unsolved risk. EVIDENCE (this cell carried none until 2026-08-14): least-authority was PROVEN live 2026-07-08 -- a read-scoped cap presented to nx_mgmt is denied with reason 4 while the same cap serves its own tools, and fixed-arg pinning was demonstrated by handing nx_status a hostile [selfswap] argv which it ignored in favour of the pinned sub. Every delegation is appended to cap_consent.log, and revocation is by nonce against cap_revoked.list

BEST

Hub-and-spoke publishing with self-healing spokes

One upsert call updates the hub from the sovereign registry; 48 domain spokes re-measure and republish on a 6-hourly beat, and an orphan census reconciles docroot directories against the roster with parts that must sum. EVIDENCE (this cell carried none until 2026-08-14): the census MEASURED census dirs=71 matrix=50 radar=7 hand=14 ORPHANS=0 parts-sum OK on the 2026-08-14 beat -- a printed partition that reconciles, which is the difference between claiming no sprawl and showing that the parts add up to the population

BEST

Hive queue: workstream contracts that flip themselves

Watch contracts named for a not-yet-existing symbol are measured every emit, so a page flips from OPEN to LANDED the moment the organ ships -- proven twice with real ships, zero hand edits, and the contracts are stored as sovereign plane rows that double as the PM intake queue

BEST

Swarm: distributed agent work placement

A swarm family exists (admit, coord, place, job, heal, shardserve) and seat coordination runs over a workstream plane with leases and checkin/checkout; Kubernetes scheduling is the bar for maturity

PART

11 competitors38 axes4 quantitativeNishi best 8 · absent 13

Honest verdict. This estate is strongest exactly where the field is weakest -- the agentic control plane -- and genuinely behind on the human-team surfaces it has never needed. Structural exceeds no competitor carries: the whole guardrail chain is ocap-secured and agent-callable over MCP (1,028 registered tools, attenuate-only capability tokens, every delegation audited), deploys are never-brick by construction (health-checked promote with automatic rollback, proven live), and the comparison surface you are reading re-measures and republishes itself on a 6-hourly beat with an orphan census that refuses to let a page drift. The teeth are real and unusually deep for a solo estate: a differential-equivalence net gates every compiler promotion, a 49-cell gauntlet is mutation-proven, and refusals are pinned to the RULE THAT FIRED rather than merely to a non-zero exit. Where it is behind, it is behind honestly and the reasons are structural, not accidental: there is no branch protection because there are no branches (content-addressed substrate, and the sovereign git host is currently down and unsupervised), no distributed tracing, no ephemeral per-change environments, no package-license scanning, and no canonical formatter. The largest measured gap is not capability but ADOPTION -- 2,317 gate SOURCES exist, 135 are deployed and only 30 are actually invoked by anything, so the estate is paying for measurements it does not collect. That number is the roadmap, and it is published here rather than hidden. This page's own first draft failed the honesty gate and that is worth stating plainly: it claimed twelve Bests against six Nos, and the generator refused to publish a sheet whose absences did not outnumber its wins. Re-grading pulled four cells down to Yes or Part -- a pre-deploy gate and an artifact-digest check are strong but sigstore-class signing and hosted environment approvals are peers, not inferiors -- and it forced the enumeration of seven gaps that had simply been skipped: no SBOM, no image scanning, no policy-as-code, no SLOs or error budgets, no alert routing, no continuous profiling, no real-user monitoring. Those are now rows on this page instead of absences from it.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/devguardrails.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain devguardrails, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from devguardrails.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	2
scanned	2
fetched	2
reused	0
failed	0
named	2
candidates	2
mentions	2
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	OpenTelemetry	1	1	col1-opentelemetry	named	https://opentelemetry.io/docs/specs/otel/
2	Kubernetes	1	1	col3-kubernetes	named	https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 8 capabilities: 8 exclusive to it and 0 shared with other boards. Shared rows on this page: 0 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 0 + refused 0 (partition 0); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6574.

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395679 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_acquire_gate`	devguardrails	plan-queue	rung=DG9

rows shown 1|this board's directives 1|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[mcp-spec] Model Context Protocol Specification, revision 2025-06-18: JSON-RPC 2.0 hosts/clients/servers, tools, resources, prompts, and the Security and Trust and Safety principles (user consent, tool safety, least-privilege guidance). publisher · read in our library knowledge/fetched/cmp_devguardrails_mcp-spec.html · pin h57308609c176192e9a3561fe8d8115235aab6bb72234463b8ff66c7e67ff84af · accessed 2026-08-18 · published-standardGrounds: The "Agent-callable guardrail tools exposed over MCP" and "Guardrails callable by an AI agent over MCP" rows: the protocol every column's MCP-server cell is graded against, and its own security section names consent and tool-authorization as implementor obligations -- which the ocap-token row answers by construction.
[otel-spec] OpenTelemetry Specification (opentelemetry.io/docs/specs/otel): the vendor-neutral standard for traces, metrics, logs and context propagation. publisher · read in our library knowledge/fetched/cmp_devguardrails_otel-spec.html · pin hfb7ab28ec4e393f3d5c1ffe9173e2fc5d38bbe46aa6725144218fea9314c0c2f · accessed 2026-08-18 · published-standardGrounds: The OpenTelemetry column and the "Distributed tracing across services" row (Nishi n): OTel context propagation is the standard that row names as a genuine absence here.
[k8s-probes] Kubernetes documentation: Configure Liveness, Readiness and Startup Probes -- kubelet-driven liveness restarts and readiness gating of traffic. publisher · read in our library knowledge/fetched/cmp_devguardrails_k8s-probes.html · pin h2c91059571135379613836c808ab83040714818126088e3dd3b200f5accd1c93 · accessed 2026-08-18 · vendor-docGrounds: The Kubernetes column on "Liveness checks on running services" (B) and "Readiness gating before traffic" (B): the probe semantics those Best codes cite; ours has health-checked restart but no separate readiness signal that holds traffic.
[k8s-admission] Kubernetes documentation: Admission Controllers Reference -- validating and mutating admission that intercepts API requests before persistence. publisher · read in our library knowledge/fetched/cmp_devguardrails_k8s-admission.html · pin h901cf891e255ac593d5865bcd24d95ba29279c79f6bb56290c28b8a75183e6fe · accessed 2026-08-18 · vendor-docGrounds: The "Policy-as-code evaluated at admission" row: Kubernetes admission control is the named bar (B); our guardrails are hand-written organs, so a new policy is a build rather than a rule.
[sre-slo] Beyer, Jones, Petoff, Murphy (eds.). Site Reliability Engineering, chapter Service Level Objectives (Jones, Wilkes, Murphy, Smith): SLIs, SLOs and the error budget as the rate at which SLOs may be missed. publisher · read in our library knowledge/fetched/cmp_devguardrails_sre-slo.html · pin h449fb54ce65e05102fac46c797a08b86c5ab93ade2c70c63ae25e7648d687d7d · accessed 2026-08-18 · published-courseGrounds: The "SLOs with error budgets driving release decisions" row (Nishi n): the definition of SLO and error budget that row measures against; nothing here defines an SLO so nothing can burn a budget.
[sigstore-docs] Sigstore documentation: keyless signing with cosign, Fulcio certificate authority and the Rekor transparency log for software artifacts. publisher · read in our library knowledge/fetched/cmp_devguardrails_sigstore-docs.html · pin h008286126a95de87c85a13073dbc269d3c0c62afdbdc244c98eec9d7f2460728 · accessed 2026-08-18 · vendor-docGrounds: The "Artifact identity verified before promotion" row: the re-grade note names Sigstore-class signing as the nearest peer practice to expect_sha256-required promotion; this is what that peer is.
[spdx-spec] SPDX (System Package Data Exchange) Specification 3.0.1, The Linux Foundation: the software bill of materials data model and serialization. publisher · read in our library knowledge/fetched/cmp_devguardrails_spdx-spec.html · pin ha905ca11b54700955ba92b4dbdf9d35553852b82bfddf2fabc06cabc194e120a · accessed 2026-08-18 · published-standardGrounds: The "Software bill of materials emitted per build" row (Nishi n): the SBOM format the Syft/Snyk-class bar emits; an unstated zero-dependency inventory is not an attested one, and this is the attestation shape.
[gh-branch-protection] GitHub Docs: About protected branches -- required status checks, required pull-request reviews and approvals, linear history, force-push restrictions. publisher · read in our library knowledge/fetched/cmp_devguardrails_gh-branch-protection.html · pin hf18b62d250903fa0059c6b04fa7ff32354e770b389fa4de64076cdf03a3453e7 · accessed 2026-08-18 · vendor-docGrounds: The GitHubActions column on "Merge/branch protection with required approvals" (B): the vendor's own definition of the control the row grades Nishi n against -- no branches to protect, promotion gated at the artifact instead.
[capmyths03] Miller, Yee, Shapiro. Capability Myths Demolished. Johns Hopkins University Systems Research Laboratory technical report SRL2003-02, 2003 (mirror: Agoric papers). publisher · read in our library knowledge/fetched/cmp_devguardrails_capmyths03.pdf · pin hb6a3e04e60d7ef08d32900143f8e93acbdcb62e2b63160b604591d7a021f7f42 · accessed 2026-08-18 · published-paperGrounds: The "Least-authority capability tokens for agent access" row (Nishi B): the object-capability model whose seven properties (attenuation, revocability, confused-deputy resistance) the X-Nishi-Cap attenuate-only, nonce-revocable, fixed-arg-pinned tokens implement; the ACL-vs-capability distinction the row's peers lack.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/devguardrails.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls