Nishi Family › Compare › The Engine Shift

Nishi Compare · capabilities, evidence and delivery

The Engine Shift

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi seat engine (measured scoreboard, split-brain router, classified egress, sovereign no-float seat, gap registry as the custom-LLM test suite) vs Claude Code and OpenCode and Ollama and LiteLLM -- Sep-2026 field

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. MEASURED 2026-09-02 against the estate's own ledgers, catalogue and session record. The scoreboard exists (nx_seat shift): over the last 30 days the Claude seat class shows 2 metering rows, 35 sessions, 40,084,522 output tokens, 13,589,263,050 cache-read tokens and 45 closed workstreams, 890,767 output tokens per closed rung; the local seat class shows ZERO rows. token_efficiency.log holds 16 rows, the last dated 2026-08-05, and no hook, clock row or organ produces one -- every row was appended by hand, so the gauge has been dark for 28 days. The autonomy meter reads 705 permil. The external lane is LIVE: nx_extllm (terms ledger and egress classifier) and nx_extllm_call are promoted and registered, the egress ledger holds 14 rows against openrouter stealth/ox-alpha between 2026-08-25 and 2026-08-26 (200, 429 and one 401 attributed), the bearer key sits on the NAS at a /tmp path declared as break-glass, and the release manifest carries four U rows. Routing exists three times and is wired nowhere: nx_llm_provider (the ladder sovereign, local, external, Claude) has two test importers and zero production importers (nx_absent, corpus_complete=1); nx_llm_route is imported by the companion orchestrator but llm_routes.conf carries zero active rows; nx_clawf_route is registered and dark. The sovereign inference stack is real and slow where it runs: the no-float seat serves Qwen2.5-0.5B at 15 tok/s on a 16-core WSL and about 1 tok/s on the GPU-less NAS, nx_f32_llm_serve is PROMOTED-UNREGISTERED and nx_nofloat_serve BUILT-UNPROMOTED; the fix loop nx_autofix_auto, the split-brain router, nx_tokroi, nx_promptpack, nx_worker_dispatch, nx_swarm_coord and nx_selfsuff are registered and never invoked over the MCP surface. The laptop RTX 5080 has 13,902 MiB free and six staged GGUFs up to Qwen2.5-Coder-7B Q4_K_M in WSL; the 2026-08-01 GPU Q4_K kernel that projected 42 tok/s for a 14B ran in a C daemon over libcuda, its source is gone, and the operator's pure-NishiLang order forbids rebuilding it that way; the sovereign /dev/dxg path is GREEN at R0 (enumerate adapters, raw syscalls, no libc) and nothing above it. Fleet review the same day: nx_sota_status grades 101 domains, PROVEN 0, MECH-OK 57, RED 18, UNPROVEN 57, CLAIM-ONLY 26, unique capabilities 379, frontier gaps 891; nx_selfsuff ranks 20 of 95 domains with outside dependency (stem 10, deploy 10, media 9, mediaingest 9, browser 5) and finds claude_loop organs 0 of 975 with the action record unjoined, so seat frequency is UNMEASURED, not zero. CORRECTED THE SAME DAY, MEASURED: ES1 (nx_seat_meter_beat, gate 24 of 24, SessionStart hook) backfilled 56 rows and the Claude column now reads 61 rows, 139.3 million output tokens and 66.4 billion cache-read tokens over 30 days; ES3 (nx_engine_dispatch, gate 21 of 21) dispatched a U task to the sovereign no-float seat running on the laptop at 35 ms per token, the declared judge passed it, and the LOCAL column moved from 0 to 1 row -- the first local row since the gauge was built on 2026-07-20. A second dispatch exercised the whole ladder: local RED, external REFUSED by the warden, HANDED-TO-SEAT.

Where we need to go. OPERATOR ASK (2026-09-02): set up the local and third-party (ox-alpha and others) farming-off capabilities so the assistant can use them to drive Claude token use toward zero intelligently, while the Nishi estate grows in pure NishiLang -- no Python or JavaScript in any build or run path -- toward its own LLM trained on its own substrate, doing more with less resources and more intelligent math as resources become scarce; benchmarks and oracles may be installed in their native languages as comparators only; the future NishiOS and browser surface stays purely sovereign with foreign software such as Chrome installable but sandboxed as a guest. Deliverable: a scoreboard that produces itself and prices the Claude column, one dispatch verb that sends every task to the cheapest engine whose terms permit its class and returns the judge's verdict, the sovereign seat on the laptop GPU through the sovereign path with the llama.cpp oracle beside it, and a retire rule that removes Claude from a rung class the moment the gap registry's measure is met -- graded against the /compare fleet's 0 of 101 PROVEN ratio as the honesty backdrop for every claim here.

The unit. 1 u = one measured session-leg (organ plus gate plus live flip), the standing calibration. Local evidence: nx_extllm and nx_extllm_call each landed in one leg on 2026-08-25; the crash-resume organ nx_crashwin with its 22-tooth gate landed in one leg on 2026-09-02.

Where we are: 16 present rows, 15 open rungs. A gauge with no producer, three routers with no route, a live external lane with fourteen rows, a sovereign seat too slow where it runs and a GPU that nothing sovereign reaches above enumeration. Counts measured at emit below this line.

Cost to a scoreboard that produces itself: 3 u. M0: ES1 the meter beat, ES2 the declared tier, ES11 the residue classifier. Version 0.1 is a gauge that moves without a seat and prices the Claude column.

Cost to a farm that closes rungs: 6.5 u more. M1: ES3 the dispatcher, ES4 the rung worker, ES5 sampler tiers, ES6 best-of-N. 9.5 u cumulative = version 1.0, measured by local rows rising on the scoreboard.

Cost to a usable sovereign seat on the GPU: 11 u more. M2: ES9 the oracle bench receipt, ES8 KV cache and fused GEMM, ES7 GPU offload through the dxg path, ES10 the laptop replica on the mesh. 20.5 u cumulative = version 2.0.

Cost to retiring Claude on a rung class: 6.5 u more. M3: ES12 forge authoring, ES13 the lawful harvest, ES14 SFT on the integer LM, ES15 the retire rule. 27 u cumulative = version 3.0; the first retired class is whatever the gap registry's held-out measure says it is.

Research bar. Stealth Program EULA, the contract that binds a free stealth model is measured on OpenRouter, updated 2026-07-06. Theirs: models offered free of charge for purposes of collecting User Content for training; an irrevocable perpetual licence; a ban on publishing performance information [stealtheula]. Ours: ES3 and ES4 send the free tier U bytes only and this page carries no ox-alpha number.

Research bar. Groq Services Agreement, the free tier that does not train and leaves outputs yours is measured on Groq, effective 2026-06-22. Theirs: Groq may not use Inputs or Outputs for training or fine-tuning any models unless explicitly granted permission [groqsa]. Ours: ES13 -- the first provider whose outputs may lawfully grow the sovereign corpus.

Research bar. Anthropic Commercial Terms, the contract under which the frontier seat runs is measured on Anthropic. Theirs: Anthropic may not train models on Customer Content from the Services; the account tier decides the posture and Claude Code inherits it [anthropiccomm]. Ours: ES2 keys the ledger row on the declared tier; ES13 refuses Claude output as corpus.

Research bar. llama.cpp, the CPU inference oracle we bench beside and never build on is measured on ggml-org. Theirs: GGUF and K-quant weights, KV cache, speculative decoding, the CPU reference [llamacpp]. Ours: ES9 -- installed in its native language as a comparator only, per the operator 2026-09-02.

Research bar. Large Language Monkeys, sampling against a verifier is measured on arXiv 2407.21787. Theirs: coverage climbs with the number of samples when a verifier exists [llmonkeys]. Ours: ES6 -- the estate's verifier is byte-exact and a free or local sampler makes N affordable.

Research bar. MARLIN, the fused dequant kernel is measured on arXiv 2408.11743. Theirs: 4-bit weights stay quantized in the hot loop and are dequantized in registers [marlin]. Ours: ES8 -- the decode lever the roofline named: move fewer bytes, not more SIMD.

Business case

Axis	Position	Figures	Decision
Investment	The whole investment is organ work (30 u to version 3.0, of which 3 u is M4 token governance at version 1.5) plus the operator's two data decisions -- the Anthropic tier row and the release manifest -- and the laptop GPU already owned; zero new hardware, zero per-token cost on the local and free tiers	30 u	fund M0 first: a gauge that produces itself is the precondition for every claim below it
Market	The field, from the mirrored record: LiteLLM routes and budgets by spend across deployments [litellmrouting]; Ollama serves local GGUF models behind a REST API [ollamaapi]; OpenCode selects providers inside an agent [opencodemodels]; the frontier seat is contracted not to train on commercial content [anthropiccomm]; the free stealth tier is paid for with the prompt [stealtheula]; Groq's free tier leaves outputs yours [groqsa]	three engine classes fall out: sovereign (zero tokens, our silicon), free external (U bytes only), rented frontier (strategy, diagnosis, judgment)	no engine is trusted from its banner; the terms row and the judge decide
Opportunity cost	Every rung closed by the frontier seat at 890,767 output tokens is a rung the sovereign team did not learn to close; every mechanical frame in the 92.9 percent is a token spent on work a deterministic organ absorbs forever at zero marginal cost	the Infinigen shape: a finite body of organs absorbs unbounded mechanical work	charge ES1 to ES3 to the platform, ES4 to ES6 to coding and extllm, ES7 to ES10 to llm and workermesh, ES12 to ES15 to team and modelwright
Competitive position	Nobody in the field measures tokens per closed rung, classifies what may leave, or keeps the exact tasks an LLM still intercedes on as the test suite for its own replacement; the sovereign seat is slower than every rival today and bit-exact where none of them are	our position is the ruler and the ledger; the model is the last thing we build	scoreboard, dispatcher, GPU seat, retire rule -- in that order
Buy vs build	Inference: TAKE the laptop GPU we own, TAKE free tiers where the terms row permits, RENT the frontier seat for the residue; oracles and benchmarks in their native languages as comparators. Scoreboard, dispatcher, residue classifier, bench receipt, GPU path, retire rule: BUILD in pure NishiLang -- none exist to buy in the clearance-aware, rung-measured form	the only permanent thing is the sovereign organ; everything foreign is a guest, sandboxed on the future NishiOS	build the gauge before the engine

Market-entry ladder

Level	Best in class (Aug 2026)	What we have	What must grow	Verdict
Hobbyist	Paste a task into a free model's playground or run a local model behind Ollama by hand [ollamaapi]; no ledger, no clearance, no judge	the classification rule as a written instruction and the byte-exact judge as a command	nothing structural -- discipline	ENTER NOW by hand on U material only, exactly how the fourteen ledger rows of 2026-08-25 were produced
Small business	A routing gateway with keys, fallbacks and spend logs [litellmrouting] in front of a local server [ollamaapi] and one or two cloud providers	the warden, the call organ, the egress ledger, the scoreboard verb	ES1 the producer, ES2 the price, ES3 the dispatcher	GROW-FIRST -- enter when M0 is green; until then every farm-off is a hand-run probe and every token number is a hand-appended row
Market leader	Agents that switch providers per task [opencodemodels], enterprise gateways with budgets, local fine-tunes served beside cloud models	the gap registry, the split-brain router mined from 221 transcripts, the sovereign no-float seat	ES4 to ES6 and ES11	HOLD until M1 -- and the position is stronger than the leader's once ES3 ships, because a clearance is a rule where a spend budget is a number
Innovation leader	Nobody combines a clearance-by-construction dispatcher, tokens per closed rung as the gauge, and a registry of LLM-intercession points as the replacement test suite; the closest published result is sampling against a verifier [llmonkeys]	the verifier, the classification and the registry are measured present; the wiring is the whole gap	ES3 and ES15 published with local rows rising on ES0	THIS IS THE WEDGE -- reachable at M1 without a model of our own
Research leader	A model trained and aligned on its own substrate, bit-exact reproducible, distilled only where the licence permits [groqsa], graded on decontaminated tasks	the integer LM, autograd, BPE, K-quants and the forge ledger exist at toy scale (modelwright)	ES12 to ES14	after M2 -- the GPU seat is the precondition for training at any real scale

Dependency investment within today's budget: Reproducible work first; frontier-scale endpoints long term. Assess every operational dependency, including this assistant, JSON, WSL, MCP, APIs, build/test/publish tools and recovery. Record each dependency's measured strengths, weaknesses, owner, workload, substitute and reversible adoption test. Move repeatable work into canonical Nishi capabilities when quality and total cost per verified result justify it; retain useful frontier reasoning and independent review while measuring the residual. Frontier-scale LLM training and new frontier hardware are outside current investment, not immediate delivery promises. Existing ES18/ES26/ES27 and ecosystem EC37/EC41 own this scope; no cost or performance advantage is assumed.

OpenRouter offload candidates 2026-09-07: Research verified; inference and savings unmeasured. User supplied https://openrouter.ai/models?order=most-popular&variant=free . Primary https://openrouter.ai/stealth/ox-alpha identifies Ox Alpha as ZAI GLM-5.3-Flash; current https://openrouter.ai/api/v1/models lists z-ai/glm-5.3-flash with nonzero pricing, not an ox-alpha entry. Catalogue evidence is not a successful inference. Discover explicit free IDs from current API metadata; https://openrouter.ai/openrouter/free randomly routes compatible models and is not a fixed experimental identity. Record returned model/provider, task quality, tokens, retries, latency, review and total cost per accepted result; enforce account/provider quotas and applicable endpoint terms. Existing nx_extllm/nx_engine_dispatch are reuse candidates from historical plan records; current automatic refresh wiring and comparative savings remain unverified. Sources externally retrieved, not estate-pinned; no inference or paid call performed.

Latest recorded release

2026-10-01 · ES0

2026-10-01: four bars earned from listings fetched and read today -- SB-ROUTE (2026-09), SB-LOCALINF (2026-10), SB-TOKEFF (2026-09), SB-DISTILL (2026-09) -- with targets T-BIC-ROUTE and T-BIC-LOCAL (best in class) and T-FR-TOKEFF and T-FR-DISTILL (frontier); 29 rungrole rows place ES0 to ES28 (ROUTE 12, LOCAL 4, DISTILL 4, TOKEFF 9); SB-WFCTL re-attested for October from the publisher's index and the empty arXiv cs.DC October listing; nine refs mirrored by nx_research_fetch into knowledge/fetched and pinned, nx_filehash equal to the fetcher's provenance digest on all nine. The page is NOT republished by this seat: a scoped regen of engineshift is owed

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

26 of 40 capability source symbols found|13 of them authored stronger-claims|14 open|coverage 650/1000|adoption 10 full / 16 partial

Evidence profile — what the gaps on this board actually are

Unstamped. No evidence profile is published for this domain yet: run nx_swcompare_evidence engineshift and this section fills itself on the next beat. No numbers are shown, deliberately — a zero-filled profile would read as a board with no gaps, which is the one wrong answer nobody would question.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Engine-shift scoreboard (ES0)	st_shift	LANDED 2026-07-20: claude versus local seat classes and tokens per closed rung from token_efficiency.log and ws_sync.jrnl, hard-capped at 4 KB	Organ	0 u
Meter beat, the scoreboard's producer (ES1)	sm_beat	A laptop organ (the transcripts live only there; the DM1 capture beat is the precedent) that walks every session jsonl, sums output, cache-read and cache-creation tokens per UTC day and seat class from the assistant usage fields, and appends ONE nx_seat meter row per day and class, idempotent by a day marker; SessionStart prints the 7-day delta beside the boot digest. Gate: a fixture of N sessions sums to a hand count, a second run appends nothing, a truncated jsonl is counted PARTIAL and never as zero. Done when the log carries a row for every day since 2026-08-05	Organ	1 u
Tier declared, Claude column priced (ES2) after ES1	xl_tier_declared	The operator declares the Anthropic account tier row in extllm_terms.conf (the UNDECLARED row refuses today [anthropiccomm]); the scoreboard multiplies tokens by that tier's published rates read from a conf row and prints spend per closed rung beside tokens per closed rung; neg-control: with no tier declared the price column reads UNDECLARED, never zero	Data and organ	0.5 u
Dispatcher: the cheapest sufficient engine (ES3) after ES1	ed_dispatch	ONE verb takes a task file (spec, KAT, declared class U or C, judge) and tries engines in ladder order -- an existing deterministic organ found through nx_capsearch, the sovereign no-float seat, an external free worker through xl_call, the rented frontier seat -- stopping at the first whose output the declared judge passes, and returns verdict, engine, tokens and bytes; every dispatch appends a shift-ledger row so ES0's local column moves. Neg-controls: a C task never reaches an external worker; a U task with a green local result never reaches Claude; an engine whose terms row reads UNKNOWN is skipped by name	Organ	2 u
Rung worker loop (ES4) after ES3	xl_rung_worker	The same contract extllm names as XL7: read a plan rung whose spec and KAT resolve entirely to U sources, run sampler then judge then bank through ES3, file the GREEN candidate on the pm intake plane; rungs citing unreleased source SKIPPED by name; attempted, GREEN, RED and SKIPPED partition sums [llmonkeys]	Organ	2 u
Sampler tiers as data (ES5) after ES3	af_sampler_tier	The same contract autodev names as AD11: local no-float, external free through the warden, Claude for judged work, selected per task class by a conf row; neg-control: the free tier sees only U bytes and the Claude tier's output never enters the corpus	Organ	1.5 u
Best-of-N against the verifier (ES6) after ES5	fg_best_of_n	The same contract coding names as CD2, extllm as XL5 and autodev as AD12: N candidates through the byte-exact judge, first GREEN kept, NONE reported when none is GREEN, pass-at-N monotone in N on the mini-pack [llmonkeys]	Organ	1 u
GPU offload through the sovereign path (ES7) after ES9	gpul_offload_layer	The same contract llm names as LM9, with the operator's 2026-09-02 constraint made explicit: the no-float Q4_K forward on the RTX 5080 reached through the /dev/dxg path the estate already enumerates (R0 GREEN), the kernel emitted by our own toolchain -- never a C daemon, never libcuda, never a Python runtime. Done-rule: a staged 7B Q4_K_M GGUF decodes on the laptop at a PRE-DECLARED floor beside the llama.cpp oracle number on the same host and file (ES9), with per-layer activations bit-identical to the CPU path. The 2026-08-01 measurement (362 GB/s DRAM-resident, 42 tok/s projected at 14B) is the bar, never a claim	Organ	4 u
KV cache and fused dequant GEMM (ES8)	kv_paged_attn	The same contracts llm names as LM3 and LM4, taken together here because the seat is unusable without both: cached K and V per layer so decode stops recomputing, token-for-token bit-identical to the uncached path; and a Marlin-class fused kernel that keeps 4-bit weights quantized in the hot loop [marlin], bit-identical to the Q4_K dot and faster on the same bench	Organ	4 u
Local seat beside the oracle: a bench receipt (ES9)	lh_bench_receipt	A .bench receipt (the lang domain's mechanism, read by nx_bench_receipt_lib) written by a measuring organ: host, model sha256, thread count, decode and prefill tok/s min and median for OUR seat and for llama.cpp on the SAME GGUF and host, two runs agreeing; llama.cpp is installed in its native language as the comparator only [llamacpp]; the page renders the receipt and a stale one abstains	Organ	1 u
Laptop replica on the mesh (ES10) after ES7	lb_remote_replica	The same contract workermesh names as R3: the laptop GPU seat joins as an endpoint row, the NAS office and the seat API route to it through the balancer and skip it when it drops; the routing log names the replica per request	Organ	2 u
Claude residue classifier (ES11) after ES1	sm_residue	Per session, from the record, frames classified mechanical (tool results, authored code the maker could have produced, re-reads) versus reasoning (diagnosis, design, judgment), published as a permil per session and a 30-day floor; the 2026-07-21 hand measurement (92.9 mechanical, 7.1 reasoning) is the calibration and the gate proves a synthetic all-mechanical session reads 1000 and an all-prose one reads 0	Organ	1.5 u
Forge authoring past the zero floor (ES12) after ES6	fe_author_organ	The same contract team names as R1: the local forge cascade authors a novel organ that compiles, runs and passes its declared gate; nx_forge_local_bench moves from 0 of 3 by a PRE-DECLARED floor that ratchets	Local model	2 u
Lawful distillation harvest (ES13) after ES4	xl_distill_corpus	The same contract extllm names as XL9 and autodev as AD19: with every external sampler disabled the verified ledger must still strictly grow; external output enters only as a candidate judged by our verifier, provenance per row, and only where the terms row reads outputs_train_ours YES [groqsa]; never from ox-alpha [stealtheula] and never from Claude [anthropiccomm]	Organ	1.5 u
Instruction SFT over the integer LM (ES14) after ES13	sft_run	The same contract modelwright names as R0: supervised fine-tuning over the integer LM on the forge ledger and the lawful harvest, bit-exact reproducible on a second CPU, held-out exact-match beating the base by a pre-declared margin	Organ	2 u
Retire Claude by rung class (ES15) after ES3,ES14	lg_retire_class	The gap registry's open gaps are the test suite: when the sovereign seat passes a gap's declared measure over N held-out tasks, ES3 stops routing that class to the frontier seat, the registry marks it RESOLVED, and this page prints classes retired with the date; neg-control: a class passed on fewer than N tasks stays LLM-DEPENDENT	Organ	1 u
Engine class routing as data (ES16) after ES3	ec_route_class	The dispatcher reads knowledge/engine_classes.conf (task class, clearance, engine order, judge, token ceiling) so neither a seat nor the operator decides per task; a task with no class row refuses by name rather than defaulting to the frontier seat; neg-control: a C-class row that lists an external engine is refused at load	Data and organ	0.5 u
Token pre-flight advisory in the tool path (ES17) after ES11	tg_advise	A laptop PreToolUse organ, sibling of nx_memnew and nx_organnew, that sees a Read or grep about to land, sizes the subject, and names the digest verb that answers the same question in fewer bytes (nx_fs size or lines, gv_last_line, the claim marker before the out file, nx_seat boot); advisory only, never blocking, silent under a declared floor; gate: a 3 KB fixture read draws the advisory, a 400 B one does not, and every advisory names a verb that exists	Organ	1 u
Tokens per closed rung as a ratchet with a quality floor (ES18) after ES1	st_ratchet	nx_seat shift prints the delta of tokens per closed rung against the previous window with the gate GREEN rate and referee grade beside it; the ratchet reads RED when tokens rise, and RED when tokens fall while the grade falls with them, so a saving that made the work worse cannot read as progress; neg-control: a window with zero closed rungs reads UNMEASURED, never a win. Scope clarification 2026-09-07: the intended optimization is quality-gated TOTAL COST PER VERIFIED RESULT, not frontier-seat token reduction alone. Publish local and remote input/output/cache tokens and context volume, compute and external spend, retries, review effort, elapsed time, autonomous completions, interventions, defect recurrence and recovery cost with the denominator and accounting coverage. Missing costs remain UNMEASURED; zero verified results cannot report a saving. Compare matched task classes and quality floors so shifting work or retries to another engine never manufactures improvement.	Organ	0.5 u
Digest, never dump: verdict verbs on the organs seats read most (ES19) after ES11,ES17	dg_verdict_line	The ten organs to which the residue verb attributes the most mechanical bytes (published as a list, re-measured each beat) each gain a verb that returns one verdict line with its envelope, and the shift page prints mechanical permil per session; done when the 7-day mechanical permil falls below the 40-day baseline of 668 with the grade floor held	Organ	1 u

Milestones

Milestone	Rungs	Cumulative
M0 · Scoreboard produces itself	ES1,ES2,ES11	3 u
M1 · A farm that closes rungs	ES3,ES4,ES5,ES6	9.5 u
M4 · Tokens governed without the operator	ES16,ES17,ES18,ES19,ES20,ES21,ES22	6 u
M2 · Sovereign seat on the GPU	ES9,ES8,ES7,ES10	20.5 u
M3 · Claude retired by rung class	ES12,ES13,ES14,ES15	27 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Dispatch ledger preflight and fail-cheap escalation (ES20) after ES3,ES16	ed_ledger_preflight	Defects filed 1788482414 and MEASURED in the shipped 42246 B organ: ed_ledger_row returns -1 when sys_openat_append fails and all TEN call sites discard it (corpus_complete=1), so an absent state dir loses the audit row ES0's local column is built from while the dispatch still reports a verdict; and the local -2 path at line 580 counts the seat as reached, falls through, and the escalation row at line 649 records every engine below the seat failed the judge, which is false when the seat never answered. ES3 proves the ledger path appendable BEFORE the first engine runs and refuses by name otherwise, and an engine that produced no answer is recorded UNREACHABLE and stops the ladder rather than escalating to the rented seat. Neg-controls: a read-only state dir refuses and buys zero tokens; a local seat returning a non-JSON body reads UNREACHABLE and never reaches the frontier seat; a local seat that answers and fails the judge still escalates normally, so the fix cannot disarm the ladder; and a ledger write that fails mid-run turns the verdict UNMEASURED rather than GREEN	Organ	1 u
Goal mapper: the estate maps an operator goal onto the boards from data, never a frontier fan-out (ES21) after ES0	gm_run	nx_goalmap <domains-csv> <word>... prints ONE capped JSON digest (budget 8192 B declared in the output, clipped=1 announced when bound): per domain the rung rows whose title, done-rule or symbol carry the words with score = DISTINCT words matched (a count, never a threshold), status derived from the matrix (present symbol = PRESENT, _ABSENT_ watch = OPEN) and from knowledge/store/accept- (REJECT naming dom:sym = PRESENT-REJECTED, ACCEPT = ACCEPTED), the log ledger count and last epoch per rung, the matrix watch rows the words match as gaps with SOURCE/BUILT/PROMOTED probed at the three roots, and a dependency order over the matched rungs (Kahn over deps, cycles announced); a duplicate rung id is REFUSED by name. Done when nx_goalmap_gate is GREEN in-process on fixture boards with planted controls (operator REJECT flips status, duplicate id refused, no-match returns empty not a guess, 300-rung scale stays inside the budget with the count still full, unreadable domain returns NO-DOMAIN), the organ is promoted, registered and callable on the MCP surface, and nx_seat gains a map verb that delegates to gm_run so the seat boot digest and the goal map are one organ; neg-control: a word that matches nothing yields rungs_matched=0 and an empty order, never an inferred rung	Organ	1 u
The seat's only surface is the estate: a PreToolUse interlock names the estate verb for every harness shell the seat reaches for (ES22) after ES17	tg_shell_interlock	OPERATOR 2026-09-05, verbatim: 'i also want claude especially the fable 5.1 model you are to stop using its own tools when it loads and to use these and nishi estate only and if there is a gap to build into the nishi estate from the first byte, no more ps1 and python and shell and all the other bullshit'. Today the law is prose in CLAUDE.md and a feedback memory; the estate has measured what happens to an invariant that depends on a seat remembering (nx_memnew: the same doctrine written 4x while the organ sat one call away). Done when a laptop-local PreToolUse organ (sibling of nx_memnew and nx_organnew, wired in settings.json, advisory never blocking -- a pre-flight that can refuse will be disabled) fires on every Bash and PowerShell tool call a seat attempts and answers with the sovereign verb that does the same work (nx_fs for cat/head/sed, nx_txtscan for grep, nx_filehash for sha256sum, nx_job_run for a poll loop, nx_goalmap for a fan-out) or, when none exists, prints GAP and the engineshift rung to declare; the one sanctioned launcher (wsl -e _offc/<organ>.elf for memory-plane organs) is allow-listed by path; the gate plants a Bash call and a PowerShell call and proves both draw the advisory with a verb that exists, plus the allow-listed launcher draws none; neg-control: an unknown command draws GAP, never a guessed verb. Measured basis: 2026-09-05 mapping cost 5,713,788 subagent tokens across two fan-outs before nx_goalmap did it in one job	Organ	1 u
The goal mapper derives its sizes and refuses nothing silently (ES23) after ES21	gm_outbuf	nx_goalmap_lib sizes rung and matrix records from a count over the file just read, the CLI sizes the words array from argc, and the output buffer is gm_outbuf(domains) = the row budget plus one measured scaffold reserve per domain plus the tail, so the digest can never grow past its buffer; the caps GM_MAXWORDS, GM_MAXRUNG, GM_MAXMAT and GM_MAXDOM are deleted; done-rule: nx_goalmap_gate carries a multi-domain overflow tooth (four copies of the 300-rung scale board, content clipped, out_bytes above the row budget and at or under gm_outbuf, JSON closed, clipped announced) and a scaffold tooth that measures one domain's scaffolding against GM_DOM_RESERVE from a real emit, and the 8-board 16-word query that crashed the promoted binary (debt 1788626163) answers	Organ	1 u
The dispatcher names the stage that failed and the local seat listens on the estate host (ES24) after ES3	ed_noreply	nx_engine_dispatch returns NO-REPLY when the socket accepted and the request was written but zero bytes came back (a listener that is not a seat), distinct from UNREACHABLE (no connect) and ANSWERED-UNPARSEABLE (bytes that are not a /gen reply), with its own ledger status; and nx_nofloat_serve (BUILT-UNPROMOTED 233189 B on 2026-09-05) is deployed on the estate host so a debt-triage dispatch from a seat reaches a seat instead of an empty port; done-rule: nx_engine_dispatch_gate gains a mute fixture seat (accepts a POST /gen and closes with no body) whose tooth reads status=NO-REPLY and never UNPARSEABLE, the ledger partition rises to 15 and sums, the gate is PROMOTED and REGISTERED (it was BUILT-UNPROMOTED and on no roster), and a real dispatch of knowledge/status/dxr_grade_task.conf on the NAS reads ANSWERED with a judge verdict	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M5 · The mapper and the dispatcher tell the truth about their limits	ES23,ES24	12 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
A one-step solve is scored by its OUTCOME, never by its step count alone: a badly evaluated one-step ranks below a rigorous forty-step (operator 2026-09-06) (ES27) after ES26	ss_quality_axis	Done-rule: nx_stepsolve_lib carries a QUALITY axis per signature from the journal's outcome column (failure permil over the ritual's own occurrences) and from malformed rows, the spine and stamp publish quality beside explained, the worklist orders by RISK = support x failure permil so a common bad one-step outranks a rare forty-step, the gate plants a one-step ritual that fails and a forty-step ritual that passes and asserts the ranking, and the compare gauge renders both axes. Scope clarification 2026-09-07: score sovereign operational work by correctness, quality, failure recovery and verified final result alongside efficiency. A one-call build/publish or AI delegation that lacks the expected artifact and acceptance evidence remains unaccepted; low step count cannot upgrade an unmeasured result. A quality acceptance result must include whether the outcome was independently verified and reproducible, whether defects recur, and whether recovery succeeds. Carry those outcomes into the total-cost ruler in ES18; task completion without independent evidence cannot become autonomous verified completion.	Organ	3 u
One-step solve: steps per common task mined from the action journal, ratcheted toward one with the reason declared (ES26) after ES19	al_steps	OPERATOR STANDING ORDER 2026-09-06: if a task can be solved in ONE step within logic it should be, and when it cannot the estate explains why two, and why three, and so on, from the most common tasks to the least, mining and evaluating this efficacy continuously. The ruler is a verb on the incumbent action-journal organ (nx_actlog, whose indexed miner already ranks recurring tool:verb bigrams and trigrams by exact support over the live 56 MB journal): every recurring n-gram is a task signature whose step count is its length, joined against knowledge/stepsolve.conf rows (signature, min_steps, reason, one_step_verb) -- a declared minimum with the reason it cannot be fewer (a true dependency such as promote must see the sha only a finished build produces, which nx_organ_ship composes into one call) or the composed verb that makes it one. Published: frequency-weighted one_step permil, two_step permil, three_plus permil with denominators; every signature without a conf row named UNDECLARED (never assumed one-step), most common first, as the worklist; a spine row per beat and a gauge stamp the CE9 gauge_pass renders. ACCEPT RULE: the one_step permil over the top-N most common signatures is published beside its denominator and may not fall beat over beat; every multi-step signature carries a declared reason or reads UNDECLARED; the neg-control proves an undeclared signature never reads as one-step and a planted 4-step ritual with a declared composed verb reads gap=3 naming that verb. ARCHITECTURE: the remedy for a multi-step ritual is a composed verb on the CANONICAL organ of that task (the common-task registry names it), never a new tiny tool -- no toilets in the living room. Scope clarification 2026-09-07: common tasks include grep/search/read/write/build/test/site emission/publication/recovery/AI, and the operator wants the estate to improve all of them. The backbone may continue to plan and review with the frontier assistant while verified local and external engines receive bounded tasks; delegation requires a reachable named engine, a permitted task class and an outcome receipt.	Organ	2 u
The promote ruler has a referee, and a subject that really dies (ES25) after ES24	nx_behaveprobe_gate	nx_sigfixture (registered) dies by a named signal on itself or exits a named code; nx_behaveprobe gains a self direction (live against itself, no stage slot) and SIGNALLED and HARNESS evidence grades; nx_behaveprobe_gate forks the LIVE probe against the fixture and the fixture directly through tr_run_capture, asserting 143 on SIGTERM, 7 on the control arm, never rc 0, SIGNALLED named, and the bite pair -- GREEN on the deployed binaries and rostered	seat	1.5 u
A rung contract answers with its incumbents and the record's rejections before a seat builds anything (ES28) after ES21,ES23	rk_incumbents	OPERATOR 2026-09-14 on the search R0 review: a seat found nx_dr_densejudge, embed_v1.bin and the DR-13 recorded rejection of learned fusion over PPMI by glob and header reads AFTER a prior seat had rebuilt the rejected design. The estate must answer a rung's contract itself: for every open rung, rk_incumbents matches the contract terms (symbol, title, note) against registered organ names and grammars, source headers in runtime and _hdl_build, and data assets under knowledge/index, and reads header prose for a recorded measured rejection (rejection, dead end, REFUTED, measured ceiling) on those terms; nx_compare_rank prints INCUMBENTS and PRIOR-REJECTIONS on the rung line and plan_pass renders them under the rung. Accept rule declared before the build: on search.plan R0 it names nx_dr_densejudge, embed_v1.bin and the DR-13 rejection with no seat input; a neg-control rung whose terms match nothing prints NONE, never a guess; coverage envelope printed (files scanned, corpus_complete)	Organ	2 u
A launched job can be cancelled from the surface that launched it: nx_job_run gains a cancel verb that finds the job by its out-file, verifies the pid's cmdline is the job it launched, sends TERM then KILL after a named grace, and journals the cancellation beside the launch (ES29)	jr_cancel	MEASURED 2026-09-15: two cross-encoder one-shots launched 09-14 through nx_job_run on the PRE-FIX f32 bricks (10x slower than the hardware twins shipped the same day) held the box at load 27 on 8 cpus for over 30 hours with 0 bytes of output, and admission correctly refused every build -- including the builds that would have replaced them. No sovereign surface could stop them: nx_job_run has no cancel verb, nx_aw_hostctl is not mintable (unregistered tool in allow list), nx_ctxtop refuses to walk /proc above load 800, and knowledge/resgov.conf's own law forbids a recycle row for a one-shot (never terminate what nothing will restart). A RUNAWAY JOB THAT CANNOT BE CANCELLED IS A RESOURCE INCIDENT WITH NO REMEDY (§29 already says so for long sweeps). Done-rule: nx_job_run cancel <out-file> on a planted sleep job terminates it and journals `CANCELLED pid= elf= out=`; a cancel naming an out-file no job wrote is REFUSED-ABSENT; a cancel whose pid cmdline does not match the launch record is REFUSED-MISMATCH (never kills a stranger); gate plants all three	Organ	2 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.

frontier (T-FR-WFCTL), dated by SB-WFCTL = 2026-09 ATTESTED. Every launched unit of estate work carries an end-to-end budget that survives queues, retries and restarts and is never re-granted on restart; is cancellable AND verifiably stopped from the surface that launched it; classifies its own failure signals and recovers under an explicit budget with a verified trajectory; and is journaled as traces the boards render, so nothing runs unmonitored and nothing stays stuck ref zylosdeadline26

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Every job carries an end-to-end budget and the launcher enforces it: nx_job_run records an ABSOLUTE deadline (epoch) and an optional core-seconds cap per launch in jobrun.jrnl, a sweep verb cancels any live job past its deadline through jc_cancel, journals BUDGET-EXCEEDED, and a re-launch of a resumed job inherits the REMAINING budget, never the original (ES30) after ES29	jr_budget	Done-rule: a planted sleep job launched with deadline=now+2s is cancelled by `nx_job_run sweep` within one grace and journaled BUDGET-EXCEEDED with verified_stopped=1; a job inside its deadline is untouched (neg-control); a resumed launch declaring resume=<out-file> receives remaining = deadline - now, refused when non-positive; the gate plants all three. September 2026 frame: time in the queue and offline count and a restart never re-grants the full budget [zylosdeadline26]	Organ	2 u
Failure classes and budgeted recovery: a finished job's exit is classified (refused-admission, over-budget, crashed, rc-nonzero, ok) from its journal and out-file, a declared recovery per class (requeue with backoff once, cancel-and-report, nothing) runs under an explicit recovery budget, and the recovered run is verified against the original accept rule before it counts (ES31) after ES30	jr_recover	Done-rule: on a planted crash the recovery requeues exactly once and journals RECOVERED with the verifying probe's result; on a second crash it stops and journals RECOVERY-BUDGET-EXHAUSTED; a refused-admission class requeues through nx_buildq and never re-launches directly; the gate plants all three and a neg-control where the recovered run fails its accept rule and is NOT counted. May 2026 frame: failure signals to classes to budgeted, verified recovery [selfheal26]	Organ	3 u
No job unmonitored: the boards render the launcher's journal as a jobs table (launched, running, done, cancelled, over-budget, recovered) with age, budget remaining and the out-file, so a stuck or runaway job is a visible row on /compare/engineshift and never a discovery by ps (ES32) after ES29	jobs_pass	Done-rule: jobs_pass in nx_swcompare_lib reads knowledge/status/jobrun.jrnl and /proc liveness through the one cancel lib's jc_verify, renders every job launched in the last 7 days with its state derived from the journal (launch without cancel and pid alive = RUNNING; pid gone with no cancel row = FINISHED; cancel row = its outcome), counts them in api.json, and a gate on a planted journal proves each state; the two 2026-09-15 runaways would have read RUNNING for 30 hours on the page [selfheal26]	Organ	2 u

Rung	Role	Toward	Stands on	Why
ES29	substrate	T-FR-WFCTL	-	the stop button every budget and recovery composes: cancel verified through /proc, journaled beside the launch
ES30	contender	T-FR-WFCTL	ES29	end-to-end budgets that survive restarts are the September 2026 bar itself
ES31	contender	T-FR-WFCTL	ES30	failure classification and budgeted, verified recovery is the self-healing frame's core loop
ES32	arm	T-FR-WFCTL	ES29	observability traces rendered where the operator already looks: the board, not a shell

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The 1-2-3 step: mined call sequences become seeded plans, plans become agents (ES33) after ES26,ES21	wm_attribute	DONE-RULE PRE-DECLARED: a miner over the seat's actlog frames (composing the nx_actlog n-gram mining and nx_workflowmine) proposes plan rows for every call sequence that recurs across sessions, each proposal a plan seed the seat runs with ONE nx_plan_run call; a proposal that runs GREEN twice is assigned an agent row (a clock or roster row) and the rung it serves declares both in its treatment row (the wf and agent fields); the receipt prints proposals, adopted plans and calls saved per session, and a session whose recurring sequences are all covered reads COVERED. First composition landed 2026-09-16: the plan-boardship seeds (rank, scoped regen, page verify) published a board in one nx_plan_run call, proven on automation; nx_workflowmine and nx_harnessmine are REGISTERED-DARK today, so the miner is the open half	Organ	3 u

Rung	Role	Toward	Stands on	Why
ES33	arm	T-FR-WFCTL	ES26,ES21	composes the launcher's plans and journals so recurring seat work runs as one budgeted unit; it triangulates calls saved and does not publish the frontier's number itself

best-in-class (T-BIC-ROUTE), dated by SB-ROUTE = 2026-09 ATTESTED. Every estate task goes to the cheapest engine whose terms permit its class, chosen from measured outcome evidence per step and never from a seat's habit; the quality floor is held by the task's own judge, a failed cheap answer is routed up and never tolerated, and the scoreboard prices tokens per closed rung beside the gate green rate so a token win with a grade drop reads RED ref arxivroute202610

best-in-class (T-BIC-LOCAL), dated by SB-LOCALINF = 2026-10 FRESH. The sovereign integer seat serves a local model in pure NishiLang with a bench receipt beside the llama.cpp oracle on one GGUF and one host -- prefill speed, decode speed, time to first token and memory -- and the KV cache, the fused dequant GEMM and the GPU path each land as a measured delta against that oracle, never as a claim ref llamacpprel202610

frontier (T-FR-TOKEFF), dated by SB-TOKEFF = 2026-09 ATTESTED. A seat's context is spent on judgement and not on re-read tool output: every organ a seat reads answers with a verdict line before a dump, a pre-flight names the cheaper read, a goal is mapped and a common task is solved in one call from board and journal data, and tokens per closed rung ratchet down with the outcome scored, so harness weight that does not earn its place is removed ref arxivtokeff202610

frontier (T-FR-DISTILL), dated by SB-DISTILL = 2026-09 ATTESTED. The estate's own small model learns the estate's work from lawfully harvested traces: terms-cleared trajectories and verdicts become the distillation corpus, the integer LM is instruction-tuned on it, the forge authors past the zero floor under a verifier, and a rung class leaves the frontier seat only when the student clears the gap registry's measure on that class ref arxivagentdistill202610

Rung	Role	Toward	Stands on	Why
ES0	substrate	T-BIC-ROUTE	-	the scoreboard is the outcome evidence a router is judged against: seat classes and tokens per closed rung
ES1	substrate	T-BIC-ROUTE	-	the scoreboard's producer: a router cannot be shown to pay for itself unless the meter runs with no seat
ES2	substrate	T-BIC-ROUTE	ES1	declares the tier and prices the frontier column, the cost every routed task is compared against
ES3	contender	T-BIC-ROUTE	ES1	the router itself: one verb sends a task to the cheapest sufficient engine and returns the judge's verdict with the engine named
ES4	arm	T-BIC-ROUTE	ES3	runs whole U-cleared plan rungs through the dispatcher, sampler then judge then bank; it exercises the router on real rungs and does not set its number
ES5	substrate	T-BIC-ROUTE	ES3	sampler tiers as data are the tier table the dispatcher and best-of-N select from
ES6	contender	T-BIC-ROUTE	ES5	best-of-N against the verifier is coverage routing: several cheap samples behind a byte-exact judge
ES16	substrate	T-BIC-ROUTE	ES3	the engine per task class is a conf row, the routing policy as data the dispatcher reads
ES18	contender	T-BIC-ROUTE	ES1	tokens per closed rung as a ratchet with a quality floor is the target's own number: cost may not rise and a fall with a grade drop reads RED
ES20	arm	T-BIC-ROUTE	ES3,ES16	ledger preflight and fail-cheap escalation: a cheap engine that never answered refuses instead of escalating to the paid seat, the cascade's escalation rule kept honest
ES24	arm	T-BIC-ROUTE	ES3	the dispatcher names the stage that failed and the local seat listens on the estate host, so a routing loss is never read as a model loss
ES25	substrate	T-BIC-ROUTE	ES24	the promote ruler has a referee and a subject that really dies: the quality floor a routed result is held to is itself refereed
ES7	contender	T-BIC-LOCAL	ES9	GPU offload through the sovereign path: tokens per second on the laptop GPU behind the bit-exact contract, measured against the oracle
ES8	contender	T-BIC-LOCAL	-	the KV cache and the fused dequant GEMM are the decode levers the runtime bar ships; each lands as a delta on the bench receipt
ES9	substrate	T-BIC-LOCAL	-	the ruler: the local seat beside the llama.cpp oracle on one GGUF and one host, as a bench receipt
ES10	arm	T-BIC-LOCAL	ES7	the laptop replica on the mesh makes the GPU seat a live endpoint; it carries the number to the dispatcher and does not set it
ES12	contender	T-FR-DISTILL	ES6	forge authoring past the zero floor is the student's capability measured: a novel organ that compiles, runs and passes its declared gate
ES13	substrate	T-FR-DISTILL	ES4	the lawful distillation harvest is the corpus: the verified ledger must grow with every external sampler disabled
ES14	contender	T-FR-DISTILL	ES13	instruction SFT over the integer LM is the student itself, tuned on the harvested traces
ES15	contender	T-FR-DISTILL	ES3,ES14	retire Claude by rung class is the target's own number: a class leaves the frontier seat when the sovereign seat clears the gap registry's measure
ES11	substrate	T-FR-TOKEFF	ES1	the residue classifier names which bytes of a session are mechanical and which are reasoning, the class the harness target removes
ES17	arm	T-FR-TOKEFF	ES11	the token pre-flight names the cheaper read before the expensive one lands; advisory in the tool path, it informs and never refuses
ES19	contender	T-FR-TOKEFF	ES11,ES17	digest, never dump: verdict verbs on the organs seats read most are the bounded tool result, measured in mechanical bytes
ES21	contender	T-FR-TOKEFF	ES0	the goal mapper maps an operator goal onto the boards from data in one job, never a frontier fan-out
ES22	arm	T-FR-TOKEFF	ES17	the interlock names the estate verb for every harness shell the seat reaches for, so work lands on the surface that answers with a verdict
ES23	arm	T-FR-TOKEFF	ES21	the goal mapper derives its sizes and refuses nothing silently, which keeps the one-job map trustworthy
ES26	contender	T-FR-TOKEFF	ES19	one-step solve: steps per common task mined from the action journal and ratcheted toward one is the harness-weight number
ES27	substrate	T-FR-TOKEFF	ES26	a one-step solve is scored by its outcome: the quality floor under the step ratchet, so a short path with a poor result ranks below a rigorous long one
ES28	arm	T-FR-TOKEFF	ES21,ES23	a rung contract answers with its incumbents and the record's rejections before a seat builds, saving the rediscovery reads

Ladder verdict. LADDERED. Targets, rung roles and bars are counted in the tables below, each partition re-derived beside its total. Bars read FRESH against the current month 2026-10.

Ladder verdict, counted (17 rows, more than the 12-row disclosure bar)

Ladder verdict, counted
Class	Count	Note
targets	5	sotatarget rows on the plan
best in class	2	targets whose class is best-in-class, by code
frontier	3	targets whose class is frontier, by code
undated	0	targets naming no bar that exists
bad class	0	targets whose class is neither word
duplicate	0	target ids an earlier row already carries
rungs	34	rung rows on the plan
placed	34	rungs carrying a rungrole row
unplaced	0	rungs with no role toward any target
bad role	0	rungrole rows naming a role the ladder does not know
bad target	0	rungrole rows naming a target no sotatarget row declares
rungs, summed	34	RECONCILED: the parts sum to the total 34
substrate	11	what the target's own methods consume
arm	10	a sovereign arm that triangulates without competing for the number
contender	13	its done-rule is a number against the target
superseded	0	kept as capability, retired as a claim
placed, summed	34	RECONCILED: the parts sum to the total 34

Bar freshness, counted
Class	Count	Note
bars	5	sotabar rows on the plan
fresh	1	the bar month is the current month
attested	4	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	5	RECONCILED: the parts sum to the total 5
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 34. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 63aa0058163ff7f01181470a637266f6c353aa77f7ba11666c59b59f8fc61f33. Target rows 5; role rows 34. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 34 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

ES0 — Engine-shift scoreboard
Prerequisites: None declared; this does not establish execution eligibility.
Contract: st_shift
Acceptance: LANDED 2026-07-20: claude versus local seat classes and tokens per closed rung from token_efficiency.log and ws_sync.jrnl, hard-capped at 4 KB
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES1 — Meter beat, the scoreboard's producer
Prerequisites: None declared; this does not establish execution eligibility.
Contract: sm_beat
Acceptance: A laptop organ (the transcripts live only there; the DM1 capture beat is the precedent) that walks every session jsonl, sums output, cache-read and cache-creation tokens per UTC day and seat class from the assistant usage fields, and appends ONE nx_seat meter row per day and class, idempotent by a day marker; SessionStart prints the 7-day delta beside the boot digest. Gate: a fixture of N sessions sums to a hand count, a second run appends nothing, a truncated jsonl is counted PARTIAL and never as zero. Done when the log carries a row for every day since 2026-08-05
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES2 — Tier declared, Claude column priced
Prerequisites: ES1 (acceptance unverified)
Contract: xl_tier_declared
Acceptance: The operator declares the Anthropic account tier row in extllm_terms.conf (the UNDECLARED row refuses today [@anthropiccomm]); the scoreboard multiplies tokens by that tier's published rates read from a conf row and prints spend per closed rung beside tokens per closed rung; neg-control: with no tier declared the price column reads UNDECLARED, never zero
Authored effort: 0.5. Executor kind: Data and organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES3 — Dispatcher: the cheapest sufficient engine
Prerequisites: ES1 (acceptance unverified)
Contract: ed_dispatch
Acceptance: ONE verb takes a task file (spec, KAT, declared class U or C, judge) and tries engines in ladder order -- an existing deterministic organ found through nx_capsearch, the sovereign no-float seat, an external free worker through xl_call, the rented frontier seat -- stopping at the first whose output the declared judge passes, and returns verdict, engine, tokens and bytes; every dispatch appends a shift-ledger row so ES0's local column moves. Neg-controls: a C task never reaches an external worker; a U task with a green local result never reaches Claude; an engine whose terms row reads UNKNOWN is skipped by name
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES4 — Rung worker loop
Prerequisites: ES3 (acceptance unverified)
Contract: xl_rung_worker
Acceptance: The same contract extllm names as XL7: read a plan rung whose spec and KAT resolve entirely to U sources, run sampler then judge then bank through ES3, file the GREEN candidate on the pm intake plane; rungs citing unreleased source SKIPPED by name; attempted, GREEN, RED and SKIPPED partition sums [@llmonkeys]
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES5 — Sampler tiers as data
Prerequisites: ES3 (acceptance unverified)
Contract: af_sampler_tier
Acceptance: The same contract autodev names as AD11: local no-float, external free through the warden, Claude for judged work, selected per task class by a conf row; neg-control: the free tier sees only U bytes and the Claude tier's output never enters the corpus
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES6 — Best-of-N against the verifier
Prerequisites: ES5 (acceptance unverified)
Contract: fg_best_of_n
Acceptance: The same contract coding names as CD2, extllm as XL5 and autodev as AD12: N candidates through the byte-exact judge, first GREEN kept, NONE reported when none is GREEN, pass-at-N monotone in N on the mini-pack [@llmonkeys]
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES7 — GPU offload through the sovereign path
Prerequisites: ES9 (acceptance unverified)
Contract: gpul_offload_layer
Acceptance: The same contract llm names as LM9, with the operator's 2026-09-02 constraint made explicit: the no-float Q4_K forward on the RTX 5080 reached through the /dev/dxg path the estate already enumerates (R0 GREEN), the kernel emitted by our own toolchain -- never a C daemon, never libcuda, never a Python runtime. Done-rule: a staged 7B Q4_K_M GGUF decodes on the laptop at a PRE-DECLARED floor beside the llama.cpp oracle number on the same host and file (ES9), with per-layer activations bit-identical to the CPU path. The 2026-08-01 measurement (362 GB/s DRAM-resident, 42 tok/s projected at 14B) is the bar, never a claim
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES8 — KV cache and fused dequant GEMM
Prerequisites: None declared; this does not establish execution eligibility.
Contract: kv_paged_attn
Acceptance: The same contracts llm names as LM3 and LM4, taken together here because the seat is unusable without both: cached K and V per layer so decode stops recomputing, token-for-token bit-identical to the uncached path; and a Marlin-class fused kernel that keeps 4-bit weights quantized in the hot loop [@marlin], bit-identical to the Q4_K dot and faster on the same bench
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES9 — Local seat beside the oracle: a bench receipt
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lh_bench_receipt
Acceptance: A .bench receipt (the lang domain's mechanism, read by nx_bench_receipt_lib) written by a measuring organ: host, model sha256, thread count, decode and prefill tok/s min and median for OUR seat and for llama.cpp on the SAME GGUF and host, two runs agreeing; llama.cpp is installed in its native language as the comparator only [@llamacpp]; the page renders the receipt and a stale one abstains
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES10 — Laptop replica on the mesh
Prerequisites: ES7 (acceptance unverified)
Contract: lb_remote_replica
Acceptance: The same contract workermesh names as R3: the laptop GPU seat joins as an endpoint row, the NAS office and the seat API route to it through the balancer and skip it when it drops; the routing log names the replica per request
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES11 — Claude residue classifier
Prerequisites: ES1 (acceptance unverified)
Contract: sm_residue
Acceptance: Per session, from the record, frames classified mechanical (tool results, authored code the maker could have produced, re-reads) versus reasoning (diagnosis, design, judgment), published as a permil per session and a 30-day floor; the 2026-07-21 hand measurement (92.9 mechanical, 7.1 reasoning) is the calibration and the gate proves a synthetic all-mechanical session reads 1000 and an all-prose one reads 0
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES12 — Forge authoring past the zero floor
Prerequisites: ES6 (acceptance unverified)
Contract: fe_author_organ
Acceptance: The same contract team names as R1: the local forge cascade authors a novel organ that compiles, runs and passes its declared gate; nx_forge_local_bench moves from 0 of 3 by a PRE-DECLARED floor that ratchets
Authored effort: 2. Executor kind: Local model. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES13 — Lawful distillation harvest
Prerequisites: ES4 (acceptance unverified)
Contract: xl_distill_corpus
Acceptance: The same contract extllm names as XL9 and autodev as AD19: with every external sampler disabled the verified ledger must still strictly grow; external output enters only as a candidate judged by our verifier, provenance per row, and only where the terms row reads outputs_train_ours YES [@groqsa]; never from ox-alpha [@stealtheula] and never from Claude [@anthropiccomm]
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES14 — Instruction SFT over the integer LM
Prerequisites: ES13 (acceptance unverified)
Contract: sft_run
Acceptance: The same contract modelwright names as R0: supervised fine-tuning over the integer LM on the forge ledger and the lawful harvest, bit-exact reproducible on a second CPU, held-out exact-match beating the base by a pre-declared margin
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES15 — Retire Claude by rung class
Prerequisites: ES3 (acceptance unverified), ES14 (acceptance unverified)
Contract: lg_retire_class
Acceptance: The gap registry's open gaps are the test suite: when the sovereign seat passes a gap's declared measure over N held-out tasks, ES3 stops routing that class to the frontier seat, the registry marks it RESOLVED, and this page prints classes retired with the date; neg-control: a class passed on fewer than N tasks stays LLM-DEPENDENT
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES16 — Engine class routing as data
Prerequisites: ES3 (acceptance unverified)
Contract: ec_route_class
Acceptance: The dispatcher reads knowledge/engine_classes.conf (task class, clearance, engine order, judge, token ceiling) so neither a seat nor the operator decides per task; a task with no class row refuses by name rather than defaulting to the frontier seat; neg-control: a C-class row that lists an external engine is refused at load
Authored effort: 0.5. Executor kind: Data and organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES17 — Token pre-flight advisory in the tool path
Prerequisites: ES11 (acceptance unverified)
Contract: tg_advise
Acceptance: A laptop PreToolUse organ, sibling of nx_memnew and nx_organnew, that sees a Read or grep about to land, sizes the subject, and names the digest verb that answers the same question in fewer bytes (nx_fs size or lines, gv_last_line, the claim marker before the out file, nx_seat boot); advisory only, never blocking, silent under a declared floor; gate: a 3 KB fixture read draws the advisory, a 400 B one does not, and every advisory names a verb that exists
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES18 — Tokens per closed rung as a ratchet with a quality floor
Prerequisites: ES1 (acceptance unverified)
Contract: st_ratchet
Acceptance: nx_seat shift prints the delta of tokens per closed rung against the previous window with the gate GREEN rate and referee grade beside it; the ratchet reads RED when tokens rise, and RED when tokens fall while the grade falls with them, so a saving that made the work worse cannot read as progress; neg-control: a window with zero closed rungs reads UNMEASURED, never a win. Scope clarification 2026-09-07: the intended optimization is quality-gated TOTAL COST PER VERIFIED RESULT, not frontier-seat token reduction alone. Publish local and remote input/output/cache tokens and context volume, compute and external spend, retries, review effort, elapsed time, autonomous completions, interventions, defect recurrence and recovery cost with the denominator and accounting coverage. Missing costs remain UNMEASURED; zero verified results cannot report a saving. Compare matched task classes and quality floors so shifting work or retries to another engine never manufactures improvement.
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES19 — Digest, never dump: verdict verbs on the organs seats read most
Prerequisites: ES11 (acceptance unverified), ES17 (acceptance unverified)
Contract: dg_verdict_line
Acceptance: The ten organs to which the residue verb attributes the most mechanical bytes (published as a list, re-measured each beat) each gain a verb that returns one verdict line with its envelope, and the shift page prints mechanical permil per session; done when the 7-day mechanical permil falls below the 40-day baseline of 668 with the grade floor held
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES20 — Dispatch ledger preflight and fail-cheap escalation
Prerequisites: ES3 (acceptance unverified), ES16 (acceptance unverified)
Contract: ed_ledger_preflight
Acceptance: Defects filed 1788482414 and MEASURED in the shipped 42246 B organ: ed_ledger_row returns -1 when sys_openat_append fails and all TEN call sites discard it (corpus_complete=1), so an absent state dir loses the audit row ES0's local column is built from while the dispatch still reports a verdict; and the local -2 path at line 580 counts the seat as reached, falls through, and the escalation row at line 649 records every engine below the seat failed the judge, which is false when the seat never answered. ES3 proves the ledger path appendable BEFORE the first engine runs and refuses by name otherwise, and an engine that produced no answer is recorded UNREACHABLE and stops the ladder rather than escalating to the rented seat. Neg-controls: a read-only state dir refuses and buys zero tokens; a local seat returning a non-JSON body reads UNREACHABLE and never reaches the frontier seat; a local seat that answers and fails the judge still escalates normally, so the fix cannot disarm the ladder; and a ledger write that fails mid-run turns the verdict UNMEASURED rather than GREEN
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES21 — Goal mapper: the estate maps an operator goal onto the boards from data, never a frontier fan-out
Prerequisites: ES0 (acceptance unverified)
Contract: gm_run
Acceptance: nx_goalmap <domains-csv> <word>... prints ONE capped JSON digest (budget 8192 B declared in the output, clipped=1 announced when bound): per domain the rung rows whose title, done-rule or symbol carry the words with score = DISTINCT words matched (a count, never a threshold), status derived from the matrix (present symbol = PRESENT, _ABSENT_ watch = OPEN) and from knowledge/store/accept- (REJECT naming dom:sym = PRESENT-REJECTED, ACCEPT = ACCEPTED), the log ledger count and last epoch per rung, the matrix watch rows the words match as gaps with SOURCE/BUILT/PROMOTED probed at the three roots, and a dependency order over the matched rungs (Kahn over deps, cycles announced); a duplicate rung id is REFUSED by name. Done when nx_goalmap_gate is GREEN in-process on fixture boards with planted controls (operator REJECT flips status, duplicate id refused, no-match returns empty not a guess, 300-rung scale stays inside the budget with the count still full, unreadable domain returns NO-DOMAIN), the organ is promoted, registered and callable on the MCP surface, and nx_seat gains a map verb that delegates to gm_run so the seat boot digest and the goal map are one organ; neg-control: a word that matches nothing yields rungs_matched=0 and an empty order, never an inferred rung
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES22 — The seat's only surface is the estate: a PreToolUse interlock names the estate verb for every harness shell the seat reaches for
Prerequisites: ES17 (acceptance unverified)
Contract: tg_shell_interlock
Acceptance: OPERATOR 2026-09-05, verbatim: 'i also want claude especially the fable 5.1 model you are to stop using its own tools when it loads and to use these and nishi estate only and if there is a gap to build into the nishi estate from the first byte, no more ps1 and python and shell and all the other bullshit'. Today the law is prose in CLAUDE.md and a feedback memory; the estate has measured what happens to an invariant that depends on a seat remembering (nx_memnew: the same doctrine written 4x while the organ sat one call away). Done when a laptop-local PreToolUse organ (sibling of nx_memnew and nx_organnew, wired in settings.json, advisory never blocking -- a pre-flight that can refuse will be disabled) fires on every Bash and PowerShell tool call a seat attempts and answers with the sovereign verb that does the same work (nx_fs for cat/head/sed, nx_txtscan for grep, nx_filehash for sha256sum, nx_job_run for a poll loop, nx_goalmap for a fan-out) or, when none exists, prints GAP and the engineshift rung to declare; the one sanctioned launcher (wsl -e _offc/<organ>.elf for memory-plane organs) is allow-listed by path; the gate plants a Bash call and a PowerShell call and proves both draw the advisory with a verb that exists, plus the allow-listed launcher draws none; neg-control: an unknown command draws GAP, never a guessed verb. Measured basis: 2026-09-05 mapping cost 5,713,788 subagent tokens across two fan-outs before nx_goalmap did it in one job
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES23 — The goal mapper derives its sizes and refuses nothing silently
Prerequisites: ES21 (acceptance unverified)
Contract: gm_outbuf
Acceptance: nx_goalmap_lib sizes rung and matrix records from a count over the file just read, the CLI sizes the words array from argc, and the output buffer is gm_outbuf(domains) = the row budget plus one measured scaffold reserve per domain plus the tail, so the digest can never grow past its buffer; the caps GM_MAXWORDS, GM_MAXRUNG, GM_MAXMAT and GM_MAXDOM are deleted; done-rule: nx_goalmap_gate carries a multi-domain overflow tooth (four copies of the 300-rung scale board, content clipped, out_bytes above the row budget and at or under gm_outbuf, JSON closed, clipped announced) and a scaffold tooth that measures one domain's scaffolding against GM_DOM_RESERVE from a real emit, and the 8-board 16-word query that crashed the promoted binary (debt 1788626163) answers
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES24 — The dispatcher names the stage that failed and the local seat listens on the estate host
Prerequisites: ES3 (acceptance unverified)
Contract: ed_noreply
Acceptance: nx_engine_dispatch returns NO-REPLY when the socket accepted and the request was written but zero bytes came back (a listener that is not a seat), distinct from UNREACHABLE (no connect) and ANSWERED-UNPARSEABLE (bytes that are not a /gen reply), with its own ledger status; and nx_nofloat_serve (BUILT-UNPROMOTED 233189 B on 2026-09-05) is deployed on the estate host so a debt-triage dispatch from a seat reaches a seat instead of an empty port; done-rule: nx_engine_dispatch_gate gains a mute fixture seat (accepts a POST /gen and closes with no body) whose tooth reads status=NO-REPLY and never UNPARSEABLE, the ledger partition rises to 15 and sums, the gate is PROMOTED and REGISTERED (it was BUILT-UNPROMOTED and on no roster), and a real dispatch of knowledge/status/dxr_grade_task.conf on the NAS reads ANSWERED with a judge verdict
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES27 — A one-step solve is scored by its OUTCOME, never by its step count alone: a badly evaluated one-step ranks below a rigorous forty-step (operator 2026-09-06)
Prerequisites: ES26 (acceptance unverified)
Contract: ss_quality_axis
Acceptance: Done-rule: nx_stepsolve_lib carries a QUALITY axis per signature from the journal's outcome column (failure permil over the ritual's own occurrences) and from malformed rows, the spine and stamp publish quality beside explained, the worklist orders by RISK = support x failure permil so a common bad one-step outranks a rare forty-step, the gate plants a one-step ritual that fails and a forty-step ritual that passes and asserts the ranking, and the compare gauge renders both axes. Scope clarification 2026-09-07: score sovereign operational work by correctness, quality, failure recovery and verified final result alongside efficiency. A one-call build/publish or AI delegation that lacks the expected artifact and acceptance evidence remains unaccepted; low step count cannot upgrade an unmeasured result. A quality acceptance result must include whether the outcome was independently verified and reproducible, whether defects recur, and whether recovery succeeds. Carry those outcomes into the total-cost ruler in ES18; task completion without independent evidence cannot become autonomous verified completion.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES26 — One-step solve: steps per common task mined from the action journal, ratcheted toward one with the reason declared
Prerequisites: ES19 (acceptance unverified)
Contract: al_steps
Acceptance: OPERATOR STANDING ORDER 2026-09-06: if a task can be solved in ONE step within logic it should be, and when it cannot the estate explains why two, and why three, and so on, from the most common tasks to the least, mining and evaluating this efficacy continuously. The ruler is a verb on the incumbent action-journal organ (nx_actlog, whose indexed miner already ranks recurring tool:verb bigrams and trigrams by exact support over the live 56 MB journal): every recurring n-gram is a task signature whose step count is its length, joined against knowledge/stepsolve.conf rows (signature, min_steps, reason, one_step_verb) -- a declared minimum with the reason it cannot be fewer (a true dependency such as promote must see the sha only a finished build produces, which nx_organ_ship composes into one call) or the composed verb that makes it one. Published: frequency-weighted one_step permil, two_step permil, three_plus permil with denominators; every signature without a conf row named UNDECLARED (never assumed one-step), most common first, as the worklist; a spine row per beat and a gauge stamp the CE9 gauge_pass renders. ACCEPT RULE: the one_step permil over the top-N most common signatures is published beside its denominator and may not fall beat over beat; every multi-step signature carries a declared reason or reads UNDECLARED; the neg-control proves an undeclared signature never reads as one-step and a planted 4-step ritual with a declared composed verb reads gap=3 naming that verb. ARCHITECTURE: the remedy for a multi-step ritual is a composed verb on the CANONICAL organ of that task (the common-task registry names it), never a new tiny tool -- no toilets in the living room. Scope clarification 2026-09-07: common tasks include grep/search/read/write/build/test/site emission/publication/recovery/AI, and the operator wants the estate to improve all of them. The backbone may continue to plan and review with the frontier assistant while verified local and external engines receive bounded tasks; delegation requires a reachable named engine, a permitted task class and an outcome receipt.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES25 — The promote ruler has a referee, and a subject that really dies
Prerequisites: ES24 (acceptance unverified)
Contract: nx_behaveprobe_gate
Acceptance: nx_sigfixture (registered) dies by a named signal on itself or exits a named code; nx_behaveprobe gains a self direction (live against itself, no stage slot) and SIGNALLED and HARNESS evidence grades; nx_behaveprobe_gate forks the LIVE probe against the fixture and the fixture directly through tr_run_capture, asserting 143 on SIGTERM, 7 on the control arm, never rc 0, SIGNALLED named, and the bite pair -- GREEN on the deployed binaries and rostered
Authored effort: 1.5. Executor kind: seat. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES28 — A rung contract answers with its incumbents and the record's rejections before a seat builds anything
Prerequisites: ES21 (acceptance unverified), ES23 (acceptance unverified)
Contract: rk_incumbents
Acceptance: OPERATOR 2026-09-14 on the search R0 review: a seat found nx_dr_densejudge, embed_v1.bin and the DR-13 recorded rejection of learned fusion over PPMI by glob and header reads AFTER a prior seat had rebuilt the rejected design. The estate must answer a rung's contract itself: for every open rung, rk_incumbents matches the contract terms (symbol, title, note) against registered organ names and grammars, source headers in runtime and _hdl_build, and data assets under knowledge/index, and reads header prose for a recorded measured rejection (rejection, dead end, REFUTED, measured ceiling) on those terms; nx_compare_rank prints INCUMBENTS and PRIOR-REJECTIONS on the rung line and plan_pass renders them under the rung. Accept rule declared before the build: on search.plan R0 it names nx_dr_densejudge, embed_v1.bin and the DR-13 rejection with no seat input; a neg-control rung whose terms match nothing prints NONE, never a guess; coverage envelope printed (files scanned, corpus_complete)
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES29 — A launched job can be cancelled from the surface that launched it: nx_job_run gains a cancel verb that finds the job by its out-file, verifies the pid's cmdline is the job it launched, sends TERM then KILL after a named grace, and journals the cancellation beside the launch
Prerequisites: None declared; this does not establish execution eligibility.
Contract: jr_cancel
Acceptance: MEASURED 2026-09-15: two cross-encoder one-shots launched 09-14 through nx_job_run on the PRE-FIX f32 bricks (10x slower than the hardware twins shipped the same day) held the box at load 27 on 8 cpus for over 30 hours with 0 bytes of output, and admission correctly refused every build -- including the builds that would have replaced them. No sovereign surface could stop them: nx_job_run has no cancel verb, nx_aw_hostctl is not mintable (unregistered tool in allow list), nx_ctxtop refuses to walk /proc above load 800, and knowledge/resgov.conf's own law forbids a recycle row for a one-shot (never terminate what nothing will restart). A RUNAWAY JOB THAT CANNOT BE CANCELLED IS A RESOURCE INCIDENT WITH NO REMEDY (§29 already says so for long sweeps). Done-rule: nx_job_run cancel <out-file> on a planted sleep job terminates it and journals `CANCELLED pid= elf= out=`; a cancel naming an out-file no job wrote is REFUSED-ABSENT; a cancel whose pid cmdline does not match the launch record is REFUSED-MISMATCH (never kills a stranger); gate plants all three
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES30 — Every job carries an end-to-end budget and the launcher enforces it: nx_job_run records an ABSOLUTE deadline (epoch) and an optional core-seconds cap per launch in jobrun.jrnl, a sweep verb cancels any live job past its deadline through jc_cancel, journals BUDGET-EXCEEDED, and a re-launch of a resumed job inherits the REMAINING budget, never the original
Prerequisites: ES29 (acceptance unverified)
Contract: jr_budget
Acceptance: Done-rule: a planted sleep job launched with deadline=now+2s is cancelled by `nx_job_run sweep` within one grace and journaled BUDGET-EXCEEDED with verified_stopped=1; a job inside its deadline is untouched (neg-control); a resumed launch declaring resume=<out-file> receives remaining = deadline - now, refused when non-positive; the gate plants all three. September 2026 frame: time in the queue and offline count and a restart never re-grants the full budget [@zylosdeadline26]
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES31 — Failure classes and budgeted recovery: a finished job's exit is classified (refused-admission, over-budget, crashed, rc-nonzero, ok) from its journal and out-file, a declared recovery per class (requeue with backoff once, cancel-and-report, nothing) runs under an explicit recovery budget, and the recovered run is verified against the original accept rule before it counts
Prerequisites: ES30 (acceptance unverified)
Contract: jr_recover
Acceptance: Done-rule: on a planted crash the recovery requeues exactly once and journals RECOVERED with the verifying probe's result; on a second crash it stops and journals RECOVERY-BUDGET-EXHAUSTED; a refused-admission class requeues through nx_buildq and never re-launches directly; the gate plants all three and a neg-control where the recovered run fails its accept rule and is NOT counted. May 2026 frame: failure signals to classes to budgeted, verified recovery [@selfheal26]
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES32 — No job unmonitored: the boards render the launcher's journal as a jobs table (launched, running, done, cancelled, over-budget, recovered) with age, budget remaining and the out-file, so a stuck or runaway job is a visible row on /compare/engineshift and never a discovery by ps
Prerequisites: ES29 (acceptance unverified)
Contract: jobs_pass
Acceptance: Done-rule: jobs_pass in nx_swcompare_lib reads knowledge/status/jobrun.jrnl and /proc liveness through the one cancel lib's jc_verify, renders every job launched in the last 7 days with its state derived from the journal (launch without cancel and pid alive = RUNNING; pid gone with no cancel row = FINISHED; cancel row = its outcome), counts them in api.json, and a gate on a planted journal proves each state; the two 2026-09-15 runaways would have read RUNNING for 30 hours on the page [@selfheal26]
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
ES33 — The 1-2-3 step: mined call sequences become seeded plans, plans become agents
Prerequisites: ES26 (acceptance unverified), ES21 (acceptance unverified)
Contract: wm_attribute
Acceptance: DONE-RULE PRE-DECLARED: a miner over the seat's actlog frames (composing the nx_actlog n-gram mining and nx_workflowmine) proposes plan rows for every call sequence that recurs across sessions, each proposal a plan seed the seat runs with ONE nx_plan_run call; a proposal that runs GREEN twice is assigned an agent row (a clock or roster row) and the rung it serves declares both in its treatment row (the wf and agent fields); the receipt prints proposals, adopted plans and calls saved per session, and a session whose recurring sequences are all covered reads COVERED. First composition landed 2026-09-16: the plan-boardship seeds (rank, scoped regen, page verify) published a board in one nx_plan_run call, proven on automation; nx_workflowmine and nx_harnessmine are REGISTERED-DARK today, so the miner is the open half
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence engineshift writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

ES0 Engine-shift scoreboard · cell PRESENT · gate NO-GATE-DECLARED

Contract	`st_shift` · executor Organ · 0 u · stands on nothing
Definition of done	LANDED 2026-07-20: claude versus local seat classes and tokens per closed rung from token_efficiency.log and ws_sync.jrnl, hard-capped at 4 KB
Matrix cell	Engine-shift scoreboard: claude versus local seat classes, tokens per closed rung · `runtime/_hdl_build/nx_seat.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_seat`; declare `nx_seat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 lesson a laptop-host organ reads SOURCE-ONLY on the NAS catalogue and that is correct, not a gap: two hosts means two ladders, so the plan row names which host owns the run 2026-09-02 lesson a laptop organ that can never run on the NAS still owes the NAS its SOURCE: the compare watch reads symbol presence from buildroot, so an unpushed laptop-only organ reads as an open contract forever 2026-10-01 measure 2026-10-01 ladder census, board-level row anchored on ES0. BEFORE: nx_ladder targets=1 best_in_class=0 rungs=34 placed=5 unplaced=29 verdict=PARTIAL (NO-BEST-IN-CLASS) and nx_barfresh SB-WFCTL UNATTESTED verdict=STALE under cur=2026-10, so nx_compare_rank refused the board. AFTER: nx_ladder targets=5 best_in_class=2 frontier=3 placed=34 unplaced=0 substrate=11 arm=10 contender=13 superseded=0 verdict=LADDERED; nx_barfresh bars=5 fresh=1 attested=4 stale=0 unattested=0 verdict=FRESH; nx_compare_rank engineshift was not refused, wrote engineshift.rank (13523 bytes, finish=6, sha256 47cb50bc) and published its row; it still labels TREATMENT NO-TREATMENT (34 rungs undeclared) and unmapped=10 2026-10-01 land 2026-10-01: four bars earned from listings fetched and read today -- SB-ROUTE (2026-09), SB-LOCALINF (2026-10), SB-TOKEFF (2026-09), SB-DISTILL (2026-09) -- with targets T-BIC-ROUTE and T-BIC-LOCAL (best in class) and T-FR-TOKEFF and T-FR-DISTILL (frontier); 29 rungrole rows place ES0 to ES28 (ROUTE 12, LOCAL 4, DISTILL 4, TOKEFF 9); SB-WFCTL re-attested for October from the publisher's index and the empty arXiv cs.DC October listing; nine refs mirrored by nx_research_fetch into knowledge/fetched and pinned, nx_filehash equal to the fetcher's provenance digest on all nine. The page is NOT republished by this seat: a scoped regen of engineshift is owed 2026-10-01 lesson THE API WAS THROTTLED AND THE SEARCH PAGE WAS NOT: export.arxiv.org answered 429 four times for the estate address and the attest organ's arXiv fan-out read UNREACHABLE, while the arxiv.org abstract-search page ordered by announcement date answered 200 through the same fetcher; it is a dated listing (announced month and submitted day per entry) and abstracts are read from the mirrored HTML by offset. Two cautions measured: a search expression the page cannot parse saves as a 16729-byte empty search form with status 200 (cmp_engineshift_arxivdistill202610.html, rejected and not cited) -- count arxiv-result before reading -- and an OR query drags in homonyms (expert routing inside mixture-of-experts models, excitons, droplet transport), so the on-subject entries are named one by one and never taken as the top of the list 2026-10-01 queue OWED after this ladder: (1) triangulation -- SB-ROUTE, SB-TOKEFF and SB-DISTILL stand on September preprints from separate author groups plus vendor pages and carry no peer-reviewed witness; add one per bar when venue versions appear, and re-read the listings once arXiv announces October entries (none existed on 2026-10-01); (2) the attest organ prints CLASSES domain=engineshift UNDECLARED: a class row for engineshift in knowledge/subject_classes.conf (cs.AI, cs.CL, cs.LG, cs.DC, cs.PF, cs.OS) would let it exclude homonyms itself; that file is outside this seat's edit scope; (3) SB-WFCTL's own ref is one article with no listing grammar, so the organ reads ATTEST-UNATTESTABLE every month and the row is attested by hand from the publisher's index; a dated source row for that index in research_sources.conf closes it; (4) treat rows for the 34 rungs; (5) the arXiv API abstention stands until the address is no longer throttled

ES1 Meter beat, the scoreboard's producer · cell LANDED · gate NO-GATE-DECLARED

Contract	`sm_beat` · executor Organ · 1 u · stands on nothing
Definition of done	A laptop organ (the transcripts live only there; the DM1 capture beat is the precedent) that walks every session jsonl, sums output, cache-read and cache-creation tokens per UTC day and seat class from the assistant usage fields, and appends ONE nx_seat meter row per day and class, idempotent by a day marker; SessionStart prints the 7-day delta beside the boot digest. Gate: a fixture of N sessions sums to a hand count, a second run appends nothing, a truncated jsonl is counted PARTIAL and never as zero. Done when the log carries a row for every day since 2026-08-05
Matrix cell	METER BEAT: session usage mined to the scoreboard with no seat · `runtime/_hdl_build/nx_seat_meter_beat.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_seat_meter_beat`; declare `nx_seat_meter_beat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_seat_meter_beat shipped on the laptop (_offc, SessionStart hook, gate 28 of 28 bite-proven) and backfilled 56 rows: nx_seat shift reads rows 61, out 139.3M, cread 66.4B; NAS twin buildroot/runtime/_hdl_build/nx_seat_meter_beat.nx sha b78305886f2a 56340 B byte-identical to the laptop

ES2 Tier declared, Claude column priced · cell WATCHING · gate NO-GATE-DECLARED

Contract	`xl_tier_declared` · executor Data and organ · 0.5 u · stands on ES1
Definition of done	The operator declares the Anthropic account tier row in extllm_terms.conf (the UNDECLARED row refuses today [anthropiccomm]); the scoreboard multiplies tokens by that tier's published rates read from a conf row and prints spend per closed rung beside tokens per closed rung; neg-control: with no tier declared the price column reads UNDECLARED, never zero
Matrix cell	TIER: the Anthropic account tier declared and the Claude column priced · `runtime/nx_extllm.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_extllm`; declare `nx_extllm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 queue xl_tier_declared waits on the operator's Anthropic tier row; the OpenRouter key at the /tmp path returns 401 and needs rotation into nx_vault

ES3 Dispatcher: the cheapest sufficient engine · cell LANDED · gate NO-GATE-DECLARED

Contract	`ed_dispatch` · executor Organ · 2 u · stands on ES1
Definition of done	ONE verb takes a task file (spec, KAT, declared class U or C, judge) and tries engines in ladder order -- an existing deterministic organ found through nx_capsearch, the sovereign no-float seat, an external free worker through xl_call, the rented frontier seat -- stopping at the first whose output the declared judge passes, and returns verdict, engine, tokens and bytes; every dispatch appends a shift-ledger row so ES0's local column moves. Neg-controls: a C task never reaches an external worker; a U task with a green local result never reaches Claude; an engine whose terms row reads UNKNOWN is skipped by name
Matrix cell	DISPATCH: one verb sends a task file to the cheapest engine whose terms permit its class and returns the judge's verdict with the engine named · `runtime/nx_engine_dispatch.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_engine_dispatch`; declare `nx_engine_dispatch TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_engine_dispatch ed_dispatch shipped on the laptop (gate 21 of 21, readiness measured by probe, bounded reap); the LOCAL column moved 0 to 1 for the first time since 2026-07-20 through the live nofloat seat; NAS twin buildroot/runtime/nx_engine_dispatch.nx 35215 B reads SOURCE-ONLY to nx_catalog by contract, the seat it drives lives on the laptop 2026-09-05 measure first grading dispatch from a seat, 2026-09-05 (task knowledge/status/dxr_grade_task.conf, tclass debt-triage, judge contains NO, max_new 8): ENGINE local status=ANSWERED-UNPARSEABLE http=0, external SKIPPED-by-class-order, verdict NEEDS-FRONTIER -- the ladder escalated correctly, but http=0 is a socket that never answered, and nx_services lists no engine on 127.0.0.1:8032 on this host, so the true state was UNREACHABLE and the status word said ANSWERED; a message that names the wrong stage costs the reader the investigation it was written to save (the dispatcher's own header promises UNOBSERVABLE for an unreadable answer and this is a different condition again); owed: a NOT-LISTENING status distinct from UNPARSEABLE, and the local seat actually serving on the estate host before any review work can be farmed to it

ES4 Rung worker loop · cell WATCHING · gate NO-GATE-DECLARED

Contract	`xl_rung_worker` · executor Organ · 2 u · stands on ES3
Definition of done	The same contract extllm names as XL7: read a plan rung whose spec and KAT resolve entirely to U sources, run sampler then judge then bank through ES3, file the GREEN candidate on the pm intake plane; rungs citing unreleased source SKIPPED by name; attempted, GREEN, RED and SKIPPED partition sums [llmonkeys]
Matrix cell	WORKER: rung worker loop over U-cleared plan rungs · `runtime/nx_extllm.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_extllm`; declare `nx_extllm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES5 Sampler tiers as data · cell WATCHING · gate NO-GATE-DECLARED

Contract	`af_sampler_tier` · executor Organ · 1.5 u · stands on ES3
Definition of done	The same contract autodev names as AD11: local no-float, external free through the warden, Claude for judged work, selected per task class by a conf row; neg-control: the free tier sees only U bytes and the Claude tier's output never enters the corpus
Matrix cell	SAMPLER: sampler tiers as data -- local no-float, external free, Claude -- selected per task class · `runtime/nx_autofix_auto.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_autofix_auto`; declare `nx_autofix_auto TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES6 Best-of-N against the verifier · cell WATCHING · gate NO-GATE-DECLARED

Contract	`fg_best_of_n` · executor Organ · 1 u · stands on ES5
Definition of done	The same contract coding names as CD2, extllm as XL5 and autodev as AD12: N candidates through the byte-exact judge, first GREEN kept, NONE reported when none is GREEN, pass-at-N monotone in N on the mini-pack [llmonkeys]
Matrix cell	BEST-OF-N against the byte-exact verifier with the local or free tier as the sampler · `runtime/nx_forge.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_forge`; declare `nx_forge TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES7 GPU offload through the sovereign path · cell WATCHING · gate NO-GATE-DECLARED

Contract	`gpul_offload_layer` · executor Organ · 4 u · stands on ES9
Definition of done	The same contract llm names as LM9, with the operator's 2026-09-02 constraint made explicit: the no-float Q4_K forward on the RTX 5080 reached through the /dev/dxg path the estate already enumerates (R0 GREEN), the kernel emitted by our own toolchain -- never a C daemon, never libcuda, never a Python runtime. Done-rule: a staged 7B Q4_K_M GGUF decodes on the laptop at a PRE-DECLARED floor beside the llama.cpp oracle number on the same host and file (ES9), with per-layer activations bit-identical to the CPU path. The 2026-08-01 measurement (362 GB/s DRAM-resident, 42 tok/s projected at 14B) is the bar, never a claim
Matrix cell	GPU offload behind the bit-exact contract through the sovereign dxg path · `runtime/nx_gpu_llm.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_gpu_llm`; declare `nx_gpu_llm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES8 KV cache and fused dequant GEMM · cell WATCHING · gate NO-GATE-DECLARED

Contract	`kv_paged_attn` · executor Organ · 4 u · stands on nothing
Definition of done	The same contracts llm names as LM3 and LM4, taken together here because the seat is unusable without both: cached K and V per layer so decode stops recomputing, token-for-token bit-identical to the uncached path; and a Marlin-class fused kernel that keeps 4-bit weights quantized in the hot loop [marlin], bit-identical to the Q4_K dot and faster on the same bench
Matrix cell	KV cache so local decode stops recomputing · `runtime/nx_kvcache.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_kvcache`; declare `nx_kvcache TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 measure Qwen2.5-Coder-7B Q4_K_M on the laptop: the dequant-once i32 cache expands 7.6B weights to about 30 GB and was killed at 12 GB on a 15 GB host; mq_fused_dequant_gemm (LM4) is the remedy, debt 1788362867 2026-09-02 land LM4 mq_fused_dequant_gemm SHIPPED on the laptop: runtime/nx_nofloat_q4k.nx keeps the Q4_K weights in the file map and dots them with nx_q4k_dot_simd_lib (extracted from nx_q4k_dot_simd; the bench organ rebuilt byte-identical to its banked sha 6814125d); nx_nofloat_serve gains route q4k (argv[4], decode mode 3, model file-mapped, no i32 or i16 layer cache, i32 or i8 requests refused by name); the attention core is ONE shared function for the i8 and q4k decoders (greedy text byte-identical before and after on the 0.5B); nx_nofloat_q4k_gate 17 of 17 GREEN with two neg-controls; every source landed on the NAS build tree by anchored CAS edits; the llm and engineshift matrix rows now watch runtime/nx_nofloat_q4k.nx instead of the never-written nx_marlin.nx 2026-09-02 measure Qwen2.5-Coder-7B Q4_K_M NOW SERVES ON THE 16 GB LAPTOP: init 24 s, VmRSS 8.32 GB after 32 tokens where the dequant-once route was SIGKILLED at 12 GB; 168 of 196 projections read in place (3.12 GB of file map) and 28 Q6_K rows fall back to the i16 cache (1.95 GB, counted and announced); greedy 32-token decode 1690 and 1868 ms per token over two runs with identical text, down from 3134 with the byte-at-a-time unpack, via a u64 nibble spread (2385) and the 6-bit scale folded into the i16 lanes so one horizontal sum serves a whole super-block. 1.5B: 428 and 506 ms per token at 2.27 GB RSS against the i16 route at 254 ms per token and 10.4 GB RSS, greedy text IDENTICAL; bench organ: the fused SIMD dot is bit-exact with the scalar Q4_K dot at 2.09x its speed, which is the LM4 done-rule 2026-09-02 lesson the i8 layer cache was never one byte per weight: nf_pack2 writes i16 lanes for vpmaddwd, so a 7B costs 13 GB of anonymous memory before any head or scratch and no cache hygiene could fit it; the fit came from reading the file map in place, and the remaining speed gap to the i16 route is the per-row unpack in scalar NishiLang (about 1.4 ops per weight), which names the next lang rung: a SIMD nibble-unpack intrinsic emitted by nx_cc 2026-09-02 queue still open under ES8 and llm LM3: prefill runs one token at a time; the 28 Q6_K rows want a fused Q6_K dot so nothing falls back; the i32 head (2.2 GB at 7B) wants an i8 head; the dispatcher seat on 8032 stays the 0.5B on the incumbent route (restored, init 17 s) until the 7B decodes under one second per token, at which point it becomes a second engine row for U-class code drafting 2026-09-02 measure WITH THE COMPILER-EMITTED UNPACK (lang LN28, __q4k_unpack32s, laptop compiler blessed a9480db0): 7B Q4_K_M greedy 32 tokens 1283 ms per token on the first run after init (page-cache faults on the 3.1 GB file map) and 819 ms per token warm, text identical to every earlier cut; 1.5B 546 then 413 ms per token. The kernel itself is 3.94x faster in isolation (nx_q4k_simd2_gate timing) but the serve moved less than that, so the per-token remainder is now outside the fused dot: per-route nanosecond accumulators are being added to /health so the next number is attributed, not guessed

ES9 Local seat beside the oracle: a bench receipt · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lh_bench_receipt` · executor Organ · 1 u · stands on nothing
Definition of done	A .bench receipt (the lang domain's mechanism, read by nx_bench_receipt_lib) written by a measuring organ: host, model sha256, thread count, decode and prefill tok/s min and median for OUR seat and for llama.cpp on the SAME GGUF and host, two runs agreeing; llama.cpp is installed in its native language as the comparator only [llamacpp]; the page renders the receipt and a stale one abstains
Matrix cell	BENCH: local seat beside the llama.cpp oracle on one GGUF and one host, as a .bench receipt · `runtime/nx_llm_h2h.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_llm_h2h`; declare `nx_llm_h2h TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES10 Laptop replica on the mesh · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lb_remote_replica` · executor Organ · 2 u · stands on ES7
Definition of done	The same contract workermesh names as R3: the laptop GPU seat joins as an endpoint row, the NAS office and the seat API route to it through the balancer and skip it when it drops; the routing log names the replica per request
Matrix cell	Remote replica: the laptop GPU seat joins the mesh as a live endpoint · `runtime/nx_mesh_lb.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mesh_lb`; declare `nx_mesh_lb TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES11 Claude residue classifier · cell LANDED · gate NO-GATE-DECLARED

Contract	`sm_residue` · executor Organ · 1.5 u · stands on ES1
Definition of done	Per session, from the record, frames classified mechanical (tool results, authored code the maker could have produced, re-reads) versus reasoning (diagnosis, design, judgment), published as a permil per session and a 30-day floor; the 2026-07-21 hand measurement (92.9 mechanical, 7.1 reasoning) is the calibration and the gate proves a synthetic all-mechanical session reads 1000 and an all-prose one reads 0
Matrix cell	RESIDUE: per-session classifier of mechanical versus reasoning bytes · `runtime/_hdl_build/nx_seat_meter_beat.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_seat_meter_beat`; declare `nx_seat_meter_beat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 measure residue over 40 days and 327.9 MB of transcripts: reasoning 56 permil, authored 245, mechanical 668 (nx_seat_meter_beat residue); the lever is the mechanical class

ES12 Forge authoring past the zero floor · cell WATCHING · gate NO-GATE-DECLARED

Contract	`fe_author_organ` · executor Local model · 2 u · stands on ES6
Definition of done	The same contract team names as R1: the local forge cascade authors a novel organ that compiles, runs and passes its declared gate; nx_forge_local_bench moves from 0 of 3 by a PRE-DECLARED floor that ratchets
Matrix cell	Forge authoring past the zero floor · `runtime/nx_forge_engine.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_forge_engine`; declare `nx_forge_engine TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES13 Lawful distillation harvest · cell WATCHING · gate NO-GATE-DECLARED

Contract	`xl_distill_corpus` · executor Organ · 1.5 u · stands on ES4
Definition of done	The same contract extllm names as XL9 and autodev as AD19: with every external sampler disabled the verified ledger must still strictly grow; external output enters only as a candidate judged by our verifier, provenance per row, and only where the terms row reads outputs_train_ours YES [groqsa]; never from ox-alpha [stealtheula] and never from Claude [anthropiccomm]
Matrix cell	Terms-gated distillation harvest into the sovereign corpus · `runtime/nx_extllm.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_extllm`; declare `nx_extllm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES14 Instruction SFT over the integer LM · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sft_run` · executor Organ · 2 u · stands on ES13
Definition of done	The same contract modelwright names as R0: supervised fine-tuning over the integer LM on the forge ledger and the lawful harvest, bit-exact reproducible on a second CPU, held-out exact-match beating the base by a pre-declared margin
Matrix cell	Instruction SFT over the integer LM · `runtime/nx_sft.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sft`; declare `nx_sft TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES15 Retire Claude by rung class · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lg_retire_class` · executor Organ · 1 u · stands on ES3, ES14
Definition of done	The gap registry's open gaps are the test suite: when the sovereign seat passes a gap's declared measure over N held-out tasks, ES3 stops routing that class to the frontier seat, the registry marks it RESOLVED, and this page prints classes retired with the date; neg-control: a class passed on fewer than N tasks stays LLM-DEPENDENT
Matrix cell	RETIRE: Claude retired on a rung class when the sovereign seat clears the gap registry's measure · `runtime/_hdl_build/nx_llm_gap_registry.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_llm_gap_registry`; declare `nx_llm_gap_registry TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES16 Engine class routing as data · cell LANDED · gate NO-GATE-DECLARED

Contract	`ec_route_class` · executor Data and organ · 0.5 u · stands on ES3
Definition of done	The dispatcher reads knowledge/engine_classes.conf (task class, clearance, engine order, judge, token ceiling) so neither a seat nor the operator decides per task; a task with no class row refuses by name rather than defaulting to the frontier seat; neg-control: a C-class row that lists an external engine is refused at load
Matrix cell	ROUTE AS DATA: the engine per task class is a conf row, not a seat's choice · `runtime/nx_engine_dispatch.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_engine_dispatch`; declare `nx_engine_dispatch TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 queue operator order 2026-09-02: token use minimised autonomously, no operator engagement, no quality loss; landed as ES16 to ES19 under M4 (version 1.5) and as standing law in the seat channel; ES16 recipe: engine_classes.conf rows read by ed_dispatch, an unclassed task refused by name 2026-09-02 land ec_route_class SHIPPED: nx_engine_dispatch reads knowledge/engine_classes.conf (class, clearance, engine order, max_new ceiling), a task names its class with tclass, an unclassed task is refused by name, a C row listing external is refused at load; gate 29 of 29 GREEN (8 new teeth incl. 4 neg-controls), laptop _offc installed byte-identical, NAS twin buildroot/runtime/nx_engine_dispatch.nx 42248 B, conf on both trees 2026-09-02 measure lang tooling that was REGISTERED-DARK ran today through nx_job_run: nx_lsp_gate 19 of 19 GREEN, nx_pkg_gate 19 of 19 GREEN, nx_gdbstub_gate SKIP (stock gdb absent on the NAS, a precondition not a defect); roster trial green_or_skip 3 of 3, admit launched 2026-09-02 measure re-rank after the leg: engineshift rungs 20 done 7 (was 4) with ES16 ES17 ES18 counted done; lang done-but-dark 8 to 6 (LN11 and LR3 now on an execution surface) 2026-09-05 measure farm-out state for review and grading work, read 2026-09-05 by the DanceXR evaluation seat: engine_classes.conf carries five class rows (estate-internal, debt-triage, code-summary, frontier-only all C local; public-lookup the one U row local,external), every ceiling inherited at 96 new tokens from NSV_MAXNEW; no row names the worker the operator calls ox alpha, and adding one is an operator edit to this file by design (a task naming no row is refused by name); nx_pm_intake is capability-denied to the ce2lane and storm caps, so a seat that finds work cannot file it into the intake without minting a cap through the mgmt API first -- the ranker is the one path that files intake rows on its own (PM filed=2 of top 3 on every rank run) 2026-09-05 queue the DanceXR census grading (37 vendor capability rows against the miner's 4) is a review-shaped task: below 96 tokens it can only be a per-row YES or NO classification, so the shape that fits the ladder today is one dispatch per row with judge contains, driven by a plan-run row set, not a document review; the first such dispatch is staged as knowledge/status/dxr_grade_task.conf (tclass debt-triage, judge contains NO) and its ledger row is the receipt

ES17 Token pre-flight advisory in the tool path · cell LANDED · gate NO-GATE-DECLARED

Contract	`tg_advise` · executor Organ · 1 u · stands on ES11
Definition of done	A laptop PreToolUse organ, sibling of nx_memnew and nx_organnew, that sees a Read or grep about to land, sizes the subject, and names the digest verb that answers the same question in fewer bytes (nx_fs size or lines, gv_last_line, the claim marker before the out file, nx_seat boot); advisory only, never blocking, silent under a declared floor; gate: a 3 KB fixture read draws the advisory, a 400 B one does not, and every advisory names a verb that exists
Matrix cell	TOKEN PRE-FLIGHT: the tool path names the cheaper read before the expensive one lands · `runtime/_hdl_build/nx_tokgate.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tokgate`; declare `nx_tokgate TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land tg_advise SHIPPED: nx_tokgate PreToolUse on Read and nx_fs read, floor from hooks/tokgate.conf (3072 B) with floor_src named in every message, bootstrap floor only when the conf is unreadable; gate 17 of 17 GREEN driven through real stdin payloads; hooked in settings.json; first live fire named nx_seat.nx at 165407 B as about 41351 tokens 2026-09-22 retract the pre-flight fired on nx_fs read _jobs/<id>.claim, the read its own remedy text names: an uncapped NAS read was convicted as over the floor because a laptop-local hook cannot stat a NAS path (operator 2026-09-22: fix these from the first byte up to the last byte) 2026-09-22 land nx_tokgate: tg_recommended_marker exempts the _jobs/<id>.claim class in CODE, spelled from the same constants the message is built from so recommendation and exemption cannot drift; tg_bounded reads DATA rows bounded 2026-09-22 lesson AN ADVISORY THAT FIRES ON THE ACTION IT RECOMMENDS IS NOISE BY CONSTRUCTION, AND NOISE IS HOW A PRE-FLIGHT GETS SWITCHED OFF; the exemption for a recommendation lives beside the recommendation in code, every other bounded class is a conf row, and an unreadable conf must never resurrect the contradiction (T15) 2026-09-22 queue GAP MEASURED 2026-09-22: nx_organ_ship cannot observe a stdin-driven organ. Its behaviour probe feeds argv only, so a hook organ answers an empty capture, the probe reads WEAK, no observation record is retained, and the review path is unreachable by construction (complete-successful-representative-probe-required, code 0). The NAS twin of nx_tokgate was therefore promoted through /api/promote with expect_sha256 on the gate-proven candidate (NAS gate 37/37 driven through real stdin payloads, loss record 3892c293 = the old remedy sentence now assembled from constants), named here rather than hidden. OWED: a --behavior-stdin <file> workload on nx_organ_ship and nx_behaveprobe so a stdin organ is probed with a real PreToolUse payload like its gate does; until then every hook organ ships through the primitives with its gate as the proof 2026-09-27 land 2026-09-27 Claude hook-noise repair is installed and verified through the actual configured laptop launcher. ES17 and ES22 now retain full per-event human explanations while emitting model guidance only on first occurrence and the configured recurrence; unchanged later occurrences emit zero bytes. Removed two inline cost alerts that asserted unsupported 96-percent cost and lossless compaction; daily usage collection and truncation warnings remain. Matched six-read replay: 3371 to 2268 hook-output bytes, a fixture result rather than billed-token or end-to-end ROI proof. Installed native regression gate passes 48/48 on the laptop and through the NAS management API. Source and binary copies are aligned with retained prior versions. Resource recovery and total journey savings remain unfinished. Evidence: knowledge/gates/claude-hook-noise-repair-20260927.json.

ES18 Tokens per closed rung as a ratchet with a quality floor · cell LANDED · gate NO-GATE-DECLARED

Contract	`st_ratchet` · executor Organ · 0.5 u · stands on ES1
Definition of done	nx_seat shift prints the delta of tokens per closed rung against the previous window with the gate GREEN rate and referee grade beside it; the ratchet reads RED when tokens rise, and RED when tokens fall while the grade falls with them, so a saving that made the work worse cannot read as progress; neg-control: a window with zero closed rungs reads UNMEASURED, never a win. Scope clarification 2026-09-07: the intended optimization is quality-gated TOTAL COST PER VERIFIED RESULT, not frontier-seat token reduction alone. Publish local and remote input/output/cache tokens and context volume, compute and external spend, retries, review effort, elapsed time, autonomous completions, interventions, defect recurrence and recovery cost with the denominator and accounting coverage. Missing costs remain UNMEASURED; zero verified results cannot report a saving. Compare matched task classes and quality floors so shifting work or retries to another engine never manufactures improvement.
Matrix cell	RATCHET: tokens per closed rung may not rise, and a fall with a grade drop reads RED · `runtime/_hdl_build/nx_seat.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_seat`; declare `nx_seat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land st_ratchet SHIPPED in nx_seat shift: prev-window aggregates, ratchet GREEN/RED/UNMEASURED with its reason, quality floor from gateroster.stamp with grade_delta declared UNMEASURED-single-stamp; selftest T12b-T12e PASS on the laptop (UNMEASURED on empty, RED 100 to 500, GREEN 2000 to 500, floor declared); laptop _offc installed; NAS source landed by five anchored CAS edits (203463 B) 2026-09-02 queue nx_organ_ship nx_seat REFUSED at step 1 by build admission (load 22.08 vs ceiling 16.43, VERDICT=QUEUE, queued=1): the NAS build fires on the next nx_orchestrate pass with headroom; verify with nx_store_put knowledge/store/deployq- load and the BQ-nx_seat row, then promote deliberately; until then the served nx_seat shift carries no ratchet fields

ES19 Digest, never dump: verdict verbs on the organs seats read most · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dg_verdict_line` · executor Organ · 1 u · stands on ES11, ES17
Definition of done	The ten organs to which the residue verb attributes the most mechanical bytes (published as a list, re-measured each beat) each gain a verb that returns one verdict line with its envelope, and the shift page prints mechanical permil per session; done when the 7-day mechanical permil falls below the 40-day baseline of 668 with the grade floor held
Matrix cell	DIGEST NOT DUMP: verdict-line verbs on the organs that cost the most mechanical bytes · `runtime/_hdl_build/nx_seat_meter_beat.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_seat_meter_beat`; declare `nx_seat_meter_beat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES20 Dispatch ledger preflight and fail-cheap escalation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ed_ledger_preflight` · executor Organ · 1 u · stands on ES3, ES16
Definition of done	Defects filed 1788482414 and MEASURED in the shipped 42246 B organ: ed_ledger_row returns -1 when sys_openat_append fails and all TEN call sites discard it (corpus_complete=1), so an absent state dir loses the audit row ES0's local column is built from while the dispatch still reports a verdict; and the local -2 path at line 580 counts the seat as reached, falls through, and the escalation row at line 649 records every engine below the seat failed the judge, which is false when the seat never answered. ES3 proves the ledger path appendable BEFORE the first engine runs and refuses by name otherwise, and an engine that produced no answer is recorded UNREACHABLE and stops the ladder rather than escalating to the rented seat. Neg-controls: a read-only state dir refuses and buys zero tokens; a local seat returning a non-JSON body reads UNREACHABLE and never reaches the frontier seat; a local seat that answers and fails the judge still escalates normally, so the fix cannot disarm the ladder; and a ledger write that fails mid-run turns the verdict UNMEASURED rather than GREEN
Matrix cell	LEDGER PREFLIGHT: the audit row is proven writable before any engine runs, and a cheap engine that never answered refuses instead of escalating to the paid seat · `runtime/nx_engine_dispatch.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_engine_dispatch`; declare `nx_engine_dispatch TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

ES21 Goal mapper: the estate maps an operator goal onto the boards from data, never a frontier fan-out · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`gm_run` · executor Organ · 1 u · stands on ES0
Definition of done	nx_goalmap <domains-csv> <word>... prints ONE capped JSON digest (budget 8192 B declared in the output, clipped=1 announced when bound): per domain the rung rows whose title, done-rule or symbol carry the words with score = DISTINCT words matched (a count, never a threshold), status derived from the matrix (present symbol = PRESENT, _ABSENT_ watch = OPEN) and from knowledge/store/accept- (REJECT naming dom:sym = PRESENT-REJECTED, ACCEPT = ACCEPTED), the log ledger count and last epoch per rung, the matrix watch rows the words match as gaps with SOURCE/BUILT/PROMOTED probed at the three roots, and a dependency order over the matched rungs (Kahn over deps, cycles announced); a duplicate rung id is REFUSED by name. Done when nx_goalmap_gate is GREEN in-process on fixture boards with planted controls (operator REJECT flips status, duplicate id refused, no-match returns empty not a guess, 300-rung scale stays inside the budget with the count still full, unreadable domain returns NO-DOMAIN), the organ is promoted, registered and callable on the MCP surface, and nx_seat gains a map verb that delegates to gm_run so the seat boot digest and the goal map are one organ; neg-control: a word that matches nothing yields rungs_matched=0 and an empty order, never an inferred rung
Matrix cell	NO-MATRIX-ROW — no matrix row carries `gm_run`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-05 measure THE COST THIS RUNG REMOVES, MEASURED ON THE DAY IT WAS DECLARED (2026-09-05). Two Claude understand-phase workflows mapped ONE operator goal (npc ai, physics, story, vegetation, weather, 60 fps via webgpu, photoreal, clipping, roadmap) onto the boards: 15 agents, 5,713,788 subagent tokens, 1,272 tool uses, ~50 min wall; a third fan-out of 18 build agents was launched and STOPPED by the operator before any write (0 write-class calls in its transcripts, measured). The operator's standing order that day: the estate, the lang, the engines, the APIs and MCP do the heavy lifting, Claude provides oversight. The local engine ladder cannot author organs today (engine_classes.conf ceiling 96 new tokens = NSV_MAXNEW, so code authoring is frontier-only by data -- that is ES12's rung, not a new one), but the MAPPING lift needs no language model at all: it is term matching over rung rows, a status join over the matrix and the accept- plane, a ledger count and a dependency sort. nx_goalmap_lib.nx (30,283 B) + nx_goalmap.nx (1,894 B) + _hdl_build/nx_goalmap_gate.nx (10,724 B) were written by the frontier seat in one pass and the gate fossil compiled to 166,087 B (buildroot/_build/nx_goalmap_gate.sov.elf); proof and promotion follow in this ledger. Next lift to move down the ladder: the read-only leg mappers' own method (title-word match -> rung -> organ catalog -> gates map -> accept plane) is exactly gm_run, so ES4's rung worker can feed a goal digest to the dispatcher instead of a transcript. 2026-09-05 land THE GOAL MAPPER IS PROVEN AND LIVE ON THE NAS (2026-09-05, all on the sovereign wire, no shell in the path). nx_goalmap_gate: first run 15/16 RED -- tooth T4 caught a real defect (a repeated query word inflated the score, contradicting the header's DISTINCT claim); fixed in nx_goalmap_lib.nx by gm_word_dup (30,283 -> 30,987 B), rebuilt 166,952 B sha 463079f6, PROMOTED prev=1, REGISTERED callable=1, nx_job_run -> NX-NX-GOALMAP-GATE passed 16/16 verdict=GREEN with values emitted (rungs_matched_a=2 out_bytes_a=796 out_bytes_scale=7908 budget_bytes=8192): a planted operator REJECT flips status to PRESENT-REJECTED, a duplicate rung id is REFUSED by name, no-match returns EMPTY not a guess, 300 matching rungs stay inside the budget with clipped=1 announced and the count still 300, an unreadable domain returns NO-DOMAIN(-3). The program nx_goalmap.sov.elf built 105,558 B sha 59ae2b6e (the build receipt itself was a 503 read-after-accept; the artifact proved the call landed -- the estate's own law). STILL OWED on this rung: promote + register nx_goalmap, run it on the REAL boards (gameengine, graphics, charsim, npcai) and compare its order against the two critics' hand orders, bite the gate with nx_gate_bite (banks the twins first), and the nx_seat map verb. Status: shipped, referee = its own gate, awaiting the real-board run and operator acceptance. 2026-09-05 measure FIRST RUN ON THE REAL BOARDS (2026-09-05, nx_job_run nx_goalmap gameengine,graphics,charsim,npcai webgpu cast npc physics locomotion story vegetation weather fps photoreal clipping roadmap). Run 1 REFUSED BY NAME: duplicate-rung-id GE50 on gameengine.plan -- the defect both critics had found, caught by the organ in production before any map was emitted; fixed as data (the ft_metric_set row re-numbered GE56 under CAS, GE51's dependency followed). Run 2: gameengine plan 226,389 B read whole (truncated 0), matrix 108 rows, rungs_total 55, rungs_matched 26, cycle 0; top score GE53 wc_surface_source 4 of 12 words; GE12 mob_step_gait reads PRESENT-REJECTED straight from knowledge/store/accept- (beach-feet-planted-0830); GE24 wc_set_style_i PRESENT; 19 matrix watch gaps with the three roots probed (e.g. rb3_solve src 0 built 0 promoted 0; gpe_webgpu_default src 1 built 1 promoted 1); verdicts naming gameengine: 3 REJECTs. graphics 56 rungs / 12 matched, charsim 26 / 4, npcai 23 / 10. Order agrees with the critics on the load-bearing chain GE42 -> GE53 and GE44 -> GE54 / GE55, and disagrees where the critics used cost and box state (the ranker's priority stamp is the missing tie-break -- queued). TWO v1.1 DEFECTS FROM THE REAL RUN: the 8,192 B budget clipped graphics to 3 rows and emptied charsim and npcai (clipped=1 announced, counts still full) -> GM_OUTCAP 16,384; and a rung whose own symbol column carries the _ABSENT_: prefix (GE26) read UNMAPPED because the matrix core was compared against the prefixed span -> normalise the prefix at parse. Cost of this map: ONE job of a 105 KB organ over 428 KB of boards, versus 5.7M subagent tokens this morning. 2026-09-05 land v1.1 LIVE AND THE FIRST WHOLE-ESTATE GOAL MAP IS ON DISK (2026-09-05). nx_goalmap 106,058 B sha ea3e471f PROMOTED prev=1 + offc; one nx_job_run over gameengine,graphics,charsim,npcai with the operator's twelve goal words returned a 16,157 B digest (budget 16,384 declared, clipped=1 only on npcai's gap list 2 of 13, every rung list complete): gameengine 55 rungs / 26 matched, top GE53 wc_surface_source score 4, GE12 mob_step_gait PRESENT-REJECTED, GE24 PRESENT, GE26 now OPEN as ws_gt_reproduce (the v1.1 prefix normalisation proven on real data), 19 watch gaps with SOURCE/BUILT/PROMOTED probed, 3 operator REJECTs joined; graphics 56 / 12 -- GR11 cw_webgpu_compute, GR35 gpe_asset_ladder, GR42 env_beauty_scene, GR46 rk_shadow_cascade lead, GR20 cc_garment_pen -> GR25 pl_fit_solve is the clipping chain, GR29 gpe_skin_microsurface PRESENT-REJECTED, and TWO RUNGS READ UNMAPPED BECAUSE THEY HAVE NO MATRIX WATCH CELL (GR49 tl_translation_census, GR51 gpe_hair_penetration_tooth -- board hygiene the map surfaced); charsim 26 / 4 -- R6 cw_npc_atlas PRESENT, R10 rs_schedule_tick whose organ runtime/nx_relsim.nx reads src=0 (a watch pointed at a file that does not exist), R11 cm_npc_turn, R16 dr_reflect_agent; npcai 23 / 10 -- NP17 gb_npc_bench and NP18 wc_step_up lead, then NP4 mob_route -> NP5 mob_avoid -> NP7 mob_schedule -> NP8 mob_reserve, NP10 go_reputation -> NP12 cm_npc_turn, NP16, NP19. The gate gained T15 (prefix normalisation) and rebuilt 168,142 B sha 70ee75fb; promote in flight. QUEUE, in order: nx_seat map verb delegating to gm_run (one organ for boot digest and goal map); join the ranker's .rank priority stamp as the tie-break inside the dependency order; a matrix-watch-missing axis (UNMAPPED rungs named as a worklist, since a rung without a cell cannot flip on /compare); feed the digest to nx_plan_run / nx_engine_dispatch so the estate executes the data-only steps of a map without a seat. Status: shipped, referee = nx_goalmap_gate, awaiting operator acceptance. 2026-09-05 measure BITE-PROVEN (2026-09-05): nx_gate_bite nx_goalmap_gate buildroot/runtime/nx_goalmap_lib.nx 2 via nx_job_run -> baseline build_exit=0 gate_exit=0 green=1 judge=verdict-line baseline_artifact_bytes=168142; operator 1 COMPARISON cmp site 0 @off=3636 build_exit=0 -> KILLED (gate went RED on a mutant that COMPILED); restore verified 31772 bytes byte-identical to pristine; cleanup_build_exit=0; twins RESTORED _offc/nx_goalmap_gate.elf and nx_goalmap_gate.elf; artifact_custody twins_checked=2 restored=2 refreshed=0 healed=0 mutant_live=0; valid_mutants=1 invalid_uncompilable=0 not_reached=0 killed=1; VERDICT GREEN (non-vacuity proven). The mutant build ran through the fixed builder (unlink-after-admission) with a live twin present and the harness's own custody check read mutant_live=0 -- the every-mutant-build-is-a-deploy hazard was handled by the harness, not by luck. Independent hash check of both twins against the promoted sha 70ee75fb follows this row. 2026-09-05 measure EXPOSED ON EVERY SURFACE (2026-09-05, operator asked 'has it been promoted and exposed to mcp and api and all that'): nx_catalog nx_goalmap -> SOURCE yes 1894B, BUILT yes 106058B, PROMOTED yes 106058B, REGISTERED yes (on the MCP surface), AUTHORISED yes (cap minted: allow=nx_goalmap,nx_goalmap_gate exp 1791213446 nonce 20260905, saved laptop-side as ~/.nishi/goalmap.cap), INVOKED yes, VERDICT LIVE. Callable now by name through the tools API and nx_job_run (three real runs today); the MCP tools/list discovery half: the first nx_toolreg_reconcile read skipped-no-schema=1, nx_toolgrammar was run (scanned 1606 emitted 1380 -- harvested the usage line from nx_goalmap.nx's own header) and a second reconcile was issued so the tool appears in tools/list with a real call grammar. Both runner twins (_offc) byte-identical to the promoted binaries. 2026-09-05 measure nx_goalmap SIGSEGV at 0x401e23 (null deref) on two real queries this seat ran through nx_job_run: 8 boards x 16 words, and 4 boards x 26 words; the 4-board control with 8 words, 7 boards x 8 words, and a 1-board ladder of 9/12/16 words all pass -- so the crash is not the domain count (GM_MAXDOM 16) and not the raw word count alone; GM_MAXWORDS=24 is exceeded silently by the 26-word run (no refusal), and the 16-word runs crash only on the boards with the most matches (graphics 23 of 56 already at 8 words) 2026-09-05 queue nx_goalmap: refuse past GM_MAXWORDS by name instead of walking off the array, and bisect the matched-rung overflow on graphics/gameengine with 16 words (jobs /tmp/gm_e7.out /tmp/gm_e8.out /tmp/gm_e9.out); rebuild with --debug so nx_addr2line can name 0x401e23; gate tooth: a query one past every cap must REFUSE, never crash 2026-09-05 measure MEASURED 2026-09-05 from the served nishihost/nx_goalmap.elf (BUILT 106058 == PROMOTED 106058): SIGSEGV at 0x401e23 touching address 0 on charsim,koikatsu,gameengine,procgen,graphics,dcc,intelmine x 16 words -- the SAME address as debt 1788626163, although runtime/nx_goalmap.nx now reads v1.2 sizing every buffer from the input. Either the served elf predates the v1.2 source (the build was queued under admission and never promoted) or the fault is inside nx_goalmap_lib rather than the CLI; the discriminator is one nx_sov_build_run nx_goalmap --build-only plus nx_addr2line on a -g build. The modding lane read its board map by hand meanwhile. 2026-09-05 land FIXED AND SHIPPED 2026-09-05 (modding lane): nx_goalmap rebuilt from the v1.2 source through nx_organ_ship (sha ca4209fc675ea719b55bcbc65eb48fbd3415579c2da81f74b7a5898ccf7d13dc, promoted, offc twin fresh, registered), and the query that crashed the served binary -- charsim,koikatsu,gameengine,procgen,graphics,dcc,intelmine x 16 words -- now returns a full map (charsim 19 rungs matched, R26 first, 7 gaps probed; koikatsu 8). So the served elf HAD predated the source fix. The ship's PROVE ran the on-disk nx_goalmap_gate 21 of 21 because the gate rebuild was refused by admission and queued (BQ-nx_goalmap_gate); the real-query run is the proof that the promoted binary does not crash. Debt 1788626163 eaten with this receipt. 2026-09-17 measure the workflow miners exist and are dark: nx_wfcost, nx_actlog and nx_workflowmine are all REGISTERED-DARK (no MCP invocation on record). One run of nx_actlog over knowledge/status/actlog.jrnl (159 MB, 1154610 frames) ranks nx_fs call plus observe at 418930 frames and nx_fs_write at 78065, and mines the recurring chain nx_fs_write:write then nx_mgmt:build, promote, register, mint at confidence 1000, which is exactly the chain nx_organ_ship composes 2026-09-17 queue COORDINATION from the aesthetictwin lane, 2026-09-16: the operator asked that our 1-2-3 steps be mined actively and composed into plan planes and agents callable over MCP. Done on that lane: ship-and-run workflows as knowledge/store/plan-atship- planes run by one nx_plan_run call. Owed here: a clock row that runs nx_actlog mine over the actlog with a PERSISTED receipt (stdout only today), and a composer that proposes a plan plane from every chain at confidence 1000 above a declared support floor; nx_wfcost mine reads a transcript dir the NAS does not hold (files=0), so it runs laptop-side or over the harvested log 2026-09-17 lesson COORDINATION (aesthetictwin lane): the scoped regen row reads buildroot/knowledge/compare/regen.scope, and a seat that writes the bare knowledge/compare/regen.scope republishes whoever's domain sits in the buildroot copy (measured: my aesthetictwin scope republished automation once). The buildroot scope was borrowed for one aesthetictwin publish and restored to automation on one line; the second line it carried (18 bytes total) is not known to this lane, re-add it if it mattered. A per-seat scope argument on the row would remove the shared scratch file

ES22 The seat's only surface is the estate: a PreToolUse interlock names the estate verb for every harness shell the seat reaches for · cell LANDED · gate NO-GATE-DECLARED

Contract	`tg_shell_interlock` · executor Organ · 1 u · stands on ES17
Definition of done	OPERATOR 2026-09-05, verbatim: 'i also want claude especially the fable 5.1 model you are to stop using its own tools when it loads and to use these and nishi estate only and if there is a gap to build into the nishi estate from the first byte, no more ps1 and python and shell and all the other bullshit'. Today the law is prose in CLAUDE.md and a feedback memory; the estate has measured what happens to an invariant that depends on a seat remembering (nx_memnew: the same doctrine written 4x while the organ sat one call away). Done when a laptop-local PreToolUse organ (sibling of nx_memnew and nx_organnew, wired in settings.json, advisory never blocking -- a pre-flight that can refuse will be disabled) fires on every Bash and PowerShell tool call a seat attempts and answers with the sovereign verb that does the same work (nx_fs for cat/head/sed, nx_txtscan for grep, nx_filehash for sha256sum, nx_job_run for a poll loop, nx_goalmap for a fan-out) or, when none exists, prints GAP and the engineshift rung to declare; the one sanctioned launcher (wsl -e _offc/<organ>.elf for memory-plane organs) is allow-listed by path; the gate plants a Bash call and a PowerShell call and proves both draw the advisory with a verb that exists, plus the allow-listed launcher draws none; neg-control: an unknown command draws GAP, never a guessed verb. Measured basis: 2026-09-05 mapping cost 5,713,788 subagent tokens across two fan-outs before nx_goalmap did it in one job
Matrix cell	SHELL INTERLOCK: every harness shell call names its estate verb, or GAP · `runtime/_hdl_build/nx_tokgate.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tokgate`; declare `nx_tokgate TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 land tg_shell_interlock SHIPPED inside nx_tokgate (the ES17 organ grew the verb; no sibling organ, one hook binary): PreToolUse on Bash and PowerShell in settings.json, verbs read from nishi-ops/hooks/shellverb.conf (tree, allow and verb rows: 40 verb rows, 3 allow rows), every named verb stat-checked against the declared source trees and printed source=present, ABSENT or unverified, GAP naming the rung to declare when no row matches, the sanctioned launcher allow-listed by needle; nx_tokgate_gate 32 of 32 GREEN (was 17) driven through real stdin payloads with neg-controls for the launcher, the hook wrapper, the unknown command, the unreadable verb table and never-block, values emitted (shell_advisory_bytes_bash=430 launcher_bytes=0 gap_bytes=515); laptop _offc installed (nx_tokgate 40376 B sha bbda5125, gate 53297 B sha 34069634); NAS source landed by CAS edits: buildroot/runtime/_hdl_build/nx_tokgate.nx 25677 B, nx_tokgate_gate.nx 16568 B; the sovereignty.matrix watch row named runtime/nx_tokgate.nx, a path that does not exist on the NAS, so the shared contract could never flip -- corrected to runtime/_hdl_build/nx_tokgate.nx, and engineshift.matrix gained its own watch row for the shared contract 2026-09-05 lesson A WATCH ROW WHOSE ORGAN PATH DOES NOT EXIST IS A CONTRACT THAT CAN NEVER FLIP: the SV3 row named runtime/nx_tokgate.nx while every hook organ lives under runtime/_hdl_build; the cell would have read OPEN forever with the organ shipped. Check the organ path with nx_fs size before declaring a watch, and put the first live fire in the receipt: the interlock fired on this seat's own PowerShell launches the moment it was wired, silent on the allow-listed launcher as designed 2026-09-05 land nx_tokgate itself passed the rule-11 ruler: nx_magic map 76 sites / 41 distinct -> 0, every literal now a const named for its meaning (TG_CH_, TG_COL_, TG_ARGV_, TG_VS_), tg_is_jsonl derives its suffix length from the bound literal; gate 32/32 held after the hoist; laptop _offc/nx_tokgate.elf rebuilt 40227 B sha eee1d6ec and installed; NAS source buildroot/runtime/_hdl_build/nx_tokgate.nx replaced whole under CAS (25677 -> 28235 B); NAS build not issued while nx_build_admit refuses on the storm ceiling (load1_centi 2065 vs 1643) -- the hook runs the laptop copy so the interlock is live regardless

ES23 The goal mapper derives its sizes and refuses nothing silently · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`gm_outbuf` · executor Organ · 1 u · stands on ES21
Definition of done	nx_goalmap_lib sizes rung and matrix records from a count over the file just read, the CLI sizes the words array from argc, and the output buffer is gm_outbuf(domains) = the row budget plus one measured scaffold reserve per domain plus the tail, so the digest can never grow past its buffer; the caps GM_MAXWORDS, GM_MAXRUNG, GM_MAXMAT and GM_MAXDOM are deleted; done-rule: nx_goalmap_gate carries a multi-domain overflow tooth (four copies of the 300-rung scale board, content clipped, out_bytes above the row budget and at or under gm_outbuf, JSON closed, clipped announced) and a scaffold tooth that measures one domain's scaffolding against GM_DOM_RESERVE from a real emit, and the 8-board 16-word query that crashed the promoted binary (debt 1788626163) answers
Matrix cell	NO-MATRIX-ROW — no matrix row carries `gm_outbuf`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-05 measure ROOT CAUSE of debt 1788626163, read from the source rather than a debugger (the promoted binary carries no .debug_line and the debug rebuild was refused by admission): gm_room budgets every ROW emit against GM_OUTCAP but the per-domain scaffolding (header numbers, array openers and closers, about 245 bytes per domain) is unbudgeted, so once the row budget is spent each further domain grows the digest past 16384 and over the edge of the CLI's 16384-byte buffer into the page that holds the word pointers; a corrupted pointer is non-canonical and x86-64 reports that fault at address 0, which is exactly what the crash guard printed; every crash this seat measured had output past the budget (8 boards x 16 words, 4 boards x 24 words) and every pass was under it (7 boards x 8 words landed at 15993 B); the gate's scale tooth never saw it because one domain's scaffolding fits inside the 200-byte tail reserve 2026-09-05 queue goalmap v1.2 SOURCE COMPLETE (2026-09-05): nx_goalmap_lib 34722 B (GM_MAXWORDS/GM_MAXRUNG/GM_MAXMAT/GM_MAXDOM deleted; gm_ndom, gm_outbuf, gm_count_pfx, gm_count_lines added; rec/mi/order/mrec allocated per domain from counts; gm_parse_rungs and gm_parse_matrix take the count as cap; gm_order sizes em from nm), nx_goalmap 2148 B (words from argc, out from gm_outbuf), nx_goalmap_gate 13760 B (T16 four clipped domains past the row budget, T17 at or under gm_outbuf with JSON closed and clipped announced, T18 gm_ndom token count, T19 scaffold measured against GM_DOM_RESERVE, out buffer from gm_outbuf); /api/build for nx_goalmap (job 1788630860) and nx_goalmap_gate (job 1788630862) are CLAIMED behind build admission (QUEUE: run queue 10-23 on 8 cpus, load 18-34); nothing promoted yet -- the crashing 8-board 16-word query is the acceptance run once the gate reads GREEN 2026-09-05 measure ACCEPTANCE PROBE (2026-09-05): nx_behaveprobe nx_goalmap on the four-board 26-word query that crashed the promoted binary -- live 960 B (the crash guard's text) against the staged v1.2 build 16536 B of digest, both processes exiting clean from the probe's view; the staged gate (sovereign build 171143 B sha e1c64d31, four new teeth) read other_rc=0 with 2363 B of teeth output against the promoted gate's 1823, so T16 (four clipped domains push out_bytes past the row budget), T17 (at or under gm_outbuf, JSON closed, clipped announced), T18 (gm_ndom token count) and T19 (scaffold measured under GM_DOM_RESERVE) all executed and passed; every build went through the SOVEREIGN lane after the mgmt lane served stale bytes: nx_goalmap 107487 B sha eca5e929 staged, gate promote in flight, contentdiff before the organ promote 2026-09-05 land GOALMAP v1.2 LIVE (2026-09-05): nx_goalmap PROMOTED 107487 B sha eca5e929 with prev banked (contentdiff live-vs-staged IDENTICAL-CONTENT, 0 lost 0 gained), nx_goalmap_gate PROMOTED 171143 B sha e1c64d31 (staged probe other_rc=0 with the four new teeth executed), both offc-installed; ACCEPTANCE: the exact 8-board 16-word query that SIGSEGV'd the old binary (debt 1788626163) now answers on the live binary -- 16096 bytes of digest through nx_job_run, no crash guard text; the array caps GM_MAXWORDS GM_MAXRUNG GM_MAXMAT GM_MAXDOM are gone from the source, sizes derive from the input, and the one declared reserve (GM_DOM_RESERVE 400) is measured by the gate on every run; debt 1788626163 is closable by its owner on this receipt

ES24 The dispatcher names the stage that failed and the local seat listens on the estate host · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ed_noreply` · executor Organ · 1.5 u · stands on ES3
Definition of done	nx_engine_dispatch returns NO-REPLY when the socket accepted and the request was written but zero bytes came back (a listener that is not a seat), distinct from UNREACHABLE (no connect) and ANSWERED-UNPARSEABLE (bytes that are not a /gen reply), with its own ledger status; and nx_nofloat_serve (BUILT-UNPROMOTED 233189 B on 2026-09-05) is deployed on the estate host so a debt-triage dispatch from a seat reaches a seat instead of an empty port; done-rule: nx_engine_dispatch_gate gains a mute fixture seat (accepts a POST /gen and closes with no body) whose tooth reads status=NO-REPLY and never UNPARSEABLE, the ledger partition rises to 15 and sums, the gate is PROMOTED and REGISTERED (it was BUILT-UNPROMOTED and on no roster), and a real dispatch of knowledge/status/dxr_grade_task.conf on the NAS reads ANSWERED with a judge verdict
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ed_noreply`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-05 land DISPATCHER NO-REPLY LIVE (2026-09-05): nx_engine_dispatch built 94832 B through the mgmt lane, contentdiff live-vs-staged lost_from_live=0 gained 3 (the NO-REPLY status line, its ledger token and its note), PROMOTED at sha 298be1cd with prev banked; nx_engine_dispatch_gate (BUILT-UNPROMOTED on no roster since 2026-09-02) promoted at 333d603a, REGISTERED, offc-installed, and run against the promoted dispatcher: 29/29 GREEN, ledger partition 14 of 14 -- the regression proof for the fix 2026-09-05 measure THE NEW TOOTH HAS NOT EXECUTED, AND THE REASON IS A BUILD-LANE DEFECT: the gate source carries the mute fixture seat and the NO-REPLY tooth (27691 B, src_sha256 27578cd6 confirmed by nx_filehash), yet /api/build returned BUILT 73200 B sha 333d603a -- byte-identical to the stage that existed BEFORE the edits -- and the promoted gate's own partition line still reads 14, the pre-edit count; nx_pageref_gate showed the same shape (rebuilt after the pr_declared_hit floor fix, identical sha 4b00a33d); two gates, two changed sources, two receipts saying BUILT with the old bytes; the sovereign lane nx_sov_build_run --build-only is the control in flight; until it lands the NO-REPLY tooth is source-proven only 2026-09-05 queue OWED after the storm clears: the sovereign-lane control build of nx_engine_dispatch_gate (refused QUEUE twice), then its run to execute the NO-REPLY tooth (the promoted gate is the pre-edit bytes, partition 14); nx_swcompare_sota rebuild (job 1788630876, CLAIMED) so the sota generator carries the lib the matrix now uses; the local seat nx_nofloat_serve is still BUILT-UNPROMOTED and 127.0.0.1:8032 is a listener that is not a seat -- the second half of this rung is an operator deploy decision 2026-09-05 land NO-REPLY GATE LIVE AND WITNESSED (2026-09-05): nx_engine_dispatch_gate rebuilt through the sovereign lane in debug flavour (76480 B sha d378c4f4; the mgmt lane had served the PRE-EDIT 333d603a twice, and the release-flavour sovereign build tripped CAPLOSS at 67485 B), contentdiff live-vs-staged lost exactly one run -- the old 14-row ledger partition string, replaced by the 16-row line -- PROMOTED with allow_capability_loss=yes prev=1, offc-installed; run against the promoted dispatcher via nx_job_run with the subject arg: 31/31 GREEN, ledger rows=16 partition sums (t42 1 + tkat 3 + tnc 0 + t42-noext 2 + unreachable 1 + push-failed 1 + tcls 1 + tfront 3 + tnoloc 2 + mute 2), T12b a socket that accepts and closes with no body reads NO-REPLY writes its own ledger status and hands off PASS, neg-control no-body-is-never-UNPARSEABLE-or-UNREACHABLE PASS; done-rule met on the mechanical side, referee grade + operator ACCEPT owed 2026-09-05 lesson the same gate source built three ways in one hour gave three binaries -- 73200 (mgmt lane, PRE-EDIT bytes served as BUILT), 67485 (sovereign release, refused CAPLOSS against the debug live), 76480 (sovereign debug, promoted) -- so a build receipt names a LANE and a FLAVOUR or it names nothing; the promote guard was right all three times and was never loosened

ES27 A one-step solve is scored by its OUTCOME, never by its step count alone: a badly evaluated one-step ranks below a rigorous forty-step (operator 2026-09-06) · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ss_quality_axis` · executor Organ · 3 u · stands on ES26
Definition of done	Done-rule: nx_stepsolve_lib carries a QUALITY axis per signature from the journal's outcome column (failure permil over the ritual's own occurrences) and from malformed rows, the spine and stamp publish quality beside explained, the worklist orders by RISK = support x failure permil so a common bad one-step outranks a rare forty-step, the gate plants a one-step ritual that fails and a forty-step ritual that passes and asserts the ranking, and the compare gauge renders both axes. Scope clarification 2026-09-07: score sovereign operational work by correctness, quality, failure recovery and verified final result alongside efficiency. A one-call build/publish or AI delegation that lacks the expected artifact and acceptance evidence remains unaccepted; low step count cannot upgrade an unmeasured result. A quality acceptance result must include whether the outcome was independently verified and reproducible, whether defects recur, and whether recovery succeeds. Carry those outcomes into the total-cost ruler in ES18; task completion without independent evidence cannot become autonomous verified completion.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ss_quality_axis`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-06 lesson OPERATOR 2026-09-06 (verbatim): malformed should be part of our 1 2 3 step type evaluation as a bad 1 step not rigourously evaluated is worse than a 40 step perfect or excellent deliverable, qualitative and quantitative, use the webgpu lane mess as a good example of a disaster we are targeting to address in the future, bad output, random coding, etc. it shouldve been an easy hit out of the park wiht all the benchmarks and oracles and industry documentation but has a rolling disaster -- captured here as rung ES27 (a quality axis on the step ruler: without an outcome axis the step metric rewards exactly the failure it was built to remove) and as a retract row on the WebGPU board naming the oracles that existed and were not used 2026-09-06 land SHIPPED (not accepted) 2026-09-06: the QUALITY axis is live end to end. nx_stepsolve_lib grew ss_fail_permil / ss_quality_permil (1000 - failure permil) / ss_risk (support x failure permil) and a fail parameter on ss_totals_add; the spine and stamp publish 2026-09-06 measure GATE GREEN 42/42 on the PROMOTED nx_actlog through a scratch registration: the failing one-step pair nx_gone:call>nx_gtwo:call (support 5, first 4 outcomes fail) reads fail=4 fail_permil=800 risk=4000; the clean triple nx_hone>nx_htwo>nx_hthree (support 3) reads fail=0 risk=0; the UNDECLARED class carries fail 4 of 8 = permil 500; totals total_fail=4 quality_permil=500; worklist_risk holds EXACTLY the failing pair and never the clean triple. The discrimination is BITE-PROVEN (quality-axis-taints-the-failing-pair-and-never-the-clean-triple fires on bad, silent on good). Quality gauge stamp FRESH gauge=500 through the same nx_gauge_lib ruler the /compare emitter renders. Operator directive proven: a badly evaluated one-step (risk 4000) outranks a rigorous multi-step (risk 0), so the step ruler can no longer reward a bad one-step over a good forty-step.

ES26 One-step solve: steps per common task mined from the action journal, ratcheted toward one with the reason declared · cell LANDED · gate NO-GATE-DECLARED

Contract	`al_steps` · executor Organ · 2 u · stands on ES19
Definition of done	OPERATOR STANDING ORDER 2026-09-06: if a task can be solved in ONE step within logic it should be, and when it cannot the estate explains why two, and why three, and so on, from the most common tasks to the least, mining and evaluating this efficacy continuously. The ruler is a verb on the incumbent action-journal organ (nx_actlog, whose indexed miner already ranks recurring tool:verb bigrams and trigrams by exact support over the live 56 MB journal): every recurring n-gram is a task signature whose step count is its length, joined against knowledge/stepsolve.conf rows (signature, min_steps, reason, one_step_verb) -- a declared minimum with the reason it cannot be fewer (a true dependency such as promote must see the sha only a finished build produces, which nx_organ_ship composes into one call) or the composed verb that makes it one. Published: frequency-weighted one_step permil, two_step permil, three_plus permil with denominators; every signature without a conf row named UNDECLARED (never assumed one-step), most common first, as the worklist; a spine row per beat and a gauge stamp the CE9 gauge_pass renders. ACCEPT RULE: the one_step permil over the top-N most common signatures is published beside its denominator and may not fall beat over beat; every multi-step signature carries a declared reason or reads UNDECLARED; the neg-control proves an undeclared signature never reads as one-step and a planted 4-step ritual with a declared composed verb reads gap=3 naming that verb. ARCHITECTURE: the remedy for a multi-step ritual is a composed verb on the CANONICAL organ of that task (the common-task registry names it), never a new tiny tool -- no toilets in the living room. Scope clarification 2026-09-07: common tasks include grep/search/read/write/build/test/site emission/publication/recovery/AI, and the operator wants the estate to improve all of them. The backbone may continue to plan and review with the frontier assistant while verified local and external engines receive bounded tasks; delegation requires a reachable named engine, a permitted task class and an outcome receipt.
Matrix cell	ONE-STEP SOLVE: steps per common task mined from the action journal, ratcheted toward one with the reason declared · `runtime/_hdl_build/nx_actlog.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_actlog`; declare `nx_actlog TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 queue declared from the operator's 2026-09-06 order (verbatim: give the estate a goal, if we can solve a task in 1 step within logic then we should explain why and evaluate why we need two steps and if we cant do it in two steps we should evaluate why and explain why we need to do it in 3 and so on from our most common tasks to our least we should be mining and evaluating this efficacy). Incumbents composed, not duplicated: nx_actlog mine/freq/harden (the indexed n-gram miner over knowledge/status/actlog.jrnl, 56,713,361 B live, sized from the input), nx_wfcost (recurring pair token cost), nx_common_tasks (the ONE canonical organ per common task with its consolidation-debt column). Build order: al_steps verb on nx_actlog + knowledge/stepsolve.conf (data) + nx_stepsolve_gate with a planted journal + daily clock row + gauge stamp knowledge/status/stepsolve.stamp. Architecture twin: ecosystem EC37. 2026-09-06 measure FIRST LIVE BEAT (nx_actlog steps over knowledge/status/actlog.jrnl, served binary 154360 B sha 29ac8aa7, nx_actlog_gate GREEN 7/7 on this generation): frames=715026 journal_bytes=56769738 truncated=0 index_overflow=0 bigrams_closed=1909 trigrams=3703 signatures=5612 support=1324286 partition_sums=1 explained_permil=0 -- every signature UNDECLARED. The most common ritual in the estate is nx_fs:call>nx_fs:call at support 119718 (a receipt poll: .claim then .out), then the three-read chain at 87509; the clock plane's fork adjacencies (elf:run>elf:run) fill most of the remaining top 40. Spine knowledge/status/stepsolve.spine (row 1), stamp knowledge/status/stepsolve.stamp FRESH axes 2/2; clock row stepsolvebeat 86400 declared (rows=176); gauge rows on engineshift.gauge and codeeffectiveness.gauge point at the stamp. 2026-09-06 retract explained_permil=0 on beat 1 was a VOCABULARY defect in knowledge/stepsolve.conf, not a ruler finding: the seven seed rows were spelled tool:use (the harvested-transcript verb) while the production journal spells MCP frames tool:call, forks elf:run and harness shell Bash:- so no row could match. Rewritten under CAS (2522 to 5915 B) in the journal's spelling with 20 rows, each carrying the support it was read at; a signature whose reason this seat could not state from evidence stays UNDECLARED on purpose. Lesson: a conf keyed on a journal's vocabulary must be proven against the journal it is read over, and it was the ruler's UNDECLARED class that made the defect visible instead of a silent zero. 2026-09-06 measure SECOND LIVE BEAT with the corrected conf (20 rows, journal spelling): frames=715256 signatures=5612 support=1324689 partition_sums=1 explained_permil=256 -- UNDECLARED 985400 (743 permil, 5593 sigs) . REDUCIBLE 257180 (194, 10) . DEPENDENCY 68000 (51, 5) . ONE-STEP-AVAILABLE 14109 (10, 4). The remaining UNDECLARED mass is fork adjacency (elf:run>elf:run, the clock plane and the job lane) and harness pairs (Bash:- PowerShell:- Edit:-). Spine row 2, stamp FRESH. 2026-09-06 land SHIPPED, NOT ACCEPTED: nx_actlog steps verb PROMOTED 154360 B sha 29ac8aa7 (the 503'd promote had landed; NOTHING-STAGED with the built sha proved it), _offc refreshed, nx_actlog_gate GREEN 7/7 on this generation; nx_stepsolve_gate BUILT via /api/build 56232 B sha c42c7813 (src_path names it, src_stable 1), PROMOTED, REGISTERED callable, _offc hash-matched, GREEN 25/25 on the served miner through nx_job_run with its bite tooth proven. Owed before ACCEPT: referee grade + operator ACCEPT row in knowledge/store/accept-. 2026-09-06 queue GROWTH IN FLIGHT: a verbclass 2026-09-06 measure GENERATION CONTROL before the new miner exists: the new gate (staged 58896 B sha 10bda754, run as a scratch registration against the OLD served miner) reads RED 20/31 and every failing tooth is a rule tooth -- conf_rules, BY-RULE support, undeclared 8 not 5, explained 578 = 11/19 with the fork pair counted UNDECLARED, the rules array, the E row, the worklist, the second bite -- while every vocabulary-independent tooth still passes. The teeth discriminate the generation, not the fixture. 2026-09-06 land CONTRACT SYMBOL MADE REAL: the watch row names al_steps and the miner had only al_steps_sig / al_steps_emit_one / al_steps_json, so the ranker read ES26 OPEN at rank 17; the entry the dispatcher calls is now func al_steps (definition + call site renamed under size CAS, 81332 -> 81327 -> 81322, the second attempt of the call-site rename correctly REFUSED because the first had landed). Conf grew the two verbclass rows (run, -) under CAS 5915 -> 6695. Miner build in flight on the sovereign lane, --build-only; the mgmt lane's queued BQ-nx_actlog fires on headroom with the same source. 2026-09-06 measure THIRD LIVE BEAT on the promoted rule-aware miner (161984 B sha b006ffe1; one lost run named and accepted: the symbol al_steps_json renamed to the contract's al_steps; 10 runs gained): frames=716124 signatures=5618 support=1326263 partition_sums=1 explained_permil=748 -- BY-RULE 653248 (492 permil, 2816 sigs: rule run 532293 over 1552 sigs, rule - 120955 over 1264) . REDUCIBLE 257828 (194, 10) . DEPENDENCY 68075 (51, 5) . ONE-STEP-AVAILABLE 14124 (10, 4) . UNDECLARED 332988 (251, 2783). The worklist is now the seat's own undeclared rituals, most common first: nx_fs:call>nx_shelltool:call 8821 . nx_swarm_beat:call>nx_swarm_gpu:call 5584 . nx_fs>nx_fs>nx_shelltool 5578 . nx_filehash>nx_filehash 4559 . nx_mgmt>nx_mgmt 4440 . nx_fs>nx_filehash 4283 . nx_job_run>nx_fs 3514 (a job launch and its receipt read: the claim-or-out verb again). Spine row 3, stamp FRESH axes 2/2. Beat over beat: 0 -> 256 -> 748, each step a declared reason, none a loosened ruler. 2026-09-06 land RULE-AWARE GATE PROVEN AND PROMOTED (shipped, not accepted): nx_stepsolve_gate rebuilt on the sovereign lane (58864 B sha d20bfbf8, the mgmt lane refused exit 6 and queued BQ-nx_stepsolve_gate; BQ-nx_actlog is queued too -- both will re-stage the same sources later and those stages are NOT to be promoted blindly, the promoted binaries already carry the source), staged by filecopy, run from the stage as a scratch registration: GREEN 31/31 with BOTH bites proven (undeclared-never-carries-a-verb; verbclass-fires-on-the-fork-pair-never-one-step). Promote guard refused CAPLOSS 113 permil; nx_contentdiff enumerated it -- lost_from_live=23 (8 shown, a prefix of its own count), ALL lost_other = the OLD planted population's strings (tool:use rows, the old tooth names, the old expected needles), lost_srcpath 0 lost_symbolname 0, gained 48 (tool:call rows, the E/F fork fixtures, the rule teeth) -- a deliberate fixture rewrite, promoted with allow_capability_loss=yes on that enumeration. Cap minted (nonce 202609067, 30 days). LESSON: gv_bite(name, fired_on_bad, fired_on_good, ctr) -- the second argument is FIRED-ON-GOOD and must be 0; passing a correct silence as 1 read a false positive on a correct gate; the first bite had it right and the second copied the wrong shape. 2026-09-06 measure SERVED-SURFACE PROOF: the promoted nx_stepsolve_gate (58864 B sha d20bfbf8) run through its registered row reads GREEN 31/31, both bites proven; _offc twin hash-matched; scratch registration nx_stepsolve_gate_staged REAPED (rows_in=1696 reaped=1). Catalog: nx_actlog LIVE end to end; nx_stepsolve_gate promoted, registered, cap minted. STATE: shipped, referee grade and operator ACCEPT owed; the /compare page renders the gauge row on the next regen beat (not forced under the storm). 2026-09-06 land THE COMPOSED VERB FOR THE MOST COMMON RITUAL, SOURCE-LANDED ON THE CANONICAL READER: nx_fs job <id> (nx_fsops, the organ behind the MCP nx_fs) reads the job's terminal marker and, only when it says DONE, the output, in ONE call -- six named states NOSUCH / RUNNING (exit 8) / DONE / DONE-EMPTY / UNPARSED / REFUSED (digits-only id, cannot leave its directory); lib fsx_job_at (gate-drivable on a /tmp fixture) + fsx_job binding, CLI header + usage + dispatch (the published grammar law), nx_fsops_gate 40 -> 46 teeth incl. a neg-control. Capsearch over 7469 organs found no incumbent (nx_job_run launches, nothing reads a receipt in one call). AHEAD check first: nx_contentdiff live vs an unchanged-source build read GREEN strict superset (lost 0), so the served reader is not ahead of its source. On promote, the conf rows nx_fs:call>nx_fs:call (120106) and the three-read chain (87785) become ONE-STEP-AVAILABLE with one_step_verb nx_fs job -- the fourth beat measures the adoption gap. Builds queued via /api/build under CPU saturation. 2026-09-06 land THE VERB IS LIVE AND WITNESSED: nx_fsops PROMOTED 54152 B sha 928efec3 (content ruler GREEN strict superset, +80 runs incl. the eight job strings; nx_fsops_gate 40 -> 46 teeth GREEN 47/47 from the stage, PROMOTED 85336 B sha 1356aeb3 -- the mgmt lane built it byte-identical to the sovereign lane; scratch registration reaped; _offc twins refreshed). WITNESS on the served surface: nx_fs job 1788707685 returned the marker AND the output in ONE call, byte-identical to the two-read control. knowledge/stepsolve.conf rows for nx_fs:call>nx_fs:call and the three-read chain now carry one_step_verb nx_fs job (6811 B). 2026-09-06 measure FOURTH LIVE BEAT (the adoption-gap reading): frames=717390 signatures=5631 support=1328611 partition_sums=1 explained_permil=748 -- ONE-STEP-AVAILABLE 222709 (167 permil, 6 sigs; was 14124) . REDUCIBLE 50040 (37, 8; was 257828) . DEPENDENCY 68177 (51, 5) . BY-RULE 653609 (491, 2820) . UNDECLARED 334076 (251, 2792). The receipt-poll pair (120501) and chain (88049) moved from REDUCIBLE to ONE-STEP-AVAILABLE with a live verb: from here their support is the ADOPTION GAP the ratchet must drive down, seat by seat. Next worklist rows: nx_fs>nx_shelltool 8822, nx_swarm_beat>nx_swarm_gpu 5585, nx_fs>nx_fs>nx_shelltool 5579, nx_filehash pairs, nx_mgmt>nx_mgmt 4444, nx_job_run>nx_fs 3534 (nx_fs job answers that one too: declare it). 2026-09-07 queue OPERATOR SCOPE 2026-09-07: all operational work is sovereign capability investment, including grep/search/read/write/build/test/site emission/publication/recovery/AI. Existing goal and rung contracts expanded; this row records requested scope only, not implementation, build, publication or functional acceptance. Next: measure the verified canonical owners and their blockers, attach comparable dated benchmark receipts, and render the changes on the existing /compare boards. Evaluate total cost per independently verified result across local and remote engines, retries, review, interventions, recurrence and recovery; token reduction alone is not acceptance.

ES25 The promote ruler has a referee, and a subject that really dies · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nx_behaveprobe_gate` · executor seat · 1.5 u · stands on ES24
Definition of done	nx_sigfixture (registered) dies by a named signal on itself or exits a named code; nx_behaveprobe gains a self direction (live against itself, no stage slot) and SIGNALLED and HARNESS evidence grades; nx_behaveprobe_gate forks the LIVE probe against the fixture and the fixture directly through tr_run_capture, asserting 143 on SIGTERM, 7 on the control arm, never rc 0, SIGNALLED named, and the bite pair -- GREEN on the deployed binaries and rostered
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nx_behaveprobe_gate`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-05 land LANDED AND WITNESSED (2026-09-05): nx_sigfixture 16316 B sha 357085ce PROMOTED + REGISTERED; nx_behaveprobe 27879 B sha 9006364e (self mode, SIGNALLED and HARNESS grades) PROMOTED prev=1 after a live-vs-staged probe of the probe on a real workload read IDENTICAL STRONG; nx_behaveprobe_gate 39307 B sha 7e988a00 PROMOTED + REGISTERED + offc, promoted run 11/11 GREEN: live_rc=143 other_rc=143 on the signal arm, 7 on the control arm, fixture forked directly reads 143 and 7 through the in-process ruler (second method class), T11 BITE-PROVEN; the first cut of this gate was 9/11 because two teeth looked for the fixture's text in the probe's capture and the probe prints only its own JSON line -- measured, retracted, fixed by forking the fixture directly, which made the gate stronger 2026-09-05 lesson A STALE COPY OF A CORRECT INSTRUMENT IS INDISTINGUISHABLE FROM A BROKEN ONE: the served probe predated the estate's own 2026-08-25 signal rule and reported rc=0 for a SIGSEGV'd gate, and the debt filed on it named a mapping defect that did not exist; the only cure that survives a promote is a REGISTERED SUBJECT THAT DIES ON PURPOSE plus a referee that asks the LIVE ruler how it reads that death -- now both exist, and any wait-status consumer (job runner, gate runner, probe) can be pointed at nx_sigfixture 15 and must answer 143

ES28 A rung contract answers with its incumbents and the record's rejections before a seat builds anything · cell LANDED · gate UNRECORDED

Contract	`rk_incumbents` · executor Organ · 2 u · stands on ES21, ES23
Definition of done	OPERATOR 2026-09-14 on the search R0 review: a seat found nx_dr_densejudge, embed_v1.bin and the DR-13 recorded rejection of learned fusion over PPMI by glob and header reads AFTER a prior seat had rebuilt the rejected design. The estate must answer a rung's contract itself: for every open rung, rk_incumbents matches the contract terms (symbol, title, note) against registered organ names and grammars, source headers in runtime and _hdl_build, and data assets under knowledge/index, and reads header prose for a recorded measured rejection (rejection, dead end, REFUTED, measured ceiling) on those terms; nx_compare_rank prints INCUMBENTS and PRIOR-REJECTIONS on the rung line and plan_pass renders them under the rung. Accept rule declared before the build: on search.plan R0 it names nx_dr_densejudge, embed_v1.bin and the DR-13 rejection with no seat input; a neg-control rung whose terms match nothing prints NONE, never a guess; coverage envelope printed (files scanned, corpus_complete)
Matrix cell	A rung contract answers with its incumbents and the record's rejections before a seat builds anything · `runtime/nx_compare_rank.nx` · LANDED decl
Gate	`nx_compare_rank_caps_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-14 land rk_incumbents LANDED (operator 2026-09-14: the estate answers a rung's contract itself, no treasure hunting). nx_incumbent_lib indexes every organ header, basename part, column-0 func name, knowledge/ asset path and recorded rejection line over both runtime roots plus knowledge/index into a stamped derived index that is refused when stale; contract terms are deduplicated by match prefix, numbers dropped, a term carried by more than a quarter of the organs dropped as non-discriminating, the rest idf-weighted with a name hit weighed a second time; PRIOR-REJECTIONS is its own axis (the name-tier organs whose headers record a rejection, ranked by the rarity of the word in their name). nx_incumbents CLI: the bare form builds the index (20820 files, 12 assets, 19 headers truncated at the 8 KB window, 10.4 MB, corpus_complete=1; clock row incumbentidx rebuilds it daily); nx_compare_rank prints INCUMBENTS(rung) under every ranked rung with the coverage envelope once. nx_incumbent_gate 47 of 47 GREEN on a planted 14-organ tree and on the live tree: THE DECLARED ACCEPT RULE HOLDS with no seat input, R0 names nx_dr_densejudge under PRIOR-REJECTIONS with its DR-13 line, lists knowledge/index/embed_v1.bin, excludes its own organ. Promoted by hash: nx_incumbents b92e0f69, nx_incumbent_gate 755cfd86, nx_compare_rank 4c4dfae4 (content ruler: one lost run, a source path); registered, _offc refreshed, rostered, organ_gate rows. Three instrument lessons on the way, each measured on the live answer and fixed at the root rather than tuned to the rule: a pure idf sum buried the organ named for the contract's word; a name TIER sorted first put an organ named for two process words second; a 4-byte prefix on a 5-letter term made dense match density and wired match wire. Owed: plan_pass renders the answer under the rung on the page (the generators re-ship); the residual noise in the rejection axis is the contracts' own process vocabulary (rule, wired, exceed) hitting organ names.

ES29 A launched job can be cancelled from the surface that launched it: nx_job_run gains a cancel verb that finds the job by its out-file, verifies the pid's cmdline is the job it launched, sends TERM then KILL after a named grace, and journals the cancellation beside the launch · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`jr_cancel` · executor Organ · 2 u · stands on nothing
Definition of done	MEASURED 2026-09-15: two cross-encoder one-shots launched 09-14 through nx_job_run on the PRE-FIX f32 bricks (10x slower than the hardware twins shipped the same day) held the box at load 27 on 8 cpus for over 30 hours with 0 bytes of output, and admission correctly refused every build -- including the builds that would have replaced them. No sovereign surface could stop them: nx_job_run has no cancel verb, nx_aw_hostctl is not mintable (unregistered tool in allow list), nx_ctxtop refuses to walk /proc above load 800, and knowledge/resgov.conf's own law forbids a recycle row for a one-shot (never terminate what nothing will restart). A RUNAWAY JOB THAT CANNOT BE CANCELLED IS A RESOURCE INCIDENT WITH NO REMEDY (§29 already says so for long sweeps). Done-rule: nx_job_run cancel <out-file> on a planted sleep job terminates it and journals `CANCELLED pid= elf= out=`; a cancel naming an out-file no job wrote is REFUSED-ABSENT; a cancel whose pid cmdline does not match the launch record is REFUSED-MISMATCH (never kills a stranger); gate plants all three
Matrix cell	NO-MATRIX-ROW — no matrix row carries `jr_cancel`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-28 retract rungrole ES29 -> T-BIC-ENGINE removed 2026-09-28: that target was never declared (the ladder read BADTARGET and refused ROLE-DUPLICATE, so the whole board was unrankable); ES29 keeps its T-FR-WFCTL substrate role. The engine-shift subject still needs its own dated best-in-class target before ES0-ES28 can be placed 2026-09-15 queue Declared from the search lane under the 2026-09-15 goal; the build itself waits on the same admission the runaway holds, which is the point. 2026-09-15 land SOURCE-LANDED ON BOTH TREES, PROVEN ON THE LAPTOP: nx_jobcancel_lib.nx (10634 B, sha 0eb63a0d) + nx_job_run.nx with the cancel verb and the launch journal (14266 B, sha 37c278b3; laptop == NAS by hash) + nx_jobcancel_gate.nx (7094 B) + knowledge/jobrun.conf (cancel_grace_ms 3000). Gate 27/27 GREEN on a REAL forked child (REFUSED-ABSENT, REFUSED-MISMATCH with the child alive, CANCELLED by TERM and reaped with signal 15, ALREADY-GONE, journal counts, conf, names); BITE: jc_verify mutated to always match killed exactly T2d/T2g/T3d (24/27 RED), restored 27/27; KILL escalation unexercised and announced by gv_kv kill_escalation_exercised=0. The launcher compiles on the laptop (173 KB asm). NAS build/promote/register waits on admission (load1 17.9 vs 16.43 after the operator killed the two runaways); until then the verb exists in source only. 2026-09-15 land PROMOTED AND LIVE: nx_jobcancel_gate 27/27 GREEN on the NAS (job 1789483303), promoted 6457fe83, registered, offc-installed, rostered (gateroster.conf) and declared (organ_gate.conf: nx_jobcancel_lib and nx_job_run -> nx_jobcancel_gate); knowledge/jobrun.conf cancel_grace_ms 3000. nx_job_run rebuilt on the mgmt lane (42936 B, sha 92fa9e76, src 37c278b3 == laptop), nx_contentdiff ONE-WAY-GAIN (91 gained runs: the cancel vocabulary and the journal path, lost 0), PROMOTED by hash, offc-installed. From this promote every nx_job_run launch writes knowledge/status/jobrun.jrnl and `nx_job_run cancel <out-file>` is the sovereign stop button; the ssh kills of 2026-09-15 are the last of their kind. Live dogfood (a launched nx_contentdiff cancelled through the verb) follows this row. 2026-09-15 measure LIVE DOGFOOD ON THE MCP SURFACE: `nx_job_run nx_contentdiff /tmp/cancel_dogfood.out <daemon> <daemon>` (pid 21124, a ~4 min job) then `nx_job_run cancel /tmp/cancel_dogfood.out` -> `JOB-CANCEL out=/tmp/cancel_dogfood.out pid=21124 outcome=CANCELLED grace_ms=3000 journal=knowledge/status/jobrun.jrnl`; the journal reads launch 1789483908 -> cancel 1789483929 CANCELLED, and /proc/21124 is gone. The same verb, the same binary, the same journal for the seat, the agent and the operator: no private path. Done-rule MET (gate 27/27 on the NAS, bite-proven, live cancel witnessed); the KILL escalation stays unexercised and is said so in the gate's own receipt.

ES30 Every job carries an end-to-end budget and the launcher enforces it: nx_job_run records an ABSOLUTE deadline (epoch) and an optional core-seconds cap per launch in jobrun.jrnl, a sweep verb cancels any live job past its deadline through jc_cancel, journals BUDGET-EXCEEDED, and a re-launch of a resumed job inherits the REMAINING budget, never the original · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`jr_budget` · executor Organ · 2 u · stands on ES29
Definition of done	Done-rule: a planted sleep job launched with deadline=now+2s is cancelled by `nx_job_run sweep` within one grace and journaled BUDGET-EXCEEDED with verified_stopped=1; a job inside its deadline is untouched (neg-control); a resumed launch declaring resume=<out-file> receives remaining = deadline - now, refused when non-positive; the gate plants all three. September 2026 frame: time in the queue and offline count and a restart never re-grants the full budget [zylosdeadline26]
Matrix cell	NO-MATRIX-ROW — no matrix row carries `jr_budget`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-15 queue Declared from the 2026-09-15 research intake (six sources mirrored and pinned, the cs.DC September listing read). Build order: ES30 first (the budget is data the cancel lib already understands), ES32 beside it (the page is the monitor), ES31 last (recovery needs the classes ES32 renders).

ES31 Failure classes and budgeted recovery: a finished job's exit is classified (refused-admission, over-budget, crashed, rc-nonzero, ok) from its journal and out-file, a declared recovery per class (requeue with backoff once, cancel-and-report, nothing) runs under an explicit recovery budget, and the recovered run is verified against the original accept rule before it counts · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`jr_recover` · executor Organ · 3 u · stands on ES30
Definition of done	Done-rule: on a planted crash the recovery requeues exactly once and journals RECOVERED with the verifying probe's result; on a second crash it stops and journals RECOVERY-BUDGET-EXHAUSTED; a refused-admission class requeues through nx_buildq and never re-launches directly; the gate plants all three and a neg-control where the recovered run fails its accept rule and is NOT counted. May 2026 frame: failure signals to classes to budgeted, verified recovery [selfheal26]
Matrix cell	NO-MATRIX-ROW — no matrix row carries `jr_recover`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

ES32 No job unmonitored: the boards render the launcher's journal as a jobs table (launched, running, done, cancelled, over-budget, recovered) with age, budget remaining and the out-file, so a stuck or runaway job is a visible row on /compare/engineshift and never a discovery by ps · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`jobs_pass` · executor Organ · 2 u · stands on ES29
Definition of done	Done-rule: jobs_pass in nx_swcompare_lib reads knowledge/status/jobrun.jrnl and /proc liveness through the one cancel lib's jc_verify, renders every job launched in the last 7 days with its state derived from the journal (launch without cancel and pid alive = RUNNING; pid gone with no cancel row = FINISHED; cancel row = its outcome), counts them in api.json, and a gate on a planted journal proves each state; the two 2026-09-15 runaways would have read RUNNING for 30 hours on the page [selfheal26]
Matrix cell	NO-MATRIX-ROW — no matrix row carries `jobs_pass`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

ES33 The 1-2-3 step: mined call sequences become seeded plans, plans become agents · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`wm_attribute` · executor Organ · 3 u · stands on ES26, ES21
Definition of done	DONE-RULE PRE-DECLARED: a miner over the seat's actlog frames (composing the nx_actlog n-gram mining and nx_workflowmine) proposes plan rows for every call sequence that recurs across sessions, each proposal a plan seed the seat runs with ONE nx_plan_run call; a proposal that runs GREEN twice is assigned an agent row (a clock or roster row) and the rung it serves declares both in its treatment row (the wf and agent fields); the receipt prints proposals, adopted plans and calls saved per session, and a session whose recurring sequences are all covered reads COVERED. First composition landed 2026-09-16: the plan-boardship seeds (rank, scoped regen, page verify) published a board in one nx_plan_run call, proven on automation; nx_workflowmine and nx_harnessmine are REGISTERED-DARK today, so the miner is the open half
Matrix cell	NO-MATRIX-ROW — no matrix row carries `wm_attribute`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-16 land 2026-09-16 first composition: knowledge/store/plan-boardship-automation- and plan-boardship-coding- seeded from knowledge/status/plan-boardship-<dom>.rows (three rows: nx_compare_rank, nx_compare_regen --domain, nx_page_verify); nx_plan_run boardship-automation returned PLAN steps=3 ok with the scoped regen fork-fresh 4 of 4 and the page GREEN; the plain MCP regen row ignores --domain-file (a full 116-domain run followed) and nx_job_run refuses pinned rows, so the plan lane is the one sovereign way to run a scoped organ with real argv today

dossiers=34 cells_joined=24 no_matrix_row=10 (sum 34) gates_recorded=0 gates_unrecorded=1 no_gate_declared=23 (sum 24 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 32 feature rows mapped of 40 matrix rows; 8 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/engineshift.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 0–1000, distinctiveness 200–800 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 596 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 0–1000 · distinctiveness 200–800 · breadth 0–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 1 · labels over marks 1 · off-canvas 3 · unresolved labels 1 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 281 permil of the plot

Nishi Claude Code (rented frontier seat) OpenCode (provider-agnostic agent) Ollama (local model server) LiteLLM (routing gateway)
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 565 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	821	666	572	833	+39 since 2026-09-23	22	10	2026-09-15
Claude Code (rented frontier seat)	Peripheral	375	357	145	666	+10 since 2026-09-23	7	10	2026-09-15
OpenCode (provider-agnostic agent)	Mainstream	517	314	187	666	-30 since 2026-09-23	9	10	2026-09-15
Ollama (local model server)	Unconventional	214	638	145	777	-53 since 2026-09-23	6	10	2026-09-15
LiteLLM (routing gateway)	Mainstream	571	458	270	722	-15 since 2026-09-23	12	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	40	5
2026-09-16	40	5
2026-09-17	40	5
2026-09-18	40	5
2026-09-19	40	5
2026-09-20	40	5
2026-09-21	40	5
2026-09-22	40	5
2026-09-23	40	5
2026-10-08	32	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 160, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Claude Code (rented frontier seat)	OpenCode (provider-agnostic agent)	Ollama (local model server)	LiteLLM (routing gateway)
One-call seat boot digest hard-capped at 4 KB Measured: `st_boot` exists in `runtime/_hdl_build/nx_seat.nx`, verified at emit. A session opens on a 1.2 KB JSON digest instead of about 40 KB of memory reads; Claude Code and OpenCode preload instruction files with no cap rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	○	○
Engine-shift scoreboard: claude versus local seat classes, tokens per closed rung Source present; authored stronger claim: `st_shift` in `runtime/_hdl_build/nx_seat.nx`, verified at emit. The gauge the operator ordered on 2026-07-20; LiteLLM logs spend per key [litellmrouting] but no rival relates spend to rungs closed Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	◐
Seat metering row appended per session class Measured: `st_meter_append` exists in `runtime/_hdl_build/nx_seat.nx`, verified at emit. Claude Code reports cost per session; ours is a durable append-only row -- and it has had no producer since 2026-08-05 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Ollama (local model server); fully adopted on the estate ladderCons behind LiteLLM (routing gateway) (leads)	●	●	●	○	◉
Crash-resume map from the session record Measured: `st_resume_map` exists in `runtime/_hdl_build/nx_seat.nx`, verified at emit. Claude Code resumes a session by id; ours correlates host crashes to killed seats and emits the resume digest at session start rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	○	○	○
Split-brain router from measured tool-transition signatures Source present; authored stronger claim: `cr_route` in `runtime/_hdl_build/nx_clawf_route.nx`, verified at emit. Routes a signature mined from 221 transcripts to a tier deterministically and fails closed; LiteLLM routes by declared rules [litellmrouting]; registered and dark today Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	○	○	●
Provider preference ladder: sovereign, then local, then external, then Claude Measured: `lp_route_local` exists in `runtime/_hdl_build/nx_llm_provider.nx`, verified at emit. OpenCode picks a provider per session [opencodemodels] and LiteLLM falls back across deployments [litellmrouting]; ours is a library with two test importers and no production caller, MEASURED 2026-09-02 with corpus_complete=1 Adoption: `LIB-GATE-ONLY importers=2` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), Ollama (local model server)Cons behind LiteLLM (routing gateway) (leads); not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	○	●	○	◉
Per-turn mixed-LLM routing as data with provenance in the reply Source present; authored stronger claim: `go_llm_route` in `runtime/nx_llm_route.nx`, verified at emit. A conf row sends a turn to a stronger backend and the reply names which engine answered; llm_routes.conf carries zero active rows today rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	●	○	●
LLM-intercession gap registry: the open gaps ARE the custom-LLM test suite Source present; authored stronger claim: `lg_council_flag` in `runtime/_hdl_build/nx_llm_gap_registry.nx`, verified at emit. No rival records where an LLM still intercedes so a future model can be tested on exactly those measures Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	◉	○	○	○	○
Provider terms ledger read from pinned contracts Source present; authored stronger claim: `xl_terms_ledger` in `runtime/nx_extllm.nx`, verified at emit. Thirteen provider rows, UNKNOWN refuses, an unpinned row admits nothing [stealtheula] [groqsa] Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	○	○	○
Egress classifier at the door: U or C per prompt byte Source present; authored stronger claim: `xl_egress_class` in `runtime/nx_extllm.nx`, verified at emit. A third-party provider is a sink cleared to U; the field scans prompts for patterns, ours resolves a clearance Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	○	○	○
Cumulative disclosure odometer per provider Source present; authored stronger claim: `xl_budget_verdict` in `runtime/nx_extllm_lib.nx`, verified at emit. The bound is on the SUM across calls, never the call; LiteLLM budgets spend per key [litellmrouting], not disclosure Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	◐
External call over sovereign TLS with one ledger row per call Measured: `xl_call` exists in `runtime/nx_extllm_call.nx`, verified at emit. Fourteen ledger rows against ox-alpha since 2026-08-25 with 200s, 429s and one 401 attributed; the key is read from a file outside the estate rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Ollama (local model server)Cons behind LiteLLM (routing gateway) (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	○	◉
Sovereign no-float seat serving Qwen2.5-0.5B on loopback Source present; authored stronger claim: `nsd_read_req` in `runtime/_hdl_build/nx_nofloat_serve.nx`, verified at emit. Integer forward, bit-exact by construction, 15 tok/s on a 16-core WSL and about 1 tok/s on the NAS CPU; Ollama serves any GGUF with a KV cache [ollamaapi] and is the bar Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), LiteLLM (routing gateway)Cons not adopted yet: compiled, never promoted to the serving root: /api/promote it	◉	○	○	◉	○
Self-localising fix loop with sampled retries on the local maker Measured: `lf_gen_t` exists in `runtime/nx_autofix_auto.nx`, verified at emit. Registered and never invoked over the MCP surface; Claude Code is the field's strongest fixer and the column it must be measured against rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Ollama (local model server), LiteLLM (routing gateway)Cons behind Claude Code (rented frontier seat) (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run	●	◉	●	○	○
Transcript harvest to sovereign action frames and the outside gauge Source present; authored stronger claim: `ch_gauge_json` in `runtime/_hdl_build/nx_claude_harvest.nx`, verified at emit. The session record is primary evidence; the gauge reports the share of tool calls that went outside the estate Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_claude_harvest_gate -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_claude_harvest_gate -- a mention, not a run Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_claude_harvest_gate -- a mention, not a run	◉	○	○	○	○
Token-efficiency ROI ledger per lever, realized versus projected Measured: `tr_report` exists in `runtime/_hdl_build/nx_tokroi.nx`, verified at emit. Investment to measured reduction with the evidence cited; registered and dark today rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	○	○	●
METER BEAT
session usage mined to the scoreboard with no seat Measured: `sm_beat` exists in `runtime/_hdl_build/nx_seat_meter_beat.nx`, verified at emit. The scoreboard's missing producer; a laptop organ because the transcripts live only there (the DM1 capture beat is the precedent); idempotent by day marker rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. dossiernot adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Ollama (local model server)Cons behind LiteLLM (routing gateway) (leads); not adopted yet: source exists, never compiled: /api/build it	●	●	●	○	◉
TIER
the Anthropic account tier declared and the Claude column priced DARK — `runtime/nx_extllm.nx` EXISTS but does not declare `xl_tier_declared`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The UNDECLARED row refuses today [anthropiccomm]; once declared the scoreboard converts tokens to that tier's published price and the page shows spend per closed rung dossierwatching xl_tier_declared Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
DISPATCH
one verb sends a task file to the cheapest engine whose terms permit its class and returns the judge's verdict with the engine named Source present; authored stronger claim: `ed_dispatch` in `runtime/nx_engine_dispatch.nx`, verified at emit. LiteLLM routes requests [litellmrouting] and OpenCode switches models [opencodemodels]; neither knows the task's clearance or a byte-exact judge; every dispatch appends a shift-ledger row so the local column moves Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	●	◐	◉
WORKER
rung worker loop over U-cleared plan rungs DARK — `runtime/nx_extllm.nx` EXISTS but does not declare `xl_rung_worker`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract extllm names as XL7; free workers climb the open rungs, the gates rule, the assistant judges dossierwatching xl_rung_worker Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
SAMPLER
sampler tiers as data -- local no-float, external free, Claude -- selected per task class DARK — `runtime/nx_autofix_auto.nx` EXISTS but does not declare `af_sampler_tier`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract autodev names as AD11; the free tier sees only U bytes and the Claude tier's output never enters the corpus rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching af_sampler_tier Pros none measured yetCons behind Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server) (leads), LiteLLM (routing gateway); open contract; expected source declaration not established	○	●	●	◉	●
BEST-OF-N against the byte-exact verifier with the local or free tier as the sampler DARK — `runtime/nx_forge.nx` EXISTS but does not declare `fg_best_of_n`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract coding names as CD2, extllm as XL5 and autodev as AD12, so four boards flip on one organ; pass at N monotone in N and NONE reported when nothing is GREEN [llmonkeys] dossierwatching fg_best_of_n Pros none measured yetCons behind Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), LiteLLM (routing gateway); open contract; expected source declaration not established	○	●	●	○	●
RESIDUE
per-session classifier of mechanical versus reasoning bytes Source present; authored stronger claim: `sm_residue` in `runtime/_hdl_build/nx_seat_meter_beat.nx`, verified at emit. The 92.9 percent mechanical and 7.1 percent reasoning hand measurement of 2026-07-21 as a standing organ (a verb of the meter beat, which already walks every transcript): MEASURED 2026-09-02 over 40 days and 327.9 MB, reasoning 56 permil, authored 245, mechanical 668 -- the shift target is a measured floor per session rather than folklore Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. dossiernot adopted: source exists, never compiled: /api/build it Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: source exists, never compiled: /api/build it	◉	○	○	○	○
BENCH
local seat beside the llama.cpp oracle on one GGUF and one host, as a .bench receipt Open — watching `runtime/nx_llm_h2h.nx` : `lh_bench_receipt`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The oracle is installed in its native language as a comparator only [llamacpp]; the receipt renders on this page through the lang domain's reader dossierwatching lh_bench_receipt Pros none measured yetCons behind Ollama (local model server) (leads); open contract; expected source declaration not established	○	○	○	◉	○
KV cache so local decode stops recomputing DARK — `runtime/nx_kvcache.nx` EXISTS but does not declare `kv_paged_attn`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract llm names as LM3; Ollama ships it [ollamaapi] dossierwatching kv_paged_attn Pros none measured yetCons behind Ollama (local model server) (leads); open contract; expected source declaration not established	○	○	○	◉	○
Fused dequant GEMM: the memory-bound decode lever Measured: `mq_fused_dequant_gemm` exists in `runtime/nx_nofloat_q4k.nx`, verified at emit. The same contract llm names as LM4 [marlin] Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	●	○
GPU offload behind the bit-exact contract through the sovereign dxg path Open — watching `runtime/nx_gpu_llm.nx` : `gpul_offload_layer`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The same contract llm names as LM9; the 2026-08-01 kernel that projected 42 tok/s at 14B ran in a C daemon over libcuda whose source is gone and which the operator's pure-NishiLang order forbids; the sovereign dxg reach is GREEN at R0 (enumerate adapters) and nothing above it rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching gpul_offload_layer Pros none measured yetCons behind Ollama (local model server) (leads); open contract; expected source declaration not established	○	○	○	◉	○
Remote replica: the laptop GPU seat joins the mesh as a live endpoint DARK — `runtime/nx_mesh_lb.nx` EXISTS but does not declare `lb_remote_replica`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract workermesh names as R3; the GPU is on the laptop, the office and the seat API are on the NAS rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching lb_remote_replica Pros none measured yetCons behind Ollama (local model server), LiteLLM (routing gateway) (leads); open contract; expected source declaration not established	○	○	○	●	◉
Forge authoring past the zero floor DARK — `runtime/nx_forge_engine.nx` EXISTS but does not declare `fe_author_organ`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract team names as R1; today every novel organ falls to Claude rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching fe_author_organ Pros none measured yetCons behind Claude Code (rented frontier seat) (leads), OpenCode (provider-agnostic agent) (leads); open contract; expected source declaration not established	○	◉	◉	○	○
Terms-gated distillation harvest into the sovereign corpus DARK — `runtime/nx_extllm.nx` EXISTS but does not declare `xl_distill_corpus`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The same contract extllm names as XL9 and autodev as AD19; never from ox-alpha [stealtheula] and never from Claude [anthropiccomm], lawfully from Groq [groqsa] dossierwatching xl_distill_corpus Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Instruction SFT over the integer LM Open — watching `runtime/nx_sft.nx` : `sft_run`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The same contract modelwright names as R0; the model is trained on our own substrate, bit-exact reproducible dossierwatching sft_run Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
RETIRE
Claude retired on a rung class when the sovereign seat clears the gap registry's measure DARK — `runtime/_hdl_build/nx_llm_gap_registry.nx` EXISTS but does not declare `lg_retire_class`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The dispatcher stops routing a class to the frontier seat once the custom seat passes that class over held-out tasks; the page prints classes retired with the date dossierwatching lg_retire_class Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
ROUTE AS DATA
the engine per task class is a conf row, not a seat's choice Measured: `ec_route_class` exists in `runtime/nx_engine_dispatch.nx`, verified at emit. The operator's 2026-09-02 order: no per-task engagement; OpenCode picks a provider per agent config [opencodemodels], LiteLLM routes by spend budget [litellmrouting], neither carries a clearance or a judge in the row Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	●	○	◐
TOKEN PRE-FLIGHT: the tool path names the cheaper read before the expensive one lands Measured: `tg_advise` exists in `runtime/_hdl_build/nx_tokgate.nx`, verified at emit. Measured 2026-09-02: 668 permil of this seat's tokens are tool output re-read into context; no rival instruments the read itself Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run. dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run	●	○	○	○	○
SHELL INTERLOCK: every harness shell call names its estate verb, or GAP Measured: `tg_shell_interlock` exists in `runtime/_hdl_build/nx_tokgate.nx`, verified at emit. SHARED CONTRACT with sovereignty SV3 (ES22, declared 2026-09-05): advisory PreToolUse on Bash and PowerShell, verbs read from hooks/shellverb.conf and each stat-checked against the declared source trees; the sanctioned launcher is allow-listed by needle; an unknown command reads GAP, never a guessed verb Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run. dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway)Cons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_tokgate_gate -- a mention, not a run	●	○	○	○	○
RATCHET
tokens per closed rung may not rise, and a fall with a grade drop reads RED Measured: `st_ratchet` exists in `runtime/_hdl_build/nx_seat.nx`, verified at emit. LiteLLM budgets spend per key [litellmrouting]; nobody in the field couples the token number to a quality floor per closed unit of work Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	◐
DIGEST NOT DUMP: verdict-line verbs on the organs that cost the most mechanical bytes DARK — `runtime/_hdl_build/nx_seat_meter_beat.nx` EXISTS but does not declare `dg_verdict_line`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The residue verb names the ten costliest producers; each gains a one-line verb with its envelope and the gauge shows the class shrink dossierwatching dg_verdict_line Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
ONE-STEP SOLVE: steps per common task mined from the action journal, ratcheted toward one with the reason declared Source present; authored stronger claim: `al_steps` in `runtime/_hdl_build/nx_actlog.nx`, verified at emit. OPEN -- rung ES26, the operator's 2026-09-06 goal. The incumbent miner already ranks recurring tool:verb n-grams by exact support; the step ruler joins them to a declared minimum with its reason or its composed verb, publishes one-step permil with the denominator, and names every undeclared signature most common first. No field platform measures steps-to-solve per task against a declared logical minimum Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
LEDGER PREFLIGHT: the audit row is proven writable before any engine runs, and a cheap engine that never answered refuses instead of escalating to the paid seat DARK — `runtime/nx_engine_dispatch.nx` EXISTS but does not declare `ed_ledger_preflight`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 in the shipped organ at 42246 B: ed_ledger_row returns -1 when sys_openat_append fails and ALL TEN of its call sites discard that code (corpus_complete=1), so an absent state dir silently loses the audit row the local column of this board is built from while the run still prints a verdict; and the escalation row at line 649 asserts every engine below the seat failed the judge, which is untrue when the local seat merely never answered, so the ledger misattributes its own spend to the rented frontier seat [anthropiccomm]. LiteLLM cools a failed deployment down and falls back [litellmrouting], but its fallback may cost more rather than less and its record is spend per key, not an append proven durable before the first token is bought dossierwatching ed_ledger_preflight Pros none measured yetCons behind LiteLLM (routing gateway); open contract; expected source declaration not established	○	○	○	○	◐
A rung contract answers with its incumbents and the record's rejections before a seat builds anything Source present; authored stronger claim: `rk_incumbents` in `runtime/nx_compare_rank.nx`, verified at emit. ES28 (operator 2026-09-14: the estate does this proactively, no treasure hunting): nx_incumbent_lib indexes every organ header, basename, func name, knowledge/ asset path and recorded rejection line in both runtime roots plus knowledge/index, and the ranker prints INCUMBENTS and PRIOR-REJECTIONS under every open rung from that stamped index; no rival answers a task's contract from its own record Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Claude Code (rented frontier seat), OpenCode (provider-agnostic agent), Ollama (local model server), LiteLLM (routing gateway); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	25	rows carrying a Yes, Best or Part in a rival column
cited	13	a reference mark resolves to a pinned mirror
uncited	12	an observation read, badged until a reference lands
rows, summed	25	RECONCILED: the parts sum to the total 25

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
A token cut that makes the answer worse	probable x high	The lossless-on-demand law: every digest declares its envelope and an escalation path; ES3 escalates to the frontier seat on a RED judge, never on a budget; the operator's 2026-07-21 order stands -- efficiency at SOTA quality, never a token killer
The gauge goes dark again and nobody notices	certain x medium	ES1 stamps its own beat and SessionStart prints the row age; an abstaining axis needs an axis-blind alarm, so a stale gauge reads STALE on this page, never as zero movement
Estate bytes reach a training provider	possible x high	The warden classifies every byte at the door, the odometer bounds the sum, the free tier sees U only [stealtheula]; the neg-control is planted and bite-proven on nx_extllm
A GPU shortcut in C or Python lands because it is faster to write	probable x high	ES7's done-rule names the path (dxg, own toolchain) and the gate reads the artifact's imports; a kernel not emitted by the sovereign toolchain does not flip the cell
A rival column graded from a banner	possible x medium	Every rival cell is grounded in a pinned mirror read this session; a claim without a mirror stays UNPROVEN

Debt register

Id	Sev	What it is	Unblock
meter-no-producernot in this scope	7	token_efficiency.log has had no producer since 2026-08-05: the daily claude rows were appended by hand and the local class has never been written by any organ, so the engine-shift scoreboard the operator ordered on 2026-07-20 measures nothing today.	ES1: the laptop meter beat, wired on SessionStart like nx_crashwin, idempotent by day.
llm-int4-adoption-1785561075not in this scope	8	The estate's own row 1785561075: the Q4_K path is BUILT in nx_nofloat_llm while the embed and decode route calls the f32 path, prefill does not batch, and the roofline says 221 to 27 ms per token is the prize.	ES8 and ES9: wire the quantized reader at the weight-fetch boundary, then prove the curve falls on the bench receipt.
gpu-path-lost-and-unsovereignnot in this scope	7	The 2026-08-01 GPU Q4_K kernel and its daemon existed only as C over libcuda and their sources are gone; the sovereign dxg path is GREEN at enumerate-only.	ES7 rebuilds it the sovereign way; the 2026-08-01 numbers are the bar to beat, banked in memory.
routing-built-three-times-wired-nowherenot in this scope	6	nx_llm_provider (zero production importers), nx_llm_route (zero active conf rows), nx_clawf_route (registered, dark): three routers, no route.	ES3 composes ONE dispatcher over lp_route_local and cr_route; the conf row is the only data added.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-02	ES1	land	nx_seat_meter_beat shipped on the laptop (_offc, SessionStart hook, gate 28 of 28 bite-proven) and backfilled 56 rows: nx_seat shift reads rows 61, out 139.3M, cread 66.4B; NAS twin buildroot/runtime/_hdl_build/nx_seat_meter_beat.nx sha b78305886f2a 56340 B byte-identical to the laptop
2026-09-02	ES3	land	nx_engine_dispatch ed_dispatch shipped on the laptop (gate 21 of 21, readiness measured by probe, bounded reap); the LOCAL column moved 0 to 1 for the first time since 2026-07-20 through the live nofloat seat; NAS twin buildroot/runtime/nx_engine_dispatch.nx 35215 B reads SOURCE-ONLY to nx_catalog by contract, the seat it drives lives on the laptop
2026-09-02	ES11	measure	residue over 40 days and 327.9 MB of transcripts: reasoning 56 permil, authored 245, mechanical 668 (nx_seat_meter_beat residue); the lever is the mechanical class
2026-09-02	ES8	measure	Qwen2.5-Coder-7B Q4_K_M on the laptop: the dequant-once i32 cache expands 7.6B weights to about 30 GB and was killed at 12 GB on a 15 GB host; mq_fused_dequant_gemm (LM4) is the remedy, debt 1788362867
2026-09-02	ES2	queue	xl_tier_declared waits on the operator's Anthropic tier row; the OpenRouter key at the /tmp path returns 401 and needs rotation into nx_vault
2026-09-02	ES16	queue	operator order 2026-09-02: token use minimised autonomously, no operator engagement, no quality loss; landed as ES16 to ES19 under M4 (version 1.5) and as standing law in the seat channel; ES16 recipe: engine_classes.conf rows read by ed_dispatch, an unclassed task refused by name
2026-09-02	ES0	lesson	a laptop-host organ reads SOURCE-ONLY on the NAS catalogue and that is correct, not a gap: two hosts means two ladders, so the plan row names which host owns the run
2026-09-02	ES16	land	ec_route_class SHIPPED: nx_engine_dispatch reads knowledge/engine_classes.conf (class, clearance, engine order, max_new ceiling), a task names its class with tclass, an unclassed task is refused by name, a C row listing external is refused at load; gate 29 of 29 GREEN (8 new teeth incl. 4 neg-controls), laptop _offc installed byte-identical, NAS twin buildroot/runtime/nx_engine_dispatch.nx 42248 B, conf on both trees
2026-09-02	ES17	land	tg_advise SHIPPED: nx_tokgate PreToolUse on Read and nx_fs read, floor from hooks/tokgate.conf (3072 B) with floor_src named in every message, bootstrap floor only when the conf is unreadable; gate 17 of 17 GREEN driven through real stdin payloads; hooked in settings.json; first live fire named nx_seat.nx at 165407 B as about 41351 tokens
2026-09-02	ES16	measure	lang tooling that was REGISTERED-DARK ran today through nx_job_run: nx_lsp_gate 19 of 19 GREEN, nx_pkg_gate 19 of 19 GREEN, nx_gdbstub_gate SKIP (stock gdb absent on the NAS, a precondition not a defect); roster trial green_or_skip 3 of 3, admit launched
2026-09-02	ES0	lesson	a laptop organ that can never run on the NAS still owes the NAS its SOURCE: the compare watch reads symbol presence from buildroot, so an unpushed laptop-only organ reads as an open contract forever
2026-09-02	ES18	land	st_ratchet SHIPPED in nx_seat shift: prev-window aggregates, ratchet GREEN/RED/UNMEASURED with its reason, quality floor from gateroster.stamp with grade_delta declared UNMEASURED-single-stamp; selftest T12b-T12e PASS on the laptop (UNMEASURED on empty, RED 100 to 500, GREEN 2000 to 500, floor declared); laptop _offc installed; NAS source landed by five anchored CAS edits (203463 B)
2026-09-02	ES18	queue	nx_organ_ship nx_seat REFUSED at step 1 by build admission (load 22.08 vs ceiling 16.43, VERDICT=QUEUE, queued=1): the NAS build fires on the next nx_orchestrate pass with headroom; verify with nx_store_put knowledge/store/deployq- load and the BQ-nx_seat row, then promote deliberately; until then the served nx_seat shift carries no ratchet fields
2026-09-02	ES16	measure	re-rank after the leg: engineshift rungs 20 done 7 (was 4) with ES16 ES17 ES18 counted done; lang done-but-dark 8 to 6 (LN11 and LR3 now on an execution surface)
2026-09-02	ES8	land	LM4 mq_fused_dequant_gemm SHIPPED on the laptop: runtime/nx_nofloat_q4k.nx keeps the Q4_K weights in the file map and dots them with nx_q4k_dot_simd_lib (extracted from nx_q4k_dot_simd; the bench organ rebuilt byte-identical to its banked sha 6814125d); nx_nofloat_serve gains route q4k (argv[4], decode mode 3, model file-mapped, no i32 or i16 layer cache, i32 or i8 requests refused by name); the attention core is ONE shared function for the i8 and q4k decoders (greedy text byte-identical before and after on the 0.5B); nx_nofloat_q4k_gate 17 of 17 GREEN with two neg-controls; every source landed on the NAS build tree by anchored CAS edits; the llm and engineshift matrix rows now watch runtime/nx_nofloat_q4k.nx instead of the never-written nx_marlin.nx
2026-09-02	ES8	measure	Qwen2.5-Coder-7B Q4_K_M NOW SERVES ON THE 16 GB LAPTOP: init 24 s, VmRSS 8.32 GB after 32 tokens where the dequant-once route was SIGKILLED at 12 GB; 168 of 196 projections read in place (3.12 GB of file map) and 28 Q6_K rows fall back to the i16 cache (1.95 GB, counted and announced); greedy 32-token decode 1690 and 1868 ms per token over two runs with identical text, down from 3134 with the byte-at-a-time unpack, via a u64 nibble spread (2385) and the 6-bit scale folded into the i16 lanes so one horizontal sum serves a whole super-block. 1.5B: 428 and 506 ms per token at 2.27 GB RSS against the i16 route at 254 ms per token and 10.4 GB RSS, greedy text IDENTICAL; bench organ: the fused SIMD dot is bit-exact with the scalar Q4_K dot at 2.09x its speed, which is the LM4 done-rule
2026-09-02	ES8	lesson	the i8 layer cache was never one byte per weight: nf_pack2 writes i16 lanes for vpmaddwd, so a 7B costs 13 GB of anonymous memory before any head or scratch and no cache hygiene could fit it; the fit came from reading the file map in place, and the remaining speed gap to the i16 route is the per-row unpack in scalar NishiLang (about 1.4 ops per weight), which names the next lang rung: a SIMD nibble-unpack intrinsic emitted by nx_cc
2026-09-02	ES8	queue	still open under ES8 and llm LM3: prefill runs one token at a time; the 28 Q6_K rows want a fused Q6_K dot so nothing falls back; the i32 head (2.2 GB at 7B) wants an i8 head; the dispatcher seat on 8032 stays the 0.5B on the incumbent route (restored, init 17 s) until the 7B decodes under one second per token, at which point it becomes a second engine row for U-class code drafting
2026-09-02	ES8	measure	WITH THE COMPILER-EMITTED UNPACK (lang LN28, __q4k_unpack32s, laptop compiler blessed a9480db0): 7B Q4_K_M greedy 32 tokens 1283 ms per token on the first run after init (page-cache faults on the 3.1 GB file map) and 819 ms per token warm, text identical to every earlier cut; 1.5B 546 then 413 ms per token. The kernel itself is 3.94x faster in isolation (nx_q4k_simd2_gate timing) but the serve moved less than that, so the per-token remainder is now outside the fused dot: per-route nanosecond accumulators are being added to /health so the next number is attributed, not guessed
2026-09-05	ES21	measure	THE COST THIS RUNG REMOVES, MEASURED ON THE DAY IT WAS DECLARED (2026-09-05). Two Claude understand-phase workflows mapped ONE operator goal (npc ai, physics, story, vegetation, weather, 60 fps via webgpu, photoreal, clipping, roadmap) onto the boards: 15 agents, 5,713,788 subagent tokens, 1,272 tool uses, ~50 min wall; a third fan-out of 18 build agents was launched and STOPPED by the operator before any write (0 write-class calls in its transcripts, measured). The operator's standing order that day: the estate, the lang, the engines, the APIs and MCP do the heavy lifting, Claude provides oversight. The local engine ladder cannot author organs today (engine_classes.conf ceiling 96 new tokens = NSV_MAXNEW, so code authoring is frontier-only by data -- that is ES12's rung, not a new one), but the MAPPING lift needs no language model at all: it is term matching over rung rows, a status join over the matrix and the accept- plane, a ledger count and a dependency sort. nx_goalmap_lib.nx (30,283 B) + nx_goalmap.nx (1,894 B) + _hdl_build/nx_goalmap_gate.nx (10,724 B) were written by the frontier seat in one pass and the gate fossil compiled to 166,087 B (buildroot/_build/nx_goalmap_gate.sov.elf); proof and promotion follow in this ledger. Next lift to move down the ladder: the read-only leg mappers' own method (title-word match -> rung -> organ catalog -> gates map -> accept plane) is exactly gm_run, so ES4's rung worker can feed a goal digest to the dispatcher instead of a transcript.
2026-09-05	ES21	land	THE GOAL MAPPER IS PROVEN AND LIVE ON THE NAS (2026-09-05, all on the sovereign wire, no shell in the path). nx_goalmap_gate: first run 15/16 RED -- tooth T4 caught a real defect (a repeated query word inflated the score, contradicting the header's DISTINCT claim); fixed in nx_goalmap_lib.nx by gm_word_dup (30,283 -> 30,987 B), rebuilt 166,952 B sha 463079f6, PROMOTED prev=1, REGISTERED callable=1, nx_job_run -> NX-NX-GOALMAP-GATE passed 16/16 verdict=GREEN with values emitted (rungs_matched_a=2 out_bytes_a=796 out_bytes_scale=7908 budget_bytes=8192): a planted operator REJECT flips status to PRESENT-REJECTED, a duplicate rung id is REFUSED by name, no-match returns EMPTY not a guess, 300 matching rungs stay inside the budget with clipped=1 announced and the count still 300, an unreadable domain returns NO-DOMAIN(-3). The program nx_goalmap.sov.elf built 105,558 B sha 59ae2b6e (the build receipt itself was a 503 read-after-accept; the artifact proved the call landed -- the estate's own law). STILL OWED on this rung: promote + register nx_goalmap, run it on the REAL boards (gameengine, graphics, charsim, npcai) and compare its order against the two critics' hand orders, bite the gate with nx_gate_bite (banks the twins first), and the nx_seat map verb. Status: shipped, referee = its own gate, awaiting the real-board run and operator acceptance.
2026-09-05	ES21	measure	FIRST RUN ON THE REAL BOARDS (2026-09-05, nx_job_run nx_goalmap gameengine,graphics,charsim,npcai webgpu cast npc physics locomotion story vegetation weather fps photoreal clipping roadmap). Run 1 REFUSED BY NAME: duplicate-rung-id GE50 on gameengine.plan -- the defect both critics had found, caught by the organ in production before any map was emitted; fixed as data (the ft_metric_set row re-numbered GE56 under CAS, GE51's dependency followed). Run 2: gameengine plan 226,389 B read whole (truncated 0), matrix 108 rows, rungs_total 55, rungs_matched 26, cycle 0; top score GE53 wc_surface_source 4 of 12 words; GE12 mob_step_gait reads PRESENT-REJECTED straight from knowledge/store/accept- (beach-feet-planted-0830); GE24 wc_set_style_i PRESENT; 19 matrix watch gaps with the three roots probed (e.g. rb3_solve src 0 built 0 promoted 0; gpe_webgpu_default src 1 built 1 promoted 1); verdicts naming gameengine: 3 REJECTs. graphics 56 rungs / 12 matched, charsim 26 / 4, npcai 23 / 10. Order agrees with the critics on the load-bearing chain GE42 -> GE53 and GE44 -> GE54 / GE55, and disagrees where the critics used cost and box state (the ranker's priority stamp is the missing tie-break -- queued). TWO v1.1 DEFECTS FROM THE REAL RUN: the 8,192 B budget clipped graphics to 3 rows and emptied charsim and npcai (clipped=1 announced, counts still full) -> GM_OUTCAP 16,384; and a rung whose own symbol column carries the _ABSENT_: prefix (GE26) read UNMAPPED because the matrix core was compared against the prefixed span -> normalise the prefix at parse. Cost of this map: ONE job of a 105 KB organ over 428 KB of boards, versus 5.7M subagent tokens this morning.
2026-09-05	ES21	land	v1.1 LIVE AND THE FIRST WHOLE-ESTATE GOAL MAP IS ON DISK (2026-09-05). nx_goalmap 106,058 B sha ea3e471f PROMOTED prev=1 + offc; one nx_job_run over gameengine,graphics,charsim,npcai with the operator's twelve goal words returned a 16,157 B digest (budget 16,384 declared, clipped=1 only on npcai's gap list 2 of 13, every rung list complete): gameengine 55 rungs / 26 matched, top GE53 wc_surface_source score 4, GE12 mob_step_gait PRESENT-REJECTED, GE24 PRESENT, GE26 now OPEN as ws_gt_reproduce (the v1.1 prefix normalisation proven on real data), 19 watch gaps with SOURCE/BUILT/PROMOTED probed, 3 operator REJECTs joined; graphics 56 / 12 -- GR11 cw_webgpu_compute, GR35 gpe_asset_ladder, GR42 env_beauty_scene, GR46 rk_shadow_cascade lead, GR20 cc_garment_pen -> GR25 pl_fit_solve is the clipping chain, GR29 gpe_skin_microsurface PRESENT-REJECTED, and TWO RUNGS READ UNMAPPED BECAUSE THEY HAVE NO MATRIX WATCH CELL (GR49 tl_translation_census, GR51 gpe_hair_penetration_tooth -- board hygiene the map surfaced); charsim 26 / 4 -- R6 cw_npc_atlas PRESENT, R10 rs_schedule_tick whose organ runtime/nx_relsim.nx reads src=0 (a watch pointed at a file that does not exist), R11 cm_npc_turn, R16 dr_reflect_agent; npcai 23 / 10 -- NP17 gb_npc_bench and NP18 wc_step_up lead, then NP4 mob_route -> NP5 mob_avoid -> NP7 mob_schedule -> NP8 mob_reserve, NP10 go_reputation -> NP12 cm_npc_turn, NP16, NP19. The gate gained T15 (prefix normalisation) and rebuilt 168,142 B sha 70ee75fb; promote in flight. QUEUE, in order: nx_seat map verb delegating to gm_run (one organ for boot digest and goal map); join the ranker's .rank priority stamp as the tie-break inside the dependency order; a matrix-watch-missing axis (UNMAPPED rungs named as a worklist, since a rung without a cell cannot flip on /compare); feed the digest to nx_plan_run / nx_engine_dispatch so the estate executes the data-only steps of a map without a seat. Status: shipped, referee = nx_goalmap_gate, awaiting operator acceptance.
2026-09-05	ES21	measure	BITE-PROVEN (2026-09-05): nx_gate_bite nx_goalmap_gate buildroot/runtime/nx_goalmap_lib.nx 2 via nx_job_run -> baseline build_exit=0 gate_exit=0 green=1 judge=verdict-line baseline_artifact_bytes=168142; operator 1 COMPARISON cmp site 0 @off=3636 build_exit=0 -> KILLED (gate went RED on a mutant that COMPILED); restore verified 31772 bytes byte-identical to pristine; cleanup_build_exit=0; twins RESTORED _offc/nx_goalmap_gate.elf and nx_goalmap_gate.elf; artifact_custody twins_checked=2 restored=2 refreshed=0 healed=0 mutant_live=0; valid_mutants=1 invalid_uncompilable=0 not_reached=0 killed=1; VERDICT GREEN (non-vacuity proven). The mutant build ran through the fixed builder (unlink-after-admission) with a live twin present and the harness's own custody check read mutant_live=0 -- the every-mutant-build-is-a-deploy hazard was handled by the harness, not by luck. Independent hash check of both twins against the promoted sha 70ee75fb follows this row.
2026-09-05	ES21	measure	EXPOSED ON EVERY SURFACE (2026-09-05, operator asked 'has it been promoted and exposed to mcp and api and all that'): nx_catalog nx_goalmap -> SOURCE yes 1894B, BUILT yes 106058B, PROMOTED yes 106058B, REGISTERED yes (on the MCP surface), AUTHORISED yes (cap minted: allow=nx_goalmap,nx_goalmap_gate exp 1791213446 nonce 20260905, saved laptop-side as ~/.nishi/goalmap.cap), INVOKED yes, VERDICT LIVE. Callable now by name through the tools API and nx_job_run (three real runs today); the MCP tools/list discovery half: the first nx_toolreg_reconcile read skipped-no-schema=1, nx_toolgrammar was run (scanned 1606 emitted 1380 -- harvested the usage line from nx_goalmap.nx's own header) and a second reconcile was issued so the tool appears in tools/list with a real call grammar. Both runner twins (_offc) byte-identical to the promoted binaries.
2026-09-05	ES21	measure	nx_goalmap SIGSEGV at 0x401e23 (null deref) on two real queries this seat ran through nx_job_run: 8 boards x 16 words, and 4 boards x 26 words; the 4-board control with 8 words, 7 boards x 8 words, and a 1-board ladder of 9/12/16 words all pass -- so the crash is not the domain count (GM_MAXDOM 16) and not the raw word count alone; GM_MAXWORDS=24 is exceeded silently by the 26-word run (no refusal), and the 16-word runs crash only on the boards with the most matches (graphics 23 of 56 already at 8 words)
2026-09-05	ES21	queue	nx_goalmap: refuse past GM_MAXWORDS by name instead of walking off the array, and bisect the matched-rung overflow on graphics/gameengine with 16 words (jobs /tmp/gm_e7.out /tmp/gm_e8.out /tmp/gm_e9.out); rebuild with --debug so nx_addr2line can name 0x401e23; gate tooth: a query one past every cap must REFUSE, never crash
2026-09-05	ES16	measure	farm-out state for review and grading work, read 2026-09-05 by the DanceXR evaluation seat: engine_classes.conf carries five class rows (estate-internal, debt-triage, code-summary, frontier-only all C local; public-lookup the one U row local,external), every ceiling inherited at 96 new tokens from NSV_MAXNEW; no row names the worker the operator calls ox alpha, and adding one is an operator edit to this file by design (a task naming no row is refused by name); nx_pm_intake is capability-denied to the ce2lane and storm caps, so a seat that finds work cannot file it into the intake without minting a cap through the mgmt API first -- the ranker is the one path that files intake rows on its own (PM filed=2 of top 3 on every rank run)
2026-09-05	ES16	queue	the DanceXR census grading (37 vendor capability rows against the miner's 4) is a review-shaped task: below 96 tokens it can only be a per-row YES or NO classification, so the shape that fits the ladder today is one dispatch per row with judge contains, driven by a plan-run row set, not a document review; the first such dispatch is staged as knowledge/status/dxr_grade_task.conf (tclass debt-triage, judge contains NO) and its ledger row is the receipt
2026-09-05	ES3	measure	first grading dispatch from a seat, 2026-09-05 (task knowledge/status/dxr_grade_task.conf, tclass debt-triage, judge contains NO, max_new 8): ENGINE local status=ANSWERED-UNPARSEABLE http=0, external SKIPPED-by-class-order, verdict NEEDS-FRONTIER -- the ladder escalated correctly, but http=0 is a socket that never answered, and nx_services lists no engine on 127.0.0.1:8032 on this host, so the true state was UNREACHABLE and the status word said ANSWERED; a message that names the wrong stage costs the reader the investigation it was written to save (the dispatcher's own header promises UNOBSERVABLE for an unreadable answer and this is a different condition again); owed: a NOT-LISTENING status distinct from UNPARSEABLE, and the local seat actually serving on the estate host before any review work can be farmed to it
2026-09-05	ES23	measure	ROOT CAUSE of debt 1788626163, read from the source rather than a debugger (the promoted binary carries no .debug_line and the debug rebuild was refused by admission): gm_room budgets every ROW emit against GM_OUTCAP but the per-domain scaffolding (header numbers, array openers and closers, about 245 bytes per domain) is unbudgeted, so once the row budget is spent each further domain grows the digest past 16384 and over the edge of the CLI's 16384-byte buffer into the page that holds the word pointers; a corrupted pointer is non-canonical and x86-64 reports that fault at address 0, which is exactly what the crash guard printed; every crash this seat measured had output past the budget (8 boards x 16 words, 4 boards x 24 words) and every pass was under it (7 boards x 8 words landed at 15993 B); the gate's scale tooth never saw it because one domain's scaffolding fits inside the 200-byte tail reserve
2026-09-05	ES22	land	tg_shell_interlock SHIPPED inside nx_tokgate (the ES17 organ grew the verb; no sibling organ, one hook binary): PreToolUse on Bash and PowerShell in settings.json, verbs read from nishi-ops/hooks/shellverb.conf (tree, allow and verb rows: 40 verb rows, 3 allow rows), every named verb stat-checked against the declared source trees and printed source=present, ABSENT or unverified, GAP naming the rung to declare when no row matches, the sanctioned launcher allow-listed by needle; nx_tokgate_gate 32 of 32 GREEN (was 17) driven through real stdin payloads with neg-controls for the launcher, the hook wrapper, the unknown command, the unreadable verb table and never-block, values emitted (shell_advisory_bytes_bash=430 launcher_bytes=0 gap_bytes=515); laptop _offc installed (nx_tokgate 40376 B sha bbda5125, gate 53297 B sha 34069634); NAS source landed by CAS edits: buildroot/runtime/_hdl_build/nx_tokgate.nx 25677 B, nx_tokgate_gate.nx 16568 B; the sovereignty.matrix watch row named runtime/nx_tokgate.nx, a path that does not exist on the NAS, so the shared contract could never flip -- corrected to runtime/_hdl_build/nx_tokgate.nx, and engineshift.matrix gained its own watch row for the shared contract
2026-09-05	ES22	lesson	A WATCH ROW WHOSE ORGAN PATH DOES NOT EXIST IS A CONTRACT THAT CAN NEVER FLIP: the SV3 row named runtime/nx_tokgate.nx while every hook organ lives under runtime/_hdl_build; the cell would have read OPEN forever with the organ shipped. Check the organ path with nx_fs size before declaring a watch, and put the first live fire in the receipt: the interlock fired on this seat's own PowerShell launches the moment it was wired, silent on the allow-listed launcher as designed
2026-09-05	ES22	land	nx_tokgate itself passed the rule-11 ruler: nx_magic map 76 sites / 41 distinct -> 0, every literal now a const named for its meaning (TG_CH_, TG_COL_, TG_ARGV_, TG_VS_), tg_is_jsonl derives its suffix length from the bound literal; gate 32/32 held after the hoist; laptop _offc/nx_tokgate.elf rebuilt 40227 B sha eee1d6ec and installed; NAS source buildroot/runtime/_hdl_build/nx_tokgate.nx replaced whole under CAS (25677 -> 28235 B); NAS build not issued while nx_build_admit refuses on the storm ceiling (load1_centi 2065 vs 1643) -- the hook runs the laptop copy so the interlock is live regardless
2026-09-05	ES24	land	DISPATCHER NO-REPLY LIVE (2026-09-05): nx_engine_dispatch built 94832 B through the mgmt lane, contentdiff live-vs-staged lost_from_live=0 gained 3 (the NO-REPLY status line, its ledger token and its note), PROMOTED at sha 298be1cd with prev banked; nx_engine_dispatch_gate (BUILT-UNPROMOTED on no roster since 2026-09-02) promoted at 333d603a, REGISTERED, offc-installed, and run against the promoted dispatcher: 29/29 GREEN, ledger partition 14 of 14 -- the regression proof for the fix
2026-09-05	ES24	measure	THE NEW TOOTH HAS NOT EXECUTED, AND THE REASON IS A BUILD-LANE DEFECT: the gate source carries the mute fixture seat and the NO-REPLY tooth (27691 B, src_sha256 27578cd6 confirmed by nx_filehash), yet /api/build returned BUILT 73200 B sha 333d603a -- byte-identical to the stage that existed BEFORE the edits -- and the promoted gate's own partition line still reads 14, the pre-edit count; nx_pageref_gate showed the same shape (rebuilt after the pr_declared_hit floor fix, identical sha 4b00a33d); two gates, two changed sources, two receipts saying BUILT with the old bytes; the sovereign lane nx_sov_build_run --build-only is the control in flight; until it lands the NO-REPLY tooth is source-proven only
2026-09-05	ES23	queue	goalmap v1.2 SOURCE COMPLETE (2026-09-05): nx_goalmap_lib 34722 B (GM_MAXWORDS/GM_MAXRUNG/GM_MAXMAT/GM_MAXDOM deleted; gm_ndom, gm_outbuf, gm_count_pfx, gm_count_lines added; rec/mi/order/mrec allocated per domain from counts; gm_parse_rungs and gm_parse_matrix take the count as cap; gm_order sizes em from nm), nx_goalmap 2148 B (words from argc, out from gm_outbuf), nx_goalmap_gate 13760 B (T16 four clipped domains past the row budget, T17 at or under gm_outbuf with JSON closed and clipped announced, T18 gm_ndom token count, T19 scaffold measured against GM_DOM_RESERVE, out buffer from gm_outbuf); /api/build for nx_goalmap (job 1788630860) and nx_goalmap_gate (job 1788630862) are CLAIMED behind build admission (QUEUE: run queue 10-23 on 8 cpus, load 18-34); nothing promoted yet -- the crashing 8-board 16-word query is the acceptance run once the gate reads GREEN
2026-09-05	ES24	queue	OWED after the storm clears: the sovereign-lane control build of nx_engine_dispatch_gate (refused QUEUE twice), then its run to execute the NO-REPLY tooth (the promoted gate is the pre-edit bytes, partition 14); nx_swcompare_sota rebuild (job 1788630876, CLAIMED) so the sota generator carries the lib the matrix now uses; the local seat nx_nofloat_serve is still BUILT-UNPROMOTED and 127.0.0.1:8032 is a listener that is not a seat -- the second half of this rung is an operator deploy decision
2026-09-05	ES23	measure	ACCEPTANCE PROBE (2026-09-05): nx_behaveprobe nx_goalmap on the four-board 26-word query that crashed the promoted binary -- live 960 B (the crash guard's text) against the staged v1.2 build 16536 B of digest, both processes exiting clean from the probe's view; the staged gate (sovereign build 171143 B sha e1c64d31, four new teeth) read other_rc=0 with 2363 B of teeth output against the promoted gate's 1823, so T16 (four clipped domains push out_bytes past the row budget), T17 (at or under gm_outbuf, JSON closed, clipped announced), T18 (gm_ndom token count) and T19 (scaffold measured under GM_DOM_RESERVE) all executed and passed; every build went through the SOVEREIGN lane after the mgmt lane served stale bytes: nx_goalmap 107487 B sha eca5e929 staged, gate promote in flight, contentdiff before the organ promote
2026-09-05	ES23	land	GOALMAP v1.2 LIVE (2026-09-05): nx_goalmap PROMOTED 107487 B sha eca5e929 with prev banked (contentdiff live-vs-staged IDENTICAL-CONTENT, 0 lost 0 gained), nx_goalmap_gate PROMOTED 171143 B sha e1c64d31 (staged probe other_rc=0 with the four new teeth executed), both offc-installed; ACCEPTANCE: the exact 8-board 16-word query that SIGSEGV'd the old binary (debt 1788626163) now answers on the live binary -- 16096 bytes of digest through nx_job_run, no crash guard text; the array caps GM_MAXWORDS GM_MAXRUNG GM_MAXMAT GM_MAXDOM are gone from the source, sizes derive from the input, and the one declared reserve (GM_DOM_RESERVE 400) is measured by the gate on every run; debt 1788626163 is closable by its owner on this receipt
2026-09-05	ES24	land	NO-REPLY GATE LIVE AND WITNESSED (2026-09-05): nx_engine_dispatch_gate rebuilt through the sovereign lane in debug flavour (76480 B sha d378c4f4; the mgmt lane had served the PRE-EDIT 333d603a twice, and the release-flavour sovereign build tripped CAPLOSS at 67485 B), contentdiff live-vs-staged lost exactly one run -- the old 14-row ledger partition string, replaced by the 16-row line -- PROMOTED with allow_capability_loss=yes prev=1, offc-installed; run against the promoted dispatcher via nx_job_run with the subject arg: 31/31 GREEN, ledger rows=16 partition sums (t42 1 + tkat 3 + tnc 0 + t42-noext 2 + unreachable 1 + push-failed 1 + tcls 1 + tfront 3 + tnoloc 2 + mute 2), T12b a socket that accepts and closes with no body reads NO-REPLY writes its own ledger status and hands off PASS, neg-control no-body-is-never-UNPARSEABLE-or-UNREACHABLE PASS; done-rule met on the mechanical side, referee grade + operator ACCEPT owed
2026-09-05	ES24	lesson	the same gate source built three ways in one hour gave three binaries -- 73200 (mgmt lane, PRE-EDIT bytes served as BUILT), 67485 (sovereign release, refused CAPLOSS against the debug live), 76480 (sovereign debug, promoted) -- so a build receipt names a LANE and a FLAVOUR or it names nothing; the promote guard was right all three times and was never loosened
2026-09-05	ES21	measure	MEASURED 2026-09-05 from the served nishihost/nx_goalmap.elf (BUILT 106058 == PROMOTED 106058): SIGSEGV at 0x401e23 touching address 0 on charsim,koikatsu,gameengine,procgen,graphics,dcc,intelmine x 16 words -- the SAME address as debt 1788626163, although runtime/nx_goalmap.nx now reads v1.2 sizing every buffer from the input. Either the served elf predates the v1.2 source (the build was queued under admission and never promoted) or the fault is inside nx_goalmap_lib rather than the CLI; the discriminator is one nx_sov_build_run nx_goalmap --build-only plus nx_addr2line on a -g build. The modding lane read its board map by hand meanwhile.
2026-09-05	ES21	land	FIXED AND SHIPPED 2026-09-05 (modding lane): nx_goalmap rebuilt from the v1.2 source through nx_organ_ship (sha ca4209fc675ea719b55bcbc65eb48fbd3415579c2da81f74b7a5898ccf7d13dc, promoted, offc twin fresh, registered), and the query that crashed the served binary -- charsim,koikatsu,gameengine,procgen,graphics,dcc,intelmine x 16 words -- now returns a full map (charsim 19 rungs matched, R26 first, 7 gaps probed; koikatsu 8). So the served elf HAD predated the source fix. The ship's PROVE ran the on-disk nx_goalmap_gate 21 of 21 because the gate rebuild was refused by admission and queued (BQ-nx_goalmap_gate); the real-query run is the proof that the promoted binary does not crash. Debt 1788626163 eaten with this receipt.
2026-09-06	ES27	lesson	OPERATOR 2026-09-06 (verbatim): malformed should be part of our 1 2 3 step type evaluation as a bad 1 step not rigourously evaluated is worse than a 40 step perfect or excellent deliverable, qualitative and quantitative, use the webgpu lane mess as a good example of a disaster we are targeting to address in the future, bad output, random coding, etc. it shouldve been an easy hit out of the park wiht all the benchmarks and oracles and industry documentation but has a rolling disaster -- captured here as rung ES27 (a quality axis on the step ruler: without an outcome axis the step metric rewards exactly the failure it was built to remove) and as a retract row on the WebGPU board naming the oracles that existed and were not used
2026-09-06	ES27	land	SHIPPED (not accepted) 2026-09-06: the QUALITY axis is live end to end. nx_stepsolve_lib grew ss_fail_permil / ss_quality_permil (1000 - failure permil) / ss_risk (support x failure permil) and a fail parameter on ss_totals_add; the spine and stamp publish
2026-09-06	ES27	measure	GATE GREEN 42/42 on the PROMOTED nx_actlog through a scratch registration: the failing one-step pair nx_gone:call>nx_gtwo:call (support 5, first 4 outcomes fail) reads fail=4 fail_permil=800 risk=4000; the clean triple nx_hone>nx_htwo>nx_hthree (support 3) reads fail=0 risk=0; the UNDECLARED class carries fail 4 of 8 = permil 500; totals total_fail=4 quality_permil=500; worklist_risk holds EXACTLY the failing pair and never the clean triple. The discrimination is BITE-PROVEN (quality-axis-taints-the-failing-pair-and-never-the-clean-triple fires on bad, silent on good). Quality gauge stamp FRESH gauge=500 through the same nx_gauge_lib ruler the /compare emitter renders. Operator directive proven: a badly evaluated one-step (risk 4000) outranks a rigorous multi-step (risk 0), so the step ruler can no longer reward a bad one-step over a good forty-step.
2026-09-06	ES26	queue	declared from the operator's 2026-09-06 order (verbatim: give the estate a goal, if we can solve a task in 1 step within logic then we should explain why and evaluate why we need two steps and if we cant do it in two steps we should evaluate why and explain why we need to do it in 3 and so on from our most common tasks to our least we should be mining and evaluating this efficacy). Incumbents composed, not duplicated: nx_actlog mine/freq/harden (the indexed n-gram miner over knowledge/status/actlog.jrnl, 56,713,361 B live, sized from the input), nx_wfcost (recurring pair token cost), nx_common_tasks (the ONE canonical organ per common task with its consolidation-debt column). Build order: al_steps verb on nx_actlog + knowledge/stepsolve.conf (data) + nx_stepsolve_gate with a planted journal + daily clock row + gauge stamp knowledge/status/stepsolve.stamp. Architecture twin: ecosystem EC37.
2026-09-06	ES26	measure	FIRST LIVE BEAT (nx_actlog steps over knowledge/status/actlog.jrnl, served binary 154360 B sha 29ac8aa7, nx_actlog_gate GREEN 7/7 on this generation): frames=715026 journal_bytes=56769738 truncated=0 index_overflow=0 bigrams_closed=1909 trigrams=3703 signatures=5612 support=1324286 partition_sums=1 explained_permil=0 -- every signature UNDECLARED. The most common ritual in the estate is nx_fs:call>nx_fs:call at support 119718 (a receipt poll: .claim then .out), then the three-read chain at 87509; the clock plane's fork adjacencies (elf:run>elf:run) fill most of the remaining top 40. Spine knowledge/status/stepsolve.spine (row 1), stamp knowledge/status/stepsolve.stamp FRESH axes 2/2; clock row stepsolvebeat 86400 declared (rows=176); gauge rows on engineshift.gauge and codeeffectiveness.gauge point at the stamp.
2026-09-06	ES26	retract	explained_permil=0 on beat 1 was a VOCABULARY defect in knowledge/stepsolve.conf, not a ruler finding: the seven seed rows were spelled tool:use (the harvested-transcript verb) while the production journal spells MCP frames tool:call, forks elf:run and harness shell Bash:- so no row could match. Rewritten under CAS (2522 to 5915 B) in the journal's spelling with 20 rows, each carrying the support it was read at; a signature whose reason this seat could not state from evidence stays UNDECLARED on purpose. Lesson: a conf keyed on a journal's vocabulary must be proven against the journal it is read over, and it was the ruler's UNDECLARED class that made the defect visible instead of a silent zero.
2026-09-06	ES26	measure	SECOND LIVE BEAT with the corrected conf (20 rows, journal spelling): frames=715256 signatures=5612 support=1324689 partition_sums=1 explained_permil=256 -- UNDECLARED 985400 (743 permil, 5593 sigs) . REDUCIBLE 257180 (194, 10) . DEPENDENCY 68000 (51, 5) . ONE-STEP-AVAILABLE 14109 (10, 4). The remaining UNDECLARED mass is fork adjacency (elf:run>elf:run, the clock plane and the job lane) and harness pairs (Bash:- PowerShell:- Edit:-). Spine row 2, stamp FRESH.
2026-09-06	ES26	land	SHIPPED, NOT ACCEPTED: nx_actlog steps verb PROMOTED 154360 B sha 29ac8aa7 (the 503'd promote had landed; NOTHING-STAGED with the built sha proved it), _offc refreshed, nx_actlog_gate GREEN 7/7 on this generation; nx_stepsolve_gate BUILT via /api/build 56232 B sha c42c7813 (src_path names it, src_stable 1), PROMOTED, REGISTERED callable, _offc hash-matched, GREEN 25/25 on the served miner through nx_job_run with its bite tooth proven. Owed before ACCEPT: referee grade + operator ACCEPT row in knowledge/store/accept-.
2026-09-06	ES26	queue	GROWTH IN FLIGHT: a verbclass
2026-09-06	ES26	measure	GENERATION CONTROL before the new miner exists: the new gate (staged 58896 B sha 10bda754, run as a scratch registration against the OLD served miner) reads RED 20/31 and every failing tooth is a rule tooth -- conf_rules, BY-RULE support, undeclared 8 not 5, explained 578 = 11/19 with the fork pair counted UNDECLARED, the rules array, the E row, the worklist, the second bite -- while every vocabulary-independent tooth still passes. The teeth discriminate the generation, not the fixture.
2026-09-06	ES26	land	CONTRACT SYMBOL MADE REAL: the watch row names al_steps and the miner had only al_steps_sig / al_steps_emit_one / al_steps_json, so the ranker read ES26 OPEN at rank 17; the entry the dispatcher calls is now func al_steps (definition + call site renamed under size CAS, 81332 -> 81327 -> 81322, the second attempt of the call-site rename correctly REFUSED because the first had landed). Conf grew the two verbclass rows (run, -) under CAS 5915 -> 6695. Miner build in flight on the sovereign lane, --build-only; the mgmt lane's queued BQ-nx_actlog fires on headroom with the same source.
2026-09-06	ES26	measure	THIRD LIVE BEAT on the promoted rule-aware miner (161984 B sha b006ffe1; one lost run named and accepted: the symbol al_steps_json renamed to the contract's al_steps; 10 runs gained): frames=716124 signatures=5618 support=1326263 partition_sums=1 explained_permil=748 -- BY-RULE 653248 (492 permil, 2816 sigs: rule run 532293 over 1552 sigs, rule - 120955 over 1264) . REDUCIBLE 257828 (194, 10) . DEPENDENCY 68075 (51, 5) . ONE-STEP-AVAILABLE 14124 (10, 4) . UNDECLARED 332988 (251, 2783). The worklist is now the seat's own undeclared rituals, most common first: nx_fs:call>nx_shelltool:call 8821 . nx_swarm_beat:call>nx_swarm_gpu:call 5584 . nx_fs>nx_fs>nx_shelltool 5578 . nx_filehash>nx_filehash 4559 . nx_mgmt>nx_mgmt 4440 . nx_fs>nx_filehash 4283 . nx_job_run>nx_fs 3514 (a job launch and its receipt read: the claim-or-out verb again). Spine row 3, stamp FRESH axes 2/2. Beat over beat: 0 -> 256 -> 748, each step a declared reason, none a loosened ruler.
2026-09-06	ES26	land	RULE-AWARE GATE PROVEN AND PROMOTED (shipped, not accepted): nx_stepsolve_gate rebuilt on the sovereign lane (58864 B sha d20bfbf8, the mgmt lane refused exit 6 and queued BQ-nx_stepsolve_gate; BQ-nx_actlog is queued too -- both will re-stage the same sources later and those stages are NOT to be promoted blindly, the promoted binaries already carry the source), staged by filecopy, run from the stage as a scratch registration: GREEN 31/31 with BOTH bites proven (undeclared-never-carries-a-verb; verbclass-fires-on-the-fork-pair-never-one-step). Promote guard refused CAPLOSS 113 permil; nx_contentdiff enumerated it -- lost_from_live=23 (8 shown, a prefix of its own count), ALL lost_other = the OLD planted population's strings (tool:use rows, the old tooth names, the old expected needles), lost_srcpath 0 lost_symbolname 0, gained 48 (tool:call rows, the E/F fork fixtures, the rule teeth) -- a deliberate fixture rewrite, promoted with allow_capability_loss=yes on that enumeration. Cap minted (nonce 202609067, 30 days). LESSON: gv_bite(name, fired_on_bad, fired_on_good, ctr) -- the second argument is FIRED-ON-GOOD and must be 0; passing a correct silence as 1 read a false positive on a correct gate; the first bite had it right and the second copied the wrong shape.
2026-09-06	ES26	measure	SERVED-SURFACE PROOF: the promoted nx_stepsolve_gate (58864 B sha d20bfbf8) run through its registered row reads GREEN 31/31, both bites proven; _offc twin hash-matched; scratch registration nx_stepsolve_gate_staged REAPED (rows_in=1696 reaped=1). Catalog: nx_actlog LIVE end to end; nx_stepsolve_gate promoted, registered, cap minted. STATE: shipped, referee grade and operator ACCEPT owed; the /compare page renders the gauge row on the next regen beat (not forced under the storm).
2026-09-06	ES26	land	THE COMPOSED VERB FOR THE MOST COMMON RITUAL, SOURCE-LANDED ON THE CANONICAL READER: nx_fs job <id> (nx_fsops, the organ behind the MCP nx_fs) reads the job's terminal marker and, only when it says DONE, the output, in ONE call -- six named states NOSUCH / RUNNING (exit 8) / DONE / DONE-EMPTY / UNPARSED / REFUSED (digits-only id, cannot leave its directory); lib fsx_job_at (gate-drivable on a /tmp fixture) + fsx_job binding, CLI header + usage + dispatch (the published grammar law), nx_fsops_gate 40 -> 46 teeth incl. a neg-control. Capsearch over 7469 organs found no incumbent (nx_job_run launches, nothing reads a receipt in one call). AHEAD check first: nx_contentdiff live vs an unchanged-source build read GREEN strict superset (lost 0), so the served reader is not ahead of its source. On promote, the conf rows nx_fs:call>nx_fs:call (120106) and the three-read chain (87785) become ONE-STEP-AVAILABLE with one_step_verb nx_fs job -- the fourth beat measures the adoption gap. Builds queued via /api/build under CPU saturation.
2026-09-06	ES26	land	THE VERB IS LIVE AND WITNESSED: nx_fsops PROMOTED 54152 B sha 928efec3 (content ruler GREEN strict superset, +80 runs incl. the eight job strings; nx_fsops_gate 40 -> 46 teeth GREEN 47/47 from the stage, PROMOTED 85336 B sha 1356aeb3 -- the mgmt lane built it byte-identical to the sovereign lane; scratch registration reaped; _offc twins refreshed). WITNESS on the served surface: nx_fs job 1788707685 returned the marker AND the output in ONE call, byte-identical to the two-read control. knowledge/stepsolve.conf rows for nx_fs:call>nx_fs:call and the three-read chain now carry one_step_verb nx_fs job (6811 B).
2026-09-06	ES26	measure	FOURTH LIVE BEAT (the adoption-gap reading): frames=717390 signatures=5631 support=1328611 partition_sums=1 explained_permil=748 -- ONE-STEP-AVAILABLE 222709 (167 permil, 6 sigs; was 14124) . REDUCIBLE 50040 (37, 8; was 257828) . DEPENDENCY 68177 (51, 5) . BY-RULE 653609 (491, 2820) . UNDECLARED 334076 (251, 2792). The receipt-poll pair (120501) and chain (88049) moved from REDUCIBLE to ONE-STEP-AVAILABLE with a live verb: from here their support is the ADOPTION GAP the ratchet must drive down, seat by seat. Next worklist rows: nx_fs>nx_shelltool 8822, nx_swarm_beat>nx_swarm_gpu 5585, nx_fs>nx_fs>nx_shelltool 5579, nx_filehash pairs, nx_mgmt>nx_mgmt 4444, nx_job_run>nx_fs 3534 (nx_fs job answers that one too: declare it).
2026-09-05	ES25	land	LANDED AND WITNESSED (2026-09-05): nx_sigfixture 16316 B sha 357085ce PROMOTED + REGISTERED; nx_behaveprobe 27879 B sha 9006364e (self mode, SIGNALLED and HARNESS grades) PROMOTED prev=1 after a live-vs-staged probe of the probe on a real workload read IDENTICAL STRONG; nx_behaveprobe_gate 39307 B sha 7e988a00 PROMOTED + REGISTERED + offc, promoted run 11/11 GREEN: live_rc=143 other_rc=143 on the signal arm, 7 on the control arm, fixture forked directly reads 143 and 7 through the in-process ruler (second method class), T11 BITE-PROVEN; the first cut of this gate was 9/11 because two teeth looked for the fixture's text in the probe's capture and the probe prints only its own JSON line -- measured, retracted, fixed by forking the fixture directly, which made the gate stronger
2026-09-05	ES25	lesson	A STALE COPY OF A CORRECT INSTRUMENT IS INDISTINGUISHABLE FROM A BROKEN ONE: the served probe predated the estate's own 2026-08-25 signal rule and reported rc=0 for a SIGSEGV'd gate, and the debt filed on it named a mapping defect that did not exist; the only cure that survives a promote is a REGISTERED SUBJECT THAT DIES ON PURPOSE plus a referee that asks the LIVE ruler how it reads that death -- now both exist, and any wait-status consumer (job runner, gate runner, probe) can be pointed at nx_sigfixture 15 and must answer 143
2026-09-07	ES26	queue	OPERATOR SCOPE 2026-09-07: all operational work is sovereign capability investment, including grep/search/read/write/build/test/site emission/publication/recovery/AI. Existing goal and rung contracts expanded; this row records requested scope only, not implementation, build, publication or functional acceptance. Next: measure the verified canonical owners and their blockers, attach comparable dated benchmark receipts, and render the changes on the existing /compare boards. Evaluate total cost per independently verified result across local and remote engines, retries, review, interventions, recurrence and recovery; token reduction alone is not acceptance.
2026-09-14	ES28	land	rk_incumbents LANDED (operator 2026-09-14: the estate answers a rung's contract itself, no treasure hunting). nx_incumbent_lib indexes every organ header, basename part, column-0 func name, knowledge/ asset path and recorded rejection line over both runtime roots plus knowledge/index into a stamped derived index that is refused when stale; contract terms are deduplicated by match prefix, numbers dropped, a term carried by more than a quarter of the organs dropped as non-discriminating, the rest idf-weighted with a name hit weighed a second time; PRIOR-REJECTIONS is its own axis (the name-tier organs whose headers record a rejection, ranked by the rarity of the word in their name). nx_incumbents CLI: the bare form builds the index (20820 files, 12 assets, 19 headers truncated at the 8 KB window, 10.4 MB, corpus_complete=1; clock row incumbentidx rebuilds it daily); nx_compare_rank prints INCUMBENTS(rung) under every ranked rung with the coverage envelope once. nx_incumbent_gate 47 of 47 GREEN on a planted 14-organ tree and on the live tree: THE DECLARED ACCEPT RULE HOLDS with no seat input, R0 names nx_dr_densejudge under PRIOR-REJECTIONS with its DR-13 line, lists knowledge/index/embed_v1.bin, excludes its own organ. Promoted by hash: nx_incumbents b92e0f69, nx_incumbent_gate 755cfd86, nx_compare_rank 4c4dfae4 (content ruler: one lost run, a source path); registered, _offc refreshed, rostered, organ_gate rows. Three instrument lessons on the way, each measured on the live answer and fixed at the root rather than tuned to the rule: a pure idf sum buried the organ named for the contract's word; a name TIER sorted first put an organ named for two process words second; a 4-byte prefix on a 5-letter term made dense match density and wired match wire. Owed: plan_pass renders the answer under the rung on the page (the generators re-ship); the residual noise in the rejection axis is the contracts' own process vocabulary (rule, wired, exceed) hitting organ names.
2026-09-28	ES29	retract	rungrole ES29 -> T-BIC-ENGINE removed 2026-09-28: that target was never declared (the ladder read BADTARGET and refused ROLE-DUPLICATE, so the whole board was unrankable); ES29 keeps its T-FR-WFCTL substrate role. The engine-shift subject still needs its own dated best-in-class target before ES0-ES28 can be placed
2026-09-15	ES29	queue	Declared from the search lane under the 2026-09-15 goal; the build itself waits on the same admission the runaway holds, which is the point.
2026-09-15	ES29	land	SOURCE-LANDED ON BOTH TREES, PROVEN ON THE LAPTOP: nx_jobcancel_lib.nx (10634 B, sha 0eb63a0d) + nx_job_run.nx with the cancel verb and the launch journal (14266 B, sha 37c278b3; laptop == NAS by hash) + nx_jobcancel_gate.nx (7094 B) + knowledge/jobrun.conf (cancel_grace_ms 3000). Gate 27/27 GREEN on a REAL forked child (REFUSED-ABSENT, REFUSED-MISMATCH with the child alive, CANCELLED by TERM and reaped with signal 15, ALREADY-GONE, journal counts, conf, names); BITE: jc_verify mutated to always match killed exactly T2d/T2g/T3d (24/27 RED), restored 27/27; KILL escalation unexercised and announced by gv_kv kill_escalation_exercised=0. The launcher compiles on the laptop (173 KB asm). NAS build/promote/register waits on admission (load1 17.9 vs 16.43 after the operator killed the two runaways); until then the verb exists in source only.
2026-09-15	ES29	land	PROMOTED AND LIVE: nx_jobcancel_gate 27/27 GREEN on the NAS (job 1789483303), promoted 6457fe83, registered, offc-installed, rostered (gateroster.conf) and declared (organ_gate.conf: nx_jobcancel_lib and nx_job_run -> nx_jobcancel_gate); knowledge/jobrun.conf cancel_grace_ms 3000. nx_job_run rebuilt on the mgmt lane (42936 B, sha 92fa9e76, src 37c278b3 == laptop), nx_contentdiff ONE-WAY-GAIN (91 gained runs: the cancel vocabulary and the journal path, lost 0), PROMOTED by hash, offc-installed. From this promote every nx_job_run launch writes knowledge/status/jobrun.jrnl and `nx_job_run cancel <out-file>` is the sovereign stop button; the ssh kills of 2026-09-15 are the last of their kind. Live dogfood (a launched nx_contentdiff cancelled through the verb) follows this row.
2026-09-15	ES29	measure	LIVE DOGFOOD ON THE MCP SURFACE: `nx_job_run nx_contentdiff /tmp/cancel_dogfood.out <daemon> <daemon>` (pid 21124, a ~4 min job) then `nx_job_run cancel /tmp/cancel_dogfood.out` -> `JOB-CANCEL out=/tmp/cancel_dogfood.out pid=21124 outcome=CANCELLED grace_ms=3000 journal=knowledge/status/jobrun.jrnl`; the journal reads launch 1789483908 -> cancel 1789483929 CANCELLED, and /proc/21124 is gone. The same verb, the same binary, the same journal for the seat, the agent and the operator: no private path. Done-rule MET (gate 27/27 on the NAS, bite-proven, live cancel witnessed); the KILL escalation stays unexercised and is said so in the gate's own receipt.
2026-09-15	ES30	queue	Declared from the 2026-09-15 research intake (six sources mirrored and pinned, the cs.DC September listing read). Build order: ES30 first (the budget is data the cancel lib already understands), ES32 beside it (the page is the monitor), ES31 last (recovery needs the classes ES32 renders).
2026-09-16	ES33	land	2026-09-16 first composition: knowledge/store/plan-boardship-automation- and plan-boardship-coding- seeded from knowledge/status/plan-boardship-<dom>.rows (three rows: nx_compare_rank, nx_compare_regen --domain, nx_page_verify); nx_plan_run boardship-automation returned PLAN steps=3 ok with the scoped regen fork-fresh 4 of 4 and the page GREEN; the plain MCP regen row ignores --domain-file (a full 116-domain run followed) and nx_job_run refuses pinned rows, so the plan lane is the one sovereign way to run a scoped organ with real argv today
2026-09-17	ES21	measure	the workflow miners exist and are dark: nx_wfcost, nx_actlog and nx_workflowmine are all REGISTERED-DARK (no MCP invocation on record). One run of nx_actlog over knowledge/status/actlog.jrnl (159 MB, 1154610 frames) ranks nx_fs call plus observe at 418930 frames and nx_fs_write at 78065, and mines the recurring chain nx_fs_write:write then nx_mgmt:build, promote, register, mint at confidence 1000, which is exactly the chain nx_organ_ship composes
2026-09-17	ES21	queue	COORDINATION from the aesthetictwin lane, 2026-09-16: the operator asked that our 1-2-3 steps be mined actively and composed into plan planes and agents callable over MCP. Done on that lane: ship-and-run workflows as knowledge/store/plan-atship- planes run by one nx_plan_run call. Owed here: a clock row that runs nx_actlog mine over the actlog with a PERSISTED receipt (stdout only today), and a composer that proposes a plan plane from every chain at confidence 1000 above a declared support floor; nx_wfcost mine reads a transcript dir the NAS does not hold (files=0), so it runs laptop-side or over the harvested log
2026-09-17	ES21	lesson	COORDINATION (aesthetictwin lane): the scoped regen row reads buildroot/knowledge/compare/regen.scope, and a seat that writes the bare knowledge/compare/regen.scope republishes whoever's domain sits in the buildroot copy (measured: my aesthetictwin scope republished automation once). The buildroot scope was borrowed for one aesthetictwin publish and restored to automation on one line; the second line it carried (18 bytes total) is not known to this lane, re-add it if it mattered. A per-seat scope argument on the row would remove the shared scratch file
2026-09-22	ES17	retract	the pre-flight fired on nx_fs read _jobs/<id>.claim, the read its own remedy text names: an uncapped NAS read was convicted as over the floor because a laptop-local hook cannot stat a NAS path (operator 2026-09-22: fix these from the first byte up to the last byte)
2026-09-22	ES17	land	nx_tokgate: tg_recommended_marker exempts the _jobs/<id>.claim class in CODE, spelled from the same constants the message is built from so recommendation and exemption cannot drift; tg_bounded reads DATA rows bounded
2026-09-22	ES17	lesson	AN ADVISORY THAT FIRES ON THE ACTION IT RECOMMENDS IS NOISE BY CONSTRUCTION, AND NOISE IS HOW A PRE-FLIGHT GETS SWITCHED OFF; the exemption for a recommendation lives beside the recommendation in code, every other bounded class is a conf row, and an unreadable conf must never resurrect the contradiction (T15)
2026-09-22	ES17	queue	GAP MEASURED 2026-09-22: nx_organ_ship cannot observe a stdin-driven organ. Its behaviour probe feeds argv only, so a hook organ answers an empty capture, the probe reads WEAK, no observation record is retained, and the review path is unreachable by construction (complete-successful-representative-probe-required, code 0). The NAS twin of nx_tokgate was therefore promoted through /api/promote with expect_sha256 on the gate-proven candidate (NAS gate 37/37 driven through real stdin payloads, loss record 3892c293 = the old remedy sentence now assembled from constants), named here rather than hidden. OWED: a --behavior-stdin <file> workload on nx_organ_ship and nx_behaveprobe so a stdin organ is probed with a real PreToolUse payload like its gate does; until then every hook organ ships through the primitives with its gate as the proof
2026-09-27	ES17	land	2026-09-27 Claude hook-noise repair is installed and verified through the actual configured laptop launcher. ES17 and ES22 now retain full per-event human explanations while emitting model guidance only on first occurrence and the configured recurrence; unchanged later occurrences emit zero bytes. Removed two inline cost alerts that asserted unsupported 96-percent cost and lossless compaction; daily usage collection and truncation warnings remain. Matched six-read replay: 3371 to 2268 hook-output bytes, a fixture result rather than billed-token or end-to-end ROI proof. Installed native regression gate passes 48/48 on the laptop and through the NAS management API. Source and binary copies are aligned with retained prior versions. Resource recovery and total journey savings remain unfinished. Evidence: knowledge/gates/claude-hook-noise-repair-20260927.json.
2026-10-01	ES0	measure	2026-10-01 ladder census, board-level row anchored on ES0. BEFORE: nx_ladder targets=1 best_in_class=0 rungs=34 placed=5 unplaced=29 verdict=PARTIAL (NO-BEST-IN-CLASS) and nx_barfresh SB-WFCTL UNATTESTED verdict=STALE under cur=2026-10, so nx_compare_rank refused the board. AFTER: nx_ladder targets=5 best_in_class=2 frontier=3 placed=34 unplaced=0 substrate=11 arm=10 contender=13 superseded=0 verdict=LADDERED; nx_barfresh bars=5 fresh=1 attested=4 stale=0 unattested=0 verdict=FRESH; nx_compare_rank engineshift was not refused, wrote engineshift.rank (13523 bytes, finish=6, sha256 47cb50bc) and published its row; it still labels TREATMENT NO-TREATMENT (34 rungs undeclared) and unmapped=10
2026-10-01	ES0	land	2026-10-01: four bars earned from listings fetched and read today -- SB-ROUTE (2026-09), SB-LOCALINF (2026-10), SB-TOKEFF (2026-09), SB-DISTILL (2026-09) -- with targets T-BIC-ROUTE and T-BIC-LOCAL (best in class) and T-FR-TOKEFF and T-FR-DISTILL (frontier); 29 rungrole rows place ES0 to ES28 (ROUTE 12, LOCAL 4, DISTILL 4, TOKEFF 9); SB-WFCTL re-attested for October from the publisher's index and the empty arXiv cs.DC October listing; nine refs mirrored by nx_research_fetch into knowledge/fetched and pinned, nx_filehash equal to the fetcher's provenance digest on all nine. The page is NOT republished by this seat: a scoped regen of engineshift is owed
2026-10-01	ES0	lesson	THE API WAS THROTTLED AND THE SEARCH PAGE WAS NOT: export.arxiv.org answered 429 four times for the estate address and the attest organ's arXiv fan-out read UNREACHABLE, while the arxiv.org abstract-search page ordered by announcement date answered 200 through the same fetcher; it is a dated listing (announced month and submitted day per entry) and abstracts are read from the mirrored HTML by offset. Two cautions measured: a search expression the page cannot parse saves as a 16729-byte empty search form with status 200 (cmp_engineshift_arxivdistill202610.html, rejected and not cited) -- count arxiv-result before reading -- and an OR query drags in homonyms (expert routing inside mixture-of-experts models, excitons, droplet transport), so the on-subject entries are named one by one and never taken as the top of the list
2026-10-01	ES0	queue	OWED after this ladder: (1) triangulation -- SB-ROUTE, SB-TOKEFF and SB-DISTILL stand on September preprints from separate author groups plus vendor pages and carry no peer-reviewed witness; add one per bar when venue versions appear, and re-read the listings once arXiv announces October entries (none existed on 2026-10-01); (2) the attest organ prints CLASSES domain=engineshift UNDECLARED: a class row for engineshift in knowledge/subject_classes.conf (cs.AI, cs.CL, cs.LG, cs.DC, cs.PF, cs.OS) would let it exclude homonyms itself; that file is outside this seat's edit scope; (3) SB-WFCTL's own ref is one article with no listing grammar, so the organ reads ATTEST-UNATTESTABLE every month and the row is attested by hand from the publisher's index; a dated source row for that index in research_sources.conf closes it; (4) treat rows for the 34 rungs; (5) the arXiv API abstention stands until the address is no longer throttled

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. MEASURED 2026-09-02 from the estate's own ledgers: over 30 days the Claude seat class produced 40.1 million output tokens against 13.6 billion cache-read tokens and closed 45 workstreams, 890,767 output tokens per closed rung, while the local engine column of the same scoreboard reads ZERO rows -- the shift the operator ordered on 2026-07-20 has a gauge and no movement, and the gauge's last row is dated 2026-08-05 because it never had a producer. The pieces exist: the external lane is live through the warden with fourteen ledger rows against ox-alpha [stealtheula], the sovereign no-float seat serves Qwen2.5-0.5B, a preference ladder (sovereign, local, external, Claude) sits in a library with two test importers and zero production ones, the companion chat's per-turn routing conf carries zero active rows, and the laptop's RTX 5080 holds 13.9 GB free beside six staged GGUFs up to 7B that no sovereign runtime serves. The field solves routing and spend (LiteLLM [litellmrouting]), local serving (Ollama [ollamaapi]) and provider choice inside an agent (OpenCode [opencodemodels]); none of them measures tokens per closed rung, none classifies what may leave, and none keeps a registry of the exact tasks an LLM still intercedes on so a future sovereign model can be tested against them. The Claude column is priced by its contract [anthropiccomm]: its output may never grow the sovereign corpus, so the corpus grows only from the compile-verified forge ledger and from providers whose terms permit it [groqsa]. Under the sampling result that coverage climbs with samples when a verifier exists [llmonkeys] and the roofline result that decode is memory-bound so the lever is fewer bytes rather than more SIMD [marlin], the path is: make the scoreboard self-producing, dispatch every task to the cheapest engine whose terms permit its class, put the sovereign seat on the GPU through the sovereign dxg path with llama.cpp as the oracle beside it [llamacpp], and retire Claude rung class by rung class as the gap registry's measures are met.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/engineshift.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain engineshift, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from engineshift.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	4
fetched	4
reused	0
failed	0
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Claude Code (rented frontier seat)	1	1	col0-claude	named	https://www.anthropic.com/legal/commercial-terms
2	OpenCode (provider-agnostic agent)	1	1	col1-opencode	named	https://opencode.ai/docs/models/
3	Ollama (local model server)	1	1	col2-ollama	named	https://raw.githubusercontent.com/ollama/ollama/main/docs/api.md
4	LiteLLM (routing gateway)	1	1	col3-litellm	named	https://docs.litellm.ai/docs/routing

Gauges — a heartbeat, never a bare number

Each row names a gauge stamp written by its measuring beat. This page re-judges the stamp on every publish with the same ruler the beat uses (nx_gauge_lib): FRESH shows the value; STALE withholds it (older than two beats); BLIND withholds it (an axis abstained); ABSENT means nothing has measured. A stale gauge never reads as zero.

gauge	state	reading	note
One-step solve: explained permil of common-task support	STALE	STALE age_s=1315443 max_age_s=172800 (the last reading is history, not a level: the gauge value is withheld)	ES26 nx_actlog steps over knowledge/status/actlog.jrnl (daily beat stepsolvebeat). gauge = declared classes (one-step-available + dependency + reducible) over ALL recurring-signature support; axes = journal read + conf read; UNDECLARED is the worklist and is never folded into one-step; a BLIND or STALE reading is a defect on this board, not a zero

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 40 capabilities: 20 exclusive to it and 20 shared with other boards. Shared rows on this page: 20 = home here 1 + home elsewhere 5 + ambiguous 11 + undecided 3 + refused 0 (partition 20); undecided = unmapped 0 + unproven 3 + unevidenced 0; homonyms 1; since the previous census: new 0, resolved 0. Census FRESH age_s=7075.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
kv_paged_attn	`nx_kvcache.nx`	llm, engineshift	—	ambiguous	plan	ambiguous
mq_fused_dequant_gemm	`nx_nofloat_q4k.nx`	llm*, engineshift	llm	rung	plan	home elsewhere adopt: `@xrow llm\|mq_fused_dequant_gemm\|home by rung (fleet duplicate census)`
gpul_offload_layer	`nx_gpu_llm.nx`	llm, engineshift	—	ambiguous	plan	ambiguous
lb_remote_replica	`nx_mesh_lb.nx`	workermesh, engineshift	—	ambiguous	plan	ambiguous
fg_best_of_n	`nx_forge.nx`	coding, extllm, autodev, engineshift	—	ambiguous	plan	ambiguous
tr_report	`-`	racing:runtime/nx_test_report.nx, engineshift:runtime/_hdl_build/nx_tokroi.nx	—	homonym	-	homonym
sft_run	`nx_sft.nx`	modelwright, engineshift	—	ambiguous	plan	ambiguous
fe_author_organ	`nx_forge_engine.nx`	team, engineshift	—	ambiguous	plan	ambiguous
ch_gauge_json	`nx_claude_harvest.nx`	devmgmt, engineshift	—	none	unproven	undecided
st_boot	`nx_seat.nx`	devmgmt, engineshift, codeeffectiveness	—	none	unproven	undecided
st_resume_map	`nx_seat.nx`	devmgmt*, engineshift	devmgmt	rung	plan	home elsewhere adopt: `@xrow devmgmt\|st_resume_map\|home by rung (fleet duplicate census)`
xl_call	`nx_extllm_call.nx`	extllm, autodev, engineshift	—	ambiguous	plan	ambiguous
xl_egress_class	`nx_extllm.nx`	extllm*, autodev, engineshift	extllm	rung	plan	home elsewhere adopt: `@xrow extllm\|xl_egress_class\|home by rung (fleet duplicate census)`
xl_terms_ledger	`nx_extllm.nx`	extllm*, engineshift	extllm	rung	plan	home elsewhere adopt: `@xrow extllm\|xl_terms_ledger\|home by rung (fleet duplicate census)`
xl_rung_worker	`nx_extllm.nx`	extllm, engineshift	—	ambiguous	plan	ambiguous
xl_distill_corpus	`nx_extllm.nx`	extllm, autodev, engineshift*	—	ambiguous	plan	ambiguous
lf_gen_t	`nx_autofix_auto.nx`	autodev, engineshift	—	none	unproven	undecided
af_sampler_tier	`nx_autofix_auto.nx`	autodev, engineshift	—	ambiguous	plan	ambiguous
go_llm_route	`nx_llm_route.nx`	companionchat*+, engineshift	companionchat	rung	plan	home elsewhere adopt: `@xrow companionchat\|go_llm_route\|home by rung (fleet duplicate census)`
ed_dispatch	`nx_engine_dispatch.nx`	engineshift*, codeeffectiveness, sovereignty	engineshift	rung	plan	home here
tg_shell_interlock	`nx_tokgate.nx`	engineshift, sovereignty	—	ambiguous	plan	ambiguous

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396180 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_goalmap_gate`	engineshift	plan-queue	rung=ES23
directive	`nx_engine_dispatch_gate`	engineshift	plan-queue	rung=ES24
directive	`nx_stepsolve_gate`	engineshift	plan-queue	rung=ES26

rows shown 3|this board's directives 3|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[stealtheula] OpenRouter. Stealth Program End User License Agreement (updated 2026-07-06). Stealth models are offered free of charge for purposes of collecting User Content for use in Stealth Model training and improvement, with an irrevocable perpetual licence to the provider and a ban on publicly disseminating performance information about the models. publisher · read in our library knowledge/fetched/cmp_engineshift_stealtheula.html · pin hb0b6c24644eb77db4694fdfbc72e342816a21d6dbf78499ffd5fdf5b61794f23 · accessed 2026-09-02 · vendor-docGrounds: The external-worker tier: only U bytes may reach it and no per-model number may be published on this page.
[groqsa] Groq. Services Agreement (effective 2026-06-22). Groq is not permitted to use Inputs or Outputs for training or fine-tuning any models unless explicitly granted permission, and the customer retains all rights in Inputs and Outputs. publisher · read in our library knowledge/fetched/cmp_engineshift_groqsa.html · pin h06213e55cd974af815a730066dd36485a18f6c493ecda6b1e83fcd139d0f953a · accessed 2026-09-02 · vendor-docGrounds: The DISTILL-lawful tier whose outputs may grow the sovereign corpus.
[anthropiccomm] Anthropic. Commercial Terms of Service. Anthropic may not train models on Customer Content from the Services; the estate's reading, banked 2026-08-25, is that the account tier decides the posture and Claude Code inherits the account it is signed into. publisher · read in our library knowledge/fetched/cmp_engineshift_anthropiccomm.html · pin h120776517daf85c5d1fa59f8e2bdba39496a971c87c349f9d2e4f46c5109dd2c · accessed 2026-09-02 · vendor-docGrounds: The Claude column: the seat whose output can never grow the sovereign corpus and whose tier must be declared before its ledger row admits anything.
[ollamaapi] Ollama. REST API reference (docs/api.md): generate, chat, create, list, show, copy, delete, pull, push and embedding endpoints for a local model server. publisher · read in our library knowledge/fetched/cmp_engineshift_ollamaapi.md · pin h4efae9dd7a70a1f32c7254a10b3a7f06f5dc3cb1739505483b2a0f9599820b8a · accessed 2026-09-02 · vendor-docGrounds: The local-server column and the bar for what a sovereign seat must serve.
[opencodemodels] OpenCode. Models documentation: provider-agnostic model selection across cloud providers and local servers, configured per project and switchable per session. publisher · read in our library knowledge/fetched/cmp_engineshift_opencodemodels.html · pin hdfb6392e7f58168174721eefbc38a8744db465344d716ae9942a474f6ad98915 · accessed 2026-09-02 · vendor-docGrounds: The provider-agnostic agent column.
[litellmrouting] LiteLLM. Router and load balancing documentation: routing strategies, fallbacks, retries, cooldowns and per-key budgets across many model deployments. publisher · read in our library knowledge/fetched/cmp_engineshift_litellmrouting.html · pin hab7e04ffe118ab2712d3e4fb4697d40d29a99553e14e0cca363f34a9b40058d7 · accessed 2026-09-02 · vendor-docGrounds: The routing-gateway column: spend and fallback are solved there; clearance and a byte-exact judge are not.
[llmonkeys] Large Language Monkeys: Scaling Inference Compute with Repeated Sampling. arXiv 2407.21787 (2024). Coverage climbs with the number of samples when a verifier exists. publisher · read in our library knowledge/fetched/cmp_engineshift_llmonkeys.html · pin h922be22acaa0999ba5690c50a680d29228db6c0e73aa6c89ffb769acb7cab68c · accessed 2026-09-02 · published-paperGrounds: The best-of-N rung: a cheap sampler behind a byte-exact judge.
[marlin] MARLIN: Mixed-Precision Auto-Regressive Parallel Inference on Large Language Models. arXiv 2408.11743 (2024). A fused dequantize-and-multiply kernel that keeps 4-bit weights quantized in the hot loop. publisher · read in our library knowledge/fetched/cmp_engineshift_marlin.html · pin h96d7bedab4af9730d3cbfe35f48aa88306ae87eae712c925860563506182bb74 · accessed 2026-09-02 · published-paperGrounds: The decode lever the roofline named: move fewer bytes, not more SIMD.
[llamacpp] ggml-org. llama.cpp repository: LLM inference in C and C++ with GGUF and K-quant weights, a KV cache and speculative decoding, the CPU reference. publisher · read in our library knowledge/fetched/cmp_engineshift_llamacpp.html · pin h36aaec85616f39a7110a47a64a3ff87c9188626d7933fb92cb58ac437d60babb · accessed 2026-09-02 · source-readGrounds: The oracle we bench beside in its native language and never build on.
[zylosdeadline26] Zylos Research (2026-09-09). End-to-End Deadlines and Cancellation Boundaries for AI Agents: how shared time budgets survive queues, RPC hops, retries and restarts, and why a timeout cannot prove that external work stopped publisher · read in our library knowledge/fetched/rf_13c863a9.raw · pin h2cd2c74bb6852a2b68055c7a5f5237ccf58591a8729f426fdff0711772eadfbc · accessed 2026-09-15 · vendor-docGrounds: SB-WFCTL
[selfheal26] Babu R.S., Agrawal A. (2026-05-31). Self-Healing Agentic Orchestrators for Reliable Tool-Augmented Large Language Model Systems (arXiv 2606.01416): reliability as a bounded runtime control problem, failure signals to classes to budgeted recovery to verified trajectories, 98.8 percent task success vs 94.5 retry-only publisher · read in our library knowledge/fetched/rf_120f3b5c.raw · pin hcd6010b3a61a344531cc5b9bd82426aa4636542f1b771ed832c722a453ad0933 · accessed 2026-09-15 · published-paperGrounds: SB-WFCTL
[graphmind26] Toscano S., Cilimdzic M., Krishnan S. et al. (2026-05-17). GraphMind: From Operational Traces to Self-Evolving Workflow Automation (arXiv 2605.17617): workflow graphs extracted from resolution traces, executed by a multi-agent traversal engine, deployed on four production cloud database services publisher · read in our library knowledge/fetched/rf_c52a69e5.raw · pin hda598189fff41bb5d95b0e2d19cb8bbc8cd43d2556d1f6778971d9393e9cd595 · accessed 2026-09-15 · published-paperGrounds: SB-WFCTL
[arxivcsdc202609] arXiv cs.DC listing, September 2026 (Distributed, Parallel, and Cluster Computing): 247 entries, fetched and read for the month's newest work publisher · read in our library knowledge/fetched/rf_64cc1944.raw · pin habcaf54fe49a2fa881d9a51fb16214fbd732fd2d34bc20d7c222604caad5b6d5 · accessed 2026-09-15 · mirrored-indexGrounds: SB-WFCTL
[kueue26] Kubernetes SIGs (2026). Kueue features overview: job queueing with priorities (StrictFIFO, BestEffortFIFO), fair sharing, cohorts and preemption policies as declared cluster policy publisher · read in our library knowledge/fetched/rf_161acc8a.raw · pin h198089fb4457cbafcec87331b1474de5724827ffd75b876d237196e9ebfb1abe · accessed 2026-09-15 · vendor-docGrounds: SB-WFCTL
[zylosdurable26] Zylos Research (2026-04-27). Durable Execution for Agent Runtimes: workflow engines, replay and recoverable AI work (Temporal, Restate, DBOS, Inngest as the 2026 durable-execution field) publisher · read in our library knowledge/fetched/rf_872f3d41.raw · pin h1b3ddf84ba610ed3fde1c88962e10bb2fb452235bb4cf6e368162d9710c2c76b · accessed 2026-09-15 · vendor-docGrounds: SB-WFCTL
[zylosindex202610] Zylos Research. Research notes index, read 2026-10-01: thirty entries dated September 2026 and one dated 2026-10-01 at the head of the list; the newest on workflow control is dated 2026-09-27 (Is It Done, or Just Reporting? Task-Completion Signals in Agent Loops) and the one October entry (One Command, Two Outputs: Keeping Side Effects Out of the Rendering Branch) is off-subject publisher · read in our library knowledge/fetched/cmp_engineshift_zylosindex202610.html · pin hfd753f1952dc44c76cfbdf65e12cec993b1c4714b9e64916056eb8a7c4a86166 · accessed 2026-10-01 · mirrored-indexGrounds: SB-WFCTL
[arxivcsdc202610] arXiv cs.DC listing, October 2026 (Distributed, Parallel, and Cluster Computing), fetched and read 2026-10-01: the page reads No updates for this time period, so the September listing is still the newest publisher · read in our library knowledge/fetched/cmp_engineshift_arxivcsdc202610.html · pin he81b42ebe4749fe9979613e917f76a3dd45d7b330af373c604d1ea7a71ad7559 · accessed 2026-10-01 · mirrored-indexGrounds: SB-WFCTL
[arxivroute202610] arXiv abstract search for LLM routing, model routing and LLM cascade, newest announced first, 50 entries fetched and read 2026-10-01: 27 announced September 2026, 19 August, 4 July, none October. Read from it: FlexRouter 2609.38585, SaveRouter 2609.37402, AgentRouter 2609.22951, Signed Rescue Routing 2609.07786 publisher · read in our library knowledge/fetched/cmp_engineshift_arxivroute202610.html · pin h0a8715dba31e7a288f1fcbb33c8a1b5307bcfe63fafc8b66bc34874607020dd3 · accessed 2026-10-01 · mirrored-indexGrounds: SB-ROUTE
[zylosrouting26] Zylos Research (2026-09-12). Routing Work by Agent Capability Profiles: From Claims to Evidence: a profile is a discovery contract and not a competence certificate; the router closes the loop discover, shortlist, verify, assign and learn, enforces authorization as a hard boundary and records the evidence that explains every assignment publisher · read in our library knowledge/fetched/cmp_engineshift_zylosrouting26.html · pin h3694b2bedb7311126f3ddaf34e4b6d1a7e4138b9c5312592b7d1cda9e6456d67 · accessed 2026-10-01 · vendor-docGrounds: SB-ROUTE
[llamacpprel202610] ggml-org. llama.cpp releases listing over the GitHub API, the five newest fetched and read 2026-10-01: b11316 to b11320, every one published 2026-10-01 (bf16 math for MXFP4 mul-mat on Metal, an OpenCL subgroup fix for Adreno, the llama-bench log filter, PLaMo tokenizer settings, an LLM-jp Harmony chat handler), each with prebuilt binaries per platform publisher · read in our library knowledge/fetched/cmp_engineshift_llamacpprel202610.json · pin he47e0b757e5da93ab325716783059852ac2a695a79c46788293e3e7b768b3f37 · accessed 2026-10-01 · mirrored-indexGrounds: SB-LOCALINF
[arxivlocalinf202610] arXiv abstract search for on-device LLM, LLM inference engine, edge LLM inference and quantized LLM inference, newest announced first, 25 entries fetched and read 2026-10-01: 8 announced September 2026, none October. Read from it: SpecQuant 2609.21704 (published at IEEE ICPC2T 2026), MobiBench 2609.13159, PolyQ 2607.14618 (accepted to ICCAD 2026) publisher · read in our library knowledge/fetched/cmp_engineshift_arxivlocalinf202610.html · pin h77fc56d4631c2a1384e8a93363476e851d8e4c35258311a2d100724afb696a6d · accessed 2026-10-01 · mirrored-indexGrounds: SB-LOCALINF
[arxivtokeff202610] arXiv abstract search for tool output, context compression and token efficiency with agent, newest announced first, 25 entries fetched and read 2026-10-01: all 25 announced September 2026, none October. Read from it: ReCAP 2609.40118, the minimal-harness study 2609.40303, Turbo Harness 2609.40330, ComputerSD 2609.40253 publisher · read in our library knowledge/fetched/cmp_engineshift_arxivtokeff202610.html · pin hb49a6d67385ec4fda4992b65ab1d8561846409c03a6dc44118a07d851f398a90 · accessed 2026-10-01 · mirrored-indexGrounds: SB-TOKEFF
[zylostoolresp26] Zylos Research (2026-09-15). Bounded tool-response ingestion for agent tool adapters: count encoded bytes before decompression, decoded bytes during it and parser growth before an object graph is built; trimming the final text protects only the model's context budget, and a partial result needs an explicit rule for what it means publisher · read in our library knowledge/fetched/cmp_engineshift_zylostoolresp26.html · pin hf32aecf906afa96b97014ba99a5c8d8aa3d01d3bfd7d67c0ae76c28024b1acc9 · accessed 2026-10-01 · vendor-docGrounds: SB-TOKEFF
[arxivagentdistill202610] arXiv abstract search for on-policy distillation, trajectory distillation, agent distillation and distilling agent, newest announced first, 25 entries fetched and read 2026-10-01: all 25 announced September 2026, none October. Read from it: PivotOPD 2609.40285, GC-OPD 2609.37522 publisher · read in our library knowledge/fetched/cmp_engineshift_arxivagentdistill202610.html · pin hfe8e31efd5310ff4024750e9d03bcad1d5af500466747b1c3042082462dca246 · accessed 2026-10-01 · mirrored-indexGrounds: SB-DISTILL

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/engineshift.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls