Nishi Family › Compare › Unified Extensible Format Family: one envelope for data, documents, media, config and archives

Nishi Compare · capabilities, evidence and delivery

Unified Extensible Format Family: one envelope for data, documents, media, config and archives

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi UXF vs Parquet and Arrow, SQLite, the MP4 and MKV container pair, and IPLD multiformats -- store the richest canonical form once, emit what each endpoint can actually consume, and let data and functionality upgrade on independent clocks

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The envelope is real and proven: one content-addressed self-describing block carries DATA, MEDIA and CONFIG profiles that cannot collide, a tolerant reader preserves fields it does not understand across a round-trip, endpoint negotiation picks DIRECT or REMUX or TRANSCODE correctly, and a frame has been carried from EBML into an MP4 mdat byte-identically. What is NOT true yet: no playable muxer, no document or archive profile exercised, no comparator actually run for any exceed claim, and nothing on this board has a September 2026 bar. The gap is finishing and proving, not inventing.

Latest recorded release

2026-10-03 · FM6

THE DOCUMENT PROFILE HAS SOMETHING BEHIND IT, UNDER ANOTHER NAME, AND THIS RUNG IS NOT CLOSED BY IT. unidoc UD11 shipped nx_uxf_doc_lib 2026-10-03 (tool nx_uxf_doc ca16fae3, gate nx_uxf_doc_gate 95fd727b 27 of 27, bite-proven): a document is a manifest and blocks as canonical NXR1 records under UXF_DOC, composing this board's FM1 (uxf_cid_profiled) and FM2 (canon_decode) rather than re-implementing them, which also gives those two libs their first shipping importers. Exercised on real files through the registered tool: a genuine Word document (48849 B) became a 66-block container (24269 B), was exported to a Word package (22275 B) and re-imported as 66 blocks; the Utah H.B. 181 enrolled PDF (41024 B) became a container of only 2 blocks (18020 B), because the PDF fold carries the text layer and almost none of the structure. So this rung's own done-rule (a real PDF or EPUB whose export back out is lossless for the fields claimed) is met for text and NOT for structure, and its contract symbol uxf_doc_ingest names no function: the owner of this board either repoints FM6 to the import path that exists (uxd_from_spec over the unified page's folders) and keeps the structure leg open, or keeps FM6 for PDF and EPUB structure recovery. Not repointed by the seat that shipped UD11, because closing another board's rung on a partly met done-rule is the name-flip this board warns against

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

6 of 10 capability source symbols found|0 of them authored stronger-claims|4 open|coverage 600/1000|adoption 3 full / 3 partial

Evidence profile — what the gaps on this board actually are

Unstamped. No evidence profile is published for this domain yet: run nx_swcompare_evidence formats and this section fills itself on the next beat. No numbers are shown, deliberately — a zero-filled profile would read as a board with no gaps, which is the one wrong answer nobody would question.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: UNBOUND. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Current prerequisite graph is invalid or unavailable. Historical rank data is retained, but cannot establish a current order. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

RungCloses withDefinition of done (pre-declared)ExecutorEst.
Self-describing profile CID (FM1)
after 		uxf_cid_profiledLANDED June 2026, gate 5/5. The multicodec profile byte is folded into the hash, so the same content under two profiles yields different CIDs and a reader can learn a block's profile without rehashing it. Built additively on nx_canon_cid. THIS RUNG IS DONE AS CODE AND UNDONE AS ADOPTION: the organ reads LIB with no importer census, and nothing on any execution surface calls it.Organ1 u
Tolerant-reader decode (FM2)
after FM1		canon_decodeLANDED June 2026, gate 4/4. Proven by CID equality rather than by inspection: encode three fields, decode with a reader that knows two, re-encode, and the CID is byte-identical because the third survived; the neg-control drops it and the CID moves. This is the operator's house-of-cards fix made mechanical.Organ1 u
Endpoint-adaptive emit plan (FM3)
after FM1		ng_negotiateLANDED June 2026, gate 5/5, capabilities data-driven from endpoint_caps.tsv. Decides the Chrome-cannot-play-MKV case as a lossless REMUX rather than a re-encode, which is the correct model and the whole point of law 1.Organ1 u
Extract the frame-level rewrap from its test (FM4)
after FM3		uxf_remux_frameThe lossless byte-identical EBML-to-MP4 carry is proven, but it lives INSIDE nx_uxf_remux_test with no callable entry point, so the capability cannot be composed by anything. Extract it to a lib function with the test as its gate. Done-rule: a caller outside the test performs the carry and the bytes still compare identical.Organ2 u
A playable muxer, not a container primitive (FM5)
after FM4		uxf_mux_trackThe honest gap June named and did not close: sample tables stts stsc stco, codec-private stsd, timestamps, multi-track moov nesting. Until this lands the remux is a proven data-flow and not a file anything can play. Done-rule: a produced MP4 plays in a real player and the referee says so, not the author.Organ3 u
Document profile exercised (FM6)
after FM2		uxf_doc_ingestUXF_DOC is a declared codec id with nothing behind it. Overlaps the reader arc's structure recovery. Done-rule: a real PDF or EPUB becomes an envelope record whose export back out is lossless for the fields claimed.Organ3 u
Archive profile exercised (FM7)
after FM2		uxf_archive_packUXF_ARCHIVE is declared and unexercised, the last of five profiles with no proof. Done-rule: a real archive round-trips through the envelope with content-dedup demonstrated across identical members.Organ4 u
Run the comparator or publish no ratio (FM8)
after FM1		uxf_bench_ratioOur side is measured on the real path at 752021 records per second written including fsync and 474 nanoseconds per point get over 20000 records, and the SQLite workload file was generated to be identical. The comparator has NEVER RUN because sqlite3 is absent from the host and an unattended install hung on a sudo prompt. Until it runs the exceed is STRUCTURAL and DECLARED, and no ratio may be published. Done-rule: the yardstick runs on the same workload and the ratio is published with both raw numbers, or the row keeps saying it did not.Organ3 u
This board earns a dated bar (FM9)
after 		_ABSENT_:fm_bar_septemberA board with no sotabar row is opted out of the currency hard fail, and that is the state this one ships in because no September 2026 listing has been read for storage and container formats. Earn it with the census organ now that one exists: nx_arxiv_census over the relevant categories for the current month, read the abstracts from the pinned bytes, then land sotabar and refs rows. Done-rule: nx_compare_rank formats reports BARFRESH verdict=FRESH rather than NO-BAR.Organ2 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.
best-in-class (ft-best-in-class), dated by fm-format-layer-research = 2026-09 UNATTESTED. Match the incumbents on their own ground: remux losslessly the way the MP4 and MKV toolchain already does, and store and retrieve at Parquet and SQLite throughput, with every cell on this board carrying a RUN rather than an assertion. Today we have the remux data-flow proven byte-identical and the store measured at 752021 records per second written including fsync and 474 nanoseconds per point get, and we have NO comparator run, so this target is unmet on evidence rather than on capability. ref arxiv-csmm-2026-09
frontier (ft-frontier), dated by fm-format-layer-research = 2026-09 UNATTESTED. Data and functionality on genuinely independent clocks, as a CHECKABLE property rather than a design intention: a reader preserves fields it does not understand and the proof is CID equality after a round-trip, not inspection. The rival formats each hold a piece (Avro is self-describing, Protobuf disciplines field evolution, IPLD content-addresses) and none ships all three composed with a byte-deterministic canonical encode. This is the exceed candidate, and it stays a candidate until a referee that is neither competitor says otherwise. ref arxiv-csmm-2026-09
RungRoleTowardStands onWhy
FM1substrateft-frontier-The self-describing profile CID is what every other rung stands on: without a codec folded into the hash there is nothing for a reader to negotiate against and no way to tell two profiles apart.
FM2substrateft-frontierFM1The tolerant reader IS the independent-clocks property, proven by CID equality. It is substrate rather than contender because it enables the claim rather than being a number a rival competes on.
FM3contenderft-frontierFM1Endpoint negotiation is the differentiating claim: no rival format decides DIRECT versus REMUX versus TRANSCODE from declared capability, because that is a layer above a format and is exactly where storing one canonical form pays.
FM4substrateft-best-in-classFM3Extracting the frame-level rewrap from its test is what makes the proven capability composable at all; nothing can call it today, so every downstream muxer rung is blocked behind it.
FM5contenderft-best-in-classFM4A playable muxer is the head-to-head against the MP4 and MKV toolchain, and it is the rung that decides whether our remux is a capability or a demonstration.
FM6armft-frontierFM2The document profile triangulates the envelope claim on a second media class without competing for the media number, which is what an arm is for.
FM7armft-frontierFM2The archive profile is the third independent witness that one envelope carries every class; it is the last of five profiles with no proof behind it.
FM8contenderft-best-in-classFM1The comparator ratio IS the best-in-class number. Until sqlite3 runs on the same workload we may publish no ratio, so this rung is the difference between a measured claim and a structural one.
FM9substrateft-best-in-class-A dated bar is the measurement apparatus every other claim is graded against; it landed 2026-09-06 and is what moved this board from NO-BAR to FRESH.

Milestones

MilestoneRungsCumulative
M0 · The envelope is self-describing and tolerantFM1,FM22 u
M1 · Endpoint-adaptive delivery decided from dataFM31 u
M2 · The lossless rewrap is composable outside its own testFM42 u
M3 · One envelope proven across media, document and archiveFM5,FM6,FM710 u
M4 · Measured against the field and datedFM8,FM95 u
Ladder verdict. LADDERED. Targets, rung roles and bars are counted in the tables below, each partition re-derived beside its total. Bars read STALE against the current month 2026-10.
Ladder verdict, counted (17 rows, more than the 12-row disclosure bar)
Ladder verdict, counted
ClassCountNote
targets2sotatarget rows on the plan
best in class1targets whose class is best-in-class, by code
frontier1targets whose class is frontier, by code
undated0targets naming no bar that exists
bad class0targets whose class is neither word
duplicate0target ids an earlier row already carries
rungs9rung rows on the plan
placed9rungs carrying a rungrole row
unplaced0rungs with no role toward any target
bad role0rungrole rows naming a role the ladder does not know
bad target0rungrole rows naming a target no sotatarget row declares
rungs, summed9RECONCILED: the parts sum to the total 9
substrate4what the target's own methods consume
arm2a sovereign arm that triangulates without competing for the number
contender3its done-rule is a number against the target
superseded0kept as capability, retired as a claim
placed, summed9RECONCILED: the parts sum to the total 9
Bar freshness, counted
ClassCountNote
bars1sotabar rows on the plan
fresh0the bar month is the current month
attested0an older bar with a this-month barscan reporting no newer entry
stale0a this-month scan saw a newer month the bar ignores
unattested1nobody looked this month
malformed0a sotabar row missing a field
duplicate0bar ids an earlier row already carries
bars, summed1RECONCILED: the parts sum to the total 1
current month2026-10the month every bar is judged against
Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 9. Rank input binding: UNBOUND. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 a31951d1e19b96eed33317d7f0298a0ca9ee8a6b88cc5f383b2af7da183673aa. Target rows 2; role rows 9. Existing risks and release worklog retain their own scope; no node completion is inferred.

Invalid declared graph. Malformed rows or IDs 2; duplicate IDs 0; duplicate prerequisites 0; missing prerequisites 0; cyclic or cycle-dependent nodes 0. Node paths withheld.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.
Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence formats writes it beside its stamp); every gate below reads UNRECORDED until it runs.
Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.
FM1 Self-describing profile CID · cell PRESENT · gate NO-GATE-DECLARED
Contractuxf_cid_profiled · executor Organ · 1 u · stands on
Definition of doneLANDED June 2026, gate 5/5. The multicodec profile byte is folded into the hash, so the same content under two profiles yields different CIDs and a reader can learn a block's profile without rehashing it. Built additively on nx_canon_cid. THIS RUNG IS DONE AS CODE AND UNDONE AS ADOPTION: the organ reads LIB with no importer census, and nothing on any execution surface calls it.
Matrix cellSelf-describing profile CID, the endpoint-adaptive keystone · runtime/nx_uxf_cid.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_cid; declare nx_uxf_cid TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-06 lesson A COMPLETE GLOB IS WHAT TURNED A SUSPICION INTO A FINDING. Searching the compare tree for any formats board returned matches=0 over 878 files with corpus_complete=1, which is an absence PROOF rather than a failed search, and it is the only reason this board exists. Sixteen gates had gone GREEN in June 2026 and none of them were reachable from any published surface; the catalogue additionally reads nx_uxf_remux_test and nx_uxf_corpus_persist as SOURCE-ONLY, meaning the proofs cannot even be re-run on the NAS today. The operator's standing order is that we do not build and lose capability to darkness, and the mechanism that failed here was not the building, it was that nothing forced the work onto a board where a ranker could see it.
2026-09-06 land BOARD ADMITTED 2026-09-06. nx_domain_admit formats returns VERDICT=ADMIT (CLAIM-ONLY -- no domain gates, which is permitted when declared) with rows=10 grounded=5 absent=2 UNGROUNDED=0 watch-new-organ=3 and C2 unpinned-declared=1. Two refusals taught the shape and both are worth recording. First, C2 REFUSES a domain with no barcheck row AND no UNPINNED declaration, on the grounds that the comparison is otherwise silently unfalsifiable, which is the right refusal: a board with implied bars nobody can check is worse than one that says it has none. Second, my first attempt to add that declaration NOMATCHED because the matrix had no @title, @sub or @cols directives at all, so the board had no rival columns for a bar to be about. ungrounded=0 on the first admission run is the one number I am pleased with: every symbol was READ with nx_fs outline rather than guessed, which is the whole DARK-CONTRACT lesson applied before the fact instead of after it.
2026-09-06 measure THE FIRST D001 MIGRATION IS LIVE AND ITS BITE IS AN HONEST FLOOR, NOT A PASS. nx_uxf_cid_gate was written as the migration of nx_uxf_cid_test onto nx_gate_verdict, because /api/promote refuses the original D001 (it hand-rolls its counters and prints its own verdict, so nx_gate_green cannot judge it and it records no harness frame -- which is the mechanism that kept sixteen GREEN UXF gates invisible for eighty-two days). It runs 6/6 GREEN, is PROMOTED and REGISTERED with live_sha equal to staged_sha, and formats.gates now carries one row, which moved nx_domain_admit from ADMIT CLAIM-ONLY to ADMIT. THE MIGRATION IS PROVEN NEUTRAL FOR FREE: the gate emits cidA=private-ref:42a4881f and cidC=private-ref:a6d62a10, reproducing the June-2026 recorded values byte-for-byte, so the rewrite changed the verdict's readability and none of its arithmetic. WHAT IS NOT PROVEN: nx_gate_bite returned valid_mutants=0 void_build_lane=3 invalid_uncompilable=1 killed=0, verdict INCONCLUSIVE, because build admission refused three of four mutant builds under a load-19 box. That is a FLOOR set by the box and not a statement about the gate, so C4 stays NEVER-BITTEN and this gate is NOT yet shown to be able to fail. Custody was clean: twins_checked=2 restored=2 mutant_live=0, and the subject came back byte-identical at 2859 B. RE-RUN THE BITE WHEN LOAD CLEARS -- admission re-measures on every call, and read void_build_lane before believing any INCONCLUSIVE.
2026-09-06 land C4 IS CLOSED: declared=5 bite-proven=5 never-bitten=0 bitten-zero-kill=0 sum=5, ALL-PROVEN. Every one of the five shipped UXF gates now kills a compiling mutant, so their greens are falsifiable rather than merely unfalsified, and custody was clean on every run (twins banked and restored, mutant_live=0, every subject byte-identical afterwards). TWO THINGS UNSTUCK IT AND BOTH ARE REUSABLE. FIRST, ONE SITE PER OPERATOR: five earlier attempts at two and three sites were each refused mid-run because a bite needs many CONSECUTIVE compiles and is the first work a loaded box starves; at one site, fired the moment admission reads GRANT, they get through. SECOND AND MORE INTERESTING, THE SUBJECT WAS THE PROBLEM AND NOT THE GATE. nx_uxf_cid_gate and nx_uxf_config_gate both read BITTEN-BUT-VACUOUS while bitten against nx_uxf_cid.nx, where valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 -- admission was NOT the cause; that subject is hex-nibble arithmetic in which perturbing a constant simply breaks the build, so no mutant could ever reach an assertion. Re-aiming both at nx_canon_cid.nx, the canonical ENCODER they depend on, killed both immediately. A GATE THAT CANNOT BE BITTEN THROUGH ONE SUBJECT MAY BE FULLY BITEABLE THROUGH THE DEPENDENCY THAT ACTUALLY CARRIES ITS LOGIC, AND READING valid_mutants BESIDE void_build_lane IS WHAT DISTINGUISHES THE TWO CAUSES. A REAL DIFFERENCE IN TOOTH STRENGTH SURFACED AND IS WORTH KEEPING: the identical comparison mutant at canon_cid offset 955 KILLED nx_uxf_cid_gate but SURVIVED nx_uxf_config_gate, which fell only to a symbol-targeted mutation inside canon_encode itself. The reason is structural -- the config gate's teeth are RELATIVE (this profile's CID differs from that profile's over the same content) and a change that moves every CID equally leaves every difference intact, whereas the cid gate pins ABSOLUTE values. Relative assertions are blind to uniform shifts, and that is a property to remember when writing teeth, not a defect to patch here.
2026-09-06 lesson ALL NINE D001 MIGRATIONS ARE SHIPPED, AND THE LAST BITE FOUND A REAL STRUCTURAL WEAKNESS RATHER THAN AN INSTRUMENT FAULT -- THE SECOND INSTANCE OF ONE PATTERN, SO IT IS NAMED HERE INSTEAD OF PATCHED TWICE. nx_uxf_tsv_persist_gate 4/4 GREEN is PROMOTED and REGISTERED; its bite returned valid_mutants=2 killed=0, and the crucial difference from the mp4box result is that these mutants were VALID and REACHED the binary (not_reached=0) -- they entered the code under test and the gate stayed GREEN. THE CAUSE IS THE SHAPE OF THE TEETH, NOT THE MUTANTS: every assertion in that gate is SELF-CONSISTENT. It encodes rows, persists them, retrieves them, and compares the retrieved bytes against WHAT IT ITSELF ENCODED, so a change inside canon_encode moves the written bytes and the expected bytes IDENTICALLY and all four teeth still pass. The same mutation at canon_cid offset 955 that KILLED nx_uxf_cid_gate also SURVIVED nx_uxf_config_gate earlier today for the same reason. ★ RELATIVE ASSERTIONS ARE BLIND TO UNIFORM SHIFTS: a tooth that compares two things the same function produced cannot detect a change to that function, and it will read GREEN forever while the encoding drifts. The gate is not vacuous -- it genuinely proves the store round-trips faithfully whatever it is handed, survives an fsync and a fresh reopen, and misses an absent address -- but its SCOPE excludes the encoding itself, and that scope is now MEASURED rather than assumed. THE REMEDY IS ABSOLUTE ANCHORING AND IT IS CHEAP: pin ONE known row's content address as a literal expected value, the way nx_uxf_cid_gate pins its CIDs, so an encoder change moves the actual away from a fixed expected. The value must be READ FROM A RUN and never recalled -- a June note records row zero as private-ref:139e9c44 but that is an 82-day-old memory of a truncated string and pinning it from recall would be exactly the fabricated-constant defect. Owed: emit row zero's CID from this gate, read it from the run, then add the absolute tooth.
2026-09-06 land THE RELATIVE-ASSERTION WEAKNESS IS FIXED IN THE GATE, AND THE FIX WAS EARNED RATHER THAN RECALLED. nx_uxf_tsv_persist_gate now carries T5, an ABSOLUTE ANCHOR pinning row zero's content address to the literal private-ref:6a8ff7f7, and ships 5/5 GREEN with adoptgate APPROVED content=GREEN behave=DIFFERS evidence=STRONG (behaviour changed, which is expected when a tooth is added). Every other tooth in that gate is self-consistent -- it compares retrieved bytes against what it itself encoded -- so a change inside canon_encode moved both sides identically and the bite measured exactly that: valid_mutants=2 killed=0 with not_reached=0, mutants that REACHED the code and were not caught. An absolute expected value breaks the symmetry. THE LITERAL WAS READ FROM A RUN: the gate was made to print row zero's CID, rebuilt and run, and the value taken from that output. A June note carries a truncated form of the same prefix, and it MATCHES, which is a pleasing corroboration that the encoding has been stable for 82 days -- but pinning from that note would have been the fabricated-constant defect the anchor exists to catch, so it was not done. A SECOND DEFECT WAS FOUND ON THE WAY AND FIXED: the fixture path was CWD-DEPENDENT. The gate passed 4/4 under the ship loop and then read UP-UNREADABLE under nx_sov_build_run, because a bare knowledge/ path resolves from the estate root and not from buildroot. The abstain-never-acquit guard did its job -- it refused by name with passed 0/0 rather than passing on zero rows -- and the fix tries the estate-root, parent and buildroot spellings in turn. OWED AND NAMED: the bite that would prove T5 kills is blocked, not skipped. Three attempts returned void_build_lane=4 valid_mutants=0 and then BUILD-REFUSED-BY-ADMISSION at load 2485 against a 1643 ceiling. Until a mutant reaches it, T5 is a REASONED fix and not a proven one, and this gate stays bitten-zero-kill on the board.
FM2 Tolerant-reader decode · cell PRESENT · gate NO-GATE-DECLARED
Contractcanon_decode · executor Organ · 1 u · stands on FM1
Definition of doneLANDED June 2026, gate 4/4. Proven by CID equality rather than by inspection: encode three fields, decode with a reader that knows two, re-encode, and the CID is byte-identical because the third survived; the neg-control drops it and the CID moves. This is the operator's house-of-cards fix made mechanical.
Matrix cellTolerant-reader decode preserves unknown fields on round-trip · runtime/nx_uxf_decode.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_decode; declare nx_uxf_decode TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
FM3 Endpoint-adaptive emit plan · cell PRESENT · gate NO-GATE-DECLARED
Contractng_negotiate · executor Organ · 1 u · stands on FM1
Definition of doneLANDED June 2026, gate 5/5, capabilities data-driven from endpoint_caps.tsv. Decides the Chrome-cannot-play-MKV case as a lossless REMUX rather than a re-encode, which is the correct model and the whole point of law 1.
Matrix cellEndpoint-adaptive emit plan chosen from declared capability · runtime/nx_uxf_negotiate.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_negotiate; declare nx_uxf_negotiate TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-06 land THREE OF NINE D001 MIGRATIONS SHIPPED, AND THE BOARD IS NO LONGER CLAIM-ONLY. nx_uxf_cid_gate 6/6, nx_uxf_decode_gate 4/4 and nx_uxf_negotiate_gate 7/7 are each PROMOTED and REGISTERED with live_sha equal to staged_sha, formats.gates carries three rows, and nx_domain_admit now returns VERDICT=ADMIT rather than ADMIT CLAIM-ONLY. The negotiate migration gained TWO TEETH the original lacked: it printed whether the capability rows loaded but never asserted it, so a missing fixture could only have been judged indirectly by the outcomes; T0a and T0b now assert the fixture reached its condition before any plan is claimed. WHAT IS STILL NOT PROVEN, STATED AS THE GATE ITSELF STATES IT: C4 reads declared=3 bite-proven=0 never-bitten=2 bitten-zero-kill=1 and the partition sums. nx_uxf_cid_gate is BITTEN-BUT-VACUOUS, meaning a mutation run happened and killed nothing, which counts as coverage and carries an empty verdict; the other two have no bite record at all. THE CAUSE IS THE BOX, NOT THE GATES: every bite attempt this session lost the admission race (valid_mutants=0 void_build_lane=3 on the first, BUILD-REFUSED-BY-ADMISSION on the next two) because a bite needs many consecutive builds and is the first work a loaded box starves. Custody was clean every time: twins banked, twins restored, mutant_live=0, subjects byte-identical. RE-RUN ALL THREE BITES ON A QUIET BOX; until then these three greens are UNFALSIFIED, not proven.
FM4 Extract the frame-level rewrap from its test · cell PRESENT · gate NO-GATE-DECLARED
Contractuxf_remux_frame · executor Organ · 2 u · stands on FM3
Definition of doneThe lossless byte-identical EBML-to-MP4 carry is proven, but it lives INSIDE nx_uxf_remux_test with no callable entry point, so the capability cannot be composed by anything. Extract it to a lib function with the test as its gate. Done-rule: a caller outside the test performs the carry and the bytes still compare identical.
Matrix cellLossless rewrap proven at the byte level · runtime/nx_uxf_remux.nx · PRESENT decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_remux; declare nx_uxf_remux TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-09-06 land FM4 CLOSED, AND IT WAS AN EXTRACTION RATHER THAN A PORT. The lossless rewrap was proven byte-identical in June 2026 inside nx_uxf_remux_test with no function anything could call, which is why this board ranked it first: a capability that cannot be composed is not yet a capability. runtime/nx_uxf_remux.nx now carries uxf_remux_frame as a real entry point taking an input element, an output buffer and a capacity, returning the bytes written or a NAMED negative refusal, plus uxf_remux_src_off so a caller can prove byte identity without re-parsing. nx_uxf_remux_gate drives it 9/9 GREEN, PROMOTED with live_sha equal to staged_sha. THE EXTRACTION ADDED BOUNDARIES, SO IT ADDED CONTROLS: a malformed vint, a frame declaring more bytes than its input holds, and an output too small to fit are each refused BY NAME with a distinct code, and all three teeth assert the specific code rather than merely that something failed. The well-formed case is the positive control, so an implementation that refused everything would fail T0 through T5. The ranker moved the rung from open to done by itself: rungs=9 done=4 open=5 finish=2 with the partition summing, and the critical path re-ordered to FM5 then FM8 because FM4 dropped off it. The matrix contract flipped from _ABSENT_:uxf_remux_frame to the live symbol, verified by arithmetic (5688 to 5679 bytes, exactly the nine characters of the removed prefix).
2026-09-06 measure TWO GATES ARE NOW BITE-PROVEN, AND THE EARLIER INCONCLUSIVES WERE THE BOX RATHER THAN THE GATES -- WHICH IS EXACTLY WHAT THE ABSTENTION SAID AND IS WHY IT MATTERED THAT IT ABSTAINED. nx_uxf_remux_gate: cmp site 0 build_exit=0 KILLED, valid_mutants=1 invalid_uncompilable=0 void_build_lane=0 killed=1, verdict=GREEN gate BITES, restore verified 6761 bytes byte-identical. nx_uxf_negotiate_gate: cmp site 0 build_exit=0 KILLED, valid_mutants=1 killed=1, verdict=GREEN gate BITES, restore verified 4354 bytes byte-identical. Custody clean on both: twins_checked=2 restored=2 mutant_live=0. THE METHOD THAT WORKED IS WORTH KEEPING: drop max_sites_per_operator to 1 so a bite needs the FEWEST consecutive compiles, and fire it the moment nx_build_admit reads GRANT with load near the ceiling rather than far above it. Five earlier attempts at two and three sites were each refused mid-run because a bite is the first work a loaded box starves. ONE HONEST NON-RESULT, RECORDED AS ITS OWN CAUSE: the same one-site method against nx_uxf_cid.nx returned valid_mutants=0 invalid_uncompilable=2 void_build_lane=0, meaning admission was NOT the problem there -- both perturbations simply failed to compile, because that subject is hex-nibble arithmetic where changing a constant breaks the build. That is a property of the subject and not evidence about the gate, so nx_uxf_cid_gate stays unproven for a DIFFERENT reason than the others did, and it needs an operator that reaches its logic rather than its constants.
2026-09-06 land SIXTH MIGRATION SHIPPED AND BITE-PROVEN IN ONE PASS, AND IT REMOVED A DUPLICATE RULER RATHER THAN ADDING ONE. nx_uxf_ebml_test carried its own ebml_vint_len, ebml_read_id and ebml_read_size that were byte-for-byte the logic now living in nx_uxf_remux.nx as uxr_vint_len, uxr_read_id and uxr_read_size, so the migration points the teeth at the LIB instead of copying a second EBML reader into a gate. nx_uxf_ebml_gate runs 14/14 GREEN, PROMOTED with live_sha equal to staged_sha, and its bite killed a compiling mutant on the first attempt. C4 now reads declared=6 bite-proven=6 never-bitten=0 bitten-zero-kill=0 sum=6 ALL-PROVEN. TWO TEETH WERE SPLIT ON PURPOSE: the original asserted a read's VALUE and its CURSOR ADVANCE inside one conjunction, so a reader returning the right number without advancing would fail without saying which half broke; T2a and T2b, T3a and T3b now name it. The eight vint length classes were likewise split from one boolean into eight teeth, so a failure names its class rather than reporting that some class among eight is wrong. ONE OPERATIONAL FACT WORTH KEEPING: a write job sat in state=CLAIMED with its target file ABSENT while the box read GRANT at load 1499, i.e. it was WEDGED rather than slow, and re-issuing the identical full-file write landed instantly. A full-file write of identical content is idempotent, so re-issue is the safe move there, unlike an append.
2026-09-06 land SEVENTH MIGRATION SHIPPED: nx_uxf_mp4box_gate 8/8 GREEN, PROMOTED and REGISTERED, and it removes the THIRD duplicate ruler in this family. nx_uxf_mp4box_test carried its own mp4_w32, mp4_r32, mp4_4cc, mp4_box_begin and mp4_box_end, the same primitives now shipping in nx_uxf_remux.nx, so the teeth were pointed at the lib and the estate keeps one MP4 box writer instead of a test copy beside a shipping copy. The 4cc comparison uses the lib's own uxr_bytes_eq rather than adding a helper to a lib that is ALREADY BITE-PROVEN, because editing a proven lib to satisfy a test destroys the proof for no capability gain. Teeth were split where the original bundled claims: the walk's ALIGNMENT and its BOX COUNT are separate, each of the three expected 4cc types is its own tooth read at box start plus four (the offset an earlier bug got wrong), and the moov size is asserted to cover header plus child so NESTING is proven rather than mere adjacency. ITS BITE IS NOT YET AVAILABLE AND IS RECORDED AS SUCH: two attempts returned BUILD-REFUSED-BY-ADMISSION with the box in an I O storm (procs_blocked 11 against a ceiling of 8, then load 1810 against 1643), so this gate is UNFALSIFIED rather than proven and must not be counted in any bite-proven figure until it kills a compiling mutant. The six gates before it are bite-proven; this one is seven-of-nine shipped and six-of-seven proven, and those are different numbers on purpose.
2026-09-06 measure EIGHT MIGRATIONS SHIPPED, SEVEN BITE-PROVEN, AND THE EIGHTH RETURNED A DIAGNOSIS I AM NOT ADOPTING BECAUSE IT IS REFUTED BY THE SOURCE. nx_uxf_media_asset_gate 7/7 GREEN is PROMOTED and BITE-PROVEN (killed=1), and it is the end-to-end proof: a descriptor is stored once under a self-describing UXF_MEDIA CID, tolerant-decoded by a consumer that did not write it, and the DECODED FIELDS ALONE decide a lossless rewrap for one endpoint and a direct serve for another. THE OPEN ONE IS nx_uxf_mp4box_gate. Its bite returned valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 not_reached=2 killed=0 with the summary NOT-SUBSTITUTABLE and the offered explanation that the gate does not import the mutated source and almost certainly FORKS its subject as a separate binary. THAT EXPLANATION IS FALSE FOR THIS GATE AND THE SOURCE SETTLES IT: nx_uxf_mp4box_gate carries import nx_uxf_remux.nx and calls uxr_w32, uxr_r32, uxr_4cc, uxr_box_begin, uxr_box_end and uxr_bytes_eq IN-PROCESS; it forks nothing. So the OBSERVATION is real -- two mutants, including one inside uxr_r32 which this gate demonstrably calls, produced a byte-identical artifact -- while the CAUSE named beside it does not apply here. This is the estate's own law that a message naming the wrong stage costs the reader the investigation it was written to save them, and the honest state is that the cause is UNKNOWN rather than forking. TWO CANDIDATES WORTH DISCRIMINATING, neither asserted: a build-cache entry for the gate keyed on something that did not change when its imported subject was mutated, or a baseline-vintage mismatch, since a direct sov-lane build of this target earlier produced 30025 bytes against the promoted 35096 and the bite recorded baseline_artifact_bytes=35096. The discriminator is cheap: mutate the subject, rebuild the gate, and compare the artifact digest to the pre-mutation one directly rather than through the harness. Until then this gate stays UNFALSIFIED and is NOT counted in any bite-proven figure. Custody was clean throughout: twins restored, mutant_live=0, subject byte-identical at 6761.
2026-09-06 measure THE mp4box NOT-REACHED HAS A MECHANISM NOW, FOUND BY PROBING THE BUILDER DIRECTLY INSTEAD OF ACCEPTING THE HARNESS PROSE. nx_sov_build_run nx_uxf_mp4box_gate --build-only prints BUILD-CACHE HIT key=23c37fa71ed135359c70da78ccf104ca01f65d2ac8405d0716cbd78d5e93cbd7 bytes=35096 with COMPILER NOT RUN and a byte-identical artifact reused. A bite mutates the LIB and rebuilds the GATE, so if the cache key does not cover the import closure the cache hands back the PRE-MUTATION binary and every mutant necessarily reads byte-identical, which is exactly the NOT-REACHED the harness saw. That is a SUFFICIENT mechanism and it is not yet a proof: six sibling gates bitten the same way DID kill mutants through the same lib, so the closure is tracked at least sometimes. The discriminating experiment is one line -- mutate nx_uxf_remux.nx, rebuild a dependent gate, and compare the PRINTED CACHE KEY against the unmutated key rather than reading the harness verdict. IF THE KEY IS UNCHANGED THE DEFECT IS SYSTEMIC AND FAILS IN THE FLATTERING DIRECTION, because an unreachable mutant is EXCLUDED rather than counted as a survivor, so a warm cache would quietly convert real mutation coverage into NOT-SUBSTITUTABLE across the estate. Filed as toolchain debt with the evidence. A SECOND FINDING FELL OUT OF THE SAME PROBE: build FLAVOUR is INHERITED FROM THE INCUMBENT (src=incumbent, debug once a serving-root twin carries a line table), so this one source built to 30025 bytes with no live twin and 35096 with one. A size difference across those two states says nothing about the source, and I had briefly read it as evidence of one.
2026-09-06 queue THE BUILD-CACHE DISCRIMINATOR IS ARMED AND NEEDS EXACTLY ONE ADMITTED BUILD. The open question from debt 1788736703 is whether the build-cache key covers a target's IMPORT CLOSURE, because if it does not then every nx_gate_bite through a lib silently degrades to NOT-REACHED on a warm cache and fails in the flattering direction. THE EXPERIMENT IS SET UP AND IS SAFE BY CONSTRUCTION: nx_uxf_remux.nx now carries a COMMENT-ONLY provenance block, which changes its source bytes while compiling byte-identical, so it cannot alter any behaviour or invalidate the bite proofs that already stand on it. The recorded key for the dependent gate BEFORE that edit is 23c37fa71ed135359c70da78ccf104ca01f65d2ac8405d0716cbd78d5e93cbd7. TO FINISH IT, run one command: nx_sov_build_run nx_uxf_mp4box_gate --build-only, and read the BUILD-CACHE line. A DIFFERENT key means the closure IS covered, the cache is exonerated, and the mp4box NOT-REACHED needs another explanation. THE SAME key means the closure is NOT covered, the cache is confirmed as the cause, and the defect is systemic across every bite in the estate rather than local to one gate. Two attempts were refused by admission at procs_running 17 and 11 against ncpu 8, so nothing is claimed either way; the refusals are a fact about the box and not about the cache. This is written down rather than left in a seat's head precisely because the answer is one command away and the question changes how much every bite verdict in the estate is worth.
2026-09-06 measure ALL NINE FORMATS GATES RUN GREEN FROM THEIR PROMOTED ARTIFACTS RATHER THAN FROM A BUILD-LANE FOSSIL -- 65 teeth, measured 2026-09-06 by forking each promoted elf through nx_job_run: cid 6 of 6, decode 4 of 4, negotiate 7 of 7, remux 9 of 9, config 5 of 5, ebml 14 of 14, mp4box 8 of 8, media_asset 7 of 7, tsv_persist 5 of 5. This is a genuinely new measurement and not a restatement: every earlier GREEN on this board was read off a build-lane run, and a green from a differently-built artifact is indistinguishable from a green from the served one. tsv_persist's T5 ABSOLUTE anchor reproduced its pinned literal row0 content address against the promoted binary, so the encoder cannot have drifted behind self-consistent teeth. nx_catalog reads all nine SOURCE then BUILT then PROMOTED then REGISTERED with AUTHORISED NO and INVOKED NO, so the remaining gap on this board is EXECUTION SURFACE and not build state: none of the nine appears in knowledge/gateroster.conf, and that absence is complete-coverage rather than a filtered read because nx_txtscan find scanned the whole 51513-byte roster and returned total=0.
2026-09-06 lesson A BUFFER RESTORE UNDOES THE INPUT AND NOT THE DERIVED STATE, SO A VALUE READ BACK FROM A REUSED OUT-PARAMETER PUBLISHES THE NEG-CONTROL'S ANSWER WEARING THE TOOTH'S NAME. MEASURED 2026-09-06 in nx_uxf_mp4box_gate, which passed 8 of 8 while publishing toplevel_box_count=0 directly against its own tooth T2b asserting actual=2 expected=2. Mechanism READ FROM THE SOURCE rather than guessed: one cnt buffer is filled by the good-tree walk, T2b tests cnt[0] and passes on 2, the neg-control then calls um_walk_count a SECOND time into THAT SAME out-parameter leaving cnt[0]=0, and the gv_kv emission runs last. The author had already reasoned about the restore and written the comment restore so the emitted values below describe the real tree -- the BUFFER was restored and the DERIVED COUNT was not, which is exactly why moov_size and mvhd_size are honest, being re-read from the restored buffer, while toplevel_box_count is not. THE GUARANTEE gv_check_eq GIVES IS NARROWER THAN IT READS: it binds the number tested to the number published only for values passed INTO it, and a separate gv_kv re-reading a mutable buffer afterwards carries no such binding. This is the first defect the estate's value emission has caught that no pass-fail vector could, because 8 of 8 GREEN was correct while the published number was false -- which is the whole argument for the L4 axis stated as a measurement instead of a hope. REMEDY LANDED IN SOURCE THE SAME HOUR: bind the good walk's count into toplevel_good before the neg-control re-walks, emit that, emit the clobbered value under its own name toplevel_box_count_after_corrupt_walk so nothing is hidden, and add a tooth that pins the clobber itself so the hazard is tested rather than commented. The rebuild is queued behind build admission and the gate on the NAS still publishes the false value until it lands.
2026-09-06 land THE NINE FORMATS GATES ARE NOW ON AN EXECUTION SURFACE -- knowledge/gateroster.conf 51513 to 54980 bytes, hand-added 2026-09-06 in the file's own declared style because the admit verb takes a trial journal and a deadline rather than a name and these have no trial-journal run. BEFORE: nx_catalog read all nine SOURCE then BUILT then PROMOTED then REGISTERED with AUTHORISED NO and INVOKED NO, and nx_txtscan find over the whole 51513-byte roster returned total=0, so their absence from the beat was complete-coverage rather than a filtered read. The evidence block declares WHAT WAS NOT MEASURED: verdicts came from nx_job_run, so there is no /api/gate_run exit_code and no timing against the 14750 ms deadline -- it matches the roster's existing 21/21 precedent, admitted on GREEN on the live promoted binary well under any deadline. It also declares two things a smoother block would have hidden. First, nx_uxf_negotiate_gate and nx_uxf_media_asset_gate READ THE LIVE knowledge/registry/endpoint_caps.tsv rather than a fixture, so a RED from either can mean the capability table changed rather than that the negotiator broke; both abstain by name when it cannot be read, which is the third state rather than an acquittal. Second, nx_uxf_mp4box_gate's source is AHEAD of the binary the beat will run until its rebuild clears admission. THE PRINCIPLE THIS CLOSES: a gate nobody runs does not degrade to neutral, it degrades to a false sense of coverage, because its existence is counted and its verdict is not.
2026-09-07 land THE MP4BOX PUBLISHED-VALUE DEFECT IS CLOSED END TO END ON THE LIVE BINARY. Source 5421 to 6038 bytes over three CAS-chained edits, built 35424 B through /api/build with src_path naming the target and src_stable=1, nx_contentdiff live against staged read lost_from_live=0 lost_permil=0 with symmetry ONE-WAY-GAIN -- a strict superset whose gained runs include the new tooth name -- promoted under expect_sha256 005ead0976b7b26d with prev=1 banked, and the live binary re-run through nx_job_run now reads 9 of 9 GREEN with toplevel_box_count=2 agreeing with its own tooth T2b while the clobbered value is published honestly under its own name as toplevel_box_count_after_corrupt_walk=0. The new neg-control tooth PASSES, so the hazard is a TESTED property of this gate rather than a comment a later editor could delete without consequence. The stale caveat this lane had written into knowledge/gateroster.conf was corrected in place the same hour rather than left standing, because a warning label on a stale fact does not stop the fact being used.
2026-09-07 retract MY OWN HYPOTHESIS THAT THE BUILD CACHE KEY DOES NOT COVER THE IMPORT CLOSURE IS REFUTED, and the discriminating experiment is recorded here so nobody re-runs it. DESIGN: nx_uxf_remux.nx received a COMMENT-ONLY provenance edit, which changes source bytes while compiling byte-identical, and nx_uxf_remux_gate -- whose own source was untouched and which imports that lib -- was rebuilt. A cache HIT would have proven the key ignores the closure; a MISS proves it covers it; and no recorded baseline key is needed because HIT against MISS is the entire answer. RESULT: BUILD-CACHE MISS reason=no-entry key=bd983b1e04db922e, and in the same run BUILD-CACHE STORE bytes=38808 sha256=f4983df33eaa389c, byte-identical in size to the promoted artifact. THE KEY MOVED WHILE THE BYTES DID NOT, which is exactly what a neutral edit should do and is the cleanest available confirmation. The cache is EXONERATED for the sovereign build lane. SCOPE STATED HONESTLY: this proves closure coverage ONLY. It says nothing about the separate and still-real defect that a cache HIT verifies its sidecar without stat-ing the artifact it describes, which is how a builder once reported reuse and materialised nothing. CONSEQUENCE I OWE: I predicted in advance that if the key changed then the mp4box NOT-REACHED bite result returns to unknown. It does. That cause is now UNATTRIBUTED and must be re-investigated rather than carried as explained. I ALSO CONTAMINATED MY FIRST PROBE by editing nx_uxf_mp4box_gate, whose key must change regardless of the lib, and the subject was swapped to nx_uxf_remux_gate for exactly that reason -- a control you edit is not a control.
2026-09-07 land ALL NINE _offc TWINS WERE STALE OR ABSENT AND ARE NOW INSTALLED FROM THE PROMOTED ROOT -- nx_offc_install reported installed=1 for every one of the nine, so not a single twin was already correct. This matters because promote writes the SERVING ROOT while runners fork _offc, so wiring these nine onto the gate roster WITHOUT this step would have pointed a beat at binaries that were stale or missing, and an absent artifact forks as exit 127, which reads as a broken gate rather than as a missing copy -- the failure would have been blamed on the gates I had just admitted. The step was taken under the standing rule that when absence cannot be cheaply proven and the remedy is idempotent and safe you apply it rather than keep reasoning: nx_offc_install is a no-op wherever the twin already matches, so the cost of being wrong was zero while the cost of skipping it was nine gates that look broken on their first beat. nx_uxf_mp4box_gate's twin was refreshed from the JUST-PROMOTED fixed binary, so the beat and the MCP surface now agree on the 9 of 9 version rather than the 8 of 8 one. DEBT HYGIENE the same hour: the refuted build-cache hypothesis was superseded by row 1788739261 carrying the discriminating experiment and the true scope, and the original row was then eaten, because an eaten row keeps its prose and a wrong mechanism left searchable costs the next seat the whole investigation again.
2026-09-07 queue THE MP4BOX NOT-REACHED CAUSE IS NOW UNATTRIBUTED AND HAS ONE NAMED NEXT EXPERIMENT, DELIBERATELY NOT RUN INTO A THIN MARGIN. With the build-cache exonerated, the surviving hypothesis is one the estate has already measured on another lane: a bite under an admission storm reports its mutants VOID, and a VOID mutant surfaces as NOT-REACHED rather than as a survivor, which fails in the FLATTERING direction because an unreachable mutant is never counted against the gate. RECIPE: nx_gate_bite nx_uxf_mp4box_gate nx_uxf_remux.nx 2, then READ void_build_lane= BEFORE believing any INCONCLUSIVE or NOT-REACHED verdict. The gate now carries 9 teeth including the clobber neg-control, and uxr_r32 is demonstrably called in-process with nothing forked, so a mutant there MUST be reachable if it is built at all -- which is what makes void_build_lane the discriminator rather than reachability. PRECONDITION, stated because ignoring it is what produced the ambiguous first result: a bite is several consecutive compiles and is the first work a loaded box starves, so it needs SUSTAINED headroom and not a single GRANT. NOT RUN THIS PASS ON PURPOSE: nx_build_admit returned GRANT with procs_blocked=7 against blocked_max=8, one D-state from refusing, and load1_centi=1700 already above max_centiload=1643. Firing a multi-compile bite into that margin would most likely reproduce the very VOID condition it exists to resolve while hammering an array that is already struggling, and on this estate a change that hammers the box is a defect even when the feature works. The instrument is not blocked, the MARGIN is -- and publishing through a blocked instrument is exactly how an ambiguous result gets promoted into a confident one.
2026-09-07 measure THE MP4BOX NOT-REACHED CAUSE IS NOW FULLY ATTRIBUTED AND IT IS A THIRD MECHANISM -- NOT THE CACHE AND NOT THE STORM. The bite ran to completion: valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 not_reached=4 killed=0, custody clean with twins_checked=2 restored=2 refreshed=0 mutant_live=0 and the lib restored byte-identical at 7180. void_build_lane=0 REFUTES MY OWN QUEUED HYPOTHESIS that an admission storm was voiding the mutants -- every mutant compiled with build_exit=0, so the storm explanation is dead. THE HARNESS'S OWN PRINTED EXPLANATION IS ALSO REFUTED: it states the gate almost certainly FORKS its subject as a separate binary, while the source shows nx_uxf_mp4box_gate imports nx_uxf_remux.nx and calls uxr_w32, uxr_r32, uxr_4cc, uxr_box_begin, uxr_box_end and uxr_bytes_eq IN-PROCESS, forking nothing at all. THE TRUE CAUSE, read straight off the offsets: nx_uxf_remux.nx contains uxr_r32 exactly twice, its definition at 3731 and one call site at 4716 inside uxr_walk_ok. The harness aimed its symbol-targeted mutation at 4782, which lands inside uxr_walk_ok -- and THIS GATE NEVER CALLS uxr_walk_ok, because it defines its OWN um_walk_count locally. Dead code is dead-stripped by the compiler, so mutating it CANNOT change the artifact; meanwhile the one site genuinely inside uxr_r32 (off 3737) did not compile and was correctly excluded. All four NOT-REACHED are therefore mutations of library code this particular gate does not reach, plus two uncompilable mutants. THE LAW: NOT-REACHED CONFLATES THE MUTATION COULD NOT REACH THE BINARY WITH THE MUTATION REACHED A BINARY THAT DOES NOT USE THAT CODE, AND DEAD-STRIPPING MAKES THE SECOND INDISTINGUISHABLE FROM THE FIRST -- which is why the harness prints a remedy, re-run with subject, that is INAPPLICABLE to an in-process gate and would have cost the next seat the entire investigation. AND THE SITE LABEL ITSELF MISLEADS: sym site uxr_r32 @off=4782 attributes a site to a function whose one-line body ends roughly a thousand bytes earlier. THE ACTIONABLE REMEDY FOR THIS GATE is to aim the bite at a function it genuinely calls, uxr_box_end or uxr_bytes_eq, rather than at whatever the symbol scan happens to land on.
2026-09-07 measure THE SERVED nx_gate_bite IGNORES argv[4] ENTIRELY -- aim AND aimlist ARE BOTH SILENTLY DISCARDED, PROVEN BY A CONTROL RATHER THAN INFERRED. Three runs against the same gate and the same subject -- no fourth argument, then aim uxr_box_end, then aimlist -- produced BYTE-IDENTICAL output: the identical mutation offsets 2970, 3273, 1866, 1870, 4782 and 3737, the identical NOT-REACHED lines, the identical verdict. aimlist is the decisive one, because its entire purpose is to PRINT A LIST INSTEAD OF RUNNING A BITE and it ran a full four-mutant bite instead. Neither run emitted a usage error, so the argument is accepted and then discarded, which is the silent class. WHY THIS MATTERS FAR BEYOND THE GATE IT WAS FOUND ON: the estate's standing doctrine instructs every seat to aim a bite with exactly these arguments, so a seat that FOLLOWS THE INSTRUCTION receives a silently ignored flag and believes it aimed the mutation when it did not -- and this is the precise defect the doctrine itself records having corrected once already, recurring. A DOCTRINE THAT NAMES AN ARGUMENT ITS TOOL DOES NOT HONOUR CONVERTS I DID NOT PROVE IT INTO I FOLLOWED THE RULE. SCOPE STATED HONESTLY AND NOT OVERREACHED: I measured the SERVED binary only. nx_catalog reads nx_gate_bite LIVE with BUILT equal to PROMOTED at 93631 against a 98879-byte source, and BUILT is the last build anybody ran rather than a fresh one, so whether the SOURCE implements aim is UNMEASURED BY ME and must not be inferred from this run. CONSEQUENCE FOR THIS BOARD: mp4box cannot be aimed at a function it genuinely calls using the tool as served, so its bite-proof stays open on a TOOL defect rather than on a GATE defect -- and keeping those two apart is the entire point, because the gate's nine teeth are not what failed here.
2026-09-07 measure AIMING THE BITE SOLVED REACHABILITY AND EXPOSED THE NEXT DEFECT IN THE SAME RUN. With aim uxr_box_end 0 the harness reported aim: func uxr_box_end @off=4235 end=4339 skip=0 and NOT-REACHED fell from 4 to ZERO, moving the verdict from NOT-SUBSTITUTABLE to INCONCLUSIVE -- which is the difference between cannot be reasoned about at all and no kill from these particular perturbations. THE NEXT DEFECT, read straight from aimlist: nx_gate_bite's numeric-constant operator treats DIGITS INSIDE IDENTIFIERS as numeric sites. All four sites in uxr_box_end are exactly that -- i64, i64 again, and the 32 of uxr_w32 -- so every mutant there is uncompilable BY CONSTRUCTION, which is precisely what happened at 2 of 2 build_exit=3, and the same cause explains the earlier num site 1866 and sym num 3737 failures. aimlist uxr_r32 then separated the classes cleanly across 13 sites: 0 to 3 and 11 to 12 are identifier or type digits, while sites 4, 7 and 10 are the REAL constants 16777216, 65536 and 256. PROOF THAT AIMING PAST THE IDENTIFIER SITES REACHES LIVE CODE: with skip=4 the mutant artifact measured 35432 bytes against the 35424-byte baseline, an 8-byte delta, so the mutation demonstrably ENTERED the binary under test -- something none of the six earlier sites managed. The PROMOTED artifact stayed 35424 throughout, so nothing live was disturbed and custody held. REMEDY FOR THE TOOL, named precisely rather than gestured at: the numeric operator must skip any digit run adjacent to identifier characters, because i64, u8, f32 and every name ending in digits are guaranteed-invalid mutants that consume the entire site budget and make a perfectly reachable gate read as unreachable.
2026-09-07 lesson THE HARNESS DEFECT IS NOW EXACT, READ OFF THE PREDICATE RATHER THAN INFERRED FROM ITS OUTPUT. nx_gate_bite's numeric site scanner walks to the LAST digit of a run and then tests only the ONE character before it, excluding lowercase, uppercase, underscore, dot and the x of a hex prefix. That is correct for a SINGLE-digit suffix -- the 8 of u8 is preceded by u and is properly excluded, which is why u8 never appears in any site list -- but for a MULTI-DIGIT suffix the last digit's predecessor is ITSELF A DIGIT, and no rule excludes a digit. So the 4 of i64 and the 2 of uxr_w32 are both accepted as numeric constants and mutated into code that cannot compile. The site list is the proof: all four sites in uxr_box_end are identifier digits, two i64 and one uxr_w32, and every aimed mutant there returned build_exit=3. THE CONSEQUENCE IS NOT COSMETIC: guaranteed-invalid sites consume the entire per-operator budget, so a gate that genuinely imports and calls its subject reports valid_mutants=0 and reads as UNREACHABLE -- which is exactly how this gate came to be labelled NOT-SUBSTITUTABLE with the harness blaming a fork boundary that does not exist in it. THE FIX IS SMALL AND PRECISE: before the preceding-character test, walk BACK across the whole digit run to its first digit and test the character before THAT, guarding the index so the walk cannot read before the buffer, and drive the walk with an explicit flag rather than by clobbering the cursor. AND IT MUST BE FIXED IN ONE PLACE, NOT TWO: gb_num_at carries the comment Predicate MIRRORS gb_site_num; that fn is UNTOUCHED, so the aimed and unaimed paths hold two copies of one predicate that must agree by discipline -- the duplicate-ruler shape this estate forbids, and correcting only one would make them diverge silently. Filed with the exact remedy; deliberately NOT shipped in this session, because this is the harness 630-plus gates are proved with, its own bite was still in flight against it, and a broken mutation harness does not fail loudly -- it returns verdicts that merely look reasonable.
2026-09-07 measure THE BITE FINALLY PRODUCED VALID MUTANTS AND THEY FOUND A REAL VACUITY IN THIS GATE'S FIXTURE. Progression across three runs of the same gate and subject: unaimed gave valid_mutants=0 not_reached=4 invalid=2 and NOT-SUBSTITUTABLE, which says nothing; aim uxr_box_end 0 gave valid=0 invalid=2 not_reached=0; aim uxr_r32 4 gave valid_mutants=2 invalid_uncompilable=0 void_build_lane=0 not_reached=0 killed=0 -- the FIRST valid mutants this gate has ever had, with custody clean (twins_checked=2 restored=2 mutant_live=0, lib restored byte-identical at 7180). BOTH SURVIVED, AND THE REASON IS A GENUINE WEAKNESS I DID NOT PUT THERE: site 4 is the 16777216 byte-0 multiplier and site 5 is the 1 index in buf[off + 1], and every box size this gate builds is 24, 116, 108 or 140 -- all of which fit in a SINGLE byte. So the 32-bit big-endian encodings the gate reads are 00 00 00 74 and friends, every high-order byte is ZERO, and 0 times 16777216 is 0 whatever that constant becomes while byte 1 and byte 2 are both 0 so swapping the index changes nothing. THE HIGH-BYTE ASSEMBLY OF uxr_r32 IS UNTESTED BY CONSTRUCTION: a reader that got the big-endian order wrong in the top three bytes would pass all nine teeth. THIS IS THE BITE DOING ITS JOB -- a surviving mutant is a measurement, and here it names a specific missing tooth rather than a defect. REMEDY, precise: add a tooth that round-trips uxr_w32 and uxr_r32 over a value with NON-ZERO high bytes (0x01020304 is the obvious choice), which makes all three multipliers and all four byte indices load-bearing; the existing teeth stay as they are. NOTE THE ORDER OF DISCOVERY, because it is the whole argument for aiming: this weakness was unreachable until the aiming was fixed, since every earlier run spent its entire site budget on identifier digits that could not compile.
2026-09-07 land THE HARNESS FIX IS LANDED IN SOURCE AND COMPILES, AND IS DELIBERATELY NOT PROMOTED. nx_gate_bite.nx 98879 to 100893 over three CAS-chained edits: a new shared predicate gb_pre_run that walks back across the WHOLE digit run and returns the character before its FIRST digit, plus both call sites repointed at it, so gb_site_num and gb_num_at can no longer disagree -- the duplication was the second defect and unifying it was the fix, not patching one copy. Definition landed FIRST and uses SECOND so every intermediate state compiles. Build: BUILD-CACHE MISS, STORE bytes=107992, asm=474954B, SOVEREIGN, nothing installed anywhere. WHY IT IS NOT PROMOTED, and this is a judgement I own rather than a deferral: nx_contentdiff live against the candidate reads lost_from_live=1 with symmetry=BIDIRECTIONAL and gained_by_candidate=110 at 370 permil. The ONE lost run is enumerated and is NOT mine -- it is a sibling's rewording of an arena-allocator message, contended past NXA_LOCK_WARN becoming sustained allocator contention seen. But 110 gained runs and 14361 extra bytes against a roughly 2000-byte source addition mean this candidate carries a substantial amount of OTHER SEATS' work that has accumulated in the shared closure since the live binary was built, and the estate's own rule is that a candidate can be another seat's work in flight and must not be promoted by whoever did not write it. The fix is therefore READY: it needs a ship cycle that adjudicates the closure, not a promote from me.
2026-09-07 lesson TWO BUILDS OF ONE TARGET SERIALISE ON THAT TARGET'S BUILD LOCK, AND THE SECOND IS INDISTINGUISHABLE FROM A SLOW BOX -- MY OWN ERROR, RECORDED BECAUSE THE SYMPTOM POINTS AT THE WRONG CAUSE. I fired /api/build for nx_uxf_mp4box_gate, judged it wedged when its receipt did not appear, and then launched nx_sov_build_run on THE SAME TARGET to get the verification another way. Both then sat CLAIMED indefinitely while nx_build_admit read GRANT with load1_centi=1380, procs_running=2 and procs_blocked=6 -- a demonstrably healthy box. THE DISCRIMINATOR IS EXACTLY THAT CONTRAST: a job that is not progressing while the admission gate reports headroom is not waiting on the machine, it is waiting on a LOCK, and _build/<target>.lock is per-target. The first build already held it and my second queued behind it, so my remedy for a slow build was to add the one thing guaranteed to make it slower. THE COMPILE ITSELF HAD ALREADY SUCCEEDED before either receipt landed: nx_catalog read BUILT 35952 against PROMOTED 35424, the +528 bytes of the new high-byte tooth, which is the artifact answering a question the job receipts could not. RULE: never issue a second build of a target whose first build has not returned, and when a job stalls, read the admission verdict FIRST -- GRANT plus no progress means a lock, not a storm, and the artifact will usually tell you the compile finished long before the receipt does.
2026-09-07 queue RESUME IN ONE COMMAND EACH -- both fixes are written, compile, and are blocked ONLY on a build lock, not on judgement. STATE AT HANDOFF: nx_uxf_mp4box_gate SOURCE 7631 BUILT 35952 PROMOTED 35424, live binary healthy at 9/9 GREEN with toplevel_box_count=2; nx_gate_bite source 100893 with the shared gb_pre_run landed and a clean sovereign build at 107992. STEP 1, the gate: re-issue /api/build target=nx_uxf_mp4box_gate once buildroot/_build/nx_uxf_mp4box_gate.lock is free, then /api/promote with expect_sha256 from that receipt, then nx_job_run it and confirm 10 of 10 with high_byte_roundtrip=16909060 equal to high_byte_kat -- the new T4 tooth is the one the bite earned and it is the only tooth that makes uxr_r32's high bytes load-bearing. STEP 2, the harness: this one needs a ship cycle and NOT a bare promote, because nx_contentdiff live against the candidate reads lost_from_live=1 (a sibling's reworded arena-allocator message, enumerated and not mine) with gained_by_candidate=110 at 370 permil and +14361 bytes against a roughly 2000-byte source change -- that candidate carries other seats' accumulated closure work, so adjudicate the closure before promoting, and run nx_gate_bite_gate against the new binary first. WHY BOTH ARE STUCK: two builds of ONE target were issued while the first was still in flight and they serialised on the per-target lock; the lock file is 0 bytes and names no holder, and forcing it could corrupt a live compile, so it is left alone deliberately. THE VERIFICATION THAT ALREADY STANDS AND NEED NOT BE REDONE: the aimed bite reached valid_mutants=2 with not_reached=0 and void_build_lane=0, both mutants survived, and the survival is explained -- every box size in this gate fits in one byte so every high-order byte of every uxr_r32 read is zero, which is precisely what the new tooth fixes.
2026-09-07 land THE HIGH-BYTE TOOTH IS DEPLOYED AND VERIFIED LIVE AT 10 OF 10 -- THE BITE FINDING IS CLOSED END TO END. The build lock released and BOTH held jobs completed. nx_sov_build_run took a BUILD-CACHE HIT at 35952 bytes sha dea6c91e, DEPLOYED to serving root (twin refresh) and RAN the gate: T4 HIGH BYTES passed with actual=16909060 expected=16909060 delta=0, run-exit=0, and the values block now publishes high_byte_roundtrip=16909060 beside high_byte_kat=16909060 so the new tooth is falsifiable from outside rather than merely present. The /api/build receipt confirmed src_path naming the target with src_stable=1, /api/promote under expect_sha256 dea6c91e answered 503 read-after-accept and HAD LANDED (verified by artifact, not retried -- nx_catalog reads SOURCE 7631, BUILT 35952, STAGED 35952, PROMOTED 35952, all aligned), and nx_offc_install returned installed=1 so the copy every runner forks matches what promote blessed. THE FULL LOOP THIS CLOSES, in the order it happened: the aimed bite produced valid_mutants=2 where every prior run produced none, both survived, the survival was explained rather than excused (all box sizes fit in one byte so every high-order byte read is zero and 0 times any multiplier is 0), the missing tooth was written to make those multipliers and byte indices load-bearing, and the gate went 9 of 9 to 10 of 10 with the new tooth passing on the promoted binary. A surviving mutant was a measurement, it named a specific missing tooth, and the tooth now exists and is live.
FM5 A playable muxer, not a container primitive · cell WATCHING · gate NO-GATE-DECLARED
Contractuxf_mux_track · executor Organ · 3 u · stands on FM4
Definition of doneThe honest gap June named and did not close: sample tables stts stsc stco, codec-private stsd, timestamps, multi-track moov nesting. Until this lands the remux is a proven data-flow and not a file anything can play. Done-rule: a produced MP4 plays in a real player and the referee says so, not the author.
Matrix cellA playable muxer, not only a container primitive · runtime/nx_uxf_mux.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_mux; declare nx_uxf_mux TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
FM6 Document profile exercised · cell WATCHING · gate NO-GATE-DECLARED
Contractuxf_doc_ingest · executor Organ · 3 u · stands on FM2
Definition of doneUXF_DOC is a declared codec id with nothing behind it. Overlaps the reader arc's structure recovery. Done-rule: a real PDF or EPUB becomes an envelope record whose export back out is lossless for the fields claimed.
Matrix cellDocument profile exercised end to end · runtime/nx_uxf_doc.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_doc; declare nx_uxf_doc TAB <gate> and the ship loop proves it and the verdict lands here.
Work log2026-10-03 land THE DOCUMENT PROFILE HAS SOMETHING BEHIND IT, UNDER ANOTHER NAME, AND THIS RUNG IS NOT CLOSED BY IT. unidoc UD11 shipped nx_uxf_doc_lib 2026-10-03 (tool nx_uxf_doc ca16fae3, gate nx_uxf_doc_gate 95fd727b 27 of 27, bite-proven): a document is a manifest and blocks as canonical NXR1 records under UXF_DOC, composing this board's FM1 (uxf_cid_profiled) and FM2 (canon_decode) rather than re-implementing them, which also gives those two libs their first shipping importers. Exercised on real files through the registered tool: a genuine Word document (48849 B) became a 66-block container (24269 B), was exported to a Word package (22275 B) and re-imported as 66 blocks; the Utah H.B. 181 enrolled PDF (41024 B) became a container of only 2 blocks (18020 B), because the PDF fold carries the text layer and almost none of the structure. So this rung's own done-rule (a real PDF or EPUB whose export back out is lossless for the fields claimed) is met for text and NOT for structure, and its contract symbol uxf_doc_ingest names no function: the owner of this board either repoints FM6 to the import path that exists (uxd_from_spec over the unified page's folders) and keeps the structure leg open, or keeps FM6 for PDF and EPUB structure recovery. Not repointed by the seat that shipped UD11, because closing another board's rung on a partly met done-rule is the name-flip this board warns against
FM7 Archive profile exercised · cell WATCHING · gate NO-GATE-DECLARED
Contractuxf_archive_pack · executor Organ · 4 u · stands on FM2
Definition of doneUXF_ARCHIVE is declared and unexercised, the last of five profiles with no proof. Done-rule: a real archive round-trips through the envelope with content-dedup demonstrated across identical members.
Matrix cellArchive profile exercised end to end · runtime/nx_uxf_archive.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_archive; declare nx_uxf_archive TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
FM8 Run the comparator or publish no ratio · cell WATCHING · gate NO-GATE-DECLARED
Contractuxf_bench_ratio · executor Organ · 3 u · stands on FM1
Definition of doneOur side is measured on the real path at 752021 records per second written including fsync and 474 nanoseconds per point get over 20000 records, and the SQLite workload file was generated to be identical. The comparator has NEVER RUN because sqlite3 is absent from the host and an unattended install hung on a sudo prompt. Until it runs the exceed is STRUCTURAL and DECLARED, and no ratio may be published. Done-rule: the yardstick runs on the same workload and the ratio is published with both raw numbers, or the row keeps saying it did not.
Matrix cellA measured one-to-one ratio against the store rival · runtime/nx_uxf_sqlite_ratio.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_uxf_sqlite_ratio; declare nx_uxf_sqlite_ratio TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
FM9 This board earns a dated bar · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
Contract_ABSENT_:fm_bar_september · executor Organ · 2 u · stands on
Definition of doneA board with no sotabar row is opted out of the currency hard fail, and that is the state this one ships in because no September 2026 listing has been read for storage and container formats. Earn it with the census organ now that one exists: nx_arxiv_census over the relevant categories for the current month, read the abstracts from the pinned bytes, then land sotabar and refs rows. Done-rule: nx_compare_rank formats reports BARFRESH verdict=FRESH rather than NO-BAR.
Matrix cellNO-MATRIX-ROW — no matrix row carries fm_bar_september; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work log2026-09-06 land BOARD FULLY GOVERNED THE DAY IT WAS ADMITTED: BARFRESH bars=1 fresh=1 verdict=FRESH and LADDER targets=2 rungs=9 placed=9 unplaced=0 badrole=0 badtarget=0 orphans=0 verdict=LADDERED, with the role partition summing (substrate 4, arm 2, contender 3) and zero DARK-CONTRACT rows. TWO MECHANISM NOTES WORTH KEEPING. First, the targets and all nine rungroles were landed in ONE ATOMIC APPEND on purpose: a ladder is all-or-nothing, NO-LADDER is merely LABELED while PARTIAL makes the ranker REFUSE, so landing targets and roles in separate writes would have put the board through a window in which it could not be ranked at all. Second, two rows read DARK-CONTRACT on the first rank because they named absent symbols on organs that EXIST, which is indistinguishable from a typo; repointing them at the new-organ paths they actually imply cleared both. The board now names its own critical path FM4 then FM8 then FM5, which is the extraction, the comparator and the muxer in that order, and it says out loud that no ratio may be published until sqlite3 runs.
2026-09-07 land THE VERSION LADDER TURNED A FLAT BOARD INTO A CRITICAL PATH, MEASURED BEFORE AND AFTER ON THE SAME INSTRUMENT. BEFORE: nx_compare_rank formats printed NO ver

dossiers=9 cells_joined=8 no_matrix_row=1 (sum 9) gates_recorded=0 gates_unrecorded=0 no_gate_declared=8 (sum 8 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 7 feature rows mapped of 10 matrix rows; 3 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map
Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/formats.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults
Position map, two-dimensional cutOne bubble per player. Bubble area is breadth, the ring colour is momentum, the dashed lines are the category means, and both axes are fitted to the field of play with their tick numerals shown. Every value is repeated in the table that follows. 0 200 400 600 800 1000 300 350 400 450 500 550 600 650 centrality (permil, fitted 0–1000) distinctiveness (permil, fitted 300–650) mean 400 mean 516 Unconventional Aspirational Peripheral Mainstream Nishi, centrality 625, distinctiveness 583, breadth 285, depth 666, momentum 0 Parquet and Arrow, centrality 250, distinctiveness 500, breadth 95, depth 666, momentum 0 SQLite, centrality 250, distinctiveness 500, breadth 95, depth 666, momentum 0 MP4 and MKV, centrality 500, distinctiveness 583, breadth 190, depth 666, momentum 0 IPLD and multiformats, centrality 375, distinctiveness 416, breadth 95, depth 666, momentum 0 Nishi Parquet and Arrow SQLite MP4 and MKV IPLD and multiformats

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 0–1000, distinctiveness 300–650 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 425 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)
Position map, three-dimensional cubeThe same players in an isometric cube. Each axis is fitted to its own field of play and carries numerals on the floor grid and the vertical axis; each bubble drops a dotted line to its floor shadow so height reads as height. Values are in the table that follows. 0 200 400 600 800 1000 300 350 400 450 500 550 600 650 0 100 200 300 400 500 centrality distinctiveness breadth IPLD and multiformats: centrality 375, distinctiveness 416, breadth 95 SQLite: centrality 250, distinctiveness 500, breadth 95 Parquet and Arrow: centrality 250, distinctiveness 500, breadth 95 MP4 and MKV: centrality 500, distinctiveness 583, breadth 190 Nishi: centrality 625, distinctiveness 583, breadth 285 Nishi Parquet and Arrow SQLite MP4 and MKV IPLD and multiformats
axes fitted: centrality 0–1000 · distinctiveness 300–650 · breadth 0–500 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 3 (a fact of the data: two players that close are that close) · data spread 121 permil of the plot
Position map, small multiplesEvery pair of registered axes as one small cut. Each panel fits both axes to the field of play, the dashed lines are the category means, bubble area is breadth and the ring colour is momentum; the legend below names the colours. 200 700 350 650 distinctiveness vs centrality Nishi: centrality 625, distinctiveness 583 Parquet and Arrow: centrality 250, distinctiveness 500 SQLite: centrality 250, distinctiveness 500 MP4 and MKV: centrality 500, distinctiveness 583 IPLD and multiformats: centrality 375, distinctiveness 416 200 700 50 350 breadth vs centrality Nishi: centrality 625, breadth 285 Parquet and Arrow: centrality 250, breadth 95 SQLite: centrality 250, breadth 95 MP4 and MKV: centrality 500, breadth 190 IPLD and multiformats: centrality 375, breadth 95 200 700 640 690 depth vs centrality Nishi: centrality 625, depth 666 Parquet and Arrow: centrality 250, depth 666 SQLite: centrality 250, depth 666 MP4 and MKV: centrality 500, depth 666 IPLD and multiformats: centrality 375, depth 666 200 700 480 520 momentum vs centrality Nishi: centrality 625, momentum 500 Parquet and Arrow: centrality 250, momentum 500 SQLite: centrality 250, momentum 500 MP4 and MKV: centrality 500, momentum 500 IPLD and multiformats: centrality 375, momentum 500 350 650 50 350 breadth vs distinctiveness Nishi: distinctiveness 583, breadth 285 Parquet and Arrow: distinctiveness 500, breadth 95 SQLite: distinctiveness 500, breadth 95 MP4 and MKV: distinctiveness 583, breadth 190 IPLD and multiformats: distinctiveness 416, breadth 95 350 650 640 690 depth vs distinctiveness Nishi: distinctiveness 583, depth 666 Parquet and Arrow: distinctiveness 500, depth 666 SQLite: distinctiveness 500, depth 666 MP4 and MKV: distinctiveness 583, depth 666 IPLD and multiformats: distinctiveness 416, depth 666 350 650 480 520 momentum vs distinctiveness Nishi: distinctiveness 583, momentum 500 Parquet and Arrow: distinctiveness 500, momentum 500 SQLite: distinctiveness 500, momentum 500 MP4 and MKV: distinctiveness 583, momentum 500 IPLD and multiformats: distinctiveness 416, momentum 500 50 350 640 690 depth vs breadth Nishi: breadth 285, depth 666 Parquet and Arrow: breadth 95, depth 666 SQLite: breadth 95, depth 666 MP4 and MKV: breadth 190, depth 666 IPLD and multiformats: breadth 95, depth 666 50 350 480 520 momentum vs breadth Nishi: breadth 285, momentum 500 Parquet and Arrow: breadth 95, momentum 500 SQLite: breadth 95, momentum 500 MP4 and MKV: breadth 190, momentum 500 IPLD and multiformats: breadth 95, momentum 500 640 690 480 520 momentum vs depth Nishi: depth 666, momentum 500 Parquet and Arrow: depth 666, momentum 500 SQLite: depth 666, momentum 500 MP4 and MKV: depth 666, momentum 500 IPLD and multiformats: depth 666, momentum 500
Nishi Parquet and Arrow SQLite MP4 and MKV IPLD and multiformats
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 25 (a fact of the data: two players that close are that close) · data spread 387 permil of the plot
PlayerQuadrantcentralitydistinctivenessbreadthdepthmomentumRows heldDays on spineFirst seen
NishiAspirational6255832856660 since 2026-09-233102026-09-15
Parquet and ArrowPeripheral250500956660 since 2026-09-231102026-09-15
SQLitePeripheral250500956660 since 2026-09-231102026-09-15
MP4 and MKVAspirational5005831906660 since 2026-09-232102026-09-15
IPLD and multiformatsPeripheral375416956660 since 2026-09-231102026-09-15
DayMatrix rows reviewedPlayers recorded
2026-09-15105
2026-09-16105
2026-09-17105
2026-09-1875
2026-09-1975
2026-09-2075
2026-09-2175
2026-09-2275
2026-09-2375
2026-10-0875

players 5|matrix rows 7|feature mass 8|centrality mean 400|distinctiveness mean 516|axes 5|spine days 10 (shown 10)|rows written today 0|readability defects 2D 0 cube 0|spine knowledge/status/cdmap/formats.spine

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 40, unassessed 0. Authored assessments are not verified outcomes.

CapabilityNishiParquet and ArrowSQLiteMP4 and MKVIPLD and multiformats
Self-describing profile CID, the endpoint-adaptive keystoneMeasured: uxf_cid_profiled exists in runtime/nx_uxf_cid.nx, verified at emit. IPLD owns this idea and is graded Best for it. Ours differs on ONE axis worth stating plainly: the canonical encode is BYTE-DETERMINISTIC by construction (magic, key-sorted length-prefixed fields) where IPLD is not deterministic by default, so two encoders of the same record here cannot disagree on the hash. The codec byte is folded INTO the hash, so identical content under two profiles can never collide. Rung FM1 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=29 nonval=13 — fully adopted (top of its ladder).
dossier
Pros Implementing source symbol found; runtime acceptance separate; ahead of Parquet and Arrow, SQLite, MP4 and MKV; fully adopted on the estate ladderCons behind IPLD and multiformats (leads)
●○○○◉
The profile is readable from the CID without rehashingMeasured: uxf_codec_of_cid exists in runtime/nx_uxf_cid.nx, verified at emit. A reader must learn what a block IS before it can decode it. MP4 is graded Part because the ftyp brand declares the container but not the record semantics. Rung FM1 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=29 nonval=13 — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Parquet and Arrow, SQLite, MP4 and MKV; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)
●○○◐●
Tolerant-reader decode preserves unknown fields on round-tripMeasured: canon_decode exists in runtime/nx_uxf_decode.nx, verified at emit. Proven by CID equality rather than inspection: encode a b c, decode with a reader that knows only a and b, re-encode, and the CID is BYTE-IDENTICAL because c survived; the neg-control drops c and the CID moves. Parquet gets Yes for schema evolution and MP4 for skippable unknown boxes. Rung FM2 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=42 nonval=28 — fully adopted (top of its ladder).
dossier
Pros Implementing source symbol found; runtime acceptance separate; ahead of SQLite; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)
●●○●●
Endpoint-adaptive emit plan chosen from declared capabilityMeasured: ng_negotiate exists in runtime/nx_uxf_negotiate.nx, verified at emit. None of the rivals do this because it is a layer above a format, which is exactly why storing one canonical form and emitting per endpoint is the interesting claim. mkv with h264 and aac to Chrome resolves to REMUX because the container is unreadable but both codecs are fine, webm with vp9 and opus to DIRECT, mkv with h265 to TRANSCODE. Rung FM3 Adoption: LIB-GATE-ONLY importers=4 — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program.
dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program
Pros Implementing source symbol found; runtime acceptance separate; ahead of Parquet and Arrow, SQLite, MP4 and MKV, IPLD and multiformatsCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program
●○○○○
Endpoint capabilities are data, not codeMeasured: ng_caps_lookup exists in runtime/nx_uxf_negotiate.nx, verified at emit. Capability rows live in knowledge/registry/endpoint_caps.tsv so a new endpoint is a row and never an edit. Rung FM3 Adoption: LIB-GATE-ONLY importers=4 — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program.
not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program
Pros Implementing source symbol found; runtime acceptance separate; ahead of Parquet and Arrow, SQLite, MP4 and MKV, IPLD and multiformatsCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program
●○○○○
Lossless rewrap proven at the byte levelMeasured: uxf_remux_frame exists in runtime/nx_uxf_remux.nx, verified at emit. Remuxing is routine for the MP4 and MKV toolchain, graded Best. Ours is proven byte-identical for a SimpleBlock carried from EBML into an MP4 mdat with the size landing in stsz, but the proof lives INSIDE a test with no callable entry point, so nothing can compose it. This row is a build order to extract it. Rung FM4 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-GATE-ONLY importers=3 — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program.
dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program
Pros Implementing source symbol found; runtime acceptance separate; ahead of Parquet and Arrow, SQLite, IPLD and multiformatsCons behind MP4 and MKV (leads); not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program
●○○◉○
A playable muxer, not only a container primitiveOpen — watching runtime/nx_uxf_mux.nx : uxf_mux_track, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. The honest gap June named and did not close: sample tables stts stsc stco, codec-private stsd, timestamps, multi-track moov nesting. Until this lands our remux is a proven data-flow and not a file anything can play. Rung FM5 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching uxf_mux_track
Pros none measured yetCons behind MP4 and MKV (leads); open contract; expected source declaration not established
○○○◉○
Document profile exercised end to endDARK — runtime/nx_uxf_doc.nx EXISTS but does not declare uxf_doc_ingest: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. UXF_DOC is a declared codec id with nothing behind it. None of the four rival columns is a document format, so their zeros are a property of the column choice and not a claim about PDF or EPUB. Rung FM6
dossierwatching uxf_doc_ingest
Pros none measured yetCons open contract; expected source declaration not established
○○○○○
Archive profile exercised end to endOpen — watching runtime/nx_uxf_archive.nx : uxf_archive_pack, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. UXF_ARCHIVE is declared and unexercised, the last of five profiles with no proof. Same column caveat as the document row. Rung FM7
dossierwatching uxf_archive_pack
Pros none measured yetCons open contract; expected source declaration not established
○○○○○
A measured one-to-one ratio against the store rivalOpen — watching runtime/nx_uxf_sqlite_ratio.nx : uxf_bench_ratio, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Our side is measured on the real seg_store path at 752021 records per second written including fsync and 474 nanoseconds per point get over 20000 records. The comparator has NEVER RUN because sqlite3 is absent from this host, so no ratio may be published and the exceed stays 0. Parquet and SQLite are graded Yes for having published, reproducible benchmarks, which is precisely what we lack here. Rung FM8 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching uxf_bench_ratio
Pros none measured yetCons behind Parquet and Arrow, SQLite; open contract; expected source declaration not established
○●●○○
Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.
Rival claims, counted
ClassCountNote
rows with rival marks6rows carrying a Yes, Best or Part in a rival column
cited0a reference mark resolves to a pinned mirror
uncited6an observation read, badged until a reference lands
rows, summed6RECONCILED: the parts sum to the total 6

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.
WhenRungKindEntry
2026-09-06FM1lessonA COMPLETE GLOB IS WHAT TURNED A SUSPICION INTO A FINDING. Searching the compare tree for any formats board returned matches=0 over 878 files with corpus_complete=1, which is an absence PROOF rather than a failed search, and it is the only reason this board exists. Sixteen gates had gone GREEN in June 2026 and none of them were reachable from any published surface; the catalogue additionally reads nx_uxf_remux_test and nx_uxf_corpus_persist as SOURCE-ONLY, meaning the proofs cannot even be re-run on the NAS today. The operator's standing order is that we do not build and lose capability to darkness, and the mechanism that failed here was not the building, it was that nothing forced the work onto a board where a ranker could see it.
2026-09-06FM1landBOARD ADMITTED 2026-09-06. nx_domain_admit formats returns VERDICT=ADMIT (CLAIM-ONLY -- no domain gates, which is permitted when declared) with rows=10 grounded=5 absent=2 UNGROUNDED=0 watch-new-organ=3 and C2 unpinned-declared=1. Two refusals taught the shape and both are worth recording. First, C2 REFUSES a domain with no barcheck row AND no UNPINNED declaration, on the grounds that the comparison is otherwise silently unfalsifiable, which is the right refusal: a board with implied bars nobody can check is worse than one that says it has none. Second, my first attempt to add that declaration NOMATCHED because the matrix had no @title, @sub or @cols directives at all, so the board had no rival columns for a bar to be about. ungrounded=0 on the first admission run is the one number I am pleased with: every symbol was READ with nx_fs outline rather than guessed, which is the whole DARK-CONTRACT lesson applied before the fact instead of after it.
2026-09-06FM9landBOARD FULLY GOVERNED THE DAY IT WAS ADMITTED: BARFRESH bars=1 fresh=1 verdict=FRESH and LADDER targets=2 rungs=9 placed=9 unplaced=0 badrole=0 badtarget=0 orphans=0 verdict=LADDERED, with the role partition summing (substrate 4, arm 2, contender 3) and zero DARK-CONTRACT rows. TWO MECHANISM NOTES WORTH KEEPING. First, the targets and all nine rungroles were landed in ONE ATOMIC APPEND on purpose: a ladder is all-or-nothing, NO-LADDER is merely LABELED while PARTIAL makes the ranker REFUSE, so landing targets and roles in separate writes would have put the board through a window in which it could not be ranked at all. Second, two rows read DARK-CONTRACT on the first rank because they named absent symbols on organs that EXIST, which is indistinguishable from a typo; repointing them at the new-organ paths they actually imply cleared both. The board now names its own critical path FM4 then FM8 then FM5, which is the extraction, the comparator and the muxer in that order, and it says out loud that no ratio may be published until sqlite3 runs.
2026-09-06FM1measureTHE FIRST D001 MIGRATION IS LIVE AND ITS BITE IS AN HONEST FLOOR, NOT A PASS. nx_uxf_cid_gate was written as the migration of nx_uxf_cid_test onto nx_gate_verdict, because /api/promote refuses the original D001 (it hand-rolls its counters and prints its own verdict, so nx_gate_green cannot judge it and it records no harness frame -- which is the mechanism that kept sixteen GREEN UXF gates invisible for eighty-two days). It runs 6/6 GREEN, is PROMOTED and REGISTERED with live_sha equal to staged_sha, and formats.gates now carries one row, which moved nx_domain_admit from ADMIT CLAIM-ONLY to ADMIT. THE MIGRATION IS PROVEN NEUTRAL FOR FREE: the gate emits cidA=private-ref:42a4881f and cidC=private-ref:a6d62a10, reproducing the June-2026 recorded values byte-for-byte, so the rewrite changed the verdict's readability and none of its arithmetic. WHAT IS NOT PROVEN: nx_gate_bite returned valid_mutants=0 void_build_lane=3 invalid_uncompilable=1 killed=0, verdict INCONCLUSIVE, because build admission refused three of four mutant builds under a load-19 box. That is a FLOOR set by the box and not a statement about the gate, so C4 stays NEVER-BITTEN and this gate is NOT yet shown to be able to fail. Custody was clean: twins_checked=2 restored=2 mutant_live=0, and the subject came back byte-identical at 2859 B. RE-RUN THE BITE WHEN LOAD CLEARS -- admission re-measures on every call, and read void_build_lane before believing any INCONCLUSIVE.
2026-09-06FM3landTHREE OF NINE D001 MIGRATIONS SHIPPED, AND THE BOARD IS NO LONGER CLAIM-ONLY. nx_uxf_cid_gate 6/6, nx_uxf_decode_gate 4/4 and nx_uxf_negotiate_gate 7/7 are each PROMOTED and REGISTERED with live_sha equal to staged_sha, formats.gates carries three rows, and nx_domain_admit now returns VERDICT=ADMIT rather than ADMIT CLAIM-ONLY. The negotiate migration gained TWO TEETH the original lacked: it printed whether the capability rows loaded but never asserted it, so a missing fixture could only have been judged indirectly by the outcomes; T0a and T0b now assert the fixture reached its condition before any plan is claimed. WHAT IS STILL NOT PROVEN, STATED AS THE GATE ITSELF STATES IT: C4 reads declared=3 bite-proven=0 never-bitten=2 bitten-zero-kill=1 and the partition sums. nx_uxf_cid_gate is BITTEN-BUT-VACUOUS, meaning a mutation run happened and killed nothing, which counts as coverage and carries an empty verdict; the other two have no bite record at all. THE CAUSE IS THE BOX, NOT THE GATES: every bite attempt this session lost the admission race (valid_mutants=0 void_build_lane=3 on the first, BUILD-REFUSED-BY-ADMISSION on the next two) because a bite needs many consecutive builds and is the first work a loaded box starves. Custody was clean every time: twins banked, twins restored, mutant_live=0, subjects byte-identical. RE-RUN ALL THREE BITES ON A QUIET BOX; until then these three greens are UNFALSIFIED, not proven.
2026-09-06FM4landFM4 CLOSED, AND IT WAS AN EXTRACTION RATHER THAN A PORT. The lossless rewrap was proven byte-identical in June 2026 inside nx_uxf_remux_test with no function anything could call, which is why this board ranked it first: a capability that cannot be composed is not yet a capability. runtime/nx_uxf_remux.nx now carries uxf_remux_frame as a real entry point taking an input element, an output buffer and a capacity, returning the bytes written or a NAMED negative refusal, plus uxf_remux_src_off so a caller can prove byte identity without re-parsing. nx_uxf_remux_gate drives it 9/9 GREEN, PROMOTED with live_sha equal to staged_sha. THE EXTRACTION ADDED BOUNDARIES, SO IT ADDED CONTROLS: a malformed vint, a frame declaring more bytes than its input holds, and an output too small to fit are each refused BY NAME with a distinct code, and all three teeth assert the specific code rather than merely that something failed. The well-formed case is the positive control, so an implementation that refused everything would fail T0 through T5. The ranker moved the rung from open to done by itself: rungs=9 done=4 open=5 finish=2 with the partition summing, and the critical path re-ordered to FM5 then FM8 because FM4 dropped off it. The matrix contract flipped from _ABSENT_:uxf_remux_frame to the live symbol, verified by arithmetic (5688 to 5679 bytes, exactly the nine characters of the removed prefix).
2026-09-06FM4measureTWO GATES ARE NOW BITE-PROVEN, AND THE EARLIER INCONCLUSIVES WERE THE BOX RATHER THAN THE GATES -- WHICH IS EXACTLY WHAT THE ABSTENTION SAID AND IS WHY IT MATTERED THAT IT ABSTAINED. nx_uxf_remux_gate: cmp site 0 build_exit=0 KILLED, valid_mutants=1 invalid_uncompilable=0 void_build_lane=0 killed=1, verdict=GREEN gate BITES, restore verified 6761 bytes byte-identical. nx_uxf_negotiate_gate: cmp site 0 build_exit=0 KILLED, valid_mutants=1 killed=1, verdict=GREEN gate BITES, restore verified 4354 bytes byte-identical. Custody clean on both: twins_checked=2 restored=2 mutant_live=0. THE METHOD THAT WORKED IS WORTH KEEPING: drop max_sites_per_operator to 1 so a bite needs the FEWEST consecutive compiles, and fire it the moment nx_build_admit reads GRANT with load near the ceiling rather than far above it. Five earlier attempts at two and three sites were each refused mid-run because a bite is the first work a loaded box starves. ONE HONEST NON-RESULT, RECORDED AS ITS OWN CAUSE: the same one-site method against nx_uxf_cid.nx returned valid_mutants=0 invalid_uncompilable=2 void_build_lane=0, meaning admission was NOT the problem there -- both perturbations simply failed to compile, because that subject is hex-nibble arithmetic where changing a constant breaks the build. That is a property of the subject and not evidence about the gate, so nx_uxf_cid_gate stays unproven for a DIFFERENT reason than the others did, and it needs an operator that reaches its logic rather than its constants.
2026-09-06FM1landC4 IS CLOSED: declared=5 bite-proven=5 never-bitten=0 bitten-zero-kill=0 sum=5, ALL-PROVEN. Every one of the five shipped UXF gates now kills a compiling mutant, so their greens are falsifiable rather than merely unfalsified, and custody was clean on every run (twins banked and restored, mutant_live=0, every subject byte-identical afterwards). TWO THINGS UNSTUCK IT AND BOTH ARE REUSABLE. FIRST, ONE SITE PER OPERATOR: five earlier attempts at two and three sites were each refused mid-run because a bite needs many CONSECUTIVE compiles and is the first work a loaded box starves; at one site, fired the moment admission reads GRANT, they get through. SECOND AND MORE INTERESTING, THE SUBJECT WAS THE PROBLEM AND NOT THE GATE. nx_uxf_cid_gate and nx_uxf_config_gate both read BITTEN-BUT-VACUOUS while bitten against nx_uxf_cid.nx, where valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 -- admission was NOT the cause; that subject is hex-nibble arithmetic in which perturbing a constant simply breaks the build, so no mutant could ever reach an assertion. Re-aiming both at nx_canon_cid.nx, the canonical ENCODER they depend on, killed both immediately. A GATE THAT CANNOT BE BITTEN THROUGH ONE SUBJECT MAY BE FULLY BITEABLE THROUGH THE DEPENDENCY THAT ACTUALLY CARRIES ITS LOGIC, AND READING valid_mutants BESIDE void_build_lane IS WHAT DISTINGUISHES THE TWO CAUSES. A REAL DIFFERENCE IN TOOTH STRENGTH SURFACED AND IS WORTH KEEPING: the identical comparison mutant at canon_cid offset 955 KILLED nx_uxf_cid_gate but SURVIVED nx_uxf_config_gate, which fell only to a symbol-targeted mutation inside canon_encode itself. The reason is structural -- the config gate's teeth are RELATIVE (this profile's CID differs from that profile's over the same content) and a change that moves every CID equally leaves every difference intact, whereas the cid gate pins ABSOLUTE values. Relative assertions are blind to uniform shifts, and that is a property to remember when writing teeth, not a defect to patch here.
2026-09-06FM4landSIXTH MIGRATION SHIPPED AND BITE-PROVEN IN ONE PASS, AND IT REMOVED A DUPLICATE RULER RATHER THAN ADDING ONE. nx_uxf_ebml_test carried its own ebml_vint_len, ebml_read_id and ebml_read_size that were byte-for-byte the logic now living in nx_uxf_remux.nx as uxr_vint_len, uxr_read_id and uxr_read_size, so the migration points the teeth at the LIB instead of copying a second EBML reader into a gate. nx_uxf_ebml_gate runs 14/14 GREEN, PROMOTED with live_sha equal to staged_sha, and its bite killed a compiling mutant on the first attempt. C4 now reads declared=6 bite-proven=6 never-bitten=0 bitten-zero-kill=0 sum=6 ALL-PROVEN. TWO TEETH WERE SPLIT ON PURPOSE: the original asserted a read's VALUE and its CURSOR ADVANCE inside one conjunction, so a reader returning the right number without advancing would fail without saying which half broke; T2a and T2b, T3a and T3b now name it. The eight vint length classes were likewise split from one boolean into eight teeth, so a failure names its class rather than reporting that some class among eight is wrong. ONE OPERATIONAL FACT WORTH KEEPING: a write job sat in state=CLAIMED with its target file ABSENT while the box read GRANT at load 1499, i.e. it was WEDGED rather than slow, and re-issuing the identical full-file write landed instantly. A full-file write of identical content is idempotent, so re-issue is the safe move there, unlike an append.
2026-09-06FM4landSEVENTH MIGRATION SHIPPED: nx_uxf_mp4box_gate 8/8 GREEN, PROMOTED and REGISTERED, and it removes the THIRD duplicate ruler in this family. nx_uxf_mp4box_test carried its own mp4_w32, mp4_r32, mp4_4cc, mp4_box_begin and mp4_box_end, the same primitives now shipping in nx_uxf_remux.nx, so the teeth were pointed at the lib and the estate keeps one MP4 box writer instead of a test copy beside a shipping copy. The 4cc comparison uses the lib's own uxr_bytes_eq rather than adding a helper to a lib that is ALREADY BITE-PROVEN, because editing a proven lib to satisfy a test destroys the proof for no capability gain. Teeth were split where the original bundled claims: the walk's ALIGNMENT and its BOX COUNT are separate, each of the three expected 4cc types is its own tooth read at box start plus four (the offset an earlier bug got wrong), and the moov size is asserted to cover header plus child so NESTING is proven rather than mere adjacency. ITS BITE IS NOT YET AVAILABLE AND IS RECORDED AS SUCH: two attempts returned BUILD-REFUSED-BY-ADMISSION with the box in an I O storm (procs_blocked 11 against a ceiling of 8, then load 1810 against 1643), so this gate is UNFALSIFIED rather than proven and must not be counted in any bite-proven figure until it kills a compiling mutant. The six gates before it are bite-proven; this one is seven-of-nine shipped and six-of-seven proven, and those are different numbers on purpose.
2026-09-06FM4measureEIGHT MIGRATIONS SHIPPED, SEVEN BITE-PROVEN, AND THE EIGHTH RETURNED A DIAGNOSIS I AM NOT ADOPTING BECAUSE IT IS REFUTED BY THE SOURCE. nx_uxf_media_asset_gate 7/7 GREEN is PROMOTED and BITE-PROVEN (killed=1), and it is the end-to-end proof: a descriptor is stored once under a self-describing UXF_MEDIA CID, tolerant-decoded by a consumer that did not write it, and the DECODED FIELDS ALONE decide a lossless rewrap for one endpoint and a direct serve for another. THE OPEN ONE IS nx_uxf_mp4box_gate. Its bite returned valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 not_reached=2 killed=0 with the summary NOT-SUBSTITUTABLE and the offered explanation that the gate does not import the mutated source and almost certainly FORKS its subject as a separate binary. THAT EXPLANATION IS FALSE FOR THIS GATE AND THE SOURCE SETTLES IT: nx_uxf_mp4box_gate carries import nx_uxf_remux.nx and calls uxr_w32, uxr_r32, uxr_4cc, uxr_box_begin, uxr_box_end and uxr_bytes_eq IN-PROCESS; it forks nothing. So the OBSERVATION is real -- two mutants, including one inside uxr_r32 which this gate demonstrably calls, produced a byte-identical artifact -- while the CAUSE named beside it does not apply here. This is the estate's own law that a message naming the wrong stage costs the reader the investigation it was written to save them, and the honest state is that the cause is UNKNOWN rather than forking. TWO CANDIDATES WORTH DISCRIMINATING, neither asserted: a build-cache entry for the gate keyed on something that did not change when its imported subject was mutated, or a baseline-vintage mismatch, since a direct sov-lane build of this target earlier produced 30025 bytes against the promoted 35096 and the bite recorded baseline_artifact_bytes=35096. The discriminator is cheap: mutate the subject, rebuild the gate, and compare the artifact digest to the pre-mutation one directly rather than through the harness. Until then this gate stays UNFALSIFIED and is NOT counted in any bite-proven figure. Custody was clean throughout: twins restored, mutant_live=0, subject byte-identical at 6761.
2026-09-06FM4measureTHE mp4box NOT-REACHED HAS A MECHANISM NOW, FOUND BY PROBING THE BUILDER DIRECTLY INSTEAD OF ACCEPTING THE HARNESS PROSE. nx_sov_build_run nx_uxf_mp4box_gate --build-only prints BUILD-CACHE HIT key=23c37fa71ed135359c70da78ccf104ca01f65d2ac8405d0716cbd78d5e93cbd7 bytes=35096 with COMPILER NOT RUN and a byte-identical artifact reused. A bite mutates the LIB and rebuilds the GATE, so if the cache key does not cover the import closure the cache hands back the PRE-MUTATION binary and every mutant necessarily reads byte-identical, which is exactly the NOT-REACHED the harness saw. That is a SUFFICIENT mechanism and it is not yet a proof: six sibling gates bitten the same way DID kill mutants through the same lib, so the closure is tracked at least sometimes. The discriminating experiment is one line -- mutate nx_uxf_remux.nx, rebuild a dependent gate, and compare the PRINTED CACHE KEY against the unmutated key rather than reading the harness verdict. IF THE KEY IS UNCHANGED THE DEFECT IS SYSTEMIC AND FAILS IN THE FLATTERING DIRECTION, because an unreachable mutant is EXCLUDED rather than counted as a survivor, so a warm cache would quietly convert real mutation coverage into NOT-SUBSTITUTABLE across the estate. Filed as toolchain debt with the evidence. A SECOND FINDING FELL OUT OF THE SAME PROBE: build FLAVOUR is INHERITED FROM THE INCUMBENT (src=incumbent, debug once a serving-root twin carries a line table), so this one source built to 30025 bytes with no live twin and 35096 with one. A size difference across those two states says nothing about the source, and I had briefly read it as evidence of one.
2026-09-06FM1lessonALL NINE D001 MIGRATIONS ARE SHIPPED, AND THE LAST BITE FOUND A REAL STRUCTURAL WEAKNESS RATHER THAN AN INSTRUMENT FAULT -- THE SECOND INSTANCE OF ONE PATTERN, SO IT IS NAMED HERE INSTEAD OF PATCHED TWICE. nx_uxf_tsv_persist_gate 4/4 GREEN is PROMOTED and REGISTERED; its bite returned valid_mutants=2 killed=0, and the crucial difference from the mp4box result is that these mutants were VALID and REACHED the binary (not_reached=0) -- they entered the code under test and the gate stayed GREEN. THE CAUSE IS THE SHAPE OF THE TEETH, NOT THE MUTANTS: every assertion in that gate is SELF-CONSISTENT. It encodes rows, persists them, retrieves them, and compares the retrieved bytes against WHAT IT ITSELF ENCODED, so a change inside canon_encode moves the written bytes and the expected bytes IDENTICALLY and all four teeth still pass. The same mutation at canon_cid offset 955 that KILLED nx_uxf_cid_gate also SURVIVED nx_uxf_config_gate earlier today for the same reason. ★ RELATIVE ASSERTIONS ARE BLIND TO UNIFORM SHIFTS: a tooth that compares two things the same function produced cannot detect a change to that function, and it will read GREEN forever while the encoding drifts. The gate is not vacuous -- it genuinely proves the store round-trips faithfully whatever it is handed, survives an fsync and a fresh reopen, and misses an absent address -- but its SCOPE excludes the encoding itself, and that scope is now MEASURED rather than assumed. THE REMEDY IS ABSOLUTE ANCHORING AND IT IS CHEAP: pin ONE known row's content address as a literal expected value, the way nx_uxf_cid_gate pins its CIDs, so an encoder change moves the actual away from a fixed expected. The value must be READ FROM A RUN and never recalled -- a June note records row zero as private-ref:139e9c44 but that is an 82-day-old memory of a truncated string and pinning it from recall would be exactly the fabricated-constant defect. Owed: emit row zero's CID from this gate, read it from the run, then add the absolute tooth.
2026-09-06FM1landTHE RELATIVE-ASSERTION WEAKNESS IS FIXED IN THE GATE, AND THE FIX WAS EARNED RATHER THAN RECALLED. nx_uxf_tsv_persist_gate now carries T5, an ABSOLUTE ANCHOR pinning row zero's content address to the literal private-ref:6a8ff7f7, and ships 5/5 GREEN with adoptgate APPROVED content=GREEN behave=DIFFERS evidence=STRONG (behaviour changed, which is expected when a tooth is added). Every other tooth in that gate is self-consistent -- it compares retrieved bytes against what it itself encoded -- so a change inside canon_encode moved both sides identically and the bite measured exactly that: valid_mutants=2 killed=0 with not_reached=0, mutants that REACHED the code and were not caught. An absolute expected value breaks the symmetry. THE LITERAL WAS READ FROM A RUN: the gate was made to print row zero's CID, rebuilt and run, and the value taken from that output. A June note carries a truncated form of the same prefix, and it MATCHES, which is a pleasing corroboration that the encoding has been stable for 82 days -- but pinning from that note would have been the fabricated-constant defect the anchor exists to catch, so it was not done. A SECOND DEFECT WAS FOUND ON THE WAY AND FIXED: the fixture path was CWD-DEPENDENT. The gate passed 4/4 under the ship loop and then read UP-UNREADABLE under nx_sov_build_run, because a bare knowledge/ path resolves from the estate root and not from buildroot. The abstain-never-acquit guard did its job -- it refused by name with passed 0/0 rather than passing on zero rows -- and the fix tries the estate-root, parent and buildroot spellings in turn. OWED AND NAMED: the bite that would prove T5 kills is blocked, not skipped. Three attempts returned void_build_lane=4 valid_mutants=0 and then BUILD-REFUSED-BY-ADMISSION at load 2485 against a 1643 ceiling. Until a mutant reaches it, T5 is a REASONED fix and not a proven one, and this gate stays bitten-zero-kill on the board.
2026-09-06FM4queueTHE BUILD-CACHE DISCRIMINATOR IS ARMED AND NEEDS EXACTLY ONE ADMITTED BUILD. The open question from debt 1788736703 is whether the build-cache key covers a target's IMPORT CLOSURE, because if it does not then every nx_gate_bite through a lib silently degrades to NOT-REACHED on a warm cache and fails in the flattering direction. THE EXPERIMENT IS SET UP AND IS SAFE BY CONSTRUCTION: nx_uxf_remux.nx now carries a COMMENT-ONLY provenance block, which changes its source bytes while compiling byte-identical, so it cannot alter any behaviour or invalidate the bite proofs that already stand on it. The recorded key for the dependent gate BEFORE that edit is 23c37fa71ed135359c70da78ccf104ca01f65d2ac8405d0716cbd78d5e93cbd7. TO FINISH IT, run one command: nx_sov_build_run nx_uxf_mp4box_gate --build-only, and read the BUILD-CACHE line. A DIFFERENT key means the closure IS covered, the cache is exonerated, and the mp4box NOT-REACHED needs another explanation. THE SAME key means the closure is NOT covered, the cache is confirmed as the cause, and the defect is systemic across every bite in the estate rather than local to one gate. Two attempts were refused by admission at procs_running 17 and 11 against ncpu 8, so nothing is claimed either way; the refusals are a fact about the box and not about the cache. This is written down rather than left in a seat's head precisely because the answer is one command away and the question changes how much every bite verdict in the estate is worth.
2026-09-06FM4measureALL NINE FORMATS GATES RUN GREEN FROM THEIR PROMOTED ARTIFACTS RATHER THAN FROM A BUILD-LANE FOSSIL -- 65 teeth, measured 2026-09-06 by forking each promoted elf through nx_job_run: cid 6 of 6, decode 4 of 4, negotiate 7 of 7, remux 9 of 9, config 5 of 5, ebml 14 of 14, mp4box 8 of 8, media_asset 7 of 7, tsv_persist 5 of 5. This is a genuinely new measurement and not a restatement: every earlier GREEN on this board was read off a build-lane run, and a green from a differently-built artifact is indistinguishable from a green from the served one. tsv_persist's T5 ABSOLUTE anchor reproduced its pinned literal row0 content address against the promoted binary, so the encoder cannot have drifted behind self-consistent teeth. nx_catalog reads all nine SOURCE then BUILT then PROMOTED then REGISTERED with AUTHORISED NO and INVOKED NO, so the remaining gap on this board is EXECUTION SURFACE and not build state: none of the nine appears in knowledge/gateroster.conf, and that absence is complete-coverage rather than a filtered read because nx_txtscan find scanned the whole 51513-byte roster and returned total=0.
2026-09-06FM4lessonA BUFFER RESTORE UNDOES THE INPUT AND NOT THE DERIVED STATE, SO A VALUE READ BACK FROM A REUSED OUT-PARAMETER PUBLISHES THE NEG-CONTROL'S ANSWER WEARING THE TOOTH'S NAME. MEASURED 2026-09-06 in nx_uxf_mp4box_gate, which passed 8 of 8 while publishing toplevel_box_count=0 directly against its own tooth T2b asserting actual=2 expected=2. Mechanism READ FROM THE SOURCE rather than guessed: one cnt buffer is filled by the good-tree walk, T2b tests cnt[0] and passes on 2, the neg-control then calls um_walk_count a SECOND time into THAT SAME out-parameter leaving cnt[0]=0, and the gv_kv emission runs last. The author had already reasoned about the restore and written the comment restore so the emitted values below describe the real tree -- the BUFFER was restored and the DERIVED COUNT was not, which is exactly why moov_size and mvhd_size are honest, being re-read from the restored buffer, while toplevel_box_count is not. THE GUARANTEE gv_check_eq GIVES IS NARROWER THAN IT READS: it binds the number tested to the number published only for values passed INTO it, and a separate gv_kv re-reading a mutable buffer afterwards carries no such binding. This is the first defect the estate's value emission has caught that no pass-fail vector could, because 8 of 8 GREEN was correct while the published number was false -- which is the whole argument for the L4 axis stated as a measurement instead of a hope. REMEDY LANDED IN SOURCE THE SAME HOUR: bind the good walk's count into toplevel_good before the neg-control re-walks, emit that, emit the clobbered value under its own name toplevel_box_count_after_corrupt_walk so nothing is hidden, and add a tooth that pins the clobber itself so the hazard is tested rather than commented. The rebuild is queued behind build admission and the gate on the NAS still publishes the false value until it lands.
2026-09-06FM4landTHE NINE FORMATS GATES ARE NOW ON AN EXECUTION SURFACE -- knowledge/gateroster.conf 51513 to 54980 bytes, hand-added 2026-09-06 in the file's own declared style because the admit verb takes a trial journal and a deadline rather than a name and these have no trial-journal run. BEFORE: nx_catalog read all nine SOURCE then BUILT then PROMOTED then REGISTERED with AUTHORISED NO and INVOKED NO, and nx_txtscan find over the whole 51513-byte roster returned total=0, so their absence from the beat was complete-coverage rather than a filtered read. The evidence block declares WHAT WAS NOT MEASURED: verdicts came from nx_job_run, so there is no /api/gate_run exit_code and no timing against the 14750 ms deadline -- it matches the roster's existing 21/21 precedent, admitted on GREEN on the live promoted binary well under any deadline. It also declares two things a smoother block would have hidden. First, nx_uxf_negotiate_gate and nx_uxf_media_asset_gate READ THE LIVE knowledge/registry/endpoint_caps.tsv rather than a fixture, so a RED from either can mean the capability table changed rather than that the negotiator broke; both abstain by name when it cannot be read, which is the third state rather than an acquittal. Second, nx_uxf_mp4box_gate's source is AHEAD of the binary the beat will run until its rebuild clears admission. THE PRINCIPLE THIS CLOSES: a gate nobody runs does not degrade to neutral, it degrades to a false sense of coverage, because its existence is counted and its verdict is not.
2026-09-07FM4landTHE MP4BOX PUBLISHED-VALUE DEFECT IS CLOSED END TO END ON THE LIVE BINARY. Source 5421 to 6038 bytes over three CAS-chained edits, built 35424 B through /api/build with src_path naming the target and src_stable=1, nx_contentdiff live against staged read lost_from_live=0 lost_permil=0 with symmetry ONE-WAY-GAIN -- a strict superset whose gained runs include the new tooth name -- promoted under expect_sha256 005ead0976b7b26d with prev=1 banked, and the live binary re-run through nx_job_run now reads 9 of 9 GREEN with toplevel_box_count=2 agreeing with its own tooth T2b while the clobbered value is published honestly under its own name as toplevel_box_count_after_corrupt_walk=0. The new neg-control tooth PASSES, so the hazard is a TESTED property of this gate rather than a comment a later editor could delete without consequence. The stale caveat this lane had written into knowledge/gateroster.conf was corrected in place the same hour rather than left standing, because a warning label on a stale fact does not stop the fact being used.
2026-09-07FM4retractMY OWN HYPOTHESIS THAT THE BUILD CACHE KEY DOES NOT COVER THE IMPORT CLOSURE IS REFUTED, and the discriminating experiment is recorded here so nobody re-runs it. DESIGN: nx_uxf_remux.nx received a COMMENT-ONLY provenance edit, which changes source bytes while compiling byte-identical, and nx_uxf_remux_gate -- whose own source was untouched and which imports that lib -- was rebuilt. A cache HIT would have proven the key ignores the closure; a MISS proves it covers it; and no recorded baseline key is needed because HIT against MISS is the entire answer. RESULT: BUILD-CACHE MISS reason=no-entry key=bd983b1e04db922e, and in the same run BUILD-CACHE STORE bytes=38808 sha256=f4983df33eaa389c, byte-identical in size to the promoted artifact. THE KEY MOVED WHILE THE BYTES DID NOT, which is exactly what a neutral edit should do and is the cleanest available confirmation. The cache is EXONERATED for the sovereign build lane. SCOPE STATED HONESTLY: this proves closure coverage ONLY. It says nothing about the separate and still-real defect that a cache HIT verifies its sidecar without stat-ing the artifact it describes, which is how a builder once reported reuse and materialised nothing. CONSEQUENCE I OWE: I predicted in advance that if the key changed then the mp4box NOT-REACHED bite result returns to unknown. It does. That cause is now UNATTRIBUTED and must be re-investigated rather than carried as explained. I ALSO CONTAMINATED MY FIRST PROBE by editing nx_uxf_mp4box_gate, whose key must change regardless of the lib, and the subject was swapped to nx_uxf_remux_gate for exactly that reason -- a control you edit is not a control.
2026-09-07FM4landALL NINE _offc TWINS WERE STALE OR ABSENT AND ARE NOW INSTALLED FROM THE PROMOTED ROOT -- nx_offc_install reported installed=1 for every one of the nine, so not a single twin was already correct. This matters because promote writes the SERVING ROOT while runners fork _offc, so wiring these nine onto the gate roster WITHOUT this step would have pointed a beat at binaries that were stale or missing, and an absent artifact forks as exit 127, which reads as a broken gate rather than as a missing copy -- the failure would have been blamed on the gates I had just admitted. The step was taken under the standing rule that when absence cannot be cheaply proven and the remedy is idempotent and safe you apply it rather than keep reasoning: nx_offc_install is a no-op wherever the twin already matches, so the cost of being wrong was zero while the cost of skipping it was nine gates that look broken on their first beat. nx_uxf_mp4box_gate's twin was refreshed from the JUST-PROMOTED fixed binary, so the beat and the MCP surface now agree on the 9 of 9 version rather than the 8 of 8 one. DEBT HYGIENE the same hour: the refuted build-cache hypothesis was superseded by row 1788739261 carrying the discriminating experiment and the true scope, and the original row was then eaten, because an eaten row keeps its prose and a wrong mechanism left searchable costs the next seat the whole investigation again.
2026-09-07FM4queueTHE MP4BOX NOT-REACHED CAUSE IS NOW UNATTRIBUTED AND HAS ONE NAMED NEXT EXPERIMENT, DELIBERATELY NOT RUN INTO A THIN MARGIN. With the build-cache exonerated, the surviving hypothesis is one the estate has already measured on another lane: a bite under an admission storm reports its mutants VOID, and a VOID mutant surfaces as NOT-REACHED rather than as a survivor, which fails in the FLATTERING direction because an unreachable mutant is never counted against the gate. RECIPE: nx_gate_bite nx_uxf_mp4box_gate nx_uxf_remux.nx 2, then READ void_build_lane= BEFORE believing any INCONCLUSIVE or NOT-REACHED verdict. The gate now carries 9 teeth including the clobber neg-control, and uxr_r32 is demonstrably called in-process with nothing forked, so a mutant there MUST be reachable if it is built at all -- which is what makes void_build_lane the discriminator rather than reachability. PRECONDITION, stated because ignoring it is what produced the ambiguous first result: a bite is several consecutive compiles and is the first work a loaded box starves, so it needs SUSTAINED headroom and not a single GRANT. NOT RUN THIS PASS ON PURPOSE: nx_build_admit returned GRANT with procs_blocked=7 against blocked_max=8, one D-state from refusing, and load1_centi=1700 already above max_centiload=1643. Firing a multi-compile bite into that margin would most likely reproduce the very VOID condition it exists to resolve while hammering an array that is already struggling, and on this estate a change that hammers the box is a defect even when the feature works. The instrument is not blocked, the MARGIN is -- and publishing through a blocked instrument is exactly how an ambiguous result gets promoted into a confident one.
2026-09-07FM9landTHE VERSION LADDER TURNED A FLAT BOARD INTO A CRITICAL PATH, MEASURED BEFORE AND AFTER ON THE SAME INSTRUMENT. BEFORE: nx_compare_rank formats printed NO ver
2026-09-07FM4measureTHE MP4BOX NOT-REACHED CAUSE IS NOW FULLY ATTRIBUTED AND IT IS A THIRD MECHANISM -- NOT THE CACHE AND NOT THE STORM. The bite ran to completion: valid_mutants=0 invalid_uncompilable=2 void_build_lane=0 not_reached=4 killed=0, custody clean with twins_checked=2 restored=2 refreshed=0 mutant_live=0 and the lib restored byte-identical at 7180. void_build_lane=0 REFUTES MY OWN QUEUED HYPOTHESIS that an admission storm was voiding the mutants -- every mutant compiled with build_exit=0, so the storm explanation is dead. THE HARNESS'S OWN PRINTED EXPLANATION IS ALSO REFUTED: it states the gate almost certainly FORKS its subject as a separate binary, while the source shows nx_uxf_mp4box_gate imports nx_uxf_remux.nx and calls uxr_w32, uxr_r32, uxr_4cc, uxr_box_begin, uxr_box_end and uxr_bytes_eq IN-PROCESS, forking nothing at all. THE TRUE CAUSE, read straight off the offsets: nx_uxf_remux.nx contains uxr_r32 exactly twice, its definition at 3731 and one call site at 4716 inside uxr_walk_ok. The harness aimed its symbol-targeted mutation at 4782, which lands inside uxr_walk_ok -- and THIS GATE NEVER CALLS uxr_walk_ok, because it defines its OWN um_walk_count locally. Dead code is dead-stripped by the compiler, so mutating it CANNOT change the artifact; meanwhile the one site genuinely inside uxr_r32 (off 3737) did not compile and was correctly excluded. All four NOT-REACHED are therefore mutations of library code this particular gate does not reach, plus two uncompilable mutants. THE LAW: NOT-REACHED CONFLATES THE MUTATION COULD NOT REACH THE BINARY WITH THE MUTATION REACHED A BINARY THAT DOES NOT USE THAT CODE, AND DEAD-STRIPPING MAKES THE SECOND INDISTINGUISHABLE FROM THE FIRST -- which is why the harness prints a remedy, re-run with subject, that is INAPPLICABLE to an in-process gate and would have cost the next seat the entire investigation. AND THE SITE LABEL ITSELF MISLEADS: sym site uxr_r32 @off=4782 attributes a site to a function whose one-line body ends roughly a thousand bytes earlier. THE ACTIONABLE REMEDY FOR THIS GATE is to aim the bite at a function it genuinely calls, uxr_box_end or uxr_bytes_eq, rather than at whatever the symbol scan happens to land on.
2026-09-07FM4measureTHE SERVED nx_gate_bite IGNORES argv[4] ENTIRELY -- aim AND aimlist ARE BOTH SILENTLY DISCARDED, PROVEN BY A CONTROL RATHER THAN INFERRED. Three runs against the same gate and the same subject -- no fourth argument, then aim uxr_box_end, then aimlist -- produced BYTE-IDENTICAL output: the identical mutation offsets 2970, 3273, 1866, 1870, 4782 and 3737, the identical NOT-REACHED lines, the identical verdict. aimlist is the decisive one, because its entire purpose is to PRINT A LIST INSTEAD OF RUNNING A BITE and it ran a full four-mutant bite instead. Neither run emitted a usage error, so the argument is accepted and then discarded, which is the silent class. WHY THIS MATTERS FAR BEYOND THE GATE IT WAS FOUND ON: the estate's standing doctrine instructs every seat to aim a bite with exactly these arguments, so a seat that FOLLOWS THE INSTRUCTION receives a silently ignored flag and believes it aimed the mutation when it did not -- and this is the precise defect the doctrine itself records having corrected once already, recurring. A DOCTRINE THAT NAMES AN ARGUMENT ITS TOOL DOES NOT HONOUR CONVERTS I DID NOT PROVE IT INTO I FOLLOWED THE RULE. SCOPE STATED HONESTLY AND NOT OVERREACHED: I measured the SERVED binary only. nx_catalog reads nx_gate_bite LIVE with BUILT equal to PROMOTED at 93631 against a 98879-byte source, and BUILT is the last build anybody ran rather than a fresh one, so whether the SOURCE implements aim is UNMEASURED BY ME and must not be inferred from this run. CONSEQUENCE FOR THIS BOARD: mp4box cannot be aimed at a function it genuinely calls using the tool as served, so its bite-proof stays open on a TOOL defect rather than on a GATE defect -- and keeping those two apart is the entire point, because the gate's nine teeth are not what failed here.
2026-09-07FM4measureAIMING THE BITE SOLVED REACHABILITY AND EXPOSED THE NEXT DEFECT IN THE SAME RUN. With aim uxr_box_end 0 the harness reported aim: func uxr_box_end @off=4235 end=4339 skip=0 and NOT-REACHED fell from 4 to ZERO, moving the verdict from NOT-SUBSTITUTABLE to INCONCLUSIVE -- which is the difference between cannot be reasoned about at all and no kill from these particular perturbations. THE NEXT DEFECT, read straight from aimlist: nx_gate_bite's numeric-constant operator treats DIGITS INSIDE IDENTIFIERS as numeric sites. All four sites in uxr_box_end are exactly that -- i64, i64 again, and the 32 of uxr_w32 -- so every mutant there is uncompilable BY CONSTRUCTION, which is precisely what happened at 2 of 2 build_exit=3, and the same cause explains the earlier num site 1866 and sym num 3737 failures. aimlist uxr_r32 then separated the classes cleanly across 13 sites: 0 to 3 and 11 to 12 are identifier or type digits, while sites 4, 7 and 10 are the REAL constants 16777216, 65536 and 256. PROOF THAT AIMING PAST THE IDENTIFIER SITES REACHES LIVE CODE: with skip=4 the mutant artifact measured 35432 bytes against the 35424-byte baseline, an 8-byte delta, so the mutation demonstrably ENTERED the binary under test -- something none of the six earlier sites managed. The PROMOTED artifact stayed 35424 throughout, so nothing live was disturbed and custody held. REMEDY FOR THE TOOL, named precisely rather than gestured at: the numeric operator must skip any digit run adjacent to identifier characters, because i64, u8, f32 and every name ending in digits are guaranteed-invalid mutants that consume the entire site budget and make a perfectly reachable gate read as unreachable.
2026-09-07FM4lessonTHE HARNESS DEFECT IS NOW EXACT, READ OFF THE PREDICATE RATHER THAN INFERRED FROM ITS OUTPUT. nx_gate_bite's numeric site scanner walks to the LAST digit of a run and then tests only the ONE character before it, excluding lowercase, uppercase, underscore, dot and the x of a hex prefix. That is correct for a SINGLE-digit suffix -- the 8 of u8 is preceded by u and is properly excluded, which is why u8 never appears in any site list -- but for a MULTI-DIGIT suffix the last digit's predecessor is ITSELF A DIGIT, and no rule excludes a digit. So the 4 of i64 and the 2 of uxr_w32 are both accepted as numeric constants and mutated into code that cannot compile. The site list is the proof: all four sites in uxr_box_end are identifier digits, two i64 and one uxr_w32, and every aimed mutant there returned build_exit=3. THE CONSEQUENCE IS NOT COSMETIC: guaranteed-invalid sites consume the entire per-operator budget, so a gate that genuinely imports and calls its subject reports valid_mutants=0 and reads as UNREACHABLE -- which is exactly how this gate came to be labelled NOT-SUBSTITUTABLE with the harness blaming a fork boundary that does not exist in it. THE FIX IS SMALL AND PRECISE: before the preceding-character test, walk BACK across the whole digit run to its first digit and test the character before THAT, guarding the index so the walk cannot read before the buffer, and drive the walk with an explicit flag rather than by clobbering the cursor. AND IT MUST BE FIXED IN ONE PLACE, NOT TWO: gb_num_at carries the comment Predicate MIRRORS gb_site_num; that fn is UNTOUCHED, so the aimed and unaimed paths hold two copies of one predicate that must agree by discipline -- the duplicate-ruler shape this estate forbids, and correcting only one would make them diverge silently. Filed with the exact remedy; deliberately NOT shipped in this session, because this is the harness 630-plus gates are proved with, its own bite was still in flight against it, and a broken mutation harness does not fail loudly -- it returns verdicts that merely look reasonable.
2026-09-07FM4measureTHE BITE FINALLY PRODUCED VALID MUTANTS AND THEY FOUND A REAL VACUITY IN THIS GATE'S FIXTURE. Progression across three runs of the same gate and subject: unaimed gave valid_mutants=0 not_reached=4 invalid=2 and NOT-SUBSTITUTABLE, which says nothing; aim uxr_box_end 0 gave valid=0 invalid=2 not_reached=0; aim uxr_r32 4 gave valid_mutants=2 invalid_uncompilable=0 void_build_lane=0 not_reached=0 killed=0 -- the FIRST valid mutants this gate has ever had, with custody clean (twins_checked=2 restored=2 mutant_live=0, lib restored byte-identical at 7180). BOTH SURVIVED, AND THE REASON IS A GENUINE WEAKNESS I DID NOT PUT THERE: site 4 is the 16777216 byte-0 multiplier and site 5 is the 1 index in buf[off + 1], and every box size this gate builds is 24, 116, 108 or 140 -- all of which fit in a SINGLE byte. So the 32-bit big-endian encodings the gate reads are 00 00 00 74 and friends, every high-order byte is ZERO, and 0 times 16777216 is 0 whatever that constant becomes while byte 1 and byte 2 are both 0 so swapping the index changes nothing. THE HIGH-BYTE ASSEMBLY OF uxr_r32 IS UNTESTED BY CONSTRUCTION: a reader that got the big-endian order wrong in the top three bytes would pass all nine teeth. THIS IS THE BITE DOING ITS JOB -- a surviving mutant is a measurement, and here it names a specific missing tooth rather than a defect. REMEDY, precise: add a tooth that round-trips uxr_w32 and uxr_r32 over a value with NON-ZERO high bytes (0x01020304 is the obvious choice), which makes all three multipliers and all four byte indices load-bearing; the existing teeth stay as they are. NOTE THE ORDER OF DISCOVERY, because it is the whole argument for aiming: this weakness was unreachable until the aiming was fixed, since every earlier run spent its entire site budget on identifier digits that could not compile.
2026-09-07FM4landTHE HARNESS FIX IS LANDED IN SOURCE AND COMPILES, AND IS DELIBERATELY NOT PROMOTED. nx_gate_bite.nx 98879 to 100893 over three CAS-chained edits: a new shared predicate gb_pre_run that walks back across the WHOLE digit run and returns the character before its FIRST digit, plus both call sites repointed at it, so gb_site_num and gb_num_at can no longer disagree -- the duplication was the second defect and unifying it was the fix, not patching one copy. Definition landed FIRST and uses SECOND so every intermediate state compiles. Build: BUILD-CACHE MISS, STORE bytes=107992, asm=474954B, SOVEREIGN, nothing installed anywhere. WHY IT IS NOT PROMOTED, and this is a judgement I own rather than a deferral: nx_contentdiff live against the candidate reads lost_from_live=1 with symmetry=BIDIRECTIONAL and gained_by_candidate=110 at 370 permil. The ONE lost run is enumerated and is NOT mine -- it is a sibling's rewording of an arena-allocator message, contended past NXA_LOCK_WARN becoming sustained allocator contention seen. But 110 gained runs and 14361 extra bytes against a roughly 2000-byte source addition mean this candidate carries a substantial amount of OTHER SEATS' work that has accumulated in the shared closure since the live binary was built, and the estate's own rule is that a candidate can be another seat's work in flight and must not be promoted by whoever did not write it. The fix is therefore READY: it needs a ship cycle that adjudicates the closure, not a promote from me.
2026-09-07FM4lessonTWO BUILDS OF ONE TARGET SERIALISE ON THAT TARGET'S BUILD LOCK, AND THE SECOND IS INDISTINGUISHABLE FROM A SLOW BOX -- MY OWN ERROR, RECORDED BECAUSE THE SYMPTOM POINTS AT THE WRONG CAUSE. I fired /api/build for nx_uxf_mp4box_gate, judged it wedged when its receipt did not appear, and then launched nx_sov_build_run on THE SAME TARGET to get the verification another way. Both then sat CLAIMED indefinitely while nx_build_admit read GRANT with load1_centi=1380, procs_running=2 and procs_blocked=6 -- a demonstrably healthy box. THE DISCRIMINATOR IS EXACTLY THAT CONTRAST: a job that is not progressing while the admission gate reports headroom is not waiting on the machine, it is waiting on a LOCK, and _build/<target>.lock is per-target. The first build already held it and my second queued behind it, so my remedy for a slow build was to add the one thing guaranteed to make it slower. THE COMPILE ITSELF HAD ALREADY SUCCEEDED before either receipt landed: nx_catalog read BUILT 35952 against PROMOTED 35424, the +528 bytes of the new high-byte tooth, which is the artifact answering a question the job receipts could not. RULE: never issue a second build of a target whose first build has not returned, and when a job stalls, read the admission verdict FIRST -- GRANT plus no progress means a lock, not a storm, and the artifact will usually tell you the compile finished long before the receipt does.
2026-09-07FM4queueRESUME IN ONE COMMAND EACH -- both fixes are written, compile, and are blocked ONLY on a build lock, not on judgement. STATE AT HANDOFF: nx_uxf_mp4box_gate SOURCE 7631 BUILT 35952 PROMOTED 35424, live binary healthy at 9/9 GREEN with toplevel_box_count=2; nx_gate_bite source 100893 with the shared gb_pre_run landed and a clean sovereign build at 107992. STEP 1, the gate: re-issue /api/build target=nx_uxf_mp4box_gate once buildroot/_build/nx_uxf_mp4box_gate.lock is free, then /api/promote with expect_sha256 from that receipt, then nx_job_run it and confirm 10 of 10 with high_byte_roundtrip=16909060 equal to high_byte_kat -- the new T4 tooth is the one the bite earned and it is the only tooth that makes uxr_r32's high bytes load-bearing. STEP 2, the harness: this one needs a ship cycle and NOT a bare promote, because nx_contentdiff live against the candidate reads lost_from_live=1 (a sibling's reworded arena-allocator message, enumerated and not mine) with gained_by_candidate=110 at 370 permil and +14361 bytes against a roughly 2000-byte source change -- that candidate carries other seats' accumulated closure work, so adjudicate the closure before promoting, and run nx_gate_bite_gate against the new binary first. WHY BOTH ARE STUCK: two builds of ONE target were issued while the first was still in flight and they serialised on the per-target lock; the lock file is 0 bytes and names no holder, and forcing it could corrupt a live compile, so it is left alone deliberately. THE VERIFICATION THAT ALREADY STANDS AND NEED NOT BE REDONE: the aimed bite reached valid_mutants=2 with not_reached=0 and void_build_lane=0, both mutants survived, and the survival is explained -- every box size in this gate fits in one byte so every high-order byte of every uxr_r32 read is zero, which is precisely what the new tooth fixes.
2026-09-07FM4landTHE HIGH-BYTE TOOTH IS DEPLOYED AND VERIFIED LIVE AT 10 OF 10 -- THE BITE FINDING IS CLOSED END TO END. The build lock released and BOTH held jobs completed. nx_sov_build_run took a BUILD-CACHE HIT at 35952 bytes sha dea6c91e, DEPLOYED to serving root (twin refresh) and RAN the gate: T4 HIGH BYTES passed with actual=16909060 expected=16909060 delta=0, run-exit=0, and the values block now publishes high_byte_roundtrip=16909060 beside high_byte_kat=16909060 so the new tooth is falsifiable from outside rather than merely present. The /api/build receipt confirmed src_path naming the target with src_stable=1, /api/promote under expect_sha256 dea6c91e answered 503 read-after-accept and HAD LANDED (verified by artifact, not retried -- nx_catalog reads SOURCE 7631, BUILT 35952, STAGED 35952, PROMOTED 35952, all aligned), and nx_offc_install returned installed=1 so the copy every runner forks matches what promote blessed. THE FULL LOOP THIS CLOSES, in the order it happened: the aimed bite produced valid_mutants=2 where every prior run produced none, both survived, the survival was explained rather than excused (all box sizes fit in one byte so every high-order byte read is zero and 0 times any multiplier is 0), the missing tooth was written to make those multipliers and byte indices load-bearing, and the gate went 9 of 9 to 10 of 10 with the new tooth passing on the promoted binary. A surviving mutant was a measurement, it named a specific missing tooth, and the tooth now exists and is live.
2026-10-03FM6landTHE DOCUMENT PROFILE HAS SOMETHING BEHIND IT, UNDER ANOTHER NAME, AND THIS RUNG IS NOT CLOSED BY IT. unidoc UD11 shipped nx_uxf_doc_lib 2026-10-03 (tool nx_uxf_doc ca16fae3, gate nx_uxf_doc_gate 95fd727b 27 of 27, bite-proven): a document is a manifest and blocks as canonical NXR1 records under UXF_DOC, composing this board's FM1 (uxf_cid_profiled) and FM2 (canon_decode) rather than re-implementing them, which also gives those two libs their first shipping importers. Exercised on real files through the registered tool: a genuine Word document (48849 B) became a 66-block container (24269 B), was exported to a Word package (22275 B) and re-imported as 66 blocks; the Utah H.B. 181 enrolled PDF (41024 B) became a container of only 2 blocks (18020 B), because the PDF fold carries the text layer and almost none of the structure. So this rung's own done-rule (a real PDF or EPUB whose export back out is lossless for the fields claimed) is met for text and NOT for structure, and its contract symbol uxf_doc_ingest names no function: the owner of this board either repoints FM6 to the import path that exists (uxd_from_spec over the unified page's folders) and keeps the structure leg open, or keeps FM6 for PDF and EPUB structure recovery. Not repointed by the seat that shipped UD11, because closing another board's rung on a partly met done-rule is the name-flip this board warns against
On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.
Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/formats.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain formats, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 10 capabilities: 10 exclusive to it and 0 shared with other boards. Shared rows on this page: 0 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 0 + refused 0 (partition 0); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=7214.

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396319 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kindnameboardsourceevidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.
  1. [arxiv-csmm-2026-09] arXiv API listing, the COMPLETE cs.MM population for 2026-09-01 to 2026-09-07: totalResults 15 reconciles exactly against 15 entry elements, verified independently by nx_arxiv_census which returned verdict=COMPLETE on the same window. Read to decide whether the current month's multimedia research says anything about the format and container layer. It does not: across all 15 titles and abstracts the strings container, content-addressed, file format and codec each occur ZERO times, measured with nx_txtscan count over these pinned bytes. The population is generation, detection, safety and retrieval, with one adjacent paper asking whether an LLM can design a video coding tool. publisher · read in our library knowledge/fetched/cmp_formats_arxiv_csMM_sept2026.xml · pin h686c5aa1827f490b930cf0f14498295e89f31313b766afb28da2f3dbff2617d0 · accessed 2026-09-06 · mirrored-indexGrounds: The format and container layer is not an arXiv research area in the current month, so this board's bars must be pinned to standards and implementations rather than to monthly papers

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/formats.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls